On this page
Controller
Marcus Hartelt is responsible for processing personal data on this website. EVENT FRAMES is his trading name. Julia Hänel is a project partner, not a co-operator of the website. Use the following contact details for privacy questions or to exercise your rights.
Marcus HarteltFalkenberger Str. 143E
13088 Berlin
Germany
hey@event-frames.de
+49 160 5667422
What data is processed
Visiting the website involves processing technical connection data. When you contact us, we process the information you provide to respond to your enquiry. An explicitly chosen language can be saved in your browser. A Cloudflare Turnstile security check is prepared for submitting a valid enquiry form.
There are no user accounts, online shop or newsletter. Vercel Web Analytics loads only with your consent to statistics. Google Analytics, Google Ads, Google Tag Manager and Speed Insights are not integrated. No social media plugins or external video players are loaded.
Hosting and access data
Vercel Inc., USA, is the intended hosting provider for publication. Vercel serves pages and files through its network and runs the server function for the enquiry form. Processing may include IP addresses, timestamps, requested URLs, browser and device information, referrers, status information and security data.
The purposes are website delivery, troubleshooting and protection against abuse. The intended legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure and reliable website. Processing the content of an enquiry is covered by the legal bases below.
The contact function is configured for the Frankfurt region. This does not automatically restrict all processing, network access or support to Germany or the EU. Actual log types, retention periods, contractual terms and subprocessors must be checked in the Vercel project before publication. We do not claim that a data processing agreement has already been concluded.
Email and telephone enquiries
If you contact us by email or telephone, we process your contact details, message and communication data needed to deal with the enquiry. The website does not automatically record calls.
Article 6(1)(b) GDPR applies where the enquiry concerns entering into or performing a contract with you. If you act as a company contact or send another business enquiry, we rely on Article 6(1)(f) GDPR. Our legitimate interest is appropriate business communication. Statutory retention duties are based on Article 6(1)(c) GDPR.
The mailbox is provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Its encrypted SMTP service is prepared for form delivery. Emails sent directly to us also reach this mailbox independently of the form. Contract and deletion requirements for the actual email product must be documented before publication.
Enquiry form
Name, email address and message are required. Company, phone number, event date or date range and location are optional. You can also choose Photo, Video, both or “Still deciding”. Without the required fields we cannot process the form; email and telephone remain available. Please avoid sending sensitive personal data that is not needed for your enquiry.
On first focus in the form, our own server is asked whether sending has been configured. A valid submission undergoes the security check described below. The form data then passes through a Vercel server function and is sent as an email to our IONOS mailbox. There is no separate enquiry database. The application does not write the message to an application log; technical provider logs may nevertheless be generated.
Our form does not save your entries in Local Storage or Session Storage. They remain in the open form until it is reset or left. The code also submits the page language, a timestamp for abuse prevention and the security token. The legal bases for the enquiry are those described under “Email and telephone enquiries”.
Security checks and spam protection
Cloudflare Turnstile, provided by Cloudflare, Inc., USA, is prepared to check valid form submissions. Its external script loads only when you submit. Cloudflare processes information including IP address, browser details and technical connection characteristics. Our server verifies the resulting token with Cloudflare. Our code does not send your name, email address or message to that verification endpoint.
Cloudflare describes two roles: processing on behalf of the website operator for protection, and acting as a controller to improve bot detection. Our intended basis for website security is Article 6(1)(f) GDPR. Necessity, the balancing of interests and any consent requirement under section 25 TDDDG must be legally assessed before activation. A privacy notice does not replace any consent that may be required.
The prepared server safeguards also include Vercel Firewall request limits, a hidden form field, and size, timing and origin checks. IP addresses are used to limit requests. The form does not send a message if the security setup is incomplete or verification fails. Email and telephone are available as alternatives.
Language and browser storage
At a language-neutral entry URL, the language reported by your browser is used to redirect to /de or /en. Your location is not determined from your IP address for this purpose. Direct language URLs remain directly accessible.
When you explicitly choose a language using the language switch, “de” or “en” is stored locally in your browser under “eventframes-language”. It is read on later visits to an entry URL. It contains no user identifier and is not sent to an analytics service. It has no automatic expiry. You can remove it through “Cookie settings” in the footer or your browser’s website-data settings; this only clears the remembered language.
