dein Werbestudio
Privacy Policy
Dein Werbestudio
Last updated: 23 September 2026
1. The most important information first
Protecting your personal data is important to us. We also want you to understand what happens to your data without needing a legal background.
This Privacy Policy explains:
what data may be processed when you visit our website;
why we need this information;
which external services we use;
who may receive personal data;
how long data may be stored;
what rights you have.
Personal data is information relating to an identified or identifiable person, such as a name, email address, telephone number or IP address.
We process personal data in accordance with the General Data Protection Regulation (GDPR), applicable German data protection law and, in relation to cookies and similar technologies, the German Telecommunications Digital Services Data Protection Act (TDDDG).
2. Who is responsible for your data?
The controller responsible for data processing is:
Iulia Sabadâș
Dein Werbestudio
Ottostraße 2
63785 Obernburg am Main
Germany
Telephone: +49 (0) 6022 6525826
Email: office@deinwerbestudio.website
Website: https://deinwerbestudio.website
In data protection law, the “controller” is the person who decides why and how personal data is processed.
You can contact us using the details above if you have any questions about data protection.
3. What legal bases do we use?
We do not process personal data without a legal basis.
Depending on the situation, we mainly rely on:
Art. 6(1)(a) GDPR – consent
For example, where you agree to Google Maps or other optional technologies. Consent can later be withdrawn.
Art. 6(1)(b) GDPR – contract or pre-contractual steps
For example, when you request a quotation, contact us regarding a project or enter into a contract with us.
Art. 6(1)(c) GDPR – legal obligation
For example, where we are required by law to retain certain tax or business records.
Art. 6(1)(f) GDPR – legitimate interests
For example, to protect our website against attacks and spam or to respond to general enquiries.
Section 25 TDDDG also applies where information is stored on or accessed from your device.
4. Hosting and server log data
Our website is hosted using services provided by Hostinger.
For customers within the EU, Hostinger services are generally provided by Hostinger International Limited, based in Cyprus.
When you visit our website, technical information may automatically be processed, including:
IP address;
date and time of access;
page or file requested;
browser type;
operating system;
referring page, where transmitted;
technical information about the connection or errors.
This information is needed to provide the website, identify technical problems and protect the website against attacks.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of our website.
Where Hostinger processes personal data on our behalf, processing is governed by the applicable arrangements under Art. 28 GDPR.
Technical data is retained only for as long as necessary for the operation and security of the service, unless legal requirements or the defence of legal claims require longer retention.
5. SSL/TLS encryption
Our website uses SSL/TLS encryption to protect information transmitted between your device and our server.
An encrypted connection can generally be recognised by a website address beginning with https://.
6. Cookies and similar technologies
Our website uses cookies and similar technologies.
Some are strictly necessary for the website to function or to remember your settings.
Other technologies are only used after you have given consent where consent is required by law.
Section 25(1) TDDDG applies to non-essential storage or access to information. Where personal data is subsequently processed on the basis of consent, Art. 6(1)(a) GDPR applies.
Section 25(2) TDDDG may apply to technologies that are strictly necessary.
Further details about the cookies used, their purposes and retention periods are provided in our Cookie Policy.
7. Consent management with Complianz
We use Complianz to manage your preferences concerning cookies and external services.
Complianz records which categories and services you have accepted or rejected so that your choice can be respected.
Cookies or other information used solely to remember your privacy settings are necessary for the operation of the consent management system.
You can change your decision or withdraw consent at any time through the “Cookie settings” option available on our website.
Withdrawal applies to future processing and does not affect the lawfulness of processing carried out before consent was withdrawn.
8. Contact form
Our contact form allows you to contact us easily and directly.
We may process:
first and last name;
email address;
telephone number, where provided;
subject;
message;
other information you voluntarily provide.
Your name and a valid email address are required so that we can identify your enquiry and respond to you. Other information is generally voluntary unless required for a particular enquiry.
Where your enquiry concerns a quotation, project, contract or potential contract, processing is based on Art. 6(1)(b) GDPR.
Other enquiries may be processed on the basis of Art. 6(1)(f) GDPR.
How long do we keep contact form data?
