Privacy Policy

§ 1 General Information

 

In this privacy policy, you will find detailed information about what happens to your personal data when you visit our website www.thestudioeight.com. All data that allows you to be personally identified is personal data. When processing your data, we strictly adhere to legal requirements, in particular the General Data Protection Regulation ("GDPR"). It is very important to us that your visit to our website is completely secure.

 

§ 2 Responsible Party

 

The responsibility for the collection and processing of personal data on this website under data protection law lies with:

• First name, Surname: Oliver Hormuth

• Street, House number, Postal code, City: Huttenstraße 22, 76646 Bruchsal

• Country: Germany

• Email: Oliver@thestudio

 

§ 3 Data Protection Officer

 

The external Data Protection Officer for the data controller is:

• First name, Surname: Oliver Hormuth

• Street, House number, Postal code, City: Huttenstraße 22, 76646 Bruchsal

• Country: Germany

• Email: oliver@thestudioeight.com

​

If you have any questions or suggestions regarding data protection, you can contact our Data Protection Officer at any time.

 

§ 4 Access Data (Server Log Files)

 

When you visit our website, we automatically collect access data transmitted by your browser and store it in so-called server log files. These include the following points:

• Browser type and browser version of your PC

• Operating system used by your PC

• Date and time of the server request

• The IP address currently used by your PC (if applicable, in anonymized form)

As a rule, it is not possible for us, nor is it our intention, to assign this data to a specific person. This data is processed in accordance with Art. 6 (1) (f) GDPR in order to safeguard our legitimate interest in improving the stability and functionality of our website.

 

§ 5 Cookies

 

We use so-called cookies to make visiting our website attractive and to enable the use of certain functions. These are small text files that are stored on your end device. Cookies cannot run programs or transfer viruses to your computer system.

Necessary cookies that are required for electronic communication or to provide desired functions are stored in accordance with Art. 6 (1) (f) GDPR. Our legitimate interest in storing them serves the technically error-free and optimized provision of our services. Other cookies (e.g., to analyze your surfing behavior) are treated separately in this privacy policy.

We mainly use so-called "session cookies", which are automatically deleted after your visit ends. In addition, we use cookies that remain stored on your end device until you remove them yourself. These enable us to recognize your browser on your next visit.

You can set your browser to inform you about the setting of cookies. You can then decide on an individual basis whether to accept cookies, exclude cookies for certain cases, or generally reject them. You can also set cookies to be automatically deleted when you close the browser. Please note that the functionality of this website may be restricted if you disable cookies.

 

§ 6 Web Analytics Tools and Advertising

 

 

A. Google Analytics

 

We use the Google Analytics web analytics service in version Google Analytics 4 on our site. This is provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google Analytics uses "cookies", text files stored on your computer that enable an analysis of your use of our website. Within Google Analytics, all data from devices located in the EU (based on geographic IP address) is initially logged via domains and servers within the EU before the traffic is routed to Analytics servers for further processing.

The processing of your data is based on your consent given in the cookie consent tool (pursuant to Art. 6 (1) sentence 1 (a) GDPR).

 

a. IP Anonymization

 

IP anonymization is automatically activated for Google Analytics on our website. Your IP address is thereby truncated within the EU or EEA before being transmitted to Google in the USA. Only in exceptional cases will the full IP address be transmitted and truncated there. Google uses this information on our behalf to evaluate your website usage, compile activity reports, and provide other services related to website and internet usage. According to Google, IP addresses in Google Analytics are not logged or stored, but are only briefly processed for geolocation and immediately deleted. Your IP address will not be merged with other Google data.

 

b. Data Processing Agreement

 

We have entered into a data processing agreement with Google and strictly comply with the strict requirements of the German data protection authorities when using Google Analytics.

 

c. Retention Period

 

User- and event-level data stored by Google that is linked to cookies, user identifiers (such as User ID), or advertising IDs (such as DoubleClick cookies or Android Advertising ID) is deleted after 2 months. Further details can be found at this link: https://support.google.com/analytics/answer/7667196?hl=en.

 

d. Right of Withdrawal

 

Many data processing operations require your explicit consent. If data processing is based on your consent, you have the right to revoke it at any time with future effect pursuant to Art. 7 (3) GDPR. Simply change your selection in the cookie settings. Such withdrawal does not affect the lawfulness of data processing carried out prior to the withdrawal. Storage of data for billing and accounting purposes remains unaffected by this revocation.

More detailed information on user data handling by Google Analytics can be found in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=en. For general privacy provisions, please refer to Google's privacy policy: https://policies.google.com/privacy?hl=de&gl=de.

