The Pirate Studio

Privacy Policy
As of: August 1, 2025

​​

Table of Contents

• Controller

• Overview of Processing Activities

• Relevant Legal Bases

• Security Measures

• Disclosure of Personal Data

• International Data Transfers

• Rights of Data Subjects

• Use of Cookies

• Business Services

• Provision of the Online Offer and Web Hosting

• Web Analysis, Monitoring, and Optimization

• Online Marketing

• Social Media Presence

• Plugins and Embedded Features and Content

​

​

Controller
Tariq Khan

Email Address:

ahoi@thepiratestudio.de

​

Relevant Legal Bases
Relevant legal bases under the General Data Protection Regulation (GDPR): Below is an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our home or place of residence. If, in specific cases, more specific legal bases are relevant, we will inform you of these in the data protection declaration.

Consent (Art. 6(1) lit. a) GDPR) - The data subject has given consent to the processing of their personal data for a specific purpose or multiple specific purposes.

Performance of a Contract and Pre-contractual Inquiries (Art. 6(1) lit. b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract.

Legal Obligation (Art. 6(1) lit. c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.

Legitimate Interests (Art. 6(1) lit. f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National Data Protection Regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. This includes, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG). In the BDSG, you will find, among other things, special provisions on the right to access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and transmission, as well as automated decision-making in individual cases, including profiling. Furthermore, the data protection regulations of the individual federal states may apply.

Reference to GDPR and Swiss Data Protection Law (DSG): These privacy policies serve as information in accordance with the Swiss Federal Act on Data Protection (Schweizerisches Datenschutzgesetz - DSG) and the General Data Protection Regulation (GDPR). Therefore, please note that, due to broader geographical application and understandability, the terms used in the GDPR are used. In particular, the terms "processing" of "personal data," "legitimate interest," and "special categories of data" are used instead of the terms "processing" of "personal data," "overriding interest," and "particularly sensitive personal data" used in the Swiss DSG. However, the legal meaning of the terms is determined in accordance with Swiss DSG within the scope of its application.

​

Overview of Processing Activities
The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

​

Types of Data Processed
Inventory data.
Payment data.
Contact details.
Content data.
Contract data.
Usage data.
Meta-communication and process data.

Categories of Data Subjects
Prospective customers.
Users.
Business and contractual partners.

Purposes of Processing
Provision of contractual services and customer support.
Contact inquiries and communication.
Security measures.
Reach measurement.
Tracking.
Office and organizational procedures.
Management and response to inquiries.
Feedback.
Marketing.
Profiles with user-related information.
Provision of our online offer and user-friendliness.
Information technology infrastructure.

​

Security Measures
In accordance with legal requirements, taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to data, as well as access, input, disclosure, availability, and separation of data. We have also established procedures to ensure the exercise of data subject rights, deletion of data, and responses to data risks. Furthermore, we consider the protection of personal data from the outset in the development or selection of hardware, software, and procedures in accordance with the principles of data protection, by design and by default.

​

Transmission of Personal Data
In the course of our processing of personal data, it may be necessary to transfer the data to other entities, companies, legally independent organizational units, or individuals or disclose it to them. Recipients of this data may include service providers responsible for IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements with data recipients to protect your data.

International Data Transfers
Data Processing in Third Countries: If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if the processing occurs as part of the use of third-party services or the disclosure or transfer of data to other individuals, entities, or companies, this will only take place in accordance with legal requirements.

Subject to explicit consent or contractual or legally required data transmission (see Art. 49 GDPR), we process or allow data to be processed only in third countries with a recognized level of data protection (Art. 45 GDPR), or if the processing complies with contractual obligations through the use of EU Commission-approved standard data protection clauses (Art. 46 GDPR) or the presence of certifications or binding corporate rules (Art. 44 to 49 GDPR, EU Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en).