Where an enquiry does not result in a contract, the data is deleted after the enquiry has been finally dealt with and no later than six months after it has been processed, unless there is a legitimate or legal reason requiring longer retention.
Where an enquiry leads to a contractual relationship, the relevant contract and business records are retained for the applicable statutory retention periods.
9. Spam protection with WP Armour
We use WP Armour – Honeypot Anti Spam to protect our contact form against automated messages and spam.
WP Armour uses a “honeypot” method. A hidden field is added to the form which normal visitors do not see, but which automated spam programs may fill in. This allows automated submissions to be identified without requiring you to solve a CAPTCHA.
WP Armour’s standard honeypot functionality does not require tracking, cookies for this purpose or communication with an external server.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting our contact form and website against spam and misuse.
10. Contact by email and telephone
If you contact us directly by email or telephone, we process the information you provide in order to respond to your enquiry.
Art. 6(1)(b) GDPR applies to contractual or pre-contractual enquiries.
Art. 6(1)(f) GDPR may apply to other enquiries.
Where the communication does not result in a contract, the data is generally deleted after the enquiry has been completed and normally no later than six months afterwards, unless there is a reason for longer retention.
11. Technical email delivery through Brevo
We use Brevo for the technical transmission, sender authentication and reliable delivery of certain emails generated by our website.
Brevo is used as an SMTP infrastructure. This helps authenticate website-generated messages and deliver them reliably.
The following information may be processed:
email address;
name, where included in the message;
sender and recipient addresses;
subject and content of the message;
date and time of transmission;
technical delivery information.
Using Brevo for this purpose does not mean that people using our contact form are automatically subscribed to a newsletter or that their data is automatically used for advertising.
The legal basis depends on the purpose of the communication. In particular, Art. 6(1)(b) GDPR applies to contractual or pre-contractual communication, while Art. 6(1)(f) GDPR may apply to other communication.
Where Brevo processes personal data on our behalf, the applicable arrangements pursuant to Art. 28 GDPR apply.
12. Website security with Wordfence
We use Wordfence, provided by Defiant, Inc., USA, to protect our website against unauthorised access, attacks, malware and other security risks.
Depending on the security event, the following information may be processed:
IP address;
URL accessed;
technical HTTP request information;
login attempts;
information concerning suspicious or blocked access.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting our website, IT infrastructure and data.
As the provider is based in the United States, data may be transferred to a third country. Where required, safeguards provided for by the GDPR, including Standard Contractual Clauses, are used.
Security data is retained only for as long as necessary to protect the website, investigate security incidents or establish, exercise or defend legal claims.
13. Google Maps
We use Google Maps, embedded through Elementor’s Google Maps widget, on our contact page so that visitors can find our location more easily.
The map is initially blocked by our consent management system and is only loaded after you choose to allow the service.
A connection with Google is only established when the map is loaded.
Google may then process information including:
IP address;
browser and device information;
operating system;
date and time of access;
the page from which the map is loaded;
potentially location information, depending on your device and settings.
For users in the European Economic Area, the service is generally provided by:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Loading Google Maps is based on your consent under Art. 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG.
You can withdraw your consent at any time through Cookie settings.
If you prefer not to load Google Maps, our address and other contact details remain available without the map.
14. Contact via WhatsApp
Our website provides a link that allows you to contact us through WhatsApp.
Simply displaying the link does not automatically establish a connection with WhatsApp. A connection is only established when you follow the link or start communication yourself.
The provider may process information such as your telephone number, profile name, technical information and other usage data.
Information that you send directly to us is processed on the basis of Art. 6(1)(b) GDPR for contractual or pre-contractual enquiries and, where appropriate, Art. 6(1)(f) GDPR for other communication.
Using WhatsApp is voluntary. You can contact us by email or telephone instead.
15. Other external links and content
Our website may contain links to external websites.
A normal external link does not establish a connection with the external provider merely because you visit our website.
Only when you follow the link do you leave our website. The relevant provider is then generally responsible for processing carried out through its service.
If we introduce other external content in the future which directly transfers data to third parties when loaded, we will update this Privacy Policy and, where required, our consent management system.
