Language note: This English version is provided for convenience. The German Privacy Policy is the source version.
Last updated: August 2026
1. Controller
The controller responsible for processing personal data on this website is:
Andreas Rother
Über den Krautländern 29
99098 Erfurt
Germany
Email: feedback@andreasrotherstudio.com
2. Purpose of this website
This website provides information about digital products from Andreas Rother Studio and links to sales platforms, particularly Etsy and Gumroad. Purchase contracts are concluded on those platforms. This website accepts no orders and processes no payment data.
3. Hosting
This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When pages are accessed, the hosting provider processes connection data required for technical operation in server log files, including:
- IP address
- Date and time of the request
- Requested file or URL
- HTTP status code
- Amount of data transferred
- Referrer URL, if transmitted
- Browser and operating-system information (user agent)
The legal basis is Article 6(1)(f) GDPR: the legitimate interest in providing a technically stable and secure website. Log files are generally deleted automatically after a short period unless longer retention is required for security reasons. Further information is available in the STRATO privacy information.
4. Cookies and tracking
This website uses no tracking cookies and no third-party analytics or marketing tools such as Google Analytics or the Meta Pixel. No personal profiles are created.
Fonts are loaded exclusively from the operating-system font stack on the visitor’s device. Google Fonts and other external font services are not requested.
5. Contact by email
If you contact us by email, we process the information you provide—at least your email address and message content, and your name where supplied—to handle and answer your request.
The legal basis is Article 6(1)(b) GDPR where the request concerns steps prior to entering into a contract or performance of a contract. Otherwise, the legal basis is Article 6(1)(f) GDPR: the legitimate interest in responding to enquiries.
The data is deleted once it is no longer required for this purpose and no statutory retention obligation applies.
6. Newsletter and freebie email (double opt-in)
Free sample files are available after you confirm a double opt-in email. We process your email address to send that confirmation message and, after you confirm, the requested sample link on andreasrotherstudio.com. Paid shop listings (particularly Etsy and Gumroad) stay available without an address. Later messages, if any, point only to platform offers.
The legal basis is your consent (Article 6(1)(a) GDPR). Consent is given when you confirm the double opt-in email, not merely by submitting the form. You may withdraw consent at any time via the unsubscribe link in every message or by emailing feedback@andreasrotherstudio.com. Withdrawal does not affect the lawfulness of processing before withdrawal.
Email delivery and list management are carried out by our processor Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France. Processing takes place in the EU. On the website, the subscribe endpoint also stores a short-lived hashed record of your IP address and email address for rate limiting, to prevent abuse.
After confirmation, a webhook from Brevo may trigger a transactional message with the sample link. We keep the address in the mailing list until you unsubscribe or ask us to erase it, unless a longer statutory retention period applies.
7. External links (Etsy, Gumroad and others)
This website links to third-party services, particularly Etsy and Gumroad. Once you leave this website, the privacy policies of the respective provider apply. The platform operators are solely responsible for data processing relating to registration, purchases, payments and downloads on their services.
We recommend reading the privacy policies and terms of the relevant platform before purchasing.
8. Your rights
Where the legal requirements are met, you have the right to:
- Access your stored personal data (Article 15 GDPR)
- Rectification of inaccurate data (Article 16 GDPR)
- Erasure (Article 17 GDPR)
- Restriction of processing (Article 18 GDPR)
- Data portability (Article 20 GDPR)
- Object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR)
- Lodge a complaint with a supervisory authority (Article 77 GDPR)
Competent supervisory authority in Thuringia:
Thuringian Commissioner for Data Protection and Freedom of Information
Häßlerstraße 8, 99096 Erfurt, Germany
www.tlfdi.de
9. No automated decision-making
No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.
10. Changes to this policy
This privacy policy may be updated if the technology, legal framework or services change. The version published on this page applies.