Privacy Policy

Pranarei n.e.V., Schönbrunnerhäuser 756, 94545 Hohenau, Germany, represented by Simon Graf. Contact: simon@simons-lens.art.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When pages are requested, Vercel processes technically necessary access data as our processor. Transfer to the USA is covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.

Each request automatically records technical data (requested address, timestamp, data volume, referrer, browser/device type, shortened IP address). This data serves only secure, stable operation. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

This website is delivered exclusively over an encrypted TLS/HTTPS connection (recognisable by the lock icon and the https:// prefix in your browser's address bar), so data exchanged between your browser and the server cannot be read by third parties.

We set no tracking cookies without your consent. As strictly necessary, we only store in your browser's local storage: your cookie choice (cb_consent) and your language preference. This information never leaves your device and is not transmitted to us.

With your explicit consent (cookie banner) we collect largely anonymised usage statistics: pages visited, dwell time, referrer, browser, device type, country (derived from the shortened IP) and time of access. We do not store the raw User-Agent string.

IP minimisation: to learn your IP, your browser makes one request to ipify.org (which thereby sees your IP). Your IP is then shortened to its first two octets in your browser (e.g. 84.123.0.0) BEFORE anything is sent to us; our analytics endpoint and storage never receive the full IP. The shortened IP is used server-side to determine your country via ipwho.is (over HTTPS), which therefore receives only the shortened IP. Both ipify.org and ipwho.is may be based or hosted outside the EU (including the USA); this transfer relies on your explicit consent (Art. 49(1)(a) GDPR).

The shortened data is stored in Google Sheets (Google Ireland Limited, Gordon House, Barrow Street, Dublin, Ireland) as processor and deleted automatically after 90 days. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the „Cookie settings“ link in the footer.

If you contact us via the form or by email, we process the data you provide (e.g. name, email, message) to handle your request. Delivery is via the provider Resend (Resend, Inc., USA) as processor; the associated transfer to the USA relies on appropriate safeguards (Standard Contractual Clauses) or the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(a) and (b) GDPR. Providing the data is voluntary but necessary to handle your request. The data is deleted once your request is resolved and no statutory retention obligations apply.

If you sign up for our letter or the print discount code, we process the data you provide (name, email address) to send the newsletter. Delivery is via the provider Kit (formerly ConvertKit; Kit Inc., 113 Cherry St #92768, Seattle, WA 98104, USA) as processor. Transfer to the USA is covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.

Sign-up uses double opt-in: you first receive a confirmation email, and your subscription only becomes effective once you confirm it. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email; your data is then removed from the list.

To show films we embed videos from Vimeo (Vimeo.com, Inc., USA) and Mux (Mux, Inc., USA). They load only once you enable the „Embedded media“ category in the cookie banner — otherwise you see a poster image only. On playback, connection data (including your IP address) may be transmitted to these providers in the USA; for Vimeo we use Do-Not-Track mode where possible. The legal basis is your consent (Art. 6(1)(a) GDPR); the transfer to the USA relies on that consent (Art. 49(1)(a) GDPR) or appropriate safeguards. The respective providers' privacy policies apply in addition.

Fonts and the animation library (GSAP) are self-hosted and served directly from this website. There is no connection to Google Fonts or other third-party CDNs.

We process personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. Server log data is kept only briefly for secure operation; consent-based analytics data is deleted after 90 days; contact data is erased once your request is resolved and no statutory retention obligations remain; newsletter data is deleted from the list when you unsubscribe.

You have the right to access, rectification, erasure, restriction of processing, data portability, and to withdraw a given consent at any time (the withdrawal does not affect the lawfulness of processing carried out beforehand).

You also have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR). No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

Finally, you have the right to lodge a complaint with a supervisory authority, e.g. the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

We may update this policy to reflect changes to our website, our services, or legal requirements. The current version published on this page always applies.