EU-US Trans-Atlantic Data Privacy Framework: As part of the so-called "Data Privacy Framework" (DPF), the EU Commission has also recognized the data protection level as safe for certain companies in the USA through an adequacy decision dated July 10, 2023. The list of certified companies, as well as further information on the DPF, can be found on the website of the U.S. Department of Commerce at https://www.dataprivacyframework.gov/. We will inform you in the context of the privacy notices which service providers used by us are certified under the Data Privacy Framework.

​

Rights of Data Subjects
Rights of data subjects under the GDPR: As data subjects, you have various rights under the GDPR, particularly stemming from Articles 15 to 21 of the GDPR:

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Right to withdraw consent: You have the right to withdraw your consent at any time.

Right of access: You have the right to obtain from us confirmation as to whether or not personal data concerning you is being processed, as well as information about such processing, and a copy of the data in accordance with legal requirements.

Right to rectification: You have the right to obtain the rectification of inaccurate personal data concerning you, and to have incomplete data completed in accordance with legal requirements.

Right to erasure and restriction of processing: You have the right to obtain the erasure of personal data concerning you without undue delay, or alternatively, to demand the restriction of processing of the data in accordance with legal requirements.

Right to data portability: You have the right to receive the personal data concerning you that you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another controller according to legal requirements.

Right to lodge a complaint with a supervisory authority: You have the right to file a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you believe that the processing of personal data relating to you violates the GDPR.

Use of Cookies
Cookies are small text files or other storage technologies that store information on your devices and retrieve information from them. They are used to store login status in a user account, shopping cart contents in an e-shop, viewed content, or the functions used in an online offering. Cookies serve various purposes, such as ensuring the functionality, security, and convenience of online offerings, as well as providing analyses of visitor traffic.

Consent Notice: We use cookies in accordance with legal regulations. Therefore, we obtain prior consent from users, unless it is legally not required. Consent is not required, in particular, if the storage and retrieval of information, including cookies, is absolutely necessary to provide users with an online service (our online offering) that they have expressly requested. Usually, cookies that are strictly necessary include cookies with functions that serve the display and functionality of the online offering, load balancing, security, storage of user preferences, and choices, or similar purposes related to providing the main and secondary functions of the online offering requested by users. The revocable consent is clearly communicated to users and contains information about the specific use of cookies.

Legal Basis for Data Processing: The legal basis for processing user data using cookies depends on whether we ask users for consent. If users give their consent, the legal basis for processing their data is the declared consent. Otherwise, the data processed using cookies are based on our legitimate interests (e.g., in the efficient operation of our online offering and improving its usability) or, if the use of cookies is necessary to fulfill our contractual obligations, to fulfill those obligations. We will clarify the purposes for which we process cookies as part of this Privacy Policy or in our consent and processing procedures.

Storage Duration: Concerning storage duration, the following types of cookies are distinguished:

Temporary Cookies (Session Cookies): Temporary cookies are deleted when a user leaves an online offering and closes their device (e.g., browser or mobile application).

Persistent Cookies: Persistent cookies remain stored even after the user has closed their device. For example, they can store the login status or display preferred content immediately when a user revisits a website. Data collected using cookies may also be used for measuring reach. If we do not provide explicit information about the type and duration of cookies (e.g., as part of obtaining consent), users should assume that cookies are persistent and can have a duration of up to two years.

General Information about Revocation and Objection (Opt-Out): Users can revoke their consent and object to the processing of data according to legal requirements. To do so, users can restrict the use of cookies in their browser settings (although this may limit the functionality of our online offering). An objection to the use of cookies for online marketing purposes can also be declared through the following websites: https://optout.aboutads.info and https://www.youronlinechoices.com/.

Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR). Consent (Art. 6(1)(a) GDPR).

More Information about Processing Procedures, Procedures, and Services:

Processing of Cookie Data Based on Consent: We use a cookie consent management process to obtain and manage user consents for the use of cookies or the data processing and service providers specified within the cookie consent management process. In this process, user consents to the use of cookies are obtained, managed, and withdrawn, and the process stores consent declarations so they do not need to be repeated, in compliance with legal obligations and can be demonstrated. Storage can be server-side and/or through the use of cookies (known as an opt-in cookie or similar technologies) to associate consent with a user or their device. Unless specified by the individual cookie management service providers, the following information applies: The duration of consent storage can be up to two years. A pseudonymous user identifier is created and stored alongside the consent time, information about the scope of consent (e.g., which cookie categories and/or service providers), as well as the browser, system, and device used. Legal Basis: Consent (Art. 6(1)(a) GDPR).