Storage serves your chosen language preference. The intended bases are section 25(2)(2) TDDDG for storage necessary for this function and Article 6(1)(f) GDPR for providing it. You can also use the website through direct language URLs with browser storage blocked.
Vercel Web Analytics
With your consent, we use Vercel Web Analytics by Vercel Inc., USA, for visitor and page-view statistics. Data may include the page viewed, referrer, timestamp, approximate region, browser, operating system and device information. According to Vercel, it uses no third-party cookies; a hash derived from the request distinguishes visitors temporarily and is discarded after 24 hours.
Our code sends only page views of public language pages and removes query strings and URL fragments before transmission. No form content or custom events containing personal information are sent to Analytics. The purpose is to improve the website. The basis is your consent under Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG. You may withdraw through Cookie settings to stop future measurements; this does not affect the lawfulness of earlier processing.
Transfers outside the EEA may occur because Vercel is a US provider; see “Transfers outside the EEA”. The 24-hour period concerns the visitor identifier, not deletion of all aggregate statistics.
Fonts, images and videos
Fonts, photographs, client logos and the hero video are delivered as files of this website. No Google-hosted fonts, YouTube players or Vimeo players are embedded. Displaying these files therefore creates no connection to those services.
Portfolio images may show identifiable people. Publication requires the necessary image rights and data protection conditions for the specific use. Depending on the circumstances, the basis may be consent under Article 6(1)(a) GDPR or an assessed legitimate interest under Article 6(1)(f) GDPR. Our interest is presenting our work, taking the interests of the people shown into account. This is not a claim that every image already has a blanket release. Please contact us about any particular image.
An individual photo or video project may require additional event-specific privacy notices, particularly for guests and employees. This website notice does not replace them.
Recipients and project collaboration
Access is limited to people and providers who need it for the relevant purpose. For the prepared website setup these include Vercel for hosting and server processing, IONOS for email and Cloudflare for security checks. Where providers process data on our behalf, the necessary Article 28 GDPR agreements must be in place before use. Their own privacy notices also apply to processing for their separate purposes.
For an enquiry involving video or a joint production, necessary project information may be shared with Julia Hänel as the video partner where needed to handle or perform the requested project. Data protection roles and access are determined for each project; collaboration alone does not establish joint controllership. The form does not automatically forward every enquiry to Julia.
Transfers outside the EEA
Vercel and Cloudflare are US providers. Using them may involve processing in the USA or other countries outside the European Economic Area. We do not promise exclusively European processing.
Transfers require a lawful basis under Articles 44 onwards GDPR, such as an applicable adequacy decision under Article 45 for a suitably certified recipient, or appropriate safeguards under Article 46, particularly EU Standard Contractual Clauses and any necessary supplementary measures. Vercel refers to the EU-US Data Privacy Framework in its privacy notice and Standard Contractual Clauses in its contractual documents. The mechanisms and recipients applicable to the actual contracts must be checked and recorded before release. You can ask us for information and, where applicable, copies of the relevant safeguards.
Retention periods
Enquiry data is deleted once the matter has been fully dealt with and no other legal basis for retention remains. Necessary contract data is kept for the duration of an assignment. Data needed to establish, exercise or defend legal claims may be kept until the applicable limitation periods expire.
Statutory retention duties remain applicable. Where section 147 of the German Fiscal Code (AO) applies to the particular records, accounting vouchers are generally retained for eight years and business correspondence for six years; certain other records require ten years. The start of the period follows the relevant law. Not every message must be kept for ten years. Article 6(1)(c) GDPR is the basis for legally required retention.
The actual retention settings for Vercel and Cloudflare access and security logs must be added before publication. The practical IONOS mailbox deletion process and any project archiving must also be documented. The language entry remains until browser data is cleared.
Your rights
Subject to the legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20). You may withdraw consent at any time with future effect. This does not affect the lawfulness of earlier processing.
Where we rely on Article 6(1)(f) GDPR, you can object for reasons relating to your particular situation (Article 21 GDPR). We then stop processing unless overriding grounds recognised by law, or establishing, exercising or defending legal claims, justify continuing. Objections to direct marketing would be possible at any time without giving a reason.
You may complain to a supervisory authority, particularly in your place of residence, workplace or the place of a suspected infringement. The Berlin authority is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.
No automated booking decisions
There are no automated decisions about a booking or quote producing legal or similarly significant effects within Article 22 GDPR. The security check may block a form submission but does not decide your business enquiry. Email and telephone are available instead.