Privacy policy

Last updated: 7 October 2026

1. Controller and contact details

The controller responsible for processing personal data on ideastudios.de is:

IDEA Studios GmbH
Represented by Wladimir Schauermann
Verdener Straße 18A
29640 Schneverdingen
Germany
Phone: 05193 8054 050
Email: info@ideastudios.de

This policy explains how data is processed when you use our website or contact us. Personal data is information relating to an identified or identifiable individual. This includes contact details, IP addresses and online identifiers, for example.

2. What data we process and why

When you visit our website, technical data is generated that is necessary to provide and secure the service. We use information from contact enquiries to respond to your request. If you consent, we use Google Analytics to analyse website use and the effectiveness of our contact options. External video content may establish additional connections to its providers; details are set out below.

Article 6(1)(b) GDPR applies to steps taken at your request before entering into a contract and to performance of a contract. Processing required by law is based on Article 6(1)(c) GDPR. We describe our legitimate interests alongside the relevant processing activities; Article 6(1)(f) GDPR applies to these. Processing that depends on consent is based on Article 6(1)(a) GDPR.

Storing information on your device or accessing information on it generally requires your consent under Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The exceptions in Section 25(2) TDDDG apply to strictly necessary operations. Any subsequent processing of personal data is also subject to the GDPR.

3. Hosting, technical provision and security

Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. We have a data processing agreement with this provider.

When a page is accessed, the data processed includes the IP address, requested address, time, browser and operating system details and, where applicable, the page previously visited. This information is used to deliver content, analyse errors and protect against misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website. Technical logs are retained only for as long as necessary for these purposes. A specific security incident may require longer retention for investigation or legal action.

Our hosting provider also receives the connection data needed to deliver locally hosted images, fonts and video files. Delivering these files does not require a connection to the original font manufacturer or media provider.

Our website uses HTTPS to encrypt data in transit. Nevertheless, complete protection of every communication over the internet cannot be guaranteed. Further information about our hosting provider: https://all-inkl.com/datenschutzinformationen/

4. Contact form, callback requests, email and telephone

When you contact us, we process your name, the contact details you provide, your enquiry and any information shared during the exchange. In the contact form, you provide a telephone number or an email address; at least one contact method is required. Providing a company name is optional. Without a way to contact you, we cannot answer your enquiry.

A form submission also transmits the date, time, page address, browser identifier and IP address to us. This technical information allows us to identify and review the enquiry and helps detect misuse. Messages are sent to info@ideastudios.de. They are transmitted via our hosting provider ALL-INKL.COM to our Microsoft 365 email mailbox. Additional storage through Elementor's form submission collection feature is not enabled for this form. Email storage, technical logs and backups are separate from this.

We use Microsoft 365 with Exchange Online to receive and process emails. Our contracting party is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Our Microsoft Customer Agreement incorporates the Microsoft Products and Services Data Protection Addendum (DPA). Microsoft processes message content, attachments, sender and recipient details and technical communication data. Information about Microsoft's data processing terms and international processing activities is available at:
https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA
https://privacy.microsoft.com/de-de/privacystatement

We process enquiries relating to entering into or performing a contract on the basis of Article 6(1)(b) GDPR. We process other enquiries and communications with company contacts on the basis of Article 6(1)(f) GDPR. Our legitimate interest is reliable business communication and responding to enquiries addressed to us. Article 6(1)(f) GDPR also applies to technical checks for misuse.

Acknowledging this privacy policy does not constitute consent to advertising. You can contact us and have your enquiry processed without consenting to Google Analytics.

Contact enquiries that do not lead to an order are currently archived; no fixed deletion period has yet been introduced. If an enquiry leads to a business relationship, the information may become part of the contractual records. Statutory retention obligations and retention specifically required to establish or defend legal claims must be considered separately.

5. Privacy settings and Borlabs Cookie

We use Borlabs Cookie, provided by Borlabs GmbH, to manage your choices regarding optional services. The consent management system stores your choice together with technical details such as version, validity and an identifier in your browser, and records consent on our server. According to the manufacturer, no visitor data is transmitted to Borlabs for this purpose.

The necessary storage of your choice on your device is based on Section 25(2), point 2 TDDDG. Where personal data is processed to fulfil our documentation obligations, the legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR. Managing your choice also serves our legitimate interest in reliably implementing your decision under Article 6(1)(f) GDPR.

You can use the privacy settings icon at any time to reopen the dialogue, reject optional services and withdraw consent with effect for the future. Withdrawal does not affect the lawfulness of earlier processing. You can also delete stored cookies through your browser; you may then need to make a new choice on a subsequent visit. The Borlabs cookie is configured to store your consent choice for 60 days. This period also applies when you select essential services only. It is separate from the retention periods of other services or records held on the server.

