Privacy policy

1. Controller

Varde Studio, Owner: Maher Kassem Naser

Hagenbeckstraße 31
22527 Hamburg
Germany

2. Overview

This website does not use analytics or tracking services, advertising cookies or embedded third-party content such as external fonts, maps or videos. All files are delivered from my own server. I process personal data only as described below.

3. Hosting and server logs

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur (Rechenzentrum in Spanien, EU). When you visit it, the hosting provider processes technically necessary connection data, for example IP address, time of access, requested URL, amount of data transferred, and browser and operating system information, and stores it in server logs. This serves the secure and stable operation of the website and is based on Art. 6(1)(f) GDPR (legitimate interest). Retention depends on the provider’s configuration. A data processing agreement under Art. 28 GDPR is in place with the provider.

4. Contact by email or phone

If you contact me by email or phone, I process your details to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where a project or contract is concerned, otherwise Art. 6(1)(f) GDPR (answering enquiries).

5. Contact form

The contact form collects your name, email address, project type, message and an optional budget range. Providing them is voluntary, but I cannot handle your enquiry without them. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request) or Art. 6(1)(f) GDPR.

To prevent abuse, the form uses a hidden field, a timing check and a short-term limit on requests per IP address. For this purpose the IP address is kept in the server’s memory for about ten minutes only and is not stored permanently.

The message is delivered to me through the email service Resend (Resend, USA). Resend processes the message content, sender details and delivery logs on my behalf; according to the provider, this data is stored in the United States and retained for up to 30 days depending on the plan. The transfer to the United States relies on the EU Standard Contractual Clauses in Resend’s data processing agreement; the provider also states that it participates in the EU-U.S. Data Privacy Framework. A data processing agreement under Art. 28 GDPR is in place with Resend.

I delete your enquiry once it is resolved and no statutory retention duty applies, at the latest six months after the correspondence ends. If a contract is concluded, I keep contract-related documents for the statutory periods.

6. Display preference (cookie)

If you switch between light and dark appearance using the button, I store your choice in the cookie “varde-theme” (value “light” or “dark”) for up to one year so the site looks the way you set it on your next visit. Without your choice this cookie is not set. It contains no personal data and is not used for tracking. The legal basis is Section 25(2) no. 2 TDDDG (a function you expressly requested) and Art. 6(1)(f) GDPR. You can delete the cookie in your browser at any time. The language of the site is determined by the address (/de or /en) and is not stored.

7. Your rights

Under the statutory conditions you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You can withdraw any consent at any time with effect for the future. Simply write to the email address above.

8. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority responsible for me is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Str. 22, 7. OG, 20459 Hamburg, www.datenschutz-hamburg.de.

Last updated: October 2026