Privacy
Identifier-free audience measurement with Cloudflare Web Analytics is provided for this website. It takes place only when the beacon described below is loaded. Personal data also arises when you submit the contact form.
| 01 | Controller | Caspar Voigt, Stolper Weg 11, 16556 Hohen Neuendorf, Germany |
|---|---|---|
| 02 | Contact | caspar.voigt@callista-studio.com |
| 03 | Hosting | Render Services, Inc. — servers in Frankfurt am Main |
| 04 | Delivery | Resend — infrastructure in Ireland |
| 05 | Mailbox | Zoho — EU data centre |
| 06 | Analytics | Cloudflare Web Analytics — identifier-free and cookieless when enabled |
| 07 | Supervisory authority | the Brandenburg State Commissioner for Data Protection and for the Right to Access Information |
Who is responsible
The controller is Caspar Voigt, Stolper Weg 11, 16556 Hohen Neuendorf, Germany, reachable at [email protected] and 015127402181. There is no data protection officer; the obligation to appoint one under § 38 BDSG does not apply here.
If you are only reading
Simply visiting these pages requires nothing from you. For a page to reach you at all, the hosting provider processes technically necessary connection data, including your IP address; the legal basis is my legitimate interest in secure operation (Art. 6 (1) (f) GDPR). How long the hosting provider keeps that connection data follows its own retention periods. I do not analyse it and do not combine it with anything.
The contact form in detail
The form asks for your name, email address, what it is about and your project; company and budget range are optional. The data is processed on my own server — no third-party form service is embedded — and stored in this website's content system so that I can handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR, because the enquiry is aimed at a contract, otherwise Art. 6 (1) (f) GDPR. A notification is sent to my own address in parallel so that I do not miss it.
How long your enquiry stays
I delete enquiries twelve months after they are closed — that is, after they have become a project or the matter has been settled. If it becomes a contract, the statutory retention periods apply to contract and invoice records. You can ask for deletion earlier at any time.
Spam protection without tracking
Against automated submissions I use three means that work without third-party services and without recognising anyone: a field invisible to humans, a minimum time between opening and submitting, and a limit on requests per sender. For that limit the IP address is not stored; only a shortened hash of it is, in memory only and only for the length of the time window. No captcha is embedded.
Who else sees the data
Four service providers, no others. Render Services, Inc. operates the server, database and storage for this website; the instance is in Frankfurt am Main, Germany. Resend sends the notification when a new enquiry arrives. Zoho runs the mailbox that notification arrives in; it sits in an EU data centre. Cloudflare is provided for identifier-free audience measurement. All four act as processors under Art. 28 GDPR and only on my instructions. Your data is not sold, not used for advertising and not passed to anyone else.
Transfer to the USA
Render Services, Inc., Resend and Cloudflare, Inc. are companies based in the USA. Their respective data processing agreements incorporate the European Commission's Standard Contractual Clauses. This website's servers are in Frankfurt am Main; email delivery runs over infrastructure in Ireland. A transfer to the USA is nonetheless possible — in support or maintenance, for example — and is based on the Standard Contractual Clauses. I therefore do not claim that your data stays exclusively within the EU. Resend's subprocessors are listed at resend.com/legal/subprocessors; Cloudflare's are listed at cloudflare.com/gdpr/subprocessors.
Fonts and media stay on this server
All fonts, images and videos used by this website sit on the same server as the site itself. Opening a page therefore sends no request for them to Google Fonts or another third-party host. When Cloudflare Web Analytics is enabled, the only external script loaded is the identifier-free beacon described below.
Audience measurement with Cloudflare Web Analytics
When Cloudflare Web Analytics is enabled, I use it to measure how this website is used. The service is provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. For each page view, the requested address, the previously visited page, your browser and device string, page-speed measurements and the server response code are then transmitted. Your country is derived from your IP address. The IP address itself is not stored.
What does not happen during audience measurement
The service sets no cookies, stores nothing on your device and assigns no identifier that could be used to recognise you. No fingerprinting takes place, and tracking across websites is not possible. For this reason I do not ask for your consent: no information is stored on or read from your terminal equipment, so section 25(1) of the German TDDDG does not apply.
Legal basis and your right to object
The legal basis is Article 6(1)(f) GDPR. My legitimate interest is to understand how this website is used and how fast it loads, so that I can improve it. I consider this interest to prevail because the measurement works without recognition and without profiling. You may object to this processing at any time under Article 21 GDPR; an informal message to [email protected] is sufficient. You can also prevent the measurement by blocking JavaScript for this site or by using a content blocker.
Cloudflare and transfer to the USA
Cloudflare is based in the United States and a transfer there cannot be ruled out. It is safeguarded by the European Commission's Standard Contractual Clauses, which form part of my contract with Cloudflare. Please note that the United States does not offer a level of data protection equivalent in every respect to that of the European Union, and that access by authorities there cannot be entirely excluded.
Processing and retention at Cloudflare
Cloudflare processes this data for me as a processor under a contract pursuant to Article 28 GDPR. Cloudflare makes the aggregated reports available for the previous six months. These reports no longer relate to an identifiable person. For more information, see Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). A message to [email protected] is enough.
Complaint to the supervisory authority
You can lodge a complaint with a data protection supervisory authority. Because the business is based in Brandenburg, the competent authority is the Brandenburg State Commissioner for Data Protection and for the Right to Access Information.