Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

No data protection officer has been appointed (currently not legally required).

2. Applicable law and international scope

This website is aimed primarily at users in the German-speaking region (DACH) but is designed for an international audience. As the controller is based in the EU (Malta), the General Data Protection Regulation (GDPR) applies regardless of where users are located. Visitors outside the EU may additionally be covered by local data protection laws – this should be reviewed separately by legal counsel as international expansion continues (e.g. UK GDPR, Swiss FADP).

Recommendation: as soon as international audiences are actively targeted, an English-language version of this policy should be provided in addition – not merely as a translation, but reviewed to be legally equivalent.

3. Provision of the website and Cloudflare

When you visit this website, our hosting/CDN provider Cloudflare, Inc. automatically processes technical data (including IP address, date/time of access, and the browser used) in order to deliver the website and protect it against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, reliable operation).

A data processing agreement (DPA) is in place between the controller and Cloudflare, including the EU Standard Contractual Clauses required for any processing outside the EU.

4. Audience measurement with Umami (no cookies)

To understand which pages are read and how visitors find the website, we use the analytics service Umami Cloud. Umami sets no cookies and stores nothing on your device. It records the page visited, the referring page, time, browser, operating system, device type, screen size, language and the country or region derived from the IP address. The IP address itself is not stored; repeat visits are only grouped via an anonymised identifier whose basis of calculation changes regularly. This does not allow us to identify you, and no profiles are built across websites.

Legal basis

Art. 6(1)(f) GDPR. Our legitimate interest is measuring the reach of our content and improving the website without building personal profiles. Since no cookies are set and no information is stored on your device, no cookie banner is required.

Provider and location

The provider is Umami Software, Inc., USA. Data is processed and stored in the EU region of Umami Cloud. A data processing agreement is in place with the provider.

Retention

Usage statistics are deleted once they are no longer needed for analysis, at the latest when the retention period of our Umami plan expires.

5. Request / contact form

When someone requests a collaboration via the form on this website, we collect the following details:

• First and last name
• Email address
• Instagram or profile link
• Phone number (optional, instead of an email address)
• Requested areas of support (multiple choice)
• Details about the current situation and goals
• Optional notes for the call

Purpose and legal basis

The data is processed to review and handle the request and to prepare a possible contractual relationship (Art. 6(1)(b) GDPR).

Storage location and recipients

The submitted data is stored exclusively in the Offkey Studio email inbox. No disclosure to third parties takes place.

Retention period

If no collaboration comes about, the contact details are deleted within 2 to 6 weeks. If a collaboration begins, the data continues to be processed as part of the contractual relationship (the details belong in the respective creator agreement, not in this privacy policy).

6. Newsletter "Offkey Notes" (CleverReach)

Anyone who wants to subscribe to our newsletter "Offkey Notes" only provides their email address. Sign-up uses a double opt-in procedure: after entering the address, an email with a confirmation link is sent to it. The address is only added to the mailing list once that link has been clicked. To document consent we store the time of sign-up and confirmation as well as the IP address used.

Purpose and legal basis

The processing serves to send the newsletter with content on personal branding, content and creator management. The legal basis is consent (Art. 6 (1) (a) GDPR). Consent can be withdrawn at any time with effect for the future – via the unsubscribe link in every email or by message to the address given in the legal notice.

Mailing service provider

We use CleverReach (CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany) to manage the mailing list and send the newsletter. The email address and the consent records are stored on CleverReach servers in Germany or the EU. CleverReach acts as a processor on the basis of a data processing agreement (Art. 28 GDPR). No data is passed on to other third parties. The address is handed over to CleverReach server-side through our sign-up service; the browser does not connect to CleverReach directly.

Performance measurement

The newsletters may contain a so-called tracking pixel and personalised links that record whether an email was opened and which links were clicked. This evaluation is used to align content with readers’ interests. If you do not want this, you can unsubscribe at any time; opting out of the measurement alone is not technically possible.

Retention period

The email address is stored for as long as the subscription exists. After unsubscribing it is removed from the mailing list; we may keep the consent records for up to three years in order to prove the earlier consent. If a sign-up is not confirmed within 30 days, the address is deleted.

7. Job applications

Anyone applying via the form on our careers page sends us the following details:

• Position or open application
• First and last name and email address
• Optional: link to CV, portfolio or profile and possible start date
• Free text about yourself and your motivation

Purpose and legal basis

Processing serves to carry out the application process and to decide on entering into an employment or service relationship (Art. 6(1)(b) GDPR). Please do not send us special categories of personal data (e.g. health data) unless they are required for the position.

Storage and recipients

The details are sent by email to the Offkey Studio mailbox and stored there. Only the people deciding on the application have access. They are not passed on to third parties.

Retention

If no collaboration results, we delete the application no later than six months after the process ends, unless you have agreed to longer storage. If a collaboration results, the data is processed further within the contractual relationship.

8. Creator onboarding

Creators we start working with receive a personal link to our onboarding form. The page is not publicly linked. Through the form we process:

• Basic data: full name, stage name, email address, mobile number, date of birth (and the age calculated from it), origin and place of residence
• Voluntary personal details, e.g. hair colour, shoe size, favourite food, job, education, daily routine and personal preferences
• Details about the collaboration: platforms, social media channels, marketing topics, limits and no-gos in chat, and price expectations
• Photos of the front and back of the identity card
• Time at which consent was given

Purpose and legal basis

The data is used to prepare and carry out the collaboration (Art. 6(1)(b) GDPR). We use the ID photo for age verification and identity checks, because we work exclusively with adults (Art. 6(1)(b) and (f) GDPR). Information about sexual preferences and limits belongs to the special categories of personal data. We only process it on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give in the form and can withdraw at any time with effect for the future.

Storage location and recipients

The data is stored in a database at Cloudflare (Cloudflare D1), the ID photos in non-public storage (Cloudflare R2). Both are restricted to storage in the EU. The ID photos are never publicly accessible, only via a protected, signed link for the Offkey team. In addition, a notification with your details, but without the ID photo, is sent by email to Offkey Studio's internal inbox. Only the people at Offkey Studio who manage the collaboration have access. The data is not passed on to third parties; Cloudflare acts as a processor (see section 3).

Storage period

If no collaboration comes about, we delete your details and the ID photos no later than six months after submission. If we work together, we keep them for the duration of the collaboration and delete them afterwards, unless statutory retention obligations apply. On request to contact@offkey.studio we delete your data at any time, unless we are legally required to keep it.

9. Your rights

Every data subject has the right to:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of the data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent given, with effect for the future (Art. 7(3) GDPR) — particularly relevant for the separate consent under Art. 9 GDPR

To exercise these rights, an informal message to contact@offkey.studio is sufficient.

10. Right to lodge a complaint with a supervisory authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of their habitual residence. The authority responsible for the controller is the Office of the Information and Data Protection Commissioner (Malta).

11. Changes to this privacy policy

This privacy policy will be updated whenever the scope of the website changes (e.g. if analytics tools, cookies or additional form fields are introduced). The version current at the time of your visit applies.