PRIVACY POLICY

01 · CONTROLLER

Jens Guenther
Chiang Rai, Thailand
blackoarstudio@gmail.com

02 · WHAT DATA WE COLLECT

• Contact: this website has no contact form. The contact dialog only opens your email client (mailto link) or copies our email address to your clipboard — no data is submitted to or processed by this website itself
• If you choose to email us, the message is delivered through your email provider to our inbox hosted by Google (Gmail). Google processes data according to its own privacy policy and EU-US Data Privacy Framework certification
• Server/CDN logs: IP address, user agent, timestamp via Cloudflare, Inc. (US) — Cloudflare is certified under the EU-US Data Privacy Framework, logs are retained for security purposes only
• No analytics, no tracking cookies, no third-party advertising, no profiling

03 · LEGAL BASIS

Processing of email correspondence is based on Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). Processing of server logs is based on Art. 6(1)(f) GDPR (legitimate interest in network and information security).

04 · DATA PROCESSORS

• Cloudflare, Inc. (US) — hosting, CDN, DDoS protection
• Google LLC (US) — email reception via Gmail

Both act as data processors under Art. 28 GDPR. Both are certified under the EU-US Data Privacy Framework, providing an adequate level of protection for international data transfers under Art. 45 GDPR.

05 · DATA RETENTION

Email correspondence is retained as long as necessary to handle your inquiry, and deleted after 90 days unless a business relationship develops or statutory retention obligations apply. Server logs are retained by Cloudflare for a maximum of 24 hours.

06 · YOUR RIGHTS (ART. 15–21 GDPR)

Right to access, rectification, erasure, restriction, portability, and objection.

Contact: blackoarstudio@gmail.com

07 · RIGHT TO LODGE A COMPLAINT

You may lodge a complaint with a supervisory authority in your EU member state of habitual residence.

08 · NO DATA SELLING

We do not sell, rent or share personal data with third parties for marketing purposes.