Clear and transparent information about how personal data is handled on this website.
1. Data Protection at a Glance
General information
Protecting your personal data is important to us. This Privacy Policy explains which personal data may be processed when you visit this website, why this processing takes place, and what rights you have.
Personal data is any information that can be used to identify you personally.
Who is responsible for data processing?
Data processing on this website is carried out by the website operator. You can find the relevant contact details in the section “Controller” of this Privacy Policy.
How do we collect your data?
Some data is provided directly by you – for example, when you complete a contact form, contact us by email, or use other services offered through this website.
Other data is collected automatically, or after you have given your consent, by our IT systems. This may include technical information such as your browser, operating system, IP address, or the time at which the website was accessed.
What do we use your data for?
Some data is necessary to provide this website securely and reliably. Other data may be used to analyse use of the website where there is an appropriate legal basis for doing so.
Where contracts can be initiated or concluded through this website, transmitted data may also be processed for enquiries, offers, orders, and contractual relationships.
What rights do you have?
Within the scope of the applicable legal provisions, you have the right to obtain information about your stored personal data and, where applicable, to request correction, deletion, or restriction of processing.
You may withdraw any consent you have given at any time with effect for the future. Under certain circumstances, you may also have the right to object to processing and the right to data portability.
You also have the right to lodge a complaint with a competent data protection supervisory authority. If you have questions about data protection, you are welcome to contact us at any time.
2. Hosting
Host Europe
We host the content of this website with:
Host Europe GmbH
c/o Spaces
Gertrudenstraße 30–36
50667 Cologne
Germany
When you visit our website, Host Europe may process various technical data and server log files. This may include your IP address and other connection data.
We use Host Europe on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the reliable and secure provision of our website.
Where corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information on the user’s device. Any consent given may be withdrawn at any time.
Data Processing Agreement
We have concluded a data processing agreement with Host Europe. This ensures that personal data of website visitors is processed only in accordance with our instructions and in compliance with applicable data protection requirements.
3. General Information and Mandatory Information
Data protection
We treat your personal data confidentially and in accordance with applicable data protection laws.
Personal data may be processed when you use this website. This Privacy Policy explains which data is processed, for what purposes, and on what legal basis.
Please note that data transmission over the internet – for example by email – may be subject to security vulnerabilities. Complete protection against access by third parties cannot be guaranteed.
Controller
The controller responsible for data processing on this website is:
Art-Cura Studios Schaffeld
WerdeKunst
Königsweg 12
26842 Ostrhauderfehn
Germany
Phone:
+49 (0) 4952 8024390
Email:
artstudio@art-cura.org
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
Storage period
Unless a more specific storage period is stated in this Privacy Policy, we store personal data only for as long as the purpose of the processing continues to apply.
If you validly request deletion of your data or withdraw your consent, the relevant data will be deleted unless there are legal or otherwise permissible reasons for continued storage. Statutory retention periods remain unaffected.
Legal bases for processing
Depending on the type and purpose of processing, the following legal bases may apply in particular:
- Art. 6(1)(a) GDPR – your consent
- Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
- Art. 6(1)(c) GDPR – compliance with legal obligations
- Art. 6(1)(f) GDPR – legitimate interests
- Art. 9(2)(a) GDPR – explicit consent where special categories of personal data are processed, where applicable
- Art. 49(1)(a) GDPR – explicit consent for certain transfers to third countries, where applicable
- Section 25(1) TDDDG – where consent is required for storage of or access to information on a user’s device
Recipients of personal data
As part of our activities, we work with external organisations and service providers. Personal data is disclosed only where there is a legal basis for doing so, where disclosure is required for the performance of a contract, where we are legally obliged to disclose it, or where you have given your consent.
Where service providers act as processors, processing takes place on the basis of an appropriate data processing agreement.
4. Your Rights
Withdrawal of consent
You may withdraw any consent you have given at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.
