Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

No data protection officer has been appointed (currently not legally required).

2. Applicable law and international scope

This website is aimed primarily at users in the German-speaking region (DACH) but is designed for an international audience. As the controller is based in the EU (Malta), the General Data Protection Regulation (GDPR) applies regardless of where users are located. Visitors outside the EU may additionally be covered by local data protection laws – this should be reviewed separately by legal counsel as international expansion continues (e.g. UK GDPR, Swiss FADP).

Recommendation: as soon as international audiences are actively targeted, an English-language version of this policy should be provided in addition – not merely as a translation, but reviewed to be legally equivalent.

3. Provision of the website and Cloudflare

When you visit this website, our hosting/CDN provider Cloudflare, Inc. automatically processes technical data (including IP address, date/time of access, and the browser used) in order to deliver the website and protect it against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, reliable operation).

A data processing agreement (DPA) is in place between the controller and Cloudflare, including the EU Standard Contractual Clauses required for any processing outside the EU.

4. No analytics tools, no cookies (current status)

We currently use no analytics or tracking tools and set no cookies that would require consent. Should an analytics tool (e.g. for audience measurement) or cookie-based features be added in future, this privacy policy must be extended before they are introduced – and, for cookies that are not strictly necessary, a legally compliant cookie consent banner (opt-in, not opt-out) must be added.

5. Request / contact form

When someone requests a collaboration via the form on this website, we collect the following details:

• First and last name
• Email address
• Instagram or profile link
• Requested areas of support (multiple choice)
• Details about the current situation and goals
• Optional notes for the call

Purpose and legal basis

The data is processed to review and handle the request and to prepare a possible contractual relationship (Art. 6(1)(b) GDPR).

Storage location and recipients

The submitted data is stored exclusively in the Offkey Studio email inbox. No disclosure to third parties takes place.

Retention period

If no collaboration comes about, the contact details are deleted within 2 to 6 weeks. If a collaboration begins, the data continues to be processed as part of the contractual relationship (the details belong in the respective creator agreement, not in this privacy policy).

6. Newsletter "Offkey Notes" (CleverReach)

Anyone who wants to subscribe to our newsletter "Offkey Notes" only provides their email address. Sign-up uses a double opt-in procedure: after entering the address, an email with a confirmation link is sent to it. The address is only added to the mailing list once that link has been clicked. To document consent we store the time of sign-up and confirmation as well as the IP address used.

Purpose and legal basis

The processing serves to send the newsletter with content on personal branding, content and creator management. The legal basis is consent (Art. 6 (1) (a) GDPR). Consent can be withdrawn at any time with effect for the future – via the unsubscribe link in every email or by message to the address given in the legal notice.

Mailing service provider

We use CleverReach (CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany) to manage the mailing list and send the newsletter. The email address and the consent records are stored on CleverReach servers in Germany or the EU. CleverReach acts as a processor on the basis of a data processing agreement (Art. 28 GDPR). No data is passed on to other third parties. The address is handed over to CleverReach server-side through our sign-up service; the browser does not connect to CleverReach directly.

Performance measurement

The newsletters may contain a so-called tracking pixel and personalised links that record whether an email was opened and which links were clicked. This evaluation is used to align content with readers’ interests. If you do not want this, you can unsubscribe at any time; opting out of the measurement alone is not technically possible.

Retention period

The email address is stored for as long as the subscription exists. After unsubscribing it is removed from the mailing list; we may keep the consent records for up to three years in order to prove the earlier consent. If a sign-up is not confirmed within 30 days, the address is deleted.

7. Your rights

Every data subject has the right to:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of the data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent given, with effect for the future (Art. 7(3) GDPR) — particularly relevant for the separate consent under Art. 9 GDPR

To exercise these rights, an informal message to [email protected] is sufficient.

8. Right to lodge a complaint with a supervisory authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of their habitual residence. The authority responsible for the controller is the Office of the Information and Data Protection Commissioner (Malta).

9. Changes to this privacy policy

This privacy policy will be updated whenever the scope of the website changes (e.g. if analytics tools, cookies or additional form fields are introduced). The version current at the time of your visit applies.