Privacy Policy

With this privacy policy, we would like to inform you about the types of personal data (hereinafter referred to simply as “data”) we process, as well as the purposes and scope of that processing.

This privacy policy applies to all personal data processing activities we carry out—both as part of providing our services and, in particular, on our websites, in mobile applications, and on external online platforms such as our social media profiles (collectively referred to as “online services”).

Last updated: May 16, 2025

Shibari Study GmbH

Giesebrechtstraße 6

10629 Berlin

Germany

Managing Director: Anton Martin

Email: mail@shibaristudy.com

The following overview summarizes the types of data we process, the purposes for which they are processed, and the categories of data subjects affected.

Below we outline the legal bases under the General Data Protection Regulation (GDPR) on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your country or ours.

• Consent (Art. 6(1)(a) GDPR): The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a Contract and Pre-contractual Inquiries (Art. 6(1)(b) GDPR): Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legitimate Interests (Art. 6(1)(f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, provided such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

In addition to the GDPR, national data protection regulations apply in Germany. These include, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), which provides specific provisions regarding:

• The right of access
• The right to erasure
• The right to object
• The processing of special categories of personal data
• Processing for different purposes
• Data transfers and
• Automated individual decision-making, including profiling

The BDSG also governs data processing for employment-related purposes (§ 26 BDSG), especially concerning the initiation, performance, or termination of employment relationships, as well as employee consent.

Additionally, state-level data protection laws of the individual German federal states may apply.

In accordance with legal requirements and taking into account the state of the art, implementation costs, the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, input, transmission, availability, and separation of the data itself. We have also established procedures to ensure data subject rights, data deletion, and responses to data threats.

Moreover, we consider the protection of personal data as early as the development or selection of hardware, software, and processes—in line with the principles of data protection by design and by default.

In the course of processing personal data, we may transmit or disclose such data to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, payment service providers involved in payment transactions, IT service providers, or providers of content and services that are integrated into a website.

In such cases, we comply with the legal requirements and, in particular, conclude data processing agreements or other legal arrangements with the recipients of your data to ensure their protection.

We may transfer personal data to other units within our organization or grant them access to it. Where such transfers are made for administrative purposes, they are based on our legitimate business and organizational interests, the need to fulfill contractual obligations, the presence of data subject consent, or another legal basis.

If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if such processing takes place through the use of third-party services, or through the disclosure or transfer of data to other persons, entities, or companies, this is done only in accordance with legal requirements.

Unless an explicit consent has been given, or a transfer is required by contract or law, we process data only in third countries that have been officially recognized as having an adequate level of data protection, including U.S. providers certified under the "Privacy Shield" (now invalidated, but still mentioned in legacy policies), or on the basis of special guarantees, such as contractual obligations through standard contractual clauses (SCCs) approved by the EU Commission, certifications, or binding corporate rules.

(Art. 44–49 GDPR; for more information, see the EU Commission’s page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en)

"Cookies" are small files stored on users' devices. They can store various pieces of information—such as language settings on a website, login status, a shopping cart, or the point at which a video was last played.

Cookies are commonly used when a user’s interests or behavior (e.g., viewing specific content, using features) are saved across individual websites in a user profile. These profiles help show users content that matches their potential interests. This practice is known as "tracking," i.e., tracking users’ potential interests. We also include other technologies under "cookies" if they fulfill similar purposes (e.g., storing user information using pseudonymous online identifiers, also called "user IDs").

If we use cookies or tracking technologies, you’ll be separately informed in our privacy policy.

Legal basis: The legal basis for processing personal data via cookies depends on whether we request your consent. If so, and you give consent, the legal basis is that consent. Otherwise, we process data via cookies based on our legitimate interests (e.g., for efficient business operation or improving our online offering) or because cookies are necessary for fulfilling contractual obligations.

Withdrawal and Objection (Opt-Out): Regardless of whether processing is based on consent or legal authorization, you may withdraw your consent or object to the use of cookie technologies at any time ("opt-out").

You can do so via your browser settings (e.g., disabling cookies, which may impair the functionality of our online offering). You can also object to cookies used for online marketing (especially tracking) via:

• U.S.: aboutads.info/choices
• EU: youronlinechoices.com
• Global: optout.aboutads.info

Types of data processed: Usage data (e.g., visited websites, content interest, access times), meta/communication data (e.g., device info, IP addresses).

Affected persons: Users (e.g., website visitors, online service users).

Legal basis: Consent (Art. 6(1)(a) GDPR), Legitimate Interests (Art. 6(1)(f) GDPR).

