Privacy policy
Controller
Kursun Studio, owner Yeliz Kursun
Bergäckerstraße 8, 89160 Dornstadt, Deutschland
Email: kontakt@kursunstudio.de
Overview
We process personal data only as far as necessary to run this website and to answer your enquiries. We use no advertising trackers and no third-party analytics services. For simple visitor statistics we count page views ourselves, without cookies (see “Visitor statistics”).
Hosting
This website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you visit, Netlify processes technically necessary data (IP address, date and time, page visited, browser information) in server logs to deliver the website and protect it from attacks (Art. 6(1)(f) GDPR). Netlify is certified under the EU-US Data Privacy Framework; standard contractual clauses are also in place.
The website content (texts and images of the apps) is stored for us by Netlify as a processor in its data store (Art. 28 GDPR).
Contact form
If you write to us via the contact form, we process your name, email address, project type, optional budget range and message to answer your enquiry and, where applicable, prepare an offer (Art. 6(1)(b) GDPR). So that we see enquiries right away, the form content is transmitted encrypted (HTTPS) as a push message via the notification service ntfy.sh to our smartphone; the service keeps the message only briefly for delivery (usually up to 12 hours). The ntfy.sh servers may be located outside the EU. An invisible field keeps automated spam out. To prevent mass abuse of the form, we count submissions per sender for one hour using an encrypted value instead of the IP address.
Visitor statistics
To learn how often our pages are visited, we count page views ourselves on our server (Art. 6(1)(f) GDPR; legitimate interest in improving our offer). We record the page visited, the website you came from (its domain only), the country (derived from the IP address), the device type (computer, tablet, phone) and the date. To avoid counting visitors twice, we derive an encrypted value from the IP address and browser identifier that changes daily and cannot be reversed; the IP address itself is not stored. No cookies are set and nothing is stored on your device; recognising you across days is not possible. If your browser sends “Do Not Track” or “Global Privacy Control”, you are not counted. We keep the aggregated figures for up to 24 months.
Contact by email
If you send us an email, we process your email address and message to handle your request (Art. 6(1)(b) or (f) GDPR).
Our mailbox is operated by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, as a processor (Art. 28 GDPR). Emails are stored in data centres within the EU.
Links to app stores and other websites
Links to the Microsoft Store, App Store, Google Play or the websites of individual apps are plain references. The other site only opens when you click a link; its privacy policy applies there.
Fonts and images
All fonts and images on this website are loaded from our own server. No data is sent to Google Fonts or other font providers.
Cookies and browser storage
We use no cookies or similar techniques for analytics, advertising or profiling, so there is no cookie banner. We only store what is strictly necessary for a service you expressly request (§ 25(2) no. 2 TDDDG):
- Your choice between light and dark mode in your browser's storage until you delete it.
- Admin area (operator only): a session cookie for signing in, up to 30 days.
Protection against abuse
To keep the admin area from being cracked by guessing passwords, we count failed sign-ins per sender. Instead of the IP address we store only an encrypted value that cannot be reversed without our secret key, and delete it after 15 minutes or after a successful sign-in (Art. 6(1)(f) GDPR). For sign-ins and repeated failed attempts we receive a push message with device type, browser, country and time, but no IP address.
Storage periods
- Contact form enquiries and emails: until your request is resolved; business correspondence up to six years (§ 147 AO).
- Hosting server logs: only briefly, as long as needed for operation and security.
Transfers to third countries
Netlify and ntfy.sh may also process data in the USA. For Netlify there is an adequacy decision of the EU Commission (EU-US Data Privacy Framework, Art. 45 GDPR). Beyond that, we do not transfer data to countries outside the EU.
Obligation to provide data
You are not legally or contractually obliged to give us any data. Without name, email address and message, however, we cannot answer an enquiry via the contact form.
SSL/TLS encryption
For security reasons this website uses SSL/TLS encryption. You can recognise an encrypted connection by the lock icon and "https://"; in your browser's address bar.
Automated decisions
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). Just contact us at kontakt@kursunstudio.de.
Right to object
Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), for example for visitor statistics or abuse protection, you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds. For the visitor statistics it is also enough to switch on "Do Not Track" or "Global Privacy Control" in your browser.
Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, https://www.baden-wuerttemberg.datenschutz.de.
Last updated: November 2026