Privacy Policy

1. Privacy at a glance

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. Her contact details can be found in the section “Responsible party” of this privacy policy.

How do we collect your data?

Some data is collected when you provide it to us, e.g. via the contact form or by email. Other data is collected automatically by the IT systems of our hosting provider when you visit the website, mainly technical data (e.g. browser, operating system or time of the page visit).

What do we use your data for?

Some data is collected to ensure the website is provided without errors. Data you send us via the contact form or by email is used to process your request.

What rights do you have regarding your data?

You have the right to receive information about the origin, recipients and purpose of your stored personal data free of charge at any time. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke it at any time for the future. You also have the right, under certain circumstances, to request the restriction of processing of your personal data, and the right to lodge a complaint with the competent supervisory authority. You can contact us at any time about this and any other questions on data protection.

2. Hosting

This website is built with the website builder Onepage (https://onepage.io) and hosted by this provider. When you visit this website, your personal data is processed on the servers of Onepage and the data centres and content delivery networks it uses. This may include IP addresses, contact requests, meta and communication data, website access and other data generated by a website. Images, fonts and program components of this website are also delivered via the servers or content delivery networks of the hosting provider.

The hosting provider is used in the interest of a secure, fast and efficient provision of our online offering (Art. 6(1)(f) GDPR). Where consent has been requested, processing is based exclusively on Art. 6(1)(a) GDPR and § 25(1) TDDDG; consent can be revoked at any time. The hosting provider only processes your data to the extent necessary to fulfil its service obligations.

Data processing on our behalf

We use the hosting provider's services under a plan (usage agreement). Where the provider processes personal data of our visitors on our behalf, this is done on the basis of the provider's contractual and data protection terms and in accordance with Art. 28 GDPR.

Server log files

The hosting provider automatically collects and stores information in server log files that your browser transmits automatically: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the server request and IP address. This data is not merged with other data sources. Collection is based on Art. 6(1)(f) GDPR; we have a legitimate interest in the technically error-free presentation and security of our website.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as requests via the contact form, this site uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in the browser's address bar and the lock icon. When encryption is active, the data you transmit to us cannot be read by third parties.

3. General information and mandatory information

Data protection

The operator of this website takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Responsible party

The party responsible for data processing on this website is:

Yasmin Aly

Gartenstraße 69c

76135 Karlsruhe, Germany

Phone: +491627312993

Email: yazdesignandillustration@gmail.com

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose for processing no longer applies. If you make a justified request for deletion or revoke your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law).

Legal bases of processing

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your device, processing is additionally based on § 25(1) TDDDG. Consent can be revoked at any time. If your data is required to perform a contract or pre-contractual measures, we process it on the basis of Art. 6(1)(b) GDPR. To fulfil a legal obligation we process data on the basis of Art. 6(1)(c) GDPR. Processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR.

Recipients of personal data

In the course of our business we work with external parties, in particular our hosting provider. We only pass on personal data to external parties if this is necessary to perform a contract, if we are legally obliged to do so, if we have a legitimate interest under Art. 6(1)(f) GDPR or if another legal basis permits it. Where service providers process data on our behalf, this is done in accordance with Art. 28 GDPR.

Revocation of your consent

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The lawfulness of processing carried out until the revocation remains unaffected.

Right to object (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING (OBJECTION UNDER ART. 21(2) GDPR).

Right to lodge a complaint

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work or place of the alleged breach. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany (https://www.baden-wuerttemberg.datenschutz.de).

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or a third party in a common, machine-readable format.

Access, correction and deletion

Within the scope of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of processing, and where applicable a right to correction or deletion of this data.

Right to restriction of processing

You have the right to request the restriction of processing of your personal data, in particular if you dispute its accuracy, if processing is unlawful and you request restriction instead of deletion, if we no longer need the data but you need it to assert legal claims, or if you have objected under Art. 21(1) GDPR and it has not yet been determined whose interests prevail.

Objection to advertising emails

The use of contact data published under the imprint obligation to send unsolicited advertising and information material is hereby rejected. The operator expressly reserves the right to take legal action in the event of unsolicited advertising, such as spam emails.

4. Data collection on this website

Cookies and storage on your device

As of now, this website does not set any cookies that require consent and does not use any analytics or marketing services. Where technically necessary cookies or similar technologies (e.g. local storage) are used that are strictly required to operate the website, this is based on § 25(2) TDDDG and Art. 6(1)(f) GDPR. Should cookies or services requiring consent be used in future, we will obtain your consent beforehand (Art. 6(1)(a) GDPR and § 25(1) TDDDG) and inform you in this privacy policy. You can set your browser to inform you about cookies, allow them only in individual cases, exclude them in general and delete them automatically when closing the browser.

Contact form

If you send us a request via the contact form, your details from the form (name, email address, requested service and your message) are stored to process the request and in case of follow-up questions. Requests are stored in the customer management (CRM) of our hosting provider Onepage, which acts as a service provider for us (see “Hosting”). We do not pass this data on to third parties without your consent. Processing is based on Art. 6(1)(b) GDPR if your request relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases it is based on your consent (Art. 6(1)(a) GDPR), which you give when submitting the form, and on our legitimate interest in effectively handling requests (Art. 6(1)(f) GDPR). Consent can be revoked at any time for the future, e.g. by email to yazdesignandillustration@gmail.com. The data remains with us until you ask us to delete it, revoke your consent or the purpose of storage no longer applies (e.g. after your request has been completed). Mandatory statutory provisions, in particular retention periods, remain unaffected.

Requests by email or phone

If you contact us by email or phone, your request including all resulting personal data (name, request) is stored and processed to handle your concern. We do not pass this data on without your consent. Processing is based on Art. 6(1)(b) GDPR if your request relates to a contract or pre-contractual measures, otherwise on our legitimate interest in effectively handling requests (Art. 6(1)(f) GDPR). For email we use Gmail by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be transferred to servers of Google LLC in the USA; this transfer is based on the EU Commission's standard contractual clauses, and Google is certified under the EU-US Data Privacy Framework (DPF). More information: https://policies.google.com/privacy. The data remains with us until you ask us to delete it, revoke your consent or the purpose no longer applies. Mandatory statutory provisions, in particular retention periods, remain unaffected.

5. Social media and external links

Links to Instagram and LinkedIn

This website contains links to our profiles on Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) and LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). These are simple links, not embedded plugins. Merely visiting this website therefore does not transfer any data to Instagram or LinkedIn. Only when you click a link are you forwarded to the provider's site, where its privacy policy applies: https://privacycenter.instagram.com/policy/ and https://www.linkedin.com/legal/privacy-policy.

Links to external websites

This website contains links to external websites, such as clients' project pages, exhibition partners and our art shop on Big Cartel. When you click such a link, you leave our website. The respective operator is responsible for data processing on the linked pages; their privacy policies apply.

6. Fonts and content

Fonts

For consistent display, this website uses the fonts Syne and Instrument Sans. They are delivered via the servers or content delivery network of our hosting provider (see “Hosting”). No connection to Google servers is established.

Note and date

This English version is provided for convenience. In case of doubt, the German version applies. This privacy policy is dated November 2026.