Privacy Policy

1. Controller

The controller under the GDPR is Cătălina Kothe. No data protection officer has been appointed.

2. Hosting

This website is hosted by Hostinger. When it is accessed, the hosting provider processes IP address, date and time, requested resource, data volume, referrer, browser and system information as needed to deliver, stabilise and secure the website. The legal basis is Article 6(1)(f) GDPR. Server logs are retained only as long as necessary for operation, fault analysis and abuse prevention, unless a specific incident or legal duty requires longer retention.

3. Contact form and email

The form processes your name, email address, selected topic, message and language. Organisation and telephone number are optional. The data is transmitted to the mailbox configured for kontakt@fairyfable.de and is not stored in a website database.

Service-related enquiries are processed under Article 6(1)(b) GDPR. General, press, network and cooperation enquiries are processed under Article 6(1)(f) GDPR. The required checkbox records acknowledgement of this policy; it is not additional consent to another use.

Please do not send health data, identity documents or other particularly sensitive information through the form.

For spam and duplicate protection, the form uses a honeypot, a timing check, a one-time submission identifier and a server-side rate limit. A pseudonymous identifier derived from the IP address and timestamps are valid for 15 minutes; a hashed submission identifier is valid for 60 minutes. Expired markers are deleted on subsequent form requests. Message content is not stored there. The legal basis is Article 6(1)(f) GDPR.

Enquiries are deleted once conclusively handled and no further contact is expected. If a contract arises, statutory commercial and tax retention periods also apply.

4. External services

5. Social media and Google Business Profile

This website does not embed plugins such as Instagram feeds or Google Maps. Links to LinkedIn, Instagram or the Google Business Profile direct you to the respective platforms. The platform providers are responsible for data processing there.

6. Local storage, Google Analytics 4 and Web Vitals

The privacy choice is stored locally in the browser and contains only the selected categories, decision time, expiry date and version. It expires after no more than twelve months. Fonts are delivered locally.

Google Analytics 4 and technical Web Vitals metrics load only after active consent to Analytics. Page views, session and device information, approximate location and metrics such as LCP, CLS and INP may be processed. Form entries and message content are not sent as analytics events. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may also process data in the United States and refers, among other safeguards, to the EU-US Data Privacy Framework.

Necessary choice storage is based on Section 25(2)(2) TDDDG. Analytics and external media require consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. Consent can be withdrawn at any time through Privacy settings in the footer.

7. AI support in commissioned projects

Contact-form data is not automatically transferred to AI services. If AI-assisted tools are proposed later for a commissioned project, purpose, data scope, provider and safeguards are clarified before processing. Particularly sensitive data is not processed without a separate suitable legal basis and protection review.

8. Your rights

Where the statutory conditions are met, you have rights to information, access, rectification, erasure, restriction of processing, data portability and objection. Consent may be withdrawn at any time with future effect. To exercise your rights, contact kontakt@fairyfable.de.

9. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular: The Hessian Commissioner for Data Protection and Freedom of Information, PO Box 3163, 65021 Wiesbaden; office: Wilhelmstraße 7, 65185 Wiesbaden.

10. Amendments

This Privacy Policy is updated when technical or legal changes occur.

Last updated: July 2026.