Privacy

1. Controller

2. Website delivery

This website is delivered through Cloudflare Pages. When it is opened, Cloudflare processes technically necessary connection data, particularly the IP address, time, requested address, and browser and device information, to deliver and protect the website. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure and reliable operation of the website.

Cloudflare may process data outside the European Economic Area. Transfers are protected by applicable adequacy decisions and/or Standard Contractual Clauses. See the Cloudflare Privacy Policy for more information.

3. Images delivered by Sanity

Images are loaded through Sanity's content delivery network. Sanity consequently processes connection data such as the IP address, time, referrer, and technical browser information. This is necessary for the fast and secure presentation of the portfolio and is based on Article 6(1)(f) GDPR. Sanity may also process data outside the EEA using appropriate safeguards.

Sanity states that access logs are deleted or anonymised within 90 days. See the Sanity Privacy Policy for more information.

4. Contact form and email

When an enquiry is submitted, we process the sender's name, email address, selected interest, message, and technically necessary transmission data. We use this information only to handle and answer the enquiry. Article 6(1)(b) GDPR applies to enquiries relating to a potential contract; Article 6(1)(f) GDPR applies to other enquiries.

The form is processed by Web3Forms, operated by Web3Creative in India, and forwarded to the controller's email inbox. Web3Forms uses providers in the EU, the United States, and other countries for hosting, email delivery, and spam prevention. Standard Contractual Clauses protect necessary international transfers. Web3Forms may retain submissions for up to three years; earlier deletion is available. See the Web3Forms Privacy Policy for details.

Email correspondence is provided through Google Gmail. Google consequently processes sender, recipient, message, and technical connection data and may process data outside the EEA. See the Google Privacy Policy for more information.

We delete enquiries when they are no longer needed. If an enquiry results in a contract, necessary records are retained only for applicable statutory retention and evidence periods.

5. Cookies and analytics

The public portfolio pages use no advertising or analytics cookies and perform no user profiling. Providers use strictly necessary security mechanisms only where required to provide a service expressly requested by the visitor. The Sanity Studio at/studio, intended only for editors, may use necessary authentication and local storage after it is opened.

6. Rights

Subject to the GDPR, individuals have rights including access, correction, erasure, restriction, data portability, and objection. A complaint may be lodged with a data protection supervisory authority. To exercise these rights, email the controller at the address above.