16. Quotation, customer and contract data
If you request a quotation, order a service or enter into a contract with us, we may process:
your name;
company name;
address;
contact details;
project information;
correspondence;
invoicing and payment information.
Processing for initiating and performing a contract is based on Art. 6(1)(b) GDPR.
Where legal retention requirements apply, continued storage is based on Art. 6(1)(c) GDPR.
17. Who may receive your data?
We do not sell your personal data or disclose it to third parties without a legal basis.
Depending on the processing activity, recipients may include:
hosting providers;
technical email providers;
IT security providers;
external services activated with your consent;
tax or legal advisers;
public authorities where disclosure is required by law.
Where a service provider processes data on our behalf, Art. 28 GDPR applies.
18. Transfers outside the EU / EEA
Some providers or their subcontractors may operate outside the European Union or European Economic Area.
Personal data is only transferred where the requirements of the GDPR are met, for example on the basis of:
an adequacy decision of the European Commission;
Standard Contractual Clauses;
another legally recognised safeguard or exemption.
19. How long do we keep personal data?
Our basic rule is simple: we do not keep personal data longer than necessary.
Where no specific period is stated, information is retained only for as long as required for the purpose for which it was collected.
It is then deleted or anonymised unless statutory retention requirements apply or it is needed to establish, exercise or defend legal claims.
Normal contact form or email enquiries that do not result in a contract are deleted no later than six months after they have been finally dealt with, unless there is a reason for longer retention.
20. Your privacy rights – explained in plain language
The GDPR gives you several rights. You do not need to know the legal article numbers to use them.
Right of access – Art. 15 GDPR
You can ask:
“What information do you have about me, and why are you using it?”
You have the right to know which personal data we process, why we process it, who may receive it and how long it is expected to be kept.
Right to rectification – Art. 16 GDPR
If information about you is incorrect or incomplete, you can ask us to correct it.
Right to erasure – Art. 17 GDPR
In certain circumstances, you can ask:
“Please delete my personal data.”
This right is not absolute. For example, if the law requires us to retain an invoice, we cannot delete it before the statutory retention period expires.
Right to restriction of processing – Art. 18 GDPR
In certain circumstances, you can ask us to retain data but temporarily stop using it for other purposes.
For example, this may be appropriate while the accuracy of information is being checked.
Right to data portability – Art. 20 GDPR
Where the legal requirements are met, you may request data you have provided to us in a structured and machine-readable format.
In some cases, you may also request that it be transferred directly to another provider.
Right to object – Art. 21 GDPR
Where we process information on the basis of a legitimate interest, you may object for reasons relating to your particular situation.
In simple terms, you can tell us:
“Because of my personal circumstances, I do not want my data to continue being used for this purpose.”
We will consider your objection and stop processing unless there are compelling legitimate reasons for continuing or the information is required for legal claims.
Withdrawing consent
Where processing is based on your consent, you can withdraw that consent at any time for future processing.
For example, you can change your choice concerning Google Maps or other optional technologies.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
How do you exercise your rights?
Simply contact us at:
office@deinwerbestudio.website
and tell us what information or action you are requesting.
Where necessary, we may request additional information to make sure that the request genuinely comes from the person concerned.
21. Right to lodge a complaint
If you believe that your personal data is not being processed lawfully, you have the right to lodge a complaint with a data protection supervisory authority.
The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
Telephone: +49 (0) 981 180093-0
Email: poststelle@lda.bayern.de
You are, of course, welcome to contact us directly first if you have any questions or concerns.
22. Do you have to provide personal data?
You generally do not need to actively provide personal data simply to visit our website.
Certain functions, particularly the contact form, require the information marked as mandatory so that we can process and respond to your enquiry.
Additional information is generally voluntary.
23. Automated decision-making and profiling
We do not use solely automated decision-making or profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
In simple terms: we do not allow an automated system to make important decisions about you on its own.
24. Data security
We use appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised access and unauthorised disclosure.
Where possible, these measures are adapted to technological developments and the relevant risks.
25. Changes to this Privacy Policy
We may update this Privacy Policy if legal requirements, the services used on our website or our processing activities change.
The version currently published on our website is the applicable version.
Last updated: 23 September 2026