 

B. Google Fonts

 

On our website, we use Google Fonts (formerly Google Web Fonts), a service provided by Google LLC.

Google Fonts allows the integration of external fonts, so-called Google Fonts. For this purpose, your web browser loads the required Google Font into your browser cache when you call up our website. This is necessary to ensure a visually appealing presentation of our texts. If your browser does not support this function, a default font from your computer will be used.

Google Fonts are integrated via a server call, usually a Google server in the USA. In doing so, information about which of our web pages you visited is transmitted to the server. In addition, Google stores the IP address of the browser of your end device. We have no influence on the scope and further use of the data collected and processed by Google through the use of Google Fonts.

The use of Google Fonts serves optimization purposes, in particular to improve user-friendliness and the attractive design of our website. This constitutes our legitimate interest in processing the aforementioned data by the third-party provider. The legal basis for this is Art. 6 (1) sentence 1 (f) GDPR.

Further information about Google Fonts can be found at https://fonts.google.com/.

 

C. WordPress Stats

 

In order to statistically analyze visitor access, our website uses the WordPress Stats tool. WordPress Stats is a component of the Jetpack plugin, which is provided by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110-4929, USA.

WordPress Stats uses cookies stored on your computer that enable an analysis of website usage. The information generated by the cookie about your use of our online offering is stored on a server in the USA. Usage profiles of users can be created from the processed data, which are used exclusively for analytical and not advertising purposes. Your IP address is anonymized after processing and before storage.

The cookies used by "WordPress Stats" remain on your end device until you delete them. Further information can be found in Automattic's privacy policy at https://automattic.com/privacy/ and in the notes on Jetpack cookies at https://jetpack.com/support/cookies/.

The storage of "WordPress Stats" cookies and the use of this analysis tool are based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in the anonymized analysis of user behavior in order to optimize both our web offering and our advertising measures.

 

§ 7 Social Media

 

 

A. Instagram Plugin

 

Functions of the Instagram service (Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA) integrated into our website can be recognized by the Instagram logo, e.g., in the form of an "Instagram camera". An overview of Instagram plugins and their visual representation can be found at: http://blog.instagram.com/post/36222022872/introducing-instagram-badges.

When visiting our website containing an Instagram plugin, your browser connects directly to Instagram. Instagram transfers the plugin content directly to your browser and thereby receives your IP address and the information that you visited our page, even if you do not have an Instagram account or are not logged in. This data is transmitted to Instagram servers in the USA.

If you are logged into your Instagram account, you can link the content of our pages to your Instagram profile by clicking the Instagram button. This allows Instagram to associate the visit to our pages with your user account. We explicitly point out that we, as the provider of the pages, receive no knowledge of the content of the transmitted data or its use by Instagram.

You can prevent the assignment of data collected via our website to your Instagram account by logging out of Instagram before visiting our website. Furthermore, you can completely prevent the loading of Instagram plugins using corresponding browser add-ons, e.g., "NoScript" (http://noscript.net/).

Information on Instagram's data collection, processing, and use, as well as your rights and privacy settings, can be found in their privacy policy: https://instagram.com/about/legal/privacy/.

 

B. LinkedIn Plugin

 

Functions of the LinkedIn social network are integrated on our website. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA ("LinkedIn").

As soon as you visit one of our pages containing LinkedIn functions, a connection to LinkedIn servers is established. LinkedIn thereby receives knowledge that you visited our web pages with your IP address. If you click the LinkedIn "Recommend button" while logged into your LinkedIn account, LinkedIn can associate your visit to our website with your personal profile. We emphasize that as the site operator, we obtain no information about the content of the transmitted data and its use by LinkedIn.

For information regarding the nature and scope of data collection, further processing, and use of data by LinkedIn, as well as your rights and settings options for protecting your privacy, please refer to LinkedIn's privacy policy at: https://www.linkedin.com/legal/privacy-policy.

 

§ 8 Newsletter

 

Only with your prior consent will we send our newsletter to your email address at regular intervals. To use this service, specification and verification of your email address are required. Further data is not collected or is provided on a voluntary basis. Your data will be used exclusively for sending the newsletter.

Data provided during newsletter registration is processed exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR. You can revoke your consent at any time. An informal notification by email or using the unsubscribe link contained in the newsletter is sufficient. Data processing already carried out remains unaffected by your revocation.

Upon unsubscribing, data stored for setting up the subscription will be deleted. If this data has already been stored by us for other purposes and elsewhere, it will remain stored.

