Privacy
policy.

This Privacy Policy explains how Elbe am Rhein Werbeagentur GmbH processes personal data when you use this website. Personal data is any information relating to an identified or identifiable natural person.

1. Controller

Elbe am Rhein Werbeagentur GmbH
Habsburgerallee 16
60385 Frankfurt am Main
Germany
Phone: +49 69 348 691 010
Email: hello@elbeamrhein.de

2. Contact for privacy matters

Contact: Oliver Fermer
Email: datenschutz@elbeamrhein.de
Phone: +49 69 348 691 011

This contact is provided for privacy enquiries. It is not a statement that a formally appointed data protection officer has been designated.

3. Hosting and technical access data (Vercel)

This website is hosted using services provided by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. When you access the website, Vercel processes technical data required to deliver and secure the website. This may include your IP address, the date and time of the request, the requested URL, the referring URL, browser and device information, request status, data volume and technical log information.

The processing is necessary to provide the website, maintain its stability and security, prevent misuse and troubleshoot technical errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of the website and protection against attacks and abuse.

Technical logs are retained for the period provided by the applicable Vercel plan and for as long as necessary for security, troubleshooting and abuse prevention. Data under our control is deleted or anonymised when it is no longer required, unless a legal obligation requires longer retention.

Vercel may process data in the United States and other countries. Vercel participates in the EU-U.S. Data Privacy Framework. Where required, transfers are additionally protected by the European Commission's Standard Contractual Clauses. Further information: vercel.com/legal/privacy-notice

4. Media and content delivery (Sanity)

Images and other media on this website are delivered through the content delivery network of Sanity (Sanity AS and Sanity US Inc.). When your browser requests a media file from cdn.sanity.io, Sanity receives technical request data, in particular your IP address, the requested file, the date and time of the request, browser information and related log data.

The purpose is the efficient, secure and reliable delivery of website media. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the efficient presentation of our portfolio and other website content. Sanity uses global cloud and content delivery infrastructure, which may involve processing in the European Economic Area, the United States and other countries. Transfers outside the EEA are protected by appropriate safeguards, including Standard Contractual Clauses where required. Further information: sanity.io/legal/privacy

5. Cookies, local storage and analytics

We do not use analytics or advertising tools, marketing pixels, social media plugins or cross-site tracking on this website. In its current configuration, the website does not set cookies that require consent and does not use browser local storage for analytics or marketing purposes. Therefore, no cookie consent banner is currently displayed.

If we introduce consent-requiring technologies in the future, we will obtain consent before using them and update this Privacy Policy. The relevant legal bases would be section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 6(1)(a) GDPR.

6. External links and map link

The website does not automatically load interactive maps, social media feeds or video players from third-party providers. The contact page displays a locally provided image of the studio location. External services such as Google Maps, Instagram or LinkedIn are contacted only when you actively follow the respective link. The external provider is then responsible for its own processing of personal data.

7. Contact form and email enquiries

When you use the contact form, we process the information you provide. Depending on your entries, this includes your name, email address, company, selected topics, budget range and project description. Fields marked as required are necessary for us to receive and respond to your enquiry. Without the required information, we cannot process the enquiry.

The legal basis is Article 6(1)(b) GDPR where the enquiry concerns steps prior to entering into a contract or an existing contractual relationship. For other enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is responding to business and general enquiries.

The form message is sent using Resend, a service provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, United States, which acts as an email delivery service provider. We use Resend's Ireland sending region for routing and sending the message. Resend states that account data, email metadata, logs and API records are stored in the United States. Transfers are protected by the European Commission's Standard Contractual Clauses incorporated into Resend's Data Processing Addendum. Further information: resend.com/legal/privacy-policy

Our email hosting and IT service providers may also process the message on our behalf. We retain enquiries for up to twelve months after the communication has ended. If an enquiry results in a contract, or if the communication is relevant to commercial, tax or legal record-keeping obligations, the relevant data may be retained for the applicable statutory period. The same principles apply when you contact us directly by email.

8. Recipients and international transfers

Personal data is disclosed only where necessary. Recipients may include hosting, content delivery, email delivery, email hosting and IT support providers acting on our behalf, as well as professional advisers, courts or public authorities where disclosure is legally required. We do not sell personal data.

Where personal data is transferred to a country outside the European Economic Area, the transfer is based on an adequacy decision under Article 45 GDPR where available, or on appropriate safeguards under Article 46 GDPR, in particular the European Commission's Standard Contractual Clauses. Information about the applicable safeguards can be requested using the contact details above.

9. Your rights

Subject to the legal requirements, you have the right to access your personal data (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and objection (Article 21 GDPR). Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

Where processing is based on Article 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. To exercise your rights, contact us using the details above.

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for our registered office is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany
Website: datenschutz.hessen.de

11. Automated decision-making

We do not use automated decision-making within the meaning of Article 22 GDPR and do not create profiles of website visitors.

12. Changes to this Privacy Policy

We may update this Privacy Policy if our website, service providers or legal requirements change. The date shown at the beginning identifies the current version.