Information from the manufacturer: https://de.borlabs.io/docs/welche-daten-speichert-borlabs-cookie/

6. Google Analytics 4 and Google Tag Manager

We use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This helps us understand how our website is used, which content is helpful and whether our contact options lead to enquiries. Optional measurement is enabled after you consent to Google Analytics in the Statistics category.

Google Analytics processes usage events such as page views, scrolling, outbound link clicks, downloads and supported video events. It also processes online identifiers, session information, visit sources and information about browsers, devices and approximate geographical locations. The setting for collecting detailed location and device data is enabled; this does not use a GPS location permission requested by your browser.

After a contact enquiry is successfully submitted, an event is triggered to count the enquiry for statistical purposes. The event configured for this purpose does not transmit the contents of contact form fields, such as name, telephone number, email address or message. Handling the enquiry and this additional statistical counting are separate processes.

Google uses cookies and identifiers, among other tools, to recognise visits and attribute events. The legal bases are your consent under Article 6(1)(a) GDPR and, for storing or reading information on your device, Section 25(1) TDDDG. You can withdraw consent through the privacy settings.

According to Google's description, IP addresses from visits originating in the EU, Switzerland and the United Kingdom are used to determine approximate locations and then deleted before being logged or stored. Different procedures apply to visits from outside these regions. Google provides further details here:
https://support.google.com/analytics/answer/12017362?hl=de
https://support.google.com/analytics/answer/16871531?hl=de

Retention is set to two months for event data and 14 months for user data. The user identifier retention period resets when new activity occurs. These settings do not limit the retention of standard aggregated reports. Google Signals, the collection of user-provided data and advertising personalisation are disabled in the property used for this website.

We use Google Tag Manager to manage measurement code. During normal website operation, the container is cached locally. Measurement services that have been enabled still establish connections to Google. Consent to optional measurement also covers its delivery through Tag Manager.

7. Data sharing in the Analytics account

We manage website measurement in our own Analytics account. The four optional account sharing settings for Google products and services, modelling contributions and business insights, technical support, and business recommendations are disabled. These settings concern additional uses by Google. They do not remove processing required to operate Analytics and do not automatically prevent data exchange through separate product links. The previous Google Ads link has been removed; Section 8 describes the current position.

Information about account sharing and data processing terms:
https://support.google.com/analytics/answer/1011397?hl=de
https://business.safety.google/adsprocessorterms/
Google's privacy policy: https://policies.google.com/privacy?hl=de

8. Google Ads and advertising performance measurement

With your separate consent to ‘Google Ads – advertising performance’, we measure whether our Google advertisements lead to successfully submitted contact enquiries. We also count clicks on our telephone and email links as indications of an intention to contact us. Such a click does not prove that a telephone conversation took place or that an email was sent or received. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This choice is independent of Google Analytics and does not constitute consent to marketing communications. Our contact options also work without this consent.

The data processed includes online identifiers, information about the ad click, the page visited and the device, and the events mentioned above. A technical event identifier helps prevent enquiries being counted twice. These measurement events do not transmit the name, telephone number, email address or message entered in the form fields. Enhanced conversions and advertising personalisation are disabled for this measurement.

Measurement is enabled through Google Tag Manager only after the relevant consent has been given. The legal bases are Article 6(1)(a) GDPR and, for storing or reading information on your device, Section 25(1) TDDDG. You can withdraw consent through the privacy settings with effect for the future. This does not automatically delete data that has already been lawfully processed.

Cookies with the prefix _gcl_, such as _gcl_aw, may be used on our domain for ad attribution; Google specifies a lifetime of 90 days for these. Local browser storage under the key _gcl_ls may also contain ad click information. Unlike cookies, this storage has no browser-defined expiry time. You can delete cookies and local website data in your browser. Details of the specific storage entries used are available in the privacy settings.

Processing in the USA is possible; the information in Section 10 applies. Further information: https://policies.google.com/privacy?hl=de and https://business.safety.google/adsdatatransfers/

The previous Analytics link has been removed. New Analytics events are no longer imported as advertising conversions through that link; this does not automatically delete data already transmitted.

8a. Hotjar – usage analysis

With your separate consent, we use Hotjar/Contentsquare to improve the usability of our website. The provider is Content Square SAS, 7 rue de Madrid, 75008 Paris, France. Heatmaps and session replays help us understand which areas are used and where difficulties occur. The data processed includes pages visited, clicks, scrolling, technical device and browser information, and identifiers used to associate sessions. Connection data is generated for technical transmission.

Form areas and entries are masked before transmission. Internal editing and preview pages, as well as visits by users logged into WordPress, are excluded. Consent is independent of Google Analytics. You can use our website and contact options without Hotjar.