 

§ 9 Contact Form

 

When you contact us by email or contact form, the data transmitted, including your contact details, will be stored to process your inquiry and for follow-up questions. We will not pass on this data without your explicit consent.

Processing of data transmitted in the contact form takes place exclusively on the basis of your consent granted pursuant to Art. 6 (1) (a) GDPR. A revocation of this consent is possible at any time without giving reasons. An informal email notification to us is sufficient for revocation. The lawfulness of data processing operations carried out prior to revocation remains unaffected.

Data submitted via the contact form remains with us until you request deletion, revoke your consent for storage, or the purpose for data storage no longer applies. Mandatory statutory retention periods remain unaffected.

 

§ 10 Customer Account

 

Creating a customer account requires your consent to store your master data (name, address, email address, bank details) and usage data (username, password). This data is stored to enable you to place orders through your customer account using your email address and password.

 

§ 11 Online Payments

 

In order to process your order in our online shop, we require certain personal data from you. Mandatory information required for contract fulfillment is marked accordingly. Depending on the payment method you choose, data relevant to payment processing will be transmitted to the respective payment service provider. The legal basis for processing your data is Art. 6 (1) sentence 1 (b) GDPR.

 

A. Apple Pay

 

Our website uses Apple Pay, an online payment service. Service provider is the American company Apple Inc., Infinite Loop, Cupertino, CA 95014, USA.

Responsibility for data processing in connection with Apple Pay lies primarily with Apple Pay. It is important to understand that this could potentially involve processing and storing data without complete anonymization. In addition, there is a possibility that US authorities may gain access to this data under certain conditions. Furthermore, this data may be linked to information from other Apple Pay services if you have a user account there.

You can learn more about data processed through the use of Apple Pay in the Privacy Policy at https://www.apple.com/legal/privacy/de-ww/.

 

B. Google Pay

 

Our website uses the online payment provider Google Pay. Service provider is the American company Google Inc. For the European area, Google Ireland Ltd., Gordon House, Barrow Street Dublin 4, Ireland is responsible for all Google services.

Responsibility for data processing in connection with Google Pay lies primarily with Google Pay. It is important to understand that this could potentially involve processing and storing data without complete anonymization. In addition, US authorities may gain access to this data under certain conditions. Furthermore, this data may be linked with information from other Google services if you have a user account there.

Further information about data processed through the use of Google Pay can be found in the Privacy Policy at https://policies.google.com/privacy.

 

C. Mastercard

 

Our website uses the payment service provider Mastercard. Service provider is the American company Mastercard Inc. For the European region, Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium is responsible.

Responsibility for data processing in connection with Mastercard lies primarily with Mastercard. It is important to understand that this could potentially involve processing and storing data without complete anonymization. In addition, US authorities may gain access to this data under certain conditions. Furthermore, this data may be linked to information from other Mastercard services if you have a user account there.

Further information about data processed through the use of Mastercard can be found in the Privacy Policy at https://www.mastercard.de/de-de/datenschutz.html.

 

D. PayPal

 

Our website uses the online payment service PayPal. Service provider is the American company PayPal Inc. For the European region, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg is responsible.

Responsibility for data processing in connection with PayPal lies primarily with PayPal. It is important to understand that this could potentially involve processing and storing data without complete anonymization. In addition, US authorities may gain access to this data under certain conditions. Furthermore, this data may be linked to information from other PayPal services if you have a user account there.

Further information about data processed through the use of PayPal can be found in the Privacy Policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

 

E. Sofortüberweisung (Direct Bank Transfer)

 

Our website enables payments via "Sofortüberweisung". Provider of the payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich.

By using "Sofortüberweisung", incoming payment is confirmed in real time by Sofort GmbH. This enables us to provide our services without delay.

When paying via "Sofortüberweisung", your PIN and TAN are transmitted to Sofort GmbH. Sofort GmbH uses this data to log into your online banking account, check your balance, carry out the transfer, and generate a transaction confirmation. As part of the login process, your transactions, credit limit of your overdraft, and existence/balance of other accounts are also automatically checked.

To perform "Sofortüberweisung", transmission of certain data to Sofort GmbH is required. In addition to PIN and TAN, this includes payment data and personal data such as first and last name, address, telephone number(s), email address, IP address, and, if applicable, other necessary information. Transmission serves identity verification and fraud prevention.

Transmission of your data to Sofort GmbH is based on Art. 6 (1) (a) GDPR (your consent) and Art. 6 (1) (b) GDPR (processing for contract performance). You are entitled to revoke your consent at any time. Data processing operations already carried out remain unaffected.

