Privacy Policy

1. Controller

Astrid M. Obert, Eisolzrieder Straße 12, 80999 Munich, Germany
Email: contact@astridobert.com · Phone: +49 (0) 172 898 4996

2. Hosting (Vercel)

These websites are hosted by Vercel Inc. (San Francisco, USA). When you visit them, technically necessary data (IP address, date and time, page requested, browser type) is processed in server logs to deliver the pages securely (Art. 6 (1) (f) GDPR). A data processing agreement is in place with Vercel; transfers to the USA are based on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

3. Database and storage (Supabase)

Content and order data are stored in a Supabase database (Supabase Inc.). The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) or (f) (legitimate interest in operating the website).

4. Contact form and email

When you contact us, we process the data you provide (name, email, message) to handle your enquiry (Art. 6 (1) (b) GDPR). The data is deleted once it is no longer needed for that purpose and no statutory retention obligations apply.

5. Art shop and payment (Stripe)

Orders in the art shop are processed via Stripe (Stripe Payments Europe, Ltd., Ireland). Payment data (e.g. card details) is collected and processed directly by Stripe; we never receive complete payment data. We process your name, email address, delivery address and order data to perform the contract (Art. 6 (1) (b) GDPR) and to meet retention obligations under commercial and tax law (Art. 6 (1) (c) GDPR). Order confirmations are sent by email. Details: stripe.com/privacy.

6. Newsletter and journey updates

If you tick the box "Send me occasional insights into new work and productions", we process your name and email address to send you a series of up to five emails and occasional notices of new dates. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 7 (2) no. 3 UWG).

The box is not pre-ticked. Requesting the portfolio or sending an enquiry through the contact form does not on its own trigger any promotional emails — that is a separate decision.

You can withdraw your consent at any time with effect for the future: via the unsubscribe link at the end of each of these emails, or informally by email to contact@astridobert.com. After withdrawal no further promotional emails are sent; messages already scheduled are checked again before sending and are not sent.

The time and scope of your consent are recorded so that it can be demonstrated.

7. Prospect and client data

Enquiries via the contact forms, portfolio downloads and journey registrations are stored in our own client database (name, email, phone if given, company, LinkedIn profile and what you are interested in). The purpose is to handle your enquiry and to look after you as a prospective client (Art. 6 (1) (b) and (f) GDPR).

The data is deleted once it is no longer needed for these purposes and no statutory retention obligations stand in the way.

8. Sending emails (Resend)

To send emails — replies to enquiries, the portfolio, and the newsletter mentioned above — we use Resend (Resend, Inc., USA) as a processor. Your email address and the content of the message are processed. A data processing agreement is in place with the provider; transfers to the USA are based on the EU Standard Contractual Clauses.

9. Cookies, tracking and reach measurement

This website sets no marketing or advertising cookies. The only technically necessary cookie is a session cookie for the password-protected admin area; no cookies are set for visitors to the public pages. The art shop cart is stored locally in your browser.

To measure reach we use Vercel Web Analytics (Vercel Inc., USA). The service works without cookies and without cross-device recognition; it records aggregated information such as the page visited, referrer, approximate country-level location and device type. No personal profiles are created. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you give or refuse on your first visit and can change at any time with effect for the future on the Cookie Settings page. Without consent the service is not loaded.

10. External links

Links to Instagram and LinkedIn lead to those platforms; their privacy policies apply only once you click. No social media plug-ins are embedded.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Please contact contact@astridobert.com. You also have the right to lodge a complaint with a data protection supervisory authority; in Bavaria this is the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach.