Privacy Policy
Last Updated: October 20, 2025
Controller
Legal Bases (Art. 6 GDPR)
Processing is based on Art. 6(1)(a) consent, (b) contract, (c) legal obligation, and (f) legitimate interests. The specific legal basis (Art. 6) is listed for each purpose below.
Purposes, Categories, Retention
Contact/Enquiries
Art. 6(1)(b)/(f) GDPR; Retention: until purpose fulfilled/statutory retention.
Newsletter/Marketing
Double opt-in, Art. 6(1)(a) GDPR; Withdrawal anytime.
Web analytics
only with consent, Art. 6(1)(a) GDPR; Retention per tool.
Data Subject Rights (Art. 15–22 GDPR)
You have rights to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). You may withdraw consent (Art. 7(3)) at any time.
You can exercise these data subject rights at any time.
Processors (Art. 28 GDPR)
We use processors under data processing agreements. Overview:
| Processor | Purpose | Location | Legal Basis | Transfers | DPA |
|---|---|---|---|---|---|
| Vercel, Inc. | Hosting/Deployment | EU/US | Art. 6(1)(f); Art. 28 | SCC/Art. 46, US DPF (if applicable) | DPA |
| Google Analytics 4 | Web analytics (consent only) | EU/US | Art. 6(1)(a); Art. 28 | SCC/Art. 46, US DPF | DPA |
International Data Transfers
Where services are located in third countries (notably the US), transfers rely on Art. 45 GDPR (adequacy) or Standard Contractual Clauses (Art. 46) with supplementary measures.
Understanding Our Privacy Policy and Data Practices
This Privacy Policy describes how H-Studio – Anna Hartung (Einzelunternehmen) collects, processes, and protects personal data when you use our website www.h-studio-berlin.de or engage our services. We comply with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Information We Collect
We collect personal data you voluntarily provide — such as your name, email address, phone number, or company details — when you contact us or request services. We do not collect or store payment card details; all transactions are handled through secure third-party payment providers or bank transfers.
Non-Personal Data and Analytics
When you visit our website, we automatically collect non-personal information (e.g. IP address, browser type, device model, operating system, and referring URLs) for security, analytics, and performance optimization. This data is processed in aggregated form and cannot directly identify you.
Cookies & Consent Management
Tracking technologies are used only with consent (§25 TDDDG/Art. 6(1)(a) GDPR). You can change cookie settings at any time:
Strictly Necessary Cookies (always active)
These cookies are essential for basic website functionality and cannot be disabled:
- cookieConsent — Storage of your cookie preference settings (Legal basis: §25(2) TDDDG, Art. 6(1)(f) GDPR)
- lang — Storage of your preferred language setting (de or en) to display the site in your chosen language automatically (Legal basis: §25(2) TDDDG - strictly necessary for service delivery)
These cookies are set without consent under §25(2) TDDDG as they are strictly necessary to deliver the requested functionality.
How We Use Your Data
We use your personal data for the following purposes:
- Communicate about projects and inquiries
- Provide and improve our services
- Send relevant updates and marketing communications (with your consent)
- Comply with legal obligations and protect our legitimate business interests
We do not sell your data to third parties.
International Data Transfers
Your personal data may be transferred to and processed in countries outside the EU/EEA. We ensure adequate protection through appropriate safeguards, such as Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission.
Your Rights Under GDPR
You have the following rights regarding your personal data:
- Access your personal data
- Correct inaccurate information
- Restrict processing
- Data portability
To exercise these rights, contact us at hello@h-studio-berlin.de with your request.
Children's Privacy
Our services are not directed to children under 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete such information promptly.
Data Security and Protection
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes encryption, secure servers, regular security updates, and access controls. However, no internet transmission is 100% secure.
Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of significant changes via email or website notice. Continued use of our services after changes constitutes acceptance of the updated policy.
Complaints
You may lodge a complaint with a supervisory authority (Art. 77 GDPR).