Detailed information on payment with Sofortüberweisung can be found in the privacy policies at: https://www.sofort.de/datenschutz.html and https://www.klarna.com/sofort/.

 

F. Visa

 

Our website enables payments via Visa. Service provider is the American company Visa Inc. For the European region, Visa Europe Services Inc., 1 Sheldon Square, London W2 6TT, United Kingdom is responsible.

Responsibility for data processing in connection with Visa lies primarily with Visa. It is important to understand that this could potentially involve processing and storing data without complete anonymization. In addition, US authorities may gain access to this data under certain conditions. Furthermore, this data may be linked to information from other Visa services if you have a user account there.

Further information about data processed through the use of Visa can be found in the Privacy Policy at https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

 

§ 12 Use and Transfer of Data

 

We assure you that personal data you disclose to us, e.g., during an order or by email (such as your name, address, or email address), will not be sold to third parties or otherwise used commercially. Processing of your data takes place exclusively for correspondence with you and to fulfill the purpose for which you provided the data. As part of payment processing, your payment data will be forwarded to the authorized credit institution.

Data automatically collected during your visit to our website is used exclusively for the above purposes. Other use of the data does not occur.

The protection of your personal data is important to us. We therefore generally do not pass on your data to third parties unless a legal obligation to do so exists or you have given us your explicit consent.

 

§ 13 Encryption (SSL/TLS)

 

Our website uses SSL or TLS encryption to ensure security and protect the transmission of confidential content. This applies in particular to orders or inquiries you send to us as site operator. An encrypted connection can be recognized by "https://" in your browser's address line and the lock symbol in your browser bar.

Activating SSL or TLS encryption ensures that data you send to us cannot be read by unauthorized third parties.

 

§ 14 Retention Period

 

Storage of your personal data transmitted to us via our website occurs only for the duration necessary to achieve the respective purpose of data processing. However, in accordance with commercial and tax retention obligations, storage of certain data may last up to 10 years.

 

§ 15 Your Data Protection Rights

 

As a data subject, you have the following rights against the controller regarding your personal data in accordance with statutory provisions:

 

A. Right of Withdrawal

 

Many data processing operations are only possible with your explicit consent. If processing of your data is based on your consent, you have the right to revoke this consent at any time with future effect pursuant to Art. 7 (3) GDPR. Lawfulness of data processing carried out up to revocation on the basis of consent remains unaffected. Data storage for billing and accounting purposes is not affected by revocation.

 

B. Right of Access / Right to Information

 

Pursuant to Art. 15 GDPR, you have the right to request confirmation from us as to whether we process your personal data. If this is the case, you are entitled to information about this data, including processing purposes, categories of processed data, recipients or categories of recipients to whom data has been or will be disclosed, planned storage period or criteria for determining it, existence of a right to rectification, erasure, restriction of processing, objection to processing, complaint to a supervisory authority, origin of data if not collected from you, existence of automated decision-making including profiling, and, where applicable, meaningful information about the logic involved as well as scope and intended effects of such processing, as well as your right to be informed about guarantees pursuant to Art. 46 GDPR upon transfer to third countries.

 

C. Right to Rectification

 

You have the right to request the correction of inaccurate personal data concerning you and/or completion of incomplete data at any time pursuant to Art. 16 GDPR.

 

D. Right to Erasure ("Right to be Forgotten")

 

You have the right to request erasure of your personal data pursuant to Art. 17 GDPR if one of the following reasons applies:

• a. Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.

• b. You revoke your consent legitimizing processing pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, and there is no other legal basis for processing.

• c. You object to processing pursuant to Art. 21 (1) GDPR and there are no overriding legitimate grounds for processing, or you object pursuant to Art. 21 (2) GDPR.

• d. Unlawful processing of personal data has occurred.

• e. Erasure of personal data is required to comply with a legal obligation under Union law or Member State law to which we are subject.

• f. Personal data was collected in connection with the offer of information society services pursuant to Art. 8 (1) GDPR.

Under the following circumstances, this right may be restricted if processing is essential:

• a. to comply with a legal obligation requiring processing under Union or Member State law to which we are subject, or to perform a task in the public interest or in the exercise of official authority;

• b. to fulfill a legal obligation requiring processing under Union or Member State law, or to perform a task in the public interest / official authority vested in us;

• c. for reasons of public interest in the area of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR;

• d. for archiving, scientific, historical research, or statistical purposes pursuant to Art. 89 (1) GDPR in the public interest, provided exercising the right renders impossible or seriously impairs achievement of processing objectives; or

• e. for the establishment, exercise, or defense of legal claims.

