Privacy policy
In short: this website sets no cookies, uses no tracking or analytics, and loads nothing from other servers; even the fonts are hosted by us. We mainly process personal data when you write to us or place an order.
1. Who is responsible
Marcel Molenda, trading as Quay Studio, Am Ziegeleipark 15, 65830 Kriftel, Germany. Email: hello.quaystudio@gmail.com
2. Visiting this website (hosting by Cloudflare)
This website is delivered by Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). With every visit, Cloudflare processes technically necessary data: your IP address, date and time, the page requested, the amount of data transferred and details about your browser and operating system. This is needed to deliver the site and to protect it from abuse and attacks.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and fast website. Cloudflare processes the data on our behalf as a processor (Art. 28 GDPR) under its Data Processing Addendum. Data may be transferred to the United States; Cloudflare is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission. We don't analyse access data ourselves and keep no visitor statistics.
3. No cookies, no tracking
We set no cookies and store nothing on your device. We use no analytics, advertising or social media services and embed no third-party content: no Google Fonts, no videos, no maps.
4. Contacting us by email
When you write to us, we process your email address, your name, your message and any attachments to answer you and, where applicable, to carry out your order. The legal basis is Art. 6(1)(b) GDPR (enquiry and contract), and Art. 6(1)(f) GDPR for general enquiries.
Our mailbox is hosted by Google (Gmail; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google may also process data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework.
5. Orders: AI tools and payment
Most of our work is done by an AI assistant. When you send us material for an order or a free sample, it is therefore processed with an AI service. Currently this is Claude by Anthropic (for the European Economic Area: Anthropic Ireland, Limited, South Bank House, Barrow Street, Dublin 4, Ireland; parent company: Anthropic, PBC, USA). We only pass on what your order needs. The legal basis is Art. 6(1)(b) GDPR. Data may be transferred to the United States; Anthropic bases such transfers on the European Commission's standard contractual clauses. Please don't send us particularly sensitive information, such as health data, that your order doesn't need.
If you pay by PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, processes your payment data as an independent controller. PayPal gives us your name, email address, the amount and the payment status. The legal basis is Art. 6(1)(b) GDPR.
6. Unsubscribing and our do-not-contact list
If you unsubscribe on our unsubscribe page or reply “unsubscribe”, we store your email address with the date and time on a do-not-contact list (hosted by Cloudflare), so that we never contact you again. The legal basis is Art. 6(1)(c) and (f) GDPR in conjunction with Art. 21(3) GDPR. For business contacts we write to, our privacy notice for business contacts also applies.
7. How long we keep data
Enquiries that don't lead to an order are deleted six months after our last contact. Your working files are deleted no later than six months after your order is completed, or earlier if you ask. Invoices and business correspondence are kept as long as German tax and commercial law requires, usually six to ten years. Entries on the do-not-contact list are kept as long as we send sales emails.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An email to hello.quaystudio@gmail.com is enough.
Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing at any time, without giving reasons; we will then stop using your data for that purpose.
You can also lodge a complaint with a data protection authority. Our lead authority is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.
9. Other
We make no automated decisions within the meaning of Art. 22 GDPR. You don't have to give us any data, but without your email address we can't reply to you.