Privacy policy

At a glance

General information

This privacy policy provides an overview of the personal data we process on this website. Personal data means any information relating to an identified or identifiable individual.

Who is responsible for processing data?

The controller is Stubbe + Finke PartG. You can find our full contact details in the section “Controller”.

How do we collect data?

You provide some data to us yourself, for example through a contact or lead generation form, by email or by telephone. Other data is generated automatically when you access the website, such as server log data. For statistical analysis, we use a self-hosted, cookieless instance of Umami Analytics.

What do we use data for?

We process data to provide the website securely and reliably, analyse its use in aggregated form, respond to enquiries and take steps prior to entering into a contract.

What rights do you have?

In particular, you have the right of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw any consent you have given at any time with effect for the future. You may also lodge a complaint with a data protection supervisory authority. Further details are provided in the following sections.

Hosting

This website and the Payload CMS we use are hosted by DigitalOcean. In particular, IP addresses, server log data, website access data and information submitted through contact and lead generation forms may be processed on the infrastructure we use.

The hosting enables us to provide our online services securely, quickly and reliably. Processing is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR. Where processing is necessary in order to take steps prior to entering into a contract or to perform a contract, Art. 6(1)(b) GDPR also applies.

Hosting provider

DigitalOcean, LLC
101 Avenue of the Americas, 10th Floor
New York, NY 10013
USA
Server location: Frankfurt am Main, Germany

We have entered into a data processing agreement with DigitalOcean pursuant to Art. 28 GDPR. DigitalOcean processes the data in accordance with our instructions and only to the extent necessary to provide the services.

Transfers of data to the USA

Despite the server being located in Germany, it cannot be completely ruled out that data may be processed in the USA or accessed from there. DigitalOcean is certified under the EU-U.S. Data Privacy Framework. Where its requirements are met, the transfer is based on the European Commission’s adequacy decision pursuant to Art. 45 GDPR. If this transfer mechanism does not apply, the agreement with DigitalOcean provides for the EU Standard Contractual Clauses as appropriate safeguards pursuant to Art. 46 GDPR.

Privacy information and mandatory disclosures

Controller

Stubbe + Finke PartG
Masen 52
22419 Hamburg
Email: hello@pola-studio.de
Telephone: 040 573 098 340

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

Storage period

Unless a more specific storage period is stated in this privacy policy, we store personal data only for as long as it is necessary for the relevant purpose. We then erase it unless statutory retention obligations or other lawful grounds require or permit further storage. We will comply with a valid request for erasure or withdrawal of consent unless overriding legal grounds prevent us from doing so.

Legal bases for processing

Depending on the processing activity, we rely on your consent under Art. 6(1)(a) GDPR, steps prior to entering into a contract or performance of a contract under Art. 6(1)(b) GDPR, compliance with a legal obligation under Art. 6(1)(c) GDPR, or our legitimate interests under Art. 6(1)(f) GDPR. Where consent covers storing or accessing information on your terminal device, Section 25(1) TDDDG also applies. We identify the applicable legal basis for each specific processing activity.

Recipients of data

We disclose personal data only where there is a legal basis for doing so or where this is necessary to provide the website, handle your enquiry, perform a contract or comply with legal obligations. Processors are engaged on the basis of an agreement pursuant to Art. 28 GDPR.

Withdrawal of consent

You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.

Right to object under Art. 21 GDPR

Where we process personal data on the basis of Art. 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation. We will then cease processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing, you may object to this processing at any time. The data concerned will then no longer be used for this purpose.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The following authority is particularly responsible for us:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22
20459 Hamburg
Email: mailbox@datenschutz.hamburg.de
Website: https://datenschutz-hamburg.de

Right to data portability

You may receive data that we process automatically on the basis of your consent or for the performance of a contract in a commonly used, machine-readable format, or have it transmitted directly to another controller where technically feasible.

Access, rectification and erasure

You may request access to the personal data we process. You may also have inaccurate data rectified and data erased, unless legal grounds prevent this.

Right to restriction of processing

You may request restriction of processing, in particular where:

• you contest the accuracy of the data and we are verifying it,
• the processing is unlawful and you request restriction instead of erasure,
• we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or
• you have objected and the balancing of interests has not yet been completed.

Automated decision-making

We do not use solely automated decision-making, including profiling within the meaning of Art. 22 GDPR, on this website.

SSL or TLS encryption

This website uses SSL or TLS encryption. This protects data you send to us from being read by third parties while it is in transit.

Data collection

Server log data

When you access the website, technically necessary information is processed. This may include the URL accessed, date and time, amount of data transferred, HTTP status code, referrer, browser type and version, operating system and IP address.

Processing is necessary to deliver the website, ensure its stability and security, and investigate technical errors or abusive access. The legal basis is Art. 6(1)(f) GDPR. Log data is erased as soon as it is no longer required for these purposes, unless a security incident or a legal obligation requires it to be retained for longer.

Cookies and similar technologies

We currently do not use analytics or marketing cookies. The Umami analytics tool we use operates without cookies. Where technically necessary cookies or comparable storage technologies are used for individual functions, this is done pursuant to Section 25(2) TDDDG. Any associated processing of personal data is based on Art. 6(1)(f) GDPR.

Umami Analytics

We use a self-hosted instance of the open-source analytics tool Umami to analyse the use of our website statistically. Umami does not set cookies. A session is recorded using an identifier that cannot be directly attributed to an individual and is generated as a hash from technical information such as the IP address, user agent and website ID. The IP address is not stored permanently.

In particular, pages visited, referrer, time of access, browser, operating system and device type may be processed. The analysis helps us improve the content, usability and technical quality of the website. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR.

Umami runs within our infrastructure hosted by DigitalOcean. No personal usage profiles are created and no analytics data is transferred to an additional analytics provider.

Contact and lead generation forms

We provide a general contact form on the website. We may also use individually configured lead generation forms for specific content or offers. The information processed depends on the particular form. Before submitting it, you can see all requested information and which fields are mandatory or optional.

We process the data you enter in order to handle your enquiry, provide requested information, respond to follow-up questions or take steps prior to entering into a contract. Without the information marked as mandatory, the relevant form cannot be submitted or the enquiry may not be processed properly.

The submitted information is stored in our Payload CMS, which is operated on the DigitalOcean infrastructure described above. We currently do not use an external CAPTCHA or spam protection service, so no data is transferred to another provider for this purpose.

Where your enquiry relates to a contract or steps prior to entering into a contract, processing is carried out under Art. 6(1)(b) GDPR. In other cases, it is based on our legitimate interest in handling incoming enquiries under Art. 6(1)(f) GDPR. If a form expressly asks for consent for a specific purpose, Art. 6(1)(a) GDPR also applies.

We store form data until the enquiry has been fully handled and no further communication or steps towards entering into a contract are expected. We then erase the data unless statutory retention obligations, legitimate interests in defending legal claims or other lawful grounds permit further storage.

Contact by email or telephone

If you contact us by email or telephone, we process the contact details you provide and the content of your enquiry in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR where the matter concerns a contract or steps prior to entering into a contract. In all other cases, Art. 6(1)(f) GDPR applies on the basis of our legitimate interest in handling the enquiry.

We store this data until your request has been fully dealt with and no further communication is expected. Statutory retention obligations and other lawful grounds for longer storage remain unaffected.