​

Business Services
We process data of our contractual and business partners, such as customers and prospects (collectively referred to as "contractual partners"), in the context of contractual and similar legal relationships and associated measures and in communication with contractual partners (or pre-contractually), e.g., to respond to inquiries.

We process this data to fulfill our contractual obligations. This includes, in particular, obligations to provide the agreed-upon services, update obligations, and remedy warranty and other performance issues. Additionally, we process the data to protect our rights and for the purpose of administrative tasks associated with these obligations and for our organizational management. Furthermore, we process the data on the basis of our legitimate interests in proper and efficient business management and in security measures to protect our contractual partners and our business operations from misuse, data, secrets, information, and rights, such as participation of telecommunications, transportation, and other auxiliary services, subcontractors, banks, tax and legal advisors, payment service providers, or financial authorities. Under applicable law, we only pass on data of contractual partners to third parties to the extent required for the aforementioned purposes or to fulfill legal obligations. Contractual partners will be informed in this privacy policy or during data collection, e.g., in online forms, by means of special labeling (e.g., colors) or symbols (e.g., asterisks), or personally.

We delete the data after the expiration of statutory warranty and comparable obligations, i.e., generally after 4 years, unless data must be stored in customer accounts due to legal archiving obligations, e.g., for tax reasons. The statutory retention period for tax-relevant documents, such as commercial books, inventories, opening balances, annual financial statements, and the corresponding management reports, is ten years, while the retention period for business letters and outgoing copies of business letters is six years. The retention period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance, the annual financial statement, or the management report, the business or commercial letter was received or sent, or the record was made, and the other documents were created.

To the extent that we use third-party providers or platforms to provide our services, the terms and privacy policies of the respective third-party providers or platforms apply in the relationship between users and the providers.

Processed Data Types: Inventory data (e.g., names, addresses); Payment data (e.g., bank details, invoices, payment history); Contact data (e.g., email, phone numbers); Contract data (e.g., subject matter of the contract, duration, customer category).

Data Subjects: Prospects; Business and contractual partners.

Purposes of Processing: Provision of contractual services and fulfillment of contractual obligations; Handling of contact inquiries and communication; Office and organizational procedures; Management and response to inquiries.

Legal Bases: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legal obligation (Art. 6(1)(c) GDPR); Legitimate interests (Art. 6(1)(f) GDPR).

​

Provision of the Online Offer and Web Hosting
We process user data to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the contents and functions of our online services to the user's browser or device.

Processed Data Types: Usage data (e.g., visited web pages, interest in content, access times); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).

Data Subjects: Users (e.g., website visitors, users of online services).

Purposes of Processing: Provision of our online offer and user-friendliness; Information technology infrastructure (operation and provision of information systems and technical devices, such as computers, servers, etc.); Security measures.

Legal Bases: Legitimate interests (Art. 6(1)(f) GDPR).

Additional Information about Processing: Collection of access data and log files: Access to our online offering is logged in the form of server log files. Server log files may include the address and name of the web pages and files accessed, date and time of access, data volumes transferred, message about successful access, type and version of the browser, the user's operating system, referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. Server log files can be used for security purposes, such as preventing server overloads (especially in the case of abusive attacks, so-called DDoS attacks), and for ensuring the server's load and stability. Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). Data deletion: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data the further storage of which is required for evidence purposes is exempt from deletion until the respective incident is finally clarified.

​

Web Analysis, Monitoring, and Optimization
Web analysis (also referred to as "reach measurement") is used to evaluate visitor flows to our online offering and can include behavior, interests, or demographic information about visitors, such as age or gender, as pseudonymous values. Through reach analysis, we can determine, for example, at what time our online offering or its functions or content are most frequently used or when it is revisited. We can also identify areas that require optimization.

