# Pola Studio privacy policy summary

Pola Studio's privacy policy explains how personal data is processed when people visit the website, submit a contact or lead-generation form, or make an enquiry by email or telephone. The controller is Stubbe + Finke PartG, Masen 52, 22419 Hamburg, Germany. The policy was last updated in August 2026. This summary is an orientation and does not replace the complete policy or its conditions.

Read the full privacy policy

## Hosting, technical data and international access

DigitalOcean hosts the website and Payload CMS, with the server located in Frankfurt am Main. Technical processing can include IP addresses, accessed URLs, timestamps, transferred data volumes, HTTP status, referrer, browser and operating system information. These data support delivery, stability, security and the investigation of errors or abusive access. SSL or TLS encryption protects submitted data in transit.

The policy states that a data processing agreement governs DigitalOcean's work. A German server location does not completely exclude processing or access from the USA. The policy describes reliance on the EU-U.S. Data Privacy Framework where its requirements are met, and EU Standard Contractual Clauses where that transfer mechanism does not apply.

## Cookieless website analytics

The website uses a self-hosted instance of Umami for statistical analysis and currently does not use analytics or marketing cookies. Sessions are recorded using a hashed identifier derived from technical information such as the IP address, user agent and website ID; the IP address is not stored permanently by Umami. Data can include pages visited, referrer, time of access, browser, operating system and device type.

Umami runs within the DigitalOcean-hosted infrastructure. The policy states that no personal usage profiles are created and analytics data is not transferred to an additional analytics provider. Technically necessary cookies or comparable storage may still be used for individual functions; cookieless analytics does not mean the website processes no personal data.

## Enquiries, legal bases and retention

Contact and lead-generation forms show the requested information and distinguish mandatory from optional fields. Submissions are stored in Payload CMS and used to handle enquiries, provide requested information, answer follow-up questions or take steps towards a contract. The policy states that no external CAPTCHA or spam-protection service is currently used. Email and telephone enquiries are processed for the corresponding communication and contractual purposes.

The applicable basis depends on the activity and can include consent, contractual or pre-contractual requirements, legal obligations or legitimate interests. Personal data is retained only as needed for its purpose, unless statutory retention obligations or other lawful grounds justify longer storage. The policy does not describe solely automated decision-making, including profiling within the meaning of Article 22 GDPR, as being used on this website.

## Rights and contact

The policy explains rights of access, rectification, erasure, restriction, data portability and objection, including the applicable conditions and exceptions. Consent may be withdrawn with effect for the future without changing the lawfulness of earlier processing. Complaints may be submitted to a supervisory authority, including the Hamburg Commissioner for Data Protection and Freedom of Information identified in the full policy.

Contact the controller at hello@pola-studio.de or +49 40 573 098 340.