Privacy Policy

The controller for data processing on this website is:

We are a small studio and are not legally required to appoint a data protection officer (cf. § 38 BDSG). For any data-protection question, reach us directly at kontakt@velvetvizion.eu.

At any time you have the right to:

• access the data we hold about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing (Art. 21 GDPR),
• withdraw a given consent with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data-protection supervisory authority. The competent authority is: [Competent state data-protection authority].

To exercise your rights, an informal message to kontakt@velvetvizion.eu is enough.

We process personal data only on one of the following bases:

• Art. 6(1)(b) — initiating and performing a contract (inquiries, consultation, project work).
• Art. 6(1)(a) — your consent (e.g. statistics cookies, newsletter).
• Art. 6(1)(f) — our legitimate interest in the secure, reliable operation of the website.
• Art. 6(1)(c) — compliance with legal obligations (e.g. commercial and tax retention).

Contact form: name, practice, specialty, city, optionally your current website, your message, and one way to reach you — solely to handle your inquiry.

Email correspondence: the content you send us.

Server logs: when you load the site, our host processes technical data (IP address, time, page requested, browser and device) to operate it securely.

Statistics: only after your consent (see the Cookie Policy).

Newsletter: only via double opt-in; your sign-up is logged as evidence.

This website is operated on Vercel; it is served from a region within the European Union. A data processing agreement (DPA) under Art. 28 GDPR is in place with the provider.

We use as few services as possible. Each named service processes data on our behalf under a DPA:

• Vercel (hosting, EU region) — US parent; transfers based on the EU Standard Contractual Clauses (SCC) / the EU-US Data Privacy Framework.
• Resend (transactional email) — DPA; transfer on the basis of appropriate safeguards.
• Cal.com (EU-hosted) or Calendly (booking) — only when you book a slot; for a US provider, based on SCC/DPF.
• Google Analytics 4 (analytics) — only after your consent; Consent Mode v2, IP anonymisation, Google Signals off; US transfer based on SCC/DPF.
• WhatsApp is off by default and used only if you actively contact us through it.

We use as few cookies as possible. Non-essential cookies (statistics) are set only with your consent under § 25(1) TDDDG; necessary cookies under § 25(2) TDDDG. For details and a full table, see our Cookie Policy.

• Inquiries without a subsequent project: up to 6 months, then deleted.
• Contract data: for the duration of the project and per statutory retention periods.
• Server logs: short-lived and only for secure operation.
• Consent-based data: until you withdraw consent.

The website is served exclusively over an encrypted connection (TLS/HTTPS). We limit access to your data to what is necessary.

Our offering is directed at practices and businesses, not children. We do not knowingly collect data from minors.

We update this statement when our processing or the legal situation changes. The version published here applies (see “Last updated” above).

Questions and requests for access or erasure go to kontakt@velvetvizion.eu. We reply within the statutory time limits.