Right to object under Art. 21 GDPR
Where personal data is processed on the basis of Art. 6(1)(e) or (f) GDPR, you have the right, under the applicable legal conditions, to object to such processing on grounds relating to your particular situation.
In the event of an objection, we will generally no longer process the relevant personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where the processing is required for the establishment, exercise, or defence of legal claims.
Where your personal data is processed for direct marketing purposes, you may object to such processing at any time. This also applies to profiling insofar as it is related to direct marketing.
Right to lodge a complaint
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a competent data protection supervisory authority.
Right to data portability
Data that we process automatically on the basis of your consent or for the performance of a contract may, under the applicable legal conditions, be provided to you in a commonly used, machine-readable format or transferred to another controller where technically feasible.
Access, correction and deletion
Within the scope of the applicable legal provisions, you have the right to request information about your stored personal data, its source and recipients, and the purpose of processing.
You may also have the right to request correction or deletion of your data.
Restriction of processing
Under certain legal conditions, you may request restriction of the processing of your personal data – for example while the accuracy of data is being verified, where processing is unlawful, where data is required for legal claims, or while an objection is being assessed.
SSL and TLS encryption
This website uses SSL or TLS encryption for security reasons and to protect confidential content.
You can recognise an encrypted connection, among other things, by the fact that the address in your browser begins with “https://”.
Encrypted payment transactions
Where paid services are offered through this website and payment data is processed, transmission takes place through encrypted SSL or TLS connections.
5. Data Collection on This Website
Cookies
Our website uses cookies. Cookies are small data packages stored on your device. They may be stored temporarily for the duration of a session or remain on your device for a longer period.
Cookies may be set by us or by third-party providers. Some cookies are technically necessary for certain website functions. Other cookies may – where you have given your consent – be used to analyse user behaviour or for other purposes.
Technically necessary cookies are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. Where consent is required, processing is based on Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
You can configure your browser to inform you when cookies are set, permit cookies only in certain cases, or prevent their storage altogether. Disabling cookies may limit some functions of this website.
CCM19 – Consent Management
We use CCM19 to obtain required consent for cookies and certain technologies and to document these decisions in a data protection-compliant manner.
Provider:
Papoo Software & Media GmbH
Auguststraße 4
53229 Bonn
Germany
When you access our website, a connection to CCM19 is established so that your consent decisions can be recorded and stored. CCM19 stores a cookie in your browser for this purpose.
The legal basis for the use of CCM19 is Art. 6(1) sentence 1 lit. c GDPR.
Contact form
If you contact us through the contact form, we process the information you enter, including your contact details, in order to respond to your enquiry and any follow-up questions.
If your enquiry relates to a contract or pre-contractual measures, processing is based on Art. 6(1)(b) GDPR. In other cases, processing may be based on our legitimate interest under Art. 6(1)(f) GDPR or – where obtained – on your consent under Art. 6(1)(a) GDPR.
Contact by email or telephone
If you contact us by email or telephone, we process the data you provide insofar as this is necessary to handle your enquiry.
The applicable legal basis depends on the content of your enquiry and may include Art. 6(1)(b), (f), or – where relevant consent has been obtained – Art. 6(1)(a) GDPR.
HubSpot CRM
We use HubSpot CRM to manage existing and potential customer relationships and to organise our communications.
Provider:
HubSpot Inc.
Cambridge, Massachusetts
USA
HubSpot CRM enables us to record, organise, and analyse customer interactions across different communication channels. Depending on the functions used, this may include interactions by email, social media, or telephone, as well as information about use of our website.
We use HubSpot CRM on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in efficient customer management and customer communication.
Where corresponding consent has been obtained, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, where applicable.
Appropriate safeguards, including the European Commission’s Standard Contractual Clauses, may apply to transfers of personal data to the United States. According to the source Privacy Policy, HubSpot is also certified under the EU-US Data Privacy Framework.
6. Newsletter
Newsletter registration
If you would like to receive our newsletter, we require your email address and information enabling us to verify that you are the owner of the address provided and that you have agreed to receive the newsletter.
