Privacy policy

1. Controller

The controller responsible for data processing on this website is: Company name or full name Street and number Postcode and city Email: hello@notales.studio

2. At a glance

This website works without tracking. Fonts are served from our own server, so visiting a page makes no connection to Google Fonts or other third parties.

Optional services — embedded YouTube videos and, if enabled, Google Analytics — only load after you allow them in our cookie settings. You can change your choice at any time via “Cookie settings” in the footer.

3. Hosting and server log files

This website is hosted by hosting provider, server location. When you visit the site, the web server automatically processes technical data: IP address, date and time of the request, requested page, referrer URL, and browser and operating system (user agent).

We process this data to deliver the website and to keep it secure and stable. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after 14 days. If applicable: we have concluded a data processing agreement with the hosting provider.

4. Cookie settings (Klaro)

We use the open-source consent manager Klaro, which is delivered from our own server. It stores your decision in the cookie “notales_consent” in your browser for 12 months. No data is sent to the developers of Klaro or to any other third party.

Storing this cookie is strictly necessary to respect your choice (§ 25 (2) no. 2 TDDDG). The legal basis for documenting your consent is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. You can change or withdraw your consent at any time with effect for the future via “Cookie settings” in the footer of every page.

5. YouTube videos

We embed videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Videos use the privacy-enhanced mode (youtube-nocookie.com) and only load after you allow YouTube in the cookie settings or start a single video. Only then does your browser connect to YouTube and transmit data such as your IP address, device information and the page you are visiting; YouTube may store cookies or similar identifiers on your device.

Data may be transferred to Google LLC in the USA, which is certified under the EU–US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25 (1) TDDDG, which you can withdraw at any time. More information: https://policies.google.com/privacy

6. Google Analytics

Only if VITE_GA_MEASUREMENT_ID is set — otherwise delete this section. With your consent we use Google Analytics 4 by Google Ireland Limited (address above) to understand how visitors use the website. Google Analytics sets cookies (e.g. “_ga”) and processes usage data such as pages viewed, device type and approximate location; IP addresses are not stored in Google Analytics 4.

Data may be transferred to Google LLC in the USA (EU–US Data Privacy Framework). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25 (1) TDDDG. Data is deleted after 14 months. You can withdraw your consent at any time via the cookie settings.

7. Contacting us

If you contact us by email or via the contact form, we process the details you provide (name, email address, topic and message) to answer your request. The legal basis is Art. 6(1)(b) GDPR for requests related to a contract and Art. 6(1)(f) GDPR for all other requests. We delete the data once your request has been handled, unless statutory retention obligations apply.

The contact form opens your own email program; the message is then sent through your email provider to ours (email provider). If the form is sent through a service such as Formspree instead: name the provider, its location, any transfer to third countries and the legal basis here.

8. Applications

If you apply for a job, we process your application documents to carry out the application process. The legal basis is Art. 6(1)(b) GDPR. If we do not hire you, your documents are deleted six months after the decision, unless you have agreed to a longer retention.

9. Links to social networks

We link to our profiles on Discord, YouTube, X and TikTok. These are plain links: no content from these services is embedded, and no data is sent to them until you click a link. After that, the privacy policy of the respective provider applies.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)) — for services on this website via “Cookie settings” in the footer.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the competent state data protection authority.

11. Changes

We update this policy when the website or the legal situation changes. The current version is always available on this page.