Privacy Policy

1. Controller

Nico Sanft
Email: hi@nicosanft.com

This website is a portfolio. There are no user accounts, no contact form, no advertising, no tracking and no analytics. No cookies are set.

2. Hosting and server log files

This website is hosted by Uberspace. When you visit it, the server automatically processes data your browser sends: IP address, date and time of access, page or file requested, amount of data transferred, status code, referrer URL, and browser and operating system.

This data is technically necessary to deliver the website and keep it secure and stable. The legal basis is Art. 6(1)(f) GDPR; my legitimate interest is the secure, error-free operation of the website. A data processing agreement under Art. 28 GDPR is in place with the host.

3. Language preference in your browser

When you switch between German and English, your choice is saved in your browser's local storage so the site shows your language on your next visit. For the duration of the session, session storage also notes that the automatic language selection has already happened. This information stays on your device and is not sent to me or third parties.

This storage is strictly necessary to provide a function you requested (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

4. Google Fonts

To display the “Inter” typeface, your browser connects to Google servers when a page loads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your IP address is sent to Google; a transfer to the USA cannot be ruled out (Google is certified under the EU-US Data Privacy Framework). The legal basis is Art. 6(1)(f) GDPR. More: policies.google.com/privacy.

5. Videos (Dropbox)

Films and trailers are delivered by Dropbox (Dropbox International Unlimited Company, One Park Place, Floor 5, Upper Hatch Street, Dublin 2, Ireland). Videos only load when you actively click play; before that, no connection to Dropbox is made. When you click, your IP address and technical browser data are sent to Dropbox. A transfer to Dropbox, Inc. in the USA cannot be ruled out; Dropbox is certified under the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in reliably providing the films at your explicit request). More information: dropbox.com/privacy.

6. Contact by email

If you email me, I process your details (email address, name, message content) to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or its preparation, otherwise Art. 6(1)(f) GDPR. I delete the data once it is no longer needed and no statutory retention obligations apply.

7. Links to other services

This website links to Instagram, Letterboxd, Crew United and the websites of collaborators. These are plain links, not embedded content. No data is transferred until you click a link; from then on, that provider's privacy policy applies.

8. Encryption

This website is served exclusively over an encrypted HTTPS connection.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal email to the address above is enough.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.