Privacy policy

Data controller

General information

Personal data is processed only where necessary to operate the website, provide content, handle contact inquiries, or provide individual functions. Recipients or categories of recipients may include Cloudflare, Sanity, Google/Gmail, and other technical service providers used for these purposes. Data is disclosed only where necessary for these purposes or where required by law. Where services process data outside the European Economic Area, transfers are carried out in accordance with the requirements of Articles 44 et seq. GDPR. To prevent abuse, the client IP is used at the endpoints /api/contact and /api/chat to rate-limit requests. The AI Assistant processes the submitted messages, chat history, current language, and current page to generate responses using Cloudflare Workers AI, without storing this data in its own database. Chat data is not stored in a dedicated database. Submitted chat messages and chat histories are not deliberately recorded in our own logs; technical error logging remains unaffected. For the AI assistant, Sanity serves as a source of information about artworks; chat user data is not stored there as persistent application data. The chat blocks obviously personal data (email, phone, IBAN, credit card, address) client- and server-side and is not intended for entering such data.

Hosting via Cloudflare Workers

This website is operated using Cloudflare Workers. Technically necessary connection and access data may be processed to provide the website, handle requests, and ensure the security and stability of the service.

Cloudflare may process technical log and error data as part of operating the service. Storage and deletion are governed by the technical configuration and applicable retention periods of the Cloudflare services used.

Content and images via Sanity

Sanity is used to manage and provide content and images. Personal data may be processed to the extent necessary to provide and manage the website content.

Sanity processes data under the applicable agreements and privacy terms. Where Sanity processes personal data on behalf of the website operator, the applicable data protection requirements apply. Sanity may also process data in countries outside the European Economic Area as part of its services; the applicable data protection safeguards for such transfers apply. For the AI assistant, Sanity serves as a source of information about artworks; chat user data is not stored there as persistent application data. The artwork images are loaded directly from Sanity's CDN into your browser — in the catalogue, on the home page and on the artwork pages as well as in the virtual tour under /werke/rundgang. In that case, Sanity is the recipient of the request's technical connection data, in particular the IP address.

Contact form

The contact form allows you to submit your name, email address, subject, and message. This information is processed to handle your inquiry. Technical data may additionally be processed to prevent abuse and spam.

Messages submitted through the form are forwarded server-side to the configured email destination. The website itself does not permanently store contact inquiries in its own database.

Email delivery and contact mailbox

When you use the contact form, your details (name, email address, subject, message) are forwarded to the recipient address configured by the operator to handle your inquiry. Gmail by Google is used for the contact mailbox and email delivery. The message is processed and stored there in accordance with the technical conditions of the email service.

The Nasrin Arts website does not permanently store messages submitted via the contact form in its own database. Further storage may take place in the recipient mailbox or in Gmail. The message is sent via Nodemailer/SMTP to the configured recipient address; the replyTo field contains the sender's email address. When using Google, data may also be processed outside the European Economic Area; where required, transfers are carried out in accordance with the requirements of Articles 44 et seq. GDPR.

Anti-abuse and security measures

Appropriate technical security measures are used to protect the contact form against abuse and automated inquiries. Technical connection data may be processed in this context.

Cloudflare Turnstile

Cloudflare Turnstile is used to protect the contact form against automated requests and abuse. Technical signals such as the IP address, User-Agent, and TLS-related information may be processed for verification.

Turnstile is used for security verification and is deployed for spam and abuse prevention. According to Cloudflare, technical signals are processed for this purpose. Cloudflare describes this processing as a security measure and states that Turnstile is not used to identify, profile, or target individuals. Turnstile does not process the content of the contact form itself; the technical data submitted to Turnstile is used exclusively for spam and abuse prevention. Cloudflare's privacy policy.

Cookies and local storage

The public website does not use its own theme cookies for the display preference. The selected preference is stored exclusively in the browser's local storage. This storage is used solely for the display preference and not for tracking. The website additionally sets a cookie named NEXT_LOCALE. It stores nothing but the currently selected language, contains no personal data, is not used for tracking or profiling, and expires at the end of the browser session.

The light or dark appearance is stored in the browser and serves only to keep the chosen display for later visits. Beyond that, the virtual tour stores nothing in the browser: it remembers neither the last room viewed nor any display setting, and whoever leaves it starts at the beginning again next time.

Legal bases

Depending on the purpose, personal data is processed in particular on the basis of Art. 6(1)(b) GDPR for the performance of pre-contractual measures or a contract, and Art. 6(1)(f) GDPR for legitimate interests, in particular the secure and reliable operation of the website.

Where processing or retention is required by law, processing is based on Art. 6(1)(c) GDPR.

Automated decision-making (Art. 22 GDPR)

No decision-making based solely on automated processing, including profiling, takes place that produces legal effects concerning you or similarly significantly affects you. The optional AI assistant provides informational answers about publicly available content on this website and does not make legally or similarly significant decisions about individuals.

Transport encryption

Your data is transmitted encrypted via HTTPS/TLS.

AI assistant

If the AI assistant is enabled, your input is transmitted to the /api/chat function. The current message, a limited portion of the previous conversation history, and the current page path may be processed. The website does not permanently store chat histories.

Technical data such as the IP address may be processed to enforce rate limits and protect the service. Requests for the AI assistant are processed using Cloudflare Workers AI. Cloudflare describes the transmitted inputs and generated responses as Customer Content and states that it does not use Customer Content to train AI models available on Workers AI unless explicit consent has been given.

Retention period

Personal data is stored only as long as is necessary for the respective purpose. Enquiries and the communication connected with them are retained for as long as is required for processing, follow-up or, where applicable, the performance of a contract. Statutory retention obligations or the enforcement or defence of legal claims may require longer storage. The storage and deletion periods of the providers used apply to technical data. The website does not store chat histories permanently. The design choice in local storage remains stored until the corresponding browser data is deleted. The NEXT_LOCALE language cookie applies only to the running browser session and is deleted when the browser is closed. The virtual tour's display markers are gone: the tour stores nothing in the browser.

Rights of data subjects

Subject to the applicable statutory requirements, data subjects have in particular the following rights:

• Access to the personal data processed
• Rectification of inaccurate data
• Erasure of personal data
• Restriction of processing
• Data portability, where applicable
• Objection to processing, where legally provided for
• Lodging a complaint with a data protection supervisory authority

Updates to this privacy policy

This privacy policy may be adjusted if the website, the services used, or the legal requirements change.