Privacy Policy

Information pursuant to Art. 13 GDPR. The German Datenschutzerklärung is the legally binding version.

1. Data Controller

The data controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Phone: +49 176 70255252
Email: ctustudios@gmx.de

2. General Information on Data Processing

2.1 Scope of processing

We process personal data of our users only insofar as this is necessary to provide a functional website and our content and services. Processing usually takes place only with the user's consent or where the processing is permitted by law.

2.2 Legal bases

Where we obtain consent for processing operations, Art. 6 (1) (a) GDPR serves as the legal basis. For processing necessary to perform a contract or pre-contractual measures, Art. 6 (1) (b) GDPR is the legal basis. For processing based on legitimate interests, Art. 6 (1) (f) GDPR is the legal basis.

2.3 Data deletion and storage duration

Personal data will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if provided for by the European or German legislator in regulations, laws or other provisions to which we are subject. Data will also be blocked or deleted when a storage period prescribed by these norms expires, unless there is a need for further storage of the data for the conclusion or fulfilment of a contract.

3. Provision of the Website (Hosting & Server Logs)

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Each time the website is accessed, the Vercel servers automatically collect information and store it in so-called log files:

• IP address of the requesting device (truncated/anonymised per Vercel's logging practice)
• Date and time of access
• Name and URL of the file accessed
• Amount of data transferred
• Successful retrieval status (HTTP status code)
• Browser type and operating system used
• Referrer URL (previously visited page)

Legal basis: Art. 6 (1) (f) GDPR. The legitimate interest lies in the technical provision, stability and security of the website.

Third-country transfer: Vercel Inc. is a US provider. Vercel is certified under the EU-US Data Privacy Framework; additionally, standard contractual clauses (SCC) under Art. 46 (2) (c) GDPR are in place. More information: vercel.com/legal/privacy-policy.

Storage duration: Server logs are stored for a maximum of 30 days.

4. Contact Form

If you send us an enquiry via the contact form, your information from the form, including the contact details you provide, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions.

Data processed:

• Name
• Email address
• Project type (optional)
• Message body
• Enquiry language

Purpose: Processing your enquiry and preparing a possible contractual relationship (discovery call, offer).

Legal basis: Art. 6 (1) (a) GDPR (your consent via the mandatory checkbox in the form) and Art. 6 (1) (b) GDPR (pre-contractual measures).

Storage duration: Enquiries are stored until the correspondence has ended; if an order arises from this, the commercial and tax retention periods apply (usually 6 or 10 years). Without an order, deletion takes place at the latest 12 months after the last contact.

4.1 Email delivery via Resend

For the technical delivery of the enquiry to our business email address and for the automatic confirmation to you, we use the service provider Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes the form data listed above on our behalf as a processor within the meaning of Art. 28 GDPR.

Third-country transfer: We have a data processing agreement (DPA) with Resend including the EU standard contractual clauses. More information: resend.com/legal/privacy-policy.

4.2 Email mailbox at GMX

Incoming enquiries reach us via the email mailbox ctustudios@gmx.de, operated by 1&1 Mail & Media GmbH (GMX), Brauerstraße 50, 76135 Karlsruhe, Germany. Processing in this mailbox takes place exclusively within the EU.

5. Web Fonts

This website uses only self-hosted fonts (Geist, Geist Mono, Clash Display). No connection is established to external font CDNs. In particular, no Google Fonts are loaded from Google's servers and no IP address is transmitted to Google.

6. Local Storage

This website uses your browser's local storage solely to remember your preferred language (key: ctu-lang) for your next visit.

Legal basis: § 25 (2) no. 2 TTDSG (German Telecommunications-Telemedia Data Protection Act) — storage is strictly necessary to provide the service you have requested (language-correct display). No consent is therefore required. No tracking and no profiling takes place.

7. Cookies, Analytics, Marketing

This website does not use cookies, no tracking, no analytics tools (no Google Analytics, Meta Pixel, TikTok Pixel, Hotjar or similar) and no marketing tools. Should such services be integrated in future, this privacy policy will be updated accordingly and — where legally required — your consent will be obtained in advance via a consent banner.

8. Links to Social Networks

The footer and contact section contain plain hyperlinks to our profiles on Instagram, TikTok and YouTube. These are simple links, not embedded content (no social plugins, no iframes). A connection to the respective provider is only established and data potentially transferred when you click on such a link. The operators of the linked platforms are solely responsible for any data processing on those platforms.

9. Your Rights as a Data Subject

Insofar as personal data is processed by you, you have the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of incorrect data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to certain processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

Please send your requests informally by email to ctustudios@gmx.de.

10. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data by us (Art. 77 GDPR). The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover, Germany
Phone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de
Web: lfd.niedersachsen.de

11. SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content (e.g. enquiries via the contact form), this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser's address bar (https:// instead of http://) and the padlock symbol.

12. Changes to this Privacy Policy

We reserve the right to amend this privacy policy so that it always meets current legal requirements or to reflect changes to our services, e.g. when introducing new services. The new privacy policy will then apply to your next visit.