1. Controller
The controller responsible for data processing on this website is:
Thorsten Zobel
Kleiststr. 37
60318 Frankfurt am Main
Germany
Email: info@thorstenzobel.com
2. Overview
I only process personal data where it is necessary to run this website and to answer enquiries. This policy explains which data is processed and why.
3. Hosting and server log files
The website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit the site, the server automatically records data your browser transmits: IP address, date and time, requested page, referrer URL, and browser and operating system information. This is technically necessary to deliver the site and keep it secure.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable and secure operation). The hosting provider deletes the log files automatically after a limited period. Backups of the website are also stored on STRATO servers. A data processing agreement under Art. 28 GDPR is in place with STRATO.
4. Cookies
This website does not set any cookies. For that reason there is no cookie banner.
5. Analytics with Independent Analytics
I use the WordPress plugin Independent Analytics to see which pages are viewed. The plugin runs on my own server and does not set cookies. IP addresses are not stored. To count repeat views, a hash is created from the IP address and browser data, using a random value that changes weekly. This means visitors cannot be recognised beyond a week.
The data recorded includes pages viewed, referrer, browser, operating system, device type and an approximate region of origin. It is deleted automatically after 12 months and is not passed on to third parties.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving the website).
6. Contact form and email
If you write to me via the contact form, I process your first name, last name, email address, subject and message to answer your enquiry, for example about prints or licensing. The form sends the message directly to me by email. The data is not stored in the website database.
The legal basis is Art. 6(1)(b) GDPR where the enquiry aims at a contract, otherwise Art. 6(1)(f) GDPR. I delete your data once the enquiry is settled and no statutory retention duties apply. If a contract is concluded, commercial and tax retention periods apply. The same applies if you email me directly.
7. Spam protection with Cloudflare Turnstile
The contact form is protected against automated abuse by Cloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. The script is only loaded on the contact page. Among other things, your IP address and information about your browser and device are transmitted to Cloudflare to verify that the input comes from a human. No cookies are set in the process.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protection against spam and abuse). Cloudflare is certified under the EU-US Data Privacy Framework. More information is available in Cloudflare’s privacy policy: cloudflare.com/privacypolicy.
8. Fonts
The fonts used are stored on the website’s own server. No connection to Google or other font providers is made.
9. Links to other platforms
The footer links to my profiles on foto, Mastodon and Cara. No content from these platforms is embedded. Data is only transmitted to the respective platform once you click a link. The privacy policies of those providers apply to their processing.
10. Encryption
This website uses TLS encryption (recognisable by “https” in the address bar).
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object at any time to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). You may withdraw any consent at any time. Simply write to info@thorstenzobel.com.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
12. Changes
I update this policy when the website or the legal situation changes. Last updated: October 2026.