When you contact us (e.g., via contact form, email, phone, or social media), we process the personal information provided, to the extent necessary to respond to inquiries or requested actions.

If the inquiry is made within a contractual or pre-contractual context, processing is based on our obligations under that relationship. Otherwise, it is based on our legitimate interest in responding to inquiries.

Types of data processed: Basic data (e.g., names, addresses), contact details (e.g., emails, phone numbers), content data (e.g., text input, photos, videos).

Affected persons: Communication partners.

Purpose of processing: Responding to contact requests and communication.

Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR), Legitimate Interests (Art. 6(1)(f) GDPR).

To securely and efficiently provide our online services, we use one or more web hosting providers. These services may include infrastructure, platform services, computing capacity, storage, databases, security, and maintenance.

This can involve processing all user-related data arising from use and communication, such as IP addresses necessary for delivering website content and any data entered on our website.

Email transmission and hosting: Our hosting services also cover sending, receiving, and storing emails, including processing sender/recipient addresses, email content, provider info, and potentially for spam detection. Note that emails sent via the internet are generally not end-to-end encrypted, so we cannot guarantee their security during transmission.

Access logs and log files: Our hosting provider collects server log data such as the address/name of retrieved websites/files, date/time of access, transferred data amounts, browser version, OS, referrer URL, IP addresses, and provider details—for security (e.g., detecting DDoS attacks) and server stability.

Content Delivery Network (CDN): We use a CDN to deliver content—especially large media files like graphics or scripts—more efficiently and securely via distributed servers.

Types of data processed: Content data (e.g., text, photos, videos), usage data, meta/communication data, basic data, contact details.

Affected persons: Users (e.g., website visitors, online users).

Purpose of processing: CDN delivery, communication, reach measurement, tracking, remarketing, performance analysis, profiling, conversion measurement.

Legal basis: Legitimate Interests (Art. 6(1)(f) GDPR), Consent (Art. 6(1)(a) GDPR).

Service Providers Used:

• UScreen (website and forms): uscreen.tv
• Amazon Web Services (AWS) (hosting): aws.amazon.com
• Cloudflare (CDN): cloudflare.com

We use internet-accessible software (so-called "cloud services" or "Software as a Service") for document storage, calendars, email, spreadsheets, presentations, file sharing, publishing web content, and communication (e.g., chat, audio/video conferencing).

Personal data may be processed and stored on these providers’ servers if it's part of our communication or necessary for business purposes. This includes user data, contact details, transaction data, and metadata used for security or service improvement.

If we share forms or content publicly via cloud services, providers may also store cookies on users' devices for analytics or settings.

Legal basis: If consent is requested, the basis is consent. Otherwise, use may be tied to contractual services or our legitimate interest in efficient collaboration.

Types of data processed: Basic data, contact data, content data, usage data, meta/communication data.

Affected persons: Customers, employees, prospects, communication partners.

Purpose of processing: Office and organizational workflows.

Legal basis: Consent (Art. 6(1)(a) GDPR), Contract fulfillment (Art. 6(1)(b) GDPR), Legitimate Interests (Art. 6(1)(f) GDPR).

Service Providers Used:

• Dropbox: dropbox.com
• Google Cloud Services: cloud.google.com

We process personal data for online marketing purposes—especially showing promotional or relevant content based on user interests and measuring effectiveness.

We create user profiles, store them in cookies or similar technologies, and collect relevant information like viewed content, websites, networks used, communication partners, browser/system info, and usage times. If location access is granted, that may be processed too.

We also use IP masking to anonymize IP addresses. Typically, only pseudonymous data is used—not real names or emails—unless a service (e.g., social network) links it.

Profiles may be stored in cookies and used across websites using the same marketing service. In rare cases, real identities may be matched (e.g., via social networks with consent).

We usually only see aggregate success metrics for our ads. For example, conversion tracking shows whether an ad led to a purchase or sign-up.

Legal basis: Consent (when requested); otherwise, legitimate interest in efficient and user-friendly services.

Example: Facebook Pixel

We use Facebook Pixel to show Facebook ads to users interested in our site or matching custom criteria (e.g., interests or behaviors). This ensures relevance and allows us to track ad performance (e.g., whether users visited our site after clicking a Facebook ad).

Types of data processed: Usage data, meta/communication data, location data.

Affected persons: Users and prospects.

Purpose of processing: Tracking, remarketing, interest-based marketing, profiling, conversion tracking, reach measurement, audience building, cross-device tracking.

Security measure: IP masking.

Legal basis: Consent (Art. 6(1)(a) GDPR), Legitimate Interests (Art. 6(1)(f) GDPR).

