Privacy Policy
1.1 Controller & Contact
The data controller for this website is ContentBloomStudio, registered at Moskauer Straße 3, Ludwigshafen am Rhein, Germany. Privacy questions, data access requests, and complaints may be sent to [email protected]. We do not maintain a statutory Data Protection Officer; the controller answers all supervisory correspondence directly.
1.2 Categories of data we process
When you contact the studio or commission services, we process: identity and contact data (name, business email, phone number, company), project correspondence (briefs, files, feedback), contractual and billing data (invoices, payment status via our payment provider), and technical logs (IP address, user agent, timestamp, pages requested) required to operate the site securely.
1.3 Purposes & legal bases (GDPR Art. 6)
We process personal data for: (a) performance of a contract or pre-contractual steps at your request — project delivery, quoting, invoicing; (b) legitimate interests — securing the website, preventing abuse, improving our service quality, and direct B2B communication about an existing inquiry; (c) consent — optional analytics cookies, which you may decline without losing site functionality; (d) legal obligations — bookkeeping and tax retention under German law.
1.4 Recipients & processors
Personal data is shared only with vetted processors acting on our instructions: our hosting and email providers, our payment provider for transaction processing, and professional advisors where legally required. Processors are bound by data processing agreements. We do not sell personal information and do not share it for cross-context behavioural advertising.
1.5 International transfers
Primary storage is within the European Economic Area. Where a provider processes data outside the EEA (for example, a cloud service in the United States), transfers rely on European Commission Standard Contractual Clauses or an applicable adequacy decision, supplemented by technical and organisational safeguards.
1.6 Retention
Inquiry data that does not become a contract is deleted within 12 months of the last meaningful contact. Contract, invoice, and accounting records are retained for the statutory periods (generally 6–10 years). Server logs are rotated within 30 days unless a security incident requires longer preservation.
1.7 Your rights
Under the GDPR you may request access, rectification, erasure, restriction, data portability, and objection to processing based on legitimate interests, and you may withdraw consent at any time without affecting prior lawfulness. Under the CCPA, California residents may request to know, delete, and correct personal information, and may opt out of any “sale” or “sharing” of personal information — we affirm that ContentBloomStudio does not sell or share personal information as those terms are defined. We respond within one month and never discriminate against you for exercising a right. You may also lodge a complaint with your supervisory authority; ours is the competent German authority for Rhineland-Palatinate.
1.8 Security
Communication with this site is encrypted via TLS. Access to project data is limited to the studio team on a need-to-know basis, protected by multi-factor authentication and device encryption. Suspected personal data breaches are assessed without undue delay and notified to authorities within 72 hours where the GDPR requires it.