Privacy Policy
Last updated: June 2026
We take the protection of your personal data seriously. This policy explains what data is processed when you visit this website and what rights you have.
1. Controller
Pranarei n.e.V., Schönbrunnerhäuser 756, 94545 Hohenau, Germany, represented by Simon Graf. Contact: simon@simons-lens.art.
2. Hosting
This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When pages are requested, Vercel processes technically necessary access data as our processor. Transfer to the USA is covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
3. Server log files
Each request automatically records technical data (requested address, timestamp, data volume, referrer, browser/device type, shortened IP address). This data serves only secure, stable operation. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
4. Data security
This website is delivered exclusively over an encrypted TLS/HTTPS connection (recognisable by the lock icon and the https:// prefix in your browser's address bar), so data exchanged between your browser and the server cannot be read by third parties.
5. Cookies & local storage
We set no tracking cookies without your consent. As strictly necessary, we only store in your browser's local storage: your cookie choice (cb_consent) and your language preference. This information never leaves your device and is not transmitted to us.
6. Self-hosted analytics (consent-based)
With your explicit consent (cookie banner) we collect anonymised usage statistics: pages visited, dwell time, referrer, browser, device type, country (derived from the shortened IP) and time of access. We do not store the raw User-Agent string.
IP minimisation: to learn your IP, your browser makes one request to ipify.org (which thereby sees your IP). Your IP is then shortened to its first two octets in your browser (e.g. 84.123.0.0) BEFORE anything is sent to us; our analytics endpoint and storage never receive the full IP. The shortened IP is used server-side to determine your country via ipwho.is (over HTTPS), which therefore receives only the shortened IP.
The shortened data is stored in Google Sheets (Google Ireland Limited, Gordon House, Barrow Street, Dublin, Ireland) as processor and deleted automatically after 90 days. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie button at the bottom-left.
7. Contact
If you contact us via the form or by email, we process the data you provide (e.g. name, email, message) to handle your request. Delivery is via the provider Resend (Resend, Inc., USA) as processor. The legal basis is Art. 6(1)(a) and (b) GDPR. The data is deleted once your request is resolved and no statutory retention obligations apply.
8. Embedded videos (Vimeo / Mux)
To show films we embed videos from Vimeo (Vimeo.com, Inc., USA) and Mux (Mux, Inc., USA). On playback, connection data (including your IP address) may be transmitted to these providers. For Vimeo we use Do-Not-Track mode where possible. The respective providers' privacy policies apply.
9. Fonts & scripts
Fonts and the animation library (GSAP) are self-hosted and served directly from this website. There is no connection to Google Fonts or other third-party CDNs.
10. Storage duration
We process personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. Server log data is kept only briefly for secure operation; consent-based analytics data is deleted after 90 days; contact data is erased once your request is resolved and no statutory retention obligations remain.
11. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and to withdraw a given consent at any time (the withdrawal does not affect the lawfulness of processing carried out beforehand).
You also have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR). No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
Finally, you have the right to lodge a complaint with a supervisory authority, e.g. the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
12. Changes to this policy
We may update this policy to reflect changes to our website, our services, or legal requirements. The current version published on this page always applies.