The legal bases are your consent under Article 6(1)(a) GDPR and, for storing or reading information on your device, Section 25(1) TDDDG. You can withdraw consent at any time through the privacy settings with effect for the future. Withdrawal stops further collection; it does not automatically delete data previously lawfully processed by the provider.

Hotjar uses browser identifiers for recognition and session attribution. Recordings are used to examine and improve the website. Their retention period depends on the specific analysis purpose and the retention limits of the service used. If you wish to request access to or deletion of your personal data, you can contact us using the details above.

The provider's affiliates and subcontractors may be involved in processing, including outside the European Economic Area. Information about recipients, international transfers and the contractual safeguards envisaged is available in the provider's information:

Contentsquare privacy information
Data processing terms and safeguards

9. Videos and external links

On our project pages, we show our own video files and link to external video services. Locally hosted videos are delivered by our hosting provider. This generates the connection data described in Section 3.

Some videos, for example on the Frischmarkt Gifhorn project page and our social media page, may be embedded through YouTube. Clicking ‘Play video’ first displays a local data processing notice. The embedded player is loaded only if you then select ‘Load YouTube video’. Selecting ‘Cancel’ closes the notice without loading the player. For users in the European Economic Area, the YouTube service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before playback, we show a locally hosted preview. Starting the embedded player establishes a connection to YouTube; this may involve processing your IP address, browser and device information, the page visited and information about video use. The player uses the youtube-nocookie.com domain. This does not mean that no personal data is processed during playback. If you are logged into Google, Google may associate activities with your account.

Article 6(1)(a) GDPR and Section 25(1) TDDDG apply to embedding that depends on consent. Permission is voluntary and applies only to the selected video on the open page. It is not stored permanently for other videos. Selecting ‘Close video’ removes the player and stops playback. This does not retrieve data already transmitted to Google. Loading the video again requires your express permission again. Permission to play a video does not require consent to Analytics or advertising performance measurement. Alternatively, you can use the links provided to watch the video directly on YouTube. When you open an external link, you leave our website; the relevant provider's privacy information then applies. Further information about YouTube and Google: https://policies.google.com/privacy?hl=de

10. Recipients and processing outside the European Economic Area

Data is processed for the purposes described above by our responsible employees and the hosting, communication and analytics providers involved. Authorities, courts or advisers bound by professional confidentiality may receive data where this is required by law or necessary to enforce or defend legal claims.

Google and Microsoft services may also involve affiliates and subcontractors outside the European Economic Area, particularly in the USA. A European server region does not necessarily exclude access or other processing from third countries. For transfers of Ads and Analytics data from the European Economic Area to Google LLC and appropriately certified US subsidiaries, Google identifies the EU–US Data Privacy Framework as the transfer basis. For other covered third-country transfers or cases without an applicable framework, Google provides for standard contractual clauses. Microsoft incorporates standard contractual clauses for Exchange Online through its data processing terms. These instruments govern protection obligations for international transfers; they do not mean that data is processed exclusively in Europe. Details and the underlying safeguards are available here:
https://business.safety.google/adsdatatransfers/
https://learn.microsoft.com/en-us/compliance/regulatory/offering-eu-model-clauses
https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA

For information about the safeguards applicable to specific processing or a copy of the relevant protection agreements, please contact us at info@ideastudios.de.

11. Retention and deletion

Permissible retention is assessed according to the purpose of processing, statutory obligations and other lawful grounds for retention. No fixed deletion period has yet been introduced for archived contact enquiries that do not lead to an order; see Section 4. Relevant factors include the status of an enquiry, existing contractual relationships, statutory retention obligations and the need to safeguard legal claims. Longer retention for a specific purpose does not mean that data may continue to be used for advertising or other original purposes.

Specific Analytics settings are described in Section 6. Cookies can be deleted through the browser independently of server-side retention periods. Withdrawing consent ends processing based on that consent with effect for the future; existing statutory retention obligations remain unaffected.

12. Your rights

Subject to the statutory conditions, you have the right to access your personal data, have inaccurate data corrected, request erasure, restrict processing and obtain data portability. For data processed by automated means on the basis of your consent or a contract, you may request that it be provided in a commonly used, machine-readable format and, where technically feasible, transmitted directly to another controller.

You can withdraw consent at any time with effect for the future. To do so, contact info@ideastudios.de or use the privacy settings for website services. Processing carried out before withdrawal remains lawful.

Objection: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will stop the processing concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the processing to establish, exercise or defend legal claims. You may object to processing for direct marketing purposes at any time without giving particular reasons. This also applies to related profiling; your data will then no longer be processed for that direct marketing.

You may also lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, workplace or the suspected infringement. In our case, the data protection supervisory authority of Lower Saxony is particularly relevant: https://www.lfd.niedersachsen.de/

If you have questions about this policy or wish to exercise your rights, you can reach us using the contact details in Section 1.