Privacy Policy
1. Controller
The controller responsible for processing personal data on this website is:
Hannes Thoms und Milena Hamel GbR (VORMA)
Rothestraße 42
22765 Hamburg
Germany
Email: hello@studio-vorma.com
Phone: +49 152 52654427
2. Providing this website
Our website presents our design studio and our products. We do not offer a newsletter subscription or a contact form.
When you access this website, technically necessary connection data is processed. This includes your IP address, which is required to deliver the website’s content to your browser.
Where processing is necessary to deliver and secure the website, it is based on Article 6(1)(f) of the General Data Protection Regulation (GDPR). Our legitimate interest is to provide a reliable and secure website. The website cannot be accessed without the technically necessary processing.
3. Hosting and subprocessors
Our website is hosted through ChatGPT Sites, a service provided by OpenAI. For customers located in the European Economic Area, the contracting entity is OpenAI Ireland Ltd.
Where OpenAI processes website visitors’ personal data on our behalf, the ChatGPT Sites Data Processing Addendum applies. It identifies possible categories of data, including log data, usage data and device information.
OpenAI may engage additional service providers. Its published subprocessor list includes Cloudflare, Ltd. for content delivery and web hosting and expressly covers ChatGPT Sites operated through Plus and Pro accounts.
Further information:
ChatGPT Sites Data Processing Addendum:
https://openai.com/policies/chatgpt-sites-data-processing-addendum/
OpenAI subprocessor list:
https://openai.com/policies/sub-processor-list/
4. Automatic visitor statistics provided by ChatGPT Sites
According to the official product documentation, ChatGPT Sites automatically records traffic statistics without requiring us to add an analytics tool. The platform provides figures for unique visitors and page views, including changes over time.
This platform-provided functionality is separate from features that we have added ourselves. We do not use any additional analytics or marketing tools.
The precise method used to identify unique visitors, the individual data processed for this purpose, the applicable retention periods and the legal basis for this specific processing have not yet been conclusively established.
Information about the analytics feature:
https://learn.chatgpt.com/docs/sites#review-site-analytics
5. Cookies and similar technologies
We have not added cookies, advertising pixels or comparable tracking features to the website ourselves. This does not necessarily mean that the hosting infrastructure uses no cookies or other storage technologies.
Hosting and security providers may use their own technical storage mechanisms. For example, Cloudflare documents the “__cf_bm” cookie for certain services that protect websites against automated traffic. According to Cloudflare, this cookie expires after 30 minutes of continuous inactivity. Whether this cookie is actually used when visiting our website has not yet been technically verified.
This cookie lifetime does not indicate how long server-side logs or analytics data are retained.
Further information about Cloudflare cookies:
https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/
6. International data processing
ChatGPT Sites does not guarantee that processing is restricted to the European Economic Area.
For relevant transfers by OpenAI Ireland Ltd. to affiliates or service providers outside the European Economic Area or Switzerland, the Sites Data Processing Addendum provides for EU Standard Contractual Clauses or an adequacy decision adopted by the European Commission.
OpenAI’s subprocessor list expressly identifies Standard Contractual Clauses as the transfer mechanism used between affiliated OpenAI entities. For Cloudflare, it describes processing at the data centre closest to the visitor.
You may contact us using the details above to request information about the safeguards applicable to a particular transfer and how to obtain a copy of them.
7. Retention of technical hosting data
The Sites Data Processing Addendum contains general provisions on the duration of processing and the return or deletion of data after the agreement ends.
We have not yet received confirmation of a specific retention period or sufficiently detailed deletion criteria for technical access logs and the data underlying the platform’s visitor statistics. The general contractual provisions do not establish a fixed retention period for individual website visits.
8. Contacting us by email or phone
If you contact us, we process the information you provide, such as your name, email address or phone number and the contents of your enquiry.
We use this information to handle and respond to your enquiry. Where your enquiry concerns a contract with you or steps taken at your request before entering into a contract, the legal basis is Article 6(1)(b) GDPR. For other enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to handle incoming enquiries.
We use INWX GmbH, Prinzessinnenstraße 30, 10969 Berlin, Germany, to host our email accounts. The provider processes messages and the data required to transmit and store them.
Providing your information is voluntary and is generally not required by law. Without the information necessary to handle your enquiry, we may be unable to respond. For contractual enquiries, certain information may be necessary to enter into or perform a contract.
9. Retention of enquiries
We delete the data relating to your enquiry once it has been resolved and further retention is no longer necessary.
Where statutory retention obligations apply, we retain the relevant records until the applicable period expires, based on Article 6(1)(c) GDPR.
Where data is necessary to establish, exercise or defend legal claims, we may retain it until the applicable limitation period expires or ongoing proceedings have concluded. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to protect our legal position.
These provisions concern our handling and retention of enquiries.
10. External links
Our website contains links to external services, such as our Instagram profile. Following one of these links takes you away from our website. The relevant provider’s privacy information applies to processing on the website you visit.
11. Your rights
Subject to the applicable legal requirements, you have the right to:
- access your personal data under Article 15 GDPR;
- have inaccurate personal data rectified under Article 16 GDPR;
- have your personal data erased under Article 17 GDPR;
- restrict processing under Article 18 GDPR;
- data portability under Article 20 GDPR.
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Right to object under Article 21 GDPR
Where we process personal data based on Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.
We will then stop processing the personal data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.
To exercise your rights, please contact us at hello@studio-vorma.com.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place where the alleged infringement occurred.
The supervisory authority responsible for our establishment in Hamburg is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit):
https://datenschutz-hamburg.de/
Last updated: October 2026