Any additional information is provided voluntarily.
MailerLite
We use MailerLite to send our newsletter.
MailerLite Limited
38 Mount Street Upper
Dublin 2, D02PR89
Ireland
The information you provide when subscribing to the newsletter is stored on MailerLite’s servers.
Newsletter analysis
MailerLite enables us to analyse our newsletters. For example, it may record whether a newsletter has been opened and which links were clicked.
Depending on the functions used, MailerLite may also analyse certain actions following the opening or clicking of a newsletter and segment newsletter recipients according to selected categories.
Legal basis
Processing is based on your consent in accordance with Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example by using the unsubscribe link in the newsletter.
Storage period
Data stored for newsletter distribution is generally retained until you unsubscribe or until the purpose of storage no longer applies.
After you unsubscribe, your email address may be stored on a suppression list where necessary to prevent further mailings and comply with legal requirements.
7. Plug-ins and Tools
Adobe Fonts
This website uses Adobe Fonts to ensure consistent presentation of our brand and web typography.
When you access a page, your browser may load the required fonts from Adobe servers. A connection to Adobe is established in the process, which may allow Adobe to receive information such as the IP address from which our website was accessed.
According to Adobe, no cookies are stored in connection with the provision of these fonts.
Processing is carried out on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the consistent and brand-appropriate presentation of our website.
Where corresponding consent is required and has been obtained, processing is based on Art. 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.
8. E-Commerce and Payment Service Providers
Customer and contract data
Where services are offered or contracts are concluded through this website, we process personal customer and contract data insofar as this is necessary to establish, perform, or amend the contractual relationship.
Processing is carried out on the basis of Art. 6(1)(b) GDPR.
Data is deleted after completion of the order or termination of the business relationship, unless statutory retention obligations require continued storage.
Payment services
If you use a paid service, data such as your name, payment amount, bank details, or credit card information may be processed by the relevant payment service provider.
Processing is carried out in particular on the basis of Art. 6(1)(b) GDPR and – where applicable – on the basis of our legitimate interest under Art. 6(1)(f) GDPR in providing a secure and convenient payment process.
Stripe
We use Stripe for certain payments.
For customers within the European Union:
Stripe Payments Europe, Ltd.
1 Grand Canal Street Lower
Grand Canal Dock
Dublin
Ireland
9. Online Audio and Video Conferences
Data processing
We may use online conference tools to communicate with prospective customers, clients, customers, and cooperation partners.
If you communicate with us by video or audio conference, personal data may be processed both by us and by the provider of the relevant conference service.
This may include your email address or telephone number, the start, end, and duration of the conference, participant information, and other metadata relating to the communication process.
Technical information such as IP address, device information, operating system, client version, and information about cameras, microphones, or speakers may also be processed.
Where content such as messages, files, images, videos, or whiteboards is shared during a conference, this content may also be processed and stored by the relevant provider.
Purpose and legal bases
Conference tools are used to communicate with existing or prospective contractual partners or to provide agreed services. Processing is carried out on the basis of Art. 6(1)(b) GDPR where applicable.
We also have a legitimate interest in simple and efficient communication in accordance with Art. 6(1)(f) GDPR. Where consent has been obtained, processing is carried out on the basis of Art. 6(1)(a) GDPR.
Storage period
Data processed directly by us through video and conference tools is deleted once the purpose of storage no longer applies, you validly request deletion, or you withdraw the relevant consent. Statutory retention periods remain unaffected.
We do not have full control over the storage period of data processed by the relevant provider for its own purposes.
Microsoft Teams
We use Microsoft Teams for online conferences.
Provider:
Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland
According to the source Privacy Policy, Microsoft is certified under the EU-US Data Privacy Framework.
Data Processing Agreement
Where Microsoft acts as a processor in connection with the services used, an appropriate data processing agreement applies. This is intended to ensure that personal data is processed in accordance with our instructions and applicable data protection requirements.