Privacy

Scope

This policy describes how personal data is processed when you visit studio-nordost.com.

In short: nothing runs until you answer the privacy banner. Accept and we measure how the site is used, with cookies and anonymised session recordings. Decline and we count visits only — no cookies, no recording, and nothing stored on your device.

Hosting and delivery

The website is delivered by Cloudflare Pages (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, on behalf of Cloudflare, Inc.). Images and video are served from our own infrastructure at SiteGround Spain S.L., Calle de Prim 19, 28004 Madrid, with servers in the Netherlands.

Both act as processors under a data processing agreement. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in delivering the site securely and reliably.

Server log files

Delivering a page necessarily processes: IP address, date and time, the requested URL, the HTTP status, the referring URL, the user agent and the hostname.

Purpose: technical delivery, security and troubleshooting. Legal basis: Art. 6(1)(f) GDPR. Retained only as long as operationally necessary.

Fonts and embedded content

All typefaces are served from this domain. No fonts are loaded from Google Fonts or any other third party, so no request leaves your browser for one.

The site embeds no social widgets, no maps and no video players from third parties. Case-study video is served from our own infrastructure.

Cookies and local storage

No cookies are set before you make a choice in the privacy banner.

Up to three values are stored locally in your browser, not on our servers, and none is used to identify you: your answer to the privacy banner, your motion preference, and — only if you have used our opt-out link — a marker recording that analytics should never run on this device. They are strictly necessary to honour a choice you made, and are kept under Art. 6(1)(f) GDPR and §165(3) TKG 2021.

If you consent to analytics, PostHog additionally sets its own cookies. Declining, or later switching analytics off under Preferences in the footer, removes them. The cookieless measurement described below stores nothing on your device at all.

Analytics and session recording

If you ACCEPT, we measure how the site is used, using PostHog. Data is processed on PostHog's European infrastructure in Germany. This includes pages viewed, referrer, approximate location derived from a truncated IP address, browser and operating system, interaction events, and a recording of the session as anonymised page interactions. Legal basis: Art. 6(1)(a) GDPR — your consent.

The contents of any field you type into are masked before a recording leaves your browser. We do not record keystrokes.

If you DECLINE, we carry out cookieless audience measurement instead: pages viewed, referrer, and the browser and operating system reported by your browser. No cookies are set, nothing is stored on your device, no session is recorded, and your clicks and interactions are not captured. Your IP address is not stored: PostHog converts it into a rotating one-way hash used only to count a visit, which cannot be linked back to you and does not persist beyond the day. We therefore cannot recognise you on a later visit. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in knowing how many people use the site and which pages they reach. Because nothing is stored on or read from your device, §165(3) TKG 2021 does not require consent for it.

Nothing at all is loaded or executed before you answer: the analytics code is not even downloaded until then.

You can change your answer at any time, with effect for the future, under Preferences in the footer of any page. You may also object to the cookieless measurement under Art. 21 GDPR by emailing us.

Processor

PostHog, Inc. — EU Cloud, servers in Germany

Booking a call

Our booking links open cal.com, a separate website operated by Cal.com, Inc. Nothing from cal.com is embedded here, and no data is shared with them unless you follow the link.

Once there, Cal.com's own privacy policy applies to what you enter. The link carries a source tag telling us which page it was followed from; it contains no information about you.

Communication

Enquiries by email are processed in order to answer them and to take any pre-contractual steps. Legal bases: Art. 6(1)(b) and (f) GDPR.

Retained only as long as needed to resolve the enquiry and to meet statutory obligations.

Recipients and international transfers

Data is disclosed only to the processors named above, and only to the extent each needs it.

PostHog, Inc. and Cloudflare, Inc. are established in the United States. The processing described here takes place on European servers; where access from outside the EEA is possible for support or maintenance, it is covered by the European Commission's standard contractual clauses together with supplementary technical measures.

Retention

Server logs are kept only as long as operationally necessary.

Analytics events and session recordings are deleted automatically after the retention period configured in PostHog, and in any case are kept no longer than necessary for the purpose.

Your rights

Under Articles 15–21 GDPR you have the right of access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interests.

Where processing rests on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

You may also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna).

Contact

hi@studio-nordost.com

Security

The site is served over HTTPS only. We implement appropriate technical and organisational measures against loss, misuse, unauthorised access and alteration.

Changes to this policy

This policy may be updated to reflect legal, technical or business developments. Where a change affects what we ask consent for, the banner will ask again rather than relying on a previous answer.