Privacy
Policy

Sam Kiala Studios, Samuel J. Kiala, Bachstraße 136, 41239 Mönchengladbach, Germany, Email: backoffice@samkiala.de, Phone: +49 178 3063933

We take the protection of your personal data very seriously. Personal data is collected and processed only in accordance with applicable law (GDPR and the German Federal Data Protection Act, BDSG). This privacy policy explains what data we collect, how we use it and what rights you have.

This website is provided through the Lovable platform (Lovable Labs Incorporated) and delivered via the global network of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). Project data, images and the admin login are stored in Lovable Cloud’s backend infrastructure, which is based on Supabase Inc. and operates in an Amazon Web Services data centre in London (region eu-west-2, United Kingdom). The European Commission has adopted an adequacy decision for the United Kingdom; for potential transfers to the USA, the providers rely on the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses, as applicable. Data processing agreements under Article 28 GDPR are in place with the providers. When you visit the website, the following data is automatically recorded in server logs: IP address, date and time of access, name and URL of the requested file, browser and operating system used, and referrer URL. Legal basis: Article 6(1)(f) GDPR (secure and stable operation). This data is deleted after no more than 7 days.

We embed videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in privacy-enhanced mode (youtube-nocookie.com). Video thumbnails are stored on our own server; simply visiting a page does not establish a connection to YouTube or Google. A video is loaded only once you have allowed “External media” in the cookie settings or actively click the video. Data (including your IP address and device and browser information) is then transferred to Google, including to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision. Legal basis: Section 25(1) TDDDG and Article 6(1)(a) GDPR (consent). You can withdraw your consent at any time via “Cookie settings”. Further information: policies.google.com/privacy

If you contact us using the contact form, the data you submit (name, company, email address, budget range and message), along with the time of your enquiry, is stored in our backend provider’s database (see the Hosting section). To prevent abuse, we also store a non-reversible hash of your IP address to block more than three enquiries per hour. We are notified of each new enquiry by email at contact@samkiala.de; this email contains your details and is sent through our hosting provider’s email service. We also send a confirmation to the email address you provide, in your selected language. If you email us directly, we also store the data you send. Legal basis: Article 6(1)(b) or (f) GDPR, as applicable. The data is deleted once the enquiry has been fully handled, and no later than after 3 years, unless statutory retention obligations apply. It is not shared with any other third parties.

To book an initial consultation, we provide a link to Google Calendar (Google Ireland Limited). Data is transferred to Google only after you click the link.

Our website contains links to our profiles on LinkedIn, Instagram and YouTube (youtube.com/@SamKialaStudios). Data is transferred to the respective provider only when you click a link. The responsible controllers are: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland (LinkedIn); Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (Instagram); Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (YouTube).

Access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), objection (Article 21), and withdrawal of consent (Article 7(3) GDPR). Contact: backoffice@samkiala.de

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de

We operate our own cookie-free audience measurement on the infrastructure described in the Hosting section, without Google Analytics or other external analytics services. We record the time and path of a page view, the referring page’s domain (without the full URL), the UTM source and campaign name where applicable, the device type derived from the user agent, and the country where provided by the hosting service. We also count successful contact enquiries and clicks on appointment booking, phone, email and our social media links, without storing form data or link contents. To count unique visitors each day, the IP address and user agent are processed only temporarily on the server using a random daily salt; only the resulting hash is stored. The daily salt is protected, replaced each day, and the old salt is deleted. Raw IP addresses, full user agents and user IDs are not stored in the statistics data. Recognition across different days is not intended; the hashes are pseudonymous and should not be considered fully anonymous. We do not use cookies, identifiers in localStorage or device fingerprinting for this purpose. Bots and admin and authentication pages are not counted, and our own page views while logged in are excluded. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in understanding the use and effectiveness of our services through audience measurement that minimises data collection. Data is deleted after 13 months during the daily cleanup. Only administrators have access. You may object to this processing on grounds relating to your particular situation under Article 21 GDPR; for contact details, see the Data controller section.

October 2026.