Opt-Out options:

If no direct opt-out is offered by a provider, you can disable cookies in your browser (note: this may limit functionality).

Other opt-out tools:

• Europe: youronlinechoices.eu
• Canada: youradchoices.ca
• USA: aboutads.info/choices
• Global: optout.aboutads.info

Service Providers Used:

Google Analytics:

Online marketing and web analysis;

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland;

Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA;

Website: https://marketingplatform.google.com/intl/de/about/analytics/

Privacy Policy: https://policies.google.com/privacy

Privacy Shield (guaranteeing data protection standards for processing data in the USA): https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active

Opt-out options:

• Opt-out plugin: http://tools.google.com/dlpage/gaoptout?hl=de
• Settings for advertising display: https://adssettings.google.com/authenticated

Facebook Pixel:

Service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland;

Parent company: Facebook, 1 Hacker Way, Menlo Park, CA 94025, USA;

Website: https://www.facebook.com

Privacy Policy: https://www.facebook.com/about/privacy

Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active

Opt-out option: https://www.facebook.com/settings?tab=ads

We integrate functional and content elements into our online offering that are sourced from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos, social media buttons, and posts (collectively referred to as “content”).

Such integration always requires that the third-party providers of this content process the IP address of the users, as they cannot send the content to the user’s browser without the IP address. The IP address is therefore necessary for displaying these contents or functions. We strive to use only those contents whose respective providers use the IP address solely for delivering the content.

Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. These pixel tags allow information such as visitor traffic on the pages of this website to be evaluated. The pseudonymized information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit, and other details regarding the use of our online offering, and may also be combined with such information from other sources.

Note on Legal Bases:

If we ask users for their consent to use third-party providers, the legal basis for data processing is consent. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economic, and user-friendly services). In this context, we also refer to the information about the use of cookies in this privacy policy.

Types of Data Processed:

Usage data (e.g., pages visited, interest in content, access times),

Meta/communication data (e.g., device information, IP addresses).

Data Subjects:

Users (e.g., website visitors, users of online services).

Purposes of Processing:

Provision of our online offering and user-friendliness, performance of contractual services and customer support.

Legal Bases:

Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR)

Google Fonts:

We integrate fonts (“Google Fonts”) provided by Google, where user data is only used for the purpose of displaying fonts in the user's browser. The integration is based on our legitimate interest in a technically secure, maintenance-free, and efficient use of fonts, their uniform presentation, and consideration of potential licensing restrictions on their integration.

Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland;

Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA;

Website: https://fonts.google.com/

Privacy Policy: https://policies.google.com/privacy

Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000TRkEAAW&status=Active

We use services, platforms, and software from other providers (hereinafter referred to as “third-party providers”) for purposes of organization, administration, planning, and the provision of our services. When selecting third-party providers and their services, we observe legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. This may include various types of data that we process according to this privacy policy. Such data may include, in particular, master data and contact information of users, data relating to processes, contracts, other procedures, and their content.

If users are referred to the third-party providers or their software or platforms in the course of communication, business, or other relationships with us, these third-party providers may process usage data and metadata for security purposes, service optimization, or marketing purposes. We therefore ask you to refer to the respective third-party providers’ privacy policies.

Note on Legal Bases:

If we ask users for consent to use third-party providers, the legal basis for data processing is consent. Their use may also be part of our (pre-)contractual services if the use of third-party providers was agreed upon within that context. Otherwise, user data is processed on the basis of our legitimate interests (i.e., interest in efficient, economic, and user-friendly services). In this context, we also refer to the information about the use of cookies in this privacy policy.

Types of Data Processed:

• Inventory data (e.g., names, addresses)
• Contact data (e.g., email, telephone numbers)
• Content data (e.g., text entries, photographs, videos)
• Usage data (e.g., pages visited, interest in content, access times)
• Meta/communication data (e.g., device information, IP addresses)

Data Subjects:

Communication partners, users (e.g., website visitors, users of online services)

Legal Bases:

• Consent (Art. 6 para. 1 sentence 1 lit. a GDPR)
• Contract performance and pre-contractual inquiries (Art. 6 para. 1 sentence 1 lit. b GDPR)
• Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR)

You remain solely liable for all obligations related to use of the Service, even after you have stopped using the Service. Neither Shibari Study nor any of its licensors, suppliers, or publishers are liable to you or to any third party for any loss caused by any termination of the Service or termination of your access to the Service.

Data processed by us will be deleted in accordance with legal requirements as soon as any consent granted for processing is revoked or other authorizations cease to apply (e.g., if the purpose for processing the data no longer exists or the data is no longer necessary for that purpose).