In addition to web analysis, we can also use test procedures, for example, to test and optimize different versions of our online offering or its components.

Unless otherwise stated below, profiles can be created for these purposes, i.e., data summarized for a usage process and information stored in a browser or on a device and read from it. The information collected includes, in particular, the web pages visited and the elements used there, as well as technical information such as the browser used, the computer system used, and information on usage times. If users have consented to the collection of their location data, either to us or to the providers of the services we use, location data can also be processed.

The IP addresses of users are also stored. However, we use an IP masking procedure (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear user data (such as email addresses or names) are stored as part of web analysis, A/B testing, and optimization, but pseudonyms. This means that we, as well as the providers of the software used, do not know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

Processed Data Types: Usage data (e.g., visited web pages, interest in content, access times); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).

Data Subjects: Users (e.g., website visitors, users of online services).

Purposes of Processing: Reach measurement (e.g., access statistics, identification of returning visitors); Profiles with user-related information (creation of user profiles).

Security Measures: IP masking (pseudonymization of the IP address).

​

Online Marketing
We process personal data for the purpose of online marketing, which includes the marketing of advertising space or the presentation of advertising and other content (collectively referred to as "content") based on potential user interests, as well as measuring their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (a so-called "cookie") or similar methods are used to store information relevant to the user for the presentation of the content. This information can include, for example, viewed content, visited web pages, used online networks, as well as communication partners and technical information such as the browser used, the computer system used, and information on usage times and functions used. If users have consented to the collection of their location data, this data can also be processed.

The IP addresses of users are also stored. However, we use IP masking procedures (i.e., pseudonymization by shortening the IP address) to protect users. In general, no clear user data (such as email addresses or names) is stored as part of online marketing processes, but pseudonyms. This means that neither we nor the providers of online marketing processes know the actual identity of users, but only the information stored in their profiles.

The information in the profiles is usually stored in cookies or similar methods. These cookies can also be read and used on other websites that use the same online marketing process, for the purpose of analyzing and displaying content, as well as supplementing them with additional data and storing them on the server of the online marketing process provider.

In exceptional cases, clear user data can be assigned to the profiles. This is the case, for example, if users are members of a social network whose online marketing process we use, and the network links the user profiles with the aforementioned information. Please note that users can enter into additional agreements with the providers, e.g., through consent during registration.

In general, we only receive access to summarized information about the success of our advertisements. However, we can use conversion tracking to determine which of our online marketing processes have led to a so-called conversion, i.e., for example, to a contract with us. Conversion tracking is used solely for the purpose of analyzing the success of our marketing measures.

Unless otherwise stated, please assume that cookies used will be stored for a period of two years.

Processed Data Types: Usage data (e.g., visited web pages, interest in content, access times); Meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).

Data Subjects: Users (e.g., website visitors, users of online services).

Purposes of Processing: Reach measurement (e.g., access statistics, identification of returning visitors); Tracking (e.g., interest/behavior-based profiling, use of cookies); Marketing. Profiles with user-related information (creation of user profiles).

Security Measures: IP masking (pseudonymization of the IP address).

Opt-Out Option: We refer to the privacy policies of the respective providers and the opt-out options provided for by the providers (so-called "opt-out"). If no explicit opt-out option has been specified, it is possible that you disable cookies in your browser settings. However, this may limit the functionality of our online offering. We therefore recommend the following opt-out options, which are offered with a focus on the respective regions: a) Europe: https://www.youronlinechoices.eu. b) Canada: https://www.youradchoices.ca/choices. c) USA: https://www.aboutads.info/choices. d) Cross-regional: https://optout.aboutads.info.

​

Social Media Presence
We maintain online presences within social networks and process user data for the purpose of communicating with active users on these platforms and providing information about us.

We would like to point out that data of users may be processed outside the European Union. This may pose risks for users, as it could make it more difficult to enforce their rights.

