Vinstand Studios

Legal

Privacy policy

Last updated: 30 October 2026

1. Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR), and the provider within the meaning of the German Digital Services Act (DDG), is:

Vinstand Studios UG (haftungsbeschränkt)
Frühlingstraße 5B
85716 Unterschleißheim
Germany
[email protected]

Website: vinstandstudios.com

2. General information on data processing

2.1 Scope

Personal data is only processed on this website to the extent necessary to provide a working website, its content, or to answer enquiries. There is no tracking, no analysis of user behaviour, no advertising and no profiling.

  • Art. 6(1)(a) GDPR: processing based on consent.
  • Art. 6(1)(b) GDPR: processing to perform a contract or to take steps prior to entering into a contract, for example for project enquiries.
  • Art. 6(1)(c) GDPR: processing to comply with a legal obligation, such as statutory retention periods.
  • Art. 6(1)(f) GDPR: processing for legitimate interests, provided the interests, fundamental rights and freedoms of the data subject do not override them.
  • Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG): storing information on, and accessing information from, the user's device.

2.3 Deletion and storage period

Personal data is deleted or blocked as soon as the purpose of storage no longer applies. Data is only kept longer where statutory retention obligations require it, and is deleted once those periods have expired.

3. Hosting and server log files

This website runs on a dedicated server operated with STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO.

Each time the website is accessed, log files containing the following data are created on this server:

  • IP address of the requesting device
  • date and time of access
  • requested address (URL) and HTTP status code
  • amount of data transferred
  • website from which the access originated (referrer)
  • browser type and version, and operating system

Purpose: delivering the website, keeping it running, detecting and fending off attacks, and analysing errors. The data is not used for marketing purposes.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in operating the website securely and reliably.

Storage period: log files are deleted after seven days at the latest.

4. Cloudflare

All requests to this website pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare establishes the encrypted connection, forwards requests to the server and protects the website against attacks and overload.

In doing so, Cloudflare processes the technical data of each request, in particular the IP address, the requested address, date and time, and browser and device information. A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in a secure, fast and reliably available website.

Transfers to third countries: Cloudflare may process data in the USA. Cloudflare is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision. Standard contractual clauses of the European Commission have been agreed in addition. More information: Cloudflare privacy policy.

5. Storage in the browser

This website stores only two settings in the browser, both purely functional:

  • Language: the cookie NEXT_LOCALE remembers the chosen language if it differs from the browser's language setting. It is deleted after one year.
  • Light or dark mode: if a mode is chosen with the toggle, the browser stores this choice in local storage (localStorage) under theme. The entry remains until it is deleted in the browser.

Neither entry contains identifiers, and neither is used for tracking or analysis.

Legal basis: Section 25(2) No. 2 TDDDG, as storage is strictly necessary to provide the language or display that was expressly requested. Both entries can be deleted at any time in the browser settings.

6. Contact form and email

When an enquiry is sent using the contact form, the following details are processed: name, email address, message and, optionally, company and area. When an enquiry is sent by email, the details contained in the email are processed.

Purpose: handling and answering the enquiry.

Legal basis: Art. 6(1)(b) GDPR where the enquiry relates to a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR. The legitimate interest lies in answering enquiries.

Transmission: the form sends the details from the server by email via Google Workspace to the mailbox of Vinstand Studios UG (haftungsbeschränkt). The contracting party for Google Workspace is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. A data processing agreement pursuant to Art. 28 GDPR is in place with Google. No automatic confirmation email is sent to the address provided.

Transfers to third countries: it cannot be ruled out that Google LLC, as the parent company, processes data in the USA. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses of the European Commission have been agreed in addition.

Storage period: messages are deleted once the enquiry has been dealt with completely. If a contract results from it, statutory retention periods apply, for example six years for business letters (Section 257 of the German Commercial Code, HGB) and ten years for tax-relevant documents (Section 147 of the German Fiscal Code, AO).

Obligation to provide data: providing the details is voluntary. Without a name, email address and message, however, an enquiry cannot be answered.

7. Protecting the form against misuse

To prevent automated mass submissions, the server checks whether a field that is invisible to humans has been filled in and how quickly the form was submitted. In addition, the IP address is briefly held in the server's memory to limit the number of requests per sender. It is not stored permanently and is discarded after 15 minutes or when the server restarts, whichever comes first. Third-party services such as reCAPTCHA are not used.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in protection against spam and misuse.

8. Fonts

The fonts used are loaded directly from this server. No connection to Google or any other font provider is made when the website is accessed.

9. No analytics and no embedded content

This website uses no analytics or tracking tools and does not embed third-party content such as videos, maps or social media posts. Links to other websites only connect to the respective provider once they are clicked; that provider's privacy policy then applies.

10. Rights of data subjects

Data subjects have the following rights with respect to the controller:

  • access to the data processed (Art. 15 GDPR)
  • rectification of inaccurate or incomplete data (Art. 16 GDPR)
  • erasure of the data (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR)
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected
  • complaint to a data protection supervisory authority (Art. 77 GDPR); the competent authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany

Right to object (Art. 21 GDPR): where data is processed on the basis of Art. 6(1)(f) GDPR, the data subject may object to this processing at any time on grounds relating to their particular situation. The data will then no longer be processed unless there are compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

An email to the address above is sufficient to exercise these rights.

11. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

12. Changes to this privacy policy

This privacy policy is updated when the website or the legal situation changes. The version published on this website applies.