If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to those purposes. This means the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the establishment, exercise, or defense of legal claims or to protect the rights of another natural or legal person.

Further information on the deletion of personal data may also be provided within the individual privacy notices in this Privacy Policy.

We kindly ask you to regularly review the contents of our Privacy Policy. We will adjust the Privacy Policy as soon as changes in the data processing activities carried out by us make it necessary. We will inform you if the changes require any cooperation on your part (e.g., renewed consent) or any other individual notification.

As a data subject, you are entitled to various rights under the GDPR, in particular Articles 15 to 18 and 21:

• Right to Object: You have the right to object, at any time and on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Article 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions. If your personal data is processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling insofar as it is related to direct marketing.
• Right to Withdraw Consent: You have the right to withdraw any consent you have given at any time.
• Right of Access: You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to that personal data along with further information and a copy of the data as provided by law.
• Right to Rectification: You have the right to request the completion or correction of inaccurate personal data concerning you, in accordance with legal requirements.
• Right to Erasure and Restriction of Processing: You have the right, in accordance with legal requirements, to request that personal data concerning you be deleted without undue delay, or alternatively, to request restriction of processing of the data as legally permitted.
• Right to Data Portability: You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and to transmit those data to another controller, in accordance with legal requirements.
• Right to Lodge a Complaint with a Supervisory Authority: You also have the right, in accordance with the law, to lodge a complaint with a supervisory authority, particularly in the member state of your habitual residence, your place of work, or the place of the alleged infringement, if you believe that the processing of personal data relating to you violates the GDPR.

This section provides an overview of the terminology used in this Privacy Policy. Many of the terms are taken from the law and are defined primarily in Article 4 of the GDPR. The legal definitions are binding. The following explanations are intended to enhance understanding. The terms are listed in alphabetical order.

• Conversion Tracking: A method used to measure the effectiveness of marketing activities. Typically, a cookie is placed on the users’ devices on the websites where marketing takes place and is then accessed again on the target website. This allows us to determine, for example, whether ads we placed on other websites were successful.
• Content Delivery Network (CDN): A service that helps deliver content of an online offering, particularly large media files such as graphics or program scripts, faster and more securely using regionally distributed, internet-connected servers.
• Cross-Device Tracking: A type of tracking where behavioral and interest-related information about users is collected across devices in so-called profiles, using an online identifier. This allows analysis of user behavior across different browsers or devices (e.g., smartphones and desktops). This identifier is generally not linked to personally identifiable information such as names or email addresses.
• IP Masking: A method whereby the last octet (the last two numbers) of an IP address is removed so that it can no longer be used to uniquely identify a person. This serves as a pseudonymization technique, especially in online marketing.
• Interest-Based and Behavioral Marketing: Marketing practices that aim to determine the likely interests of users based on previous behavior (e.g., visiting specific websites, interaction, purchasing behavior) to show them targeted ads. This information is typically stored in a profile using cookies.
• Conversion Measurement: Similar to conversion tracking, it measures the effectiveness of marketing efforts. A cookie is set on the user's device during the marketing activity and accessed again upon completion (e.g., a successful purchase).
• Personal Data: All information relating to an identified or identifiable natural person ("data subject"); a person is considered identifiable if they can be identified directly or indirectly by reference to an identifier such as name, location data, online ID, or specific characteristics expressing their identity.
• Profiling: Any form of automated processing of personal data to analyze or predict certain personal aspects (e.g., interests, location, purchasing behavior, social interactions). Cookies and web beacons are often used for this purpose.
• Reach Measurement: Also known as web analytics, this involves evaluating visitor flows and their interests (e.g., which content they engage with). It helps website operators tailor content to user needs. Cookies and web beacons are typically used for this.
• Remarketing / Retargeting: Refers to recording user interest in products on a website for the purpose of reminding them via ads on other websites.
• Tracking: The ability to follow user behavior across multiple online offerings. Behavioral and interest data is usually stored in cookies or provider servers and used for targeted advertising.
• Controller: A natural or legal person, public authority, agency, or other body that determines the purposes and means of processing personal data.
• Processing: Any operation performed on personal data, whether or not by automated means, including collection, storage, use, disclosure, or deletion.
• Audience Segmentation (Custom Audiences): Refers to defining specific target audiences for advertising purposes. For example, based on user interest in products, ads can be targeted accordingly. “Lookalike Audiences” are users with similar profiles or interests as existing audience groups. Cookies and web beacons are typically used for this.