Privacy policy.
Last updated: July 2026
1. Controller
The controller responsible for the processing of personal data on this website is:
Phinot
Winzererstraße 49b
80797 Munich
Germany
Email: contact@phinot.de
“Personal data” means any information relating to an identified or identifiable natural person.
2. General information about data processing
We process personal data only where this is necessary to provide and operate this website, respond to enquiries, protect the website against misuse, or comply with legal obligations.
Depending on the particular processing activity, the legal basis is:
Article 6(1)(a) GDPR, where you have given consent;
Article 6(1)(b) GDPR, where processing is necessary to respond to an enquiry or take steps before entering into a contract;
Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation;
Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests, particularly the secure and effective operation of this website.
3. Website hosting by Squarespace
This website is hosted by Squarespace. Squarespace collects personal data when you visit this website. This includes:
information about your browser, network and device;
web pages you visited prior to coming to this website;
web pages you view while on this website;
your IP address.
Squarespace needs this data to operate this website and to protect and improve its platform and services.
For more information about how Squarespace uses your data, including end-user website usage information, for its own purposes, please see the Squarespace Privacy Policy.
Squarespace provides the technical platform, hosting, security and related services required to make this website available. The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest is the reliable, secure and efficient operation of this website.
This wording reflects Squarespace’s current official sample language for website operators.
4. Technical access data and server information
When you access this website, certain technical information may be processed automatically. This may include:
IP address;
date and time of access;
pages and files requested;
referring website;
browser type and version;
operating system;
device and network information;
information relating to errors, security events or attempted misuse.
This information is processed to deliver the website, ensure its technical stability, identify errors and protect the website and hosting infrastructure against unauthorised access and misuse.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.
Squarespace’s activity and analytics functions may include information such as accessed pages, IP addresses, browser information and visitor activity.
5. Contact by email
When you contact us by email, we process the information contained in your message. This normally includes:
your name;
your email address;
the content of your message;
any files or information you choose to provide.
We use this information solely to process and respond to your enquiry.
Where your enquiry relates to a possible commission, purchase, collaboration or other contractual relationship, the legal basis is Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is responding to legitimate communications concerning our artistic work and services.
We retain correspondence for as long as necessary to process the enquiry. Information may be retained for longer where this is necessary to establish, exercise or defend legal claims or to comply with statutory record-keeping obligations.
6. Cookies and similar technologies
This website uses cookies and similar technologies.
Essential cookies
Certain cookies are required for the website to function correctly and securely. These may be used, for example, for security, network management, accessibility, website navigation and the storage of privacy preferences.
Where access to information on your device is strictly necessary to provide a service expressly requested by you, this processing is based on Section 25(2) TDDDG. Where personal data is processed through these technologies, the legal basis is Article 6(1)(f) GDPR.
Analytics and performance cookies
Squarespace may offer analytics and performance cookies that provide information about website traffic and visitor interactions.
Where these non-essential cookies are enabled, they are used only after you have provided consent through the cookie banner. The legal basis for storing or accessing information on your device is Section 25(1) TDDDG. The legal basis for the subsequent processing of personal data is Article 6(1)(a) GDPR.
You may refuse or withdraw your consent through the cookie settings available on this website. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
Squarespace explains that its analytics and performance cookies support statistics such as traffic sources and visitor numbers and can be disabled or restricted until a visitor gives consent.
7. Squarespace Analytics
Where you consent to analytics and performance cookies, we may use Squarespace Analytics to understand how visitors use the website. The information may include:
page views;
visitor numbers;
traffic sources;
approximate geographic information;
browser and device information;
interactions with pages, buttons or forms.
We use this information to understand the general performance of the website and improve its content and presentation.
The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time through the website’s cookie settings.
Squarespace Analytics can provide information including page views, traffic sources, visitor activity and engagement.
Delete this section if Squarespace Analytics and its optional cookies are completely disabled.
8. External links and social media
This website may contain links to external websites or social-media profiles.
When you follow an external link, the operator of the destination website may process personal data about you. The privacy practices of external websites are controlled by their respective operators and are not covered by this Privacy Policy.
A standard hyperlink does not itself mean that we receive personal data from the external provider. However, the provider may process information after you open its website or application.
9. International data transfers
Squarespace is an international service provider. Personal data may therefore be processed in or transferred to countries outside the European Economic Area, including the United States.
Where required, Squarespace relies on recognised transfer mechanisms such as the EU–US Data Privacy Framework and the European Commission’s Standard Contractual Clauses. These mechanisms are intended to provide appropriate safeguards for international transfers of personal data.
Squarespace describes these transfer mechanisms in its GDPR information and Data Processing Addendum.
10. Data retention
We retain personal data only for as long as necessary for the purposes for which it was collected.
The applicable retention period depends on the type of information and the reason for processing it. Data may be retained for longer where this is required by law or necessary for the establishment, exercise or defence of legal claims.
Once personal data is no longer required, it will be deleted or anonymised where technically and legally possible.
11. Recipients of personal data
Personal data may be disclosed to service providers that assist us in operating this website and communicating with visitors. These may include:
Squarespace as the website and hosting provider;
email and communication providers;
technical support and IT service providers;
professional advisers where necessary;
public authorities where disclosure is legally required.
Service providers acting on our behalf may process personal data only for the agreed purposes and in accordance with applicable data-protection requirements.
12. Your rights
Subject to the requirements of applicable law, you have the right to:
request access to your personal data;
request the correction of inaccurate or incomplete data;
request the deletion of your personal data;
request the restriction of processing;
receive certain personal data in a structured, commonly used and machine-readable format;
object to processing based on legitimate interests;
withdraw consent at any time with effect for the future;
lodge a complaint with a data-protection supervisory authority.
Where processing is based on Article 6(1)(f) GDPR, you may object to the processing on grounds relating to your particular situation.
To exercise your rights, contact us using the details listed in Section 1.
You also have the right to lodge a complaint with the supervisory authority responsible for your place of residence, workplace or the location of the alleged infringement.
The GDPR establishes these information and data-subject rights, including access, correction, erasure, restriction, objection, portability and withdrawal of consent.
13. Automated decision-making
We do not use personal data collected through this website for automated decision-making or profiling that produces legal effects or similarly significant effects concerning you.
14. Security
We take reasonable technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration or disclosure.
However, internet-based data transmission cannot be guaranteed to be completely secure.
15. Changes to this Privacy Policy
We may update this Privacy Policy where the website, the services used on it or the applicable legal requirements change.
The current version is published on this page. The date of the most recent update appears at the beginning of the Privacy Policy.