If we have made your personal data public and are obliged to erase it according to the above provisions, taking into account available technology and implementation costs, we will take reasonable measures (including technical ones) to inform data controllers processing such data that you as a data subject have requested erasure of any links to, or copies/replications of, that personal data.

 

E. Right to Restriction of Processing

 

Pursuant to Art. 18 GDPR, you have the right to request restriction of processing (blocking) of your personal data. To exercise this right, you can contact us at any time. Contact details can be found in the legal notice (Impressum). Restriction of processing may be requested in the following cases:

• a. If you dispute accuracy of personal data stored with us, we generally need time to verify this. For the duration of verification, you have the right to request restriction of processing.

• b. If processing of your personal data was/is unlawful, you can request restriction instead of erasure.

• c. If we no longer need your personal data, but you require it for exercise, defense, or establishment of legal claims, you have the right to request restriction instead of erasure.

• d. If you filed an objection pursuant to Art. 21 (1) GDPR, a balancing between your interests and ours must be conducted. As long as it is not determined whose interests prevail, you have the right to request restriction.

After restriction, your data may generally only be processed with your consent, with exceptions for specific statutory cases (e.g. legal claims or public interest).

 

F. Right to Information / Notification

 

If you exercise your right to rectification, erasure, or restriction of processing, we are obliged under Art. 19 GDPR to inform all recipients to whom data was disclosed. This does not apply if notification proves impossible or involves disproportionate effort. Upon request, we will inform you about these recipients.

 

G. Protection against Automated Decision-Making (Profiling)

 

Pursuant to Art. 22 GDPR, you have the right not to be subject to a decision based solely on automated processing—including profiling—which produces legal effects concerning you or similarly significantly affects you.

This does not apply if the decision:

• a. is necessary for entering into or performing a contract between you and us,

• b. is authorized by Union or Member State law to which controller is subject and which contains suitable measures to safeguard your rights and freedoms, or

• c. is made with your explicit consent.

However, decisions in cases (a) to (c) must not be based on special categories of personal data (Art. 9 (1) GDPR) unless Art. 9 (2) (a) or (g) applies and suitable measures to protect rights/freedoms/interests are in place.

In cases (a) and (c), we take suitable measures to safeguard rights/freedoms/interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view, and contest the decision.

 

H. Right to Data Portability

 

If processing of your personal data is based on consent (Art. 6 (1) (a) or Art. 9 (2) (a) GDPR) or on a contract (Art. 6 (1) (b) GDPR) and carried out by automated means, you have the right under Art. 20 GDPR to receive your data provided to us in a structured, commonly used, and machine-readable format and to transmit it to another controller or request transmission directly by us, where technically feasible.

 

I. Right to Object

 

If we process your personal data based on a balancing of interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object to processing at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. Applicable legal bases can be found in this privacy policy.

In the event of an objection, we will no longer process affected personal data unless we can demonstrate compelling legitimate grounds for processing which override your interests/rights/freedoms, or processing serves establishment, exercise, or defense of legal claims (objection pursuant to Art. 21 (1) GDPR).

If personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing, including profiling related to direct marketing. Upon objection, your personal data will no longer be used for direct marketing (objection pursuant to Art. 21 (2) GDPR).

In connection with the use of information society services, notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

 

J. Right to Lodge a Complaint with the Competent Supervisory Authority pursuant to Art. 77 GDPR

 

In the event of infringements of GDPR provisions, data subjects have the right to lodge a complaint with a competent supervisory authority. The complaint may be lodged in particular in the Member State of habitual residence, place of work, or place of alleged infringement. The right to lodge a complaint exists without prejudice to other administrative or judicial remedies.

Our competent supervisory authority is:

• Organization: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

• P.O. Box: Postfach 10 29 32, 70025 Stuttgart

• Address: Lautenschlagerstraße 20, 70173 Stuttgart

• Telephone: 07 11/61 55 41-0

• Email: poststelle@lfdi.bwl.de

• Internet: https://www.baden-wuerttemberg.datenschutz.de

   

 

§ 16 Validity and Amendment of this Privacy Policy

 

This privacy policy comes into effect on August 4, 2026. We reserve the right to amend this policy as needed in compliance with applicable data protection laws. This may be necessary, for example, to comply with new legal requirements or to reflect changes on our website or new services offered via our website. The current version accessible on our website at the time of your visit is binding.

In the event of changes, we will publish them on this page to fully inform you about what personal data we collect, how we process it, and under what conditions we may pass it on.