Furthermore, user data is usually processed within social networks for market research and advertising purposes. For example, user profiles can be created based on user behavior and resulting interests. These user profiles can be used to display ads within and outside the networks that likely match the users' interests. Typically, cookies are stored on users' computers for these purposes, in which the users' usage behavior and interests are stored. In the user profiles, data can also be stored independently of the devices used by users (especially if users are members of the respective platforms and are logged in).

For a detailed presentation of the respective processing methods and opt-out options, we refer to the privacy policies and information provided by the operators of the respective networks.

In the case of information requests and the assertion of data subject rights, we also point out that these can be most effectively asserted with the providers. Only the providers have access to the data of the users and can directly take appropriate measures and provide information. If you still need assistance, you can contact us.

Processed Data Types: Contact data (e.g., email, phone numbers); content data (e.g., entries in online forms); usage data (e.g., visited web pages, interest in content, access times); meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).

Data Subjects: Users (e.g., website visitors, users of online services).

Purposes of Processing: Contact requests and communication; feedback (e.g., collecting feedback via online forms); marketing.

Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

​

Plugins and Embedded Functions and Content
We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as "third-party providers"). These elements can include, for example, graphics, videos, or maps (collectively referred to as "content").

The integration always requires that the third-party providers of this content process the IP address of the user since they could not send the content to the user's browser without the IP address. The IP address is thus necessary for the presentation of this content or functions. We strive to use only such content whose respective providers use the IP address solely for delivering the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information can also be stored in cookies on the user's device and may contain technical information about the browser and operating system, referring web pages, visit times, as well as other information about the use of our online offering, and may also be linked to such information from other sources.

Processed Data Types: Usage data (e.g., visited web pages, interest in content, access times); meta, communication, and process data (e.g., IP addresses, timestamps, identification numbers, consent status).

Data Subjects: Users (e.g., website visitors, users of online services).

Purposes of Processing: Provision of our online offering and user-friendliness.

Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR).

Additional Information about Processing Procedures, Procedures, and Services:

Google Fonts (Sourced from the Google server): Sourcing of fonts (and symbols) for the purpose of technically secure, maintenance-free, and efficient use of fonts and symbols with regard to up-to-dateness and loading times, their uniform representation, and consideration of possible licensing restrictions. The user's IP address is shared with the provider of the fonts so that the fonts can be made available in the user's browser. Furthermore, technical data (language settings, screen resolution, operating system, hardware used) is transmitted, which is necessary for the provision of the fonts depending on the devices used and the technical environment. This data may be processed on a server of the font provider in the USA. When visiting our online offering, users' browsers send their browser HTTP requests to the Google Fonts Web API (i.e., a software interface for retrieving the fonts). The Google Fonts Web API provides users with the Cascading Style Sheets (CSS) from Google Fonts and then the fonts specified in the CSS. These HTTP requests include (1) the user's IP address used to access the Internet, (2) the requested URL on the Google server, and (3) HTTP headers, including the user agent that describes the browser and operating system versions of website visitors, as well as the referring URL (i.e., the website where the Google font is to be displayed). IP addresses are neither logged nor stored on Google servers, and they are not analyzed. The Google Fonts Web API logs details of the HTTP requests (requested URL, user agent, and referring URL). The requested URL identifies the font families the user wants to load. This data is logged so that Google can determine how often a particular font family is requested. In the Google Fonts Web API, the user agent must adapt the font generated for the respective browser type. The user agent is primarily logged for debugging purposes and used to generate aggregated usage statistics that measure the popularity of font families. These aggregated usage statistics are published on the Google Fonts "Analytics" page. Finally, the referring URL is logged, so that the data can be used for production maintenance and to generate an aggregated report on the top integrations based on the number of font requests. According to Google's own information, it does not use any of the information collected by Google Fonts to create profiles of end-users or to display targeted ads; Service Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal Basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://fonts.google.com/; Privacy Policy: https://policies.google.com/privacy; Basis for Data Transmission to Third Countries: EU-US Data Privacy Framework (DPF). Additional Information: https://developers.google.com/fonts/faq/privacy?hl=en.

​

Created with the free Datenschutz-Generator.de by Dr. Thomas Schwenke.
Translated from german to english language by ChatGPT