Privacy Policy

With this privacy policy, we would like to inform you about the types of personal data (hereinafter referred to simply as “data”) we process, as well as the purposes and scope of that processing.

This privacy policy applies to all personal data processing activities we carry out, both as part of providing our services and, in particular, on our websites, in mobile applications, and on external online platforms such as our social media profiles and our Discord server (collectively referred to as “online services”).

It covers our website www.shibaristudy.com, including our tutorial library, courses, live classes, blog, podcast, community area and Studio Directory, our iOS and Android apps, our Discord server, our Studio Partnership Program, our newsletter and our online shop at shop.shibaristudy.com.

Shibari Study GmbH

Grunewaldstraße 85

10823 Berlin Germany

Managing Director: Anton Martin

Email: mail@shibaristudy.com

The following overview summarizes the types of data we process, the purposes for which they are processed, and the categories of data subjects affected.

Below we outline the legal bases under the General Data Protection Regulation (GDPR) on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your country or ours.

• Consent (Art. 6(1)(a) GDPR): The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Explicit Consent for Special Category Data (Art. 9(2)(a) GDPR): The data subject has given explicit consent to the processing of special category personal data for one or more specified purposes.
• Performance of a Contract and Pre-contractual Inquiries (Art. 6(1)(b) GDPR): Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal Obligation (Art. 6(1)(c) GDPR): Processing is necessary to comply with a legal obligation, for example the retention of invoices and accounting records under tax and commercial law.
• Legitimate Interests (Art. 6(1)(f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, provided such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

In addition to the GDPR, national data protection regulations apply in Germany. These include, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), which provides specific provisions regarding: the right of access; the right to erasure; the right to object; the processing of special categories of personal data; processing for different purposes; data transfers; and automated individual decision-making, including profiling.

The BDSG also governs data processing for employment-related purposes (§ 26 BDSG), especially concerning the initiation, performance, or termination of employment relationships, as well as employee consent.

In addition, the Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) applies. Under § 25 TDDDG, we may only store information on your device or read information from it with your consent, unless this is strictly necessary to provide a service you have requested. See Section 11 (Use of Cookies).

Additionally, state-level data protection laws of the individual German federal states may apply.

Shibari Study is an educational platform. Because rope bondage can be part of people’s intimate lives, some of the data we hold could be seen as data concerning a person’s sex life, which Article 9 GDPR protects as special category data. To be on the safe side, we treat your your answer to our signup question as sensitive data and give it the extra protection that Article 9 GDPR requires. We keep this data safe and private.

When you sign up, we ask whether you are looking to tie, be tied, or both. Answering is optional, and you can use the Service without answering. We use the answers to understand our audience and to improve our content and the Service. We process your answer only with your consent (Art. 9(2)(a) GDPR), which you give by choosing to answer. You can withdraw your consent at any time by writing to mail@shibaristudy.com. We will then delete your answer. Withdrawal does not affect the lawfulness of processing before the withdrawal.

In accordance with legal requirements and taking into account the state of the art, implementation costs, the nature, scope, context, and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, input, transmission, availability, and separation of the data itself. We have also established procedures to ensure data subject rights, data deletion, and responses to data threats.

Moreover, we consider the protection of personal data as early as the development or selection of hardware, software, and processes, in line with the principles of data protection by design and by default.

In the course of processing personal data, we may transmit or disclose such data to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, payment service providers involved in payment transactions, IT service providers, or providers of content and services that are integrated into a website.

In such cases, we comply with the legal requirements and, in particular, conclude data processing agreements or other legal arrangements with the recipients of your data to ensure their protection.

We may transfer personal data to other units within our organization or grant them access to it. Where such transfers are made for administrative purposes, they are based on our legitimate business and organizational interests, the need to fulfill contractual obligations, the presence of data subject consent, or another legal basis.

If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), or if such processing takes place through the use of third-party services, or through the disclosure or transfer of data to other persons, entities, or companies, this is done only in accordance with legal requirements.

Unless an explicit consent has been given, or a transfer is required by contract or law, we process data only in third countries that have been officially recognized as having an adequate level of data protection, including U.S. providers certified under the EU-U.S. Data Privacy Framework, or on the basis of special guarantees, such as contractual obligations through standard contractual clauses (SCCs) approved by the EU Commission, certifications, or binding corporate rules.

(Art. 44-49 GDPR; for more information, see the EU Commission’s page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en)

Several of our providers are based in the USA or store data there. This includes Uscreen, which stores data primarily on servers in the USA, Railway, which hosts our Studio Directory in the USA, and Resend, which sends emails from our Studio Directory and processes data in the USA, as well as StreamYard, which we use to stream our live classes, and Better Stack, which stores our error logs.

“Cookies” are small files stored on users’ devices. They can store various pieces of information, such as language settings on a website, login status, a shopping cart, or the point at which a video was last played.

Cookies are commonly used when a user’s interests or behavior (e.g., viewing specific content, using features) are saved across individual websites in a user profile. These profiles help show users content that matches their potential interests. This practice is known as “tracking.” We also include other technologies under “cookies” if they fulfill similar purposes (e.g., storing user information using pseudonymous online identifiers, also called “user IDs”).

If we use cookies or tracking technologies, you will be separately informed in our privacy policy.

Legal basis: The legal basis for processing personal data via cookies depends on whether we request your consent. If so, and you give consent, the legal basis is that consent. Otherwise, we process data via cookies based on our legitimate interests (e.g., for efficient business operation or improving our online offering) or because cookies are necessary for fulfilling contractual obligations.

Under § 25 TDDDG, we only set cookies that are not strictly necessary with your consent. On our website we ask for your consent with our cookie banner and store your choices with the consent management tool of Usercentrics GmbH, Germany. Our shop uses Shopify’s cookie banner. Strictly necessary cookies, for example for your login or your choices in the cookie banner, are set without consent.

Withdrawal and Objection (Opt-Out): Regardless of whether processing is based on consent or legal authorization, you may withdraw your consent or object to the use of cookie technologies at any time (“opt-out”).

You can change or withdraw your consent at any time via the cookie settings link in our website footer. You can also do so via your browser settings (e.g., disabling cookies, which may impair the functionality of our online offering). You can also object to cookies used for online marketing (especially tracking) via:

• U.S.: aboutads.info/choices
• EU: youronlinechoices.com
• Global: optout.aboutads.info

Types of data processed: Usage data (e.g., visited websites, content interest, access times), meta/communication data (e.g., device info, IP addresses).

Affected persons: Users (e.g., website visitors, online service users).

Legal basis: Consent (Art. 6(1)(a) GDPR), Legitimate Interests (Art. 6(1)(f) GDPR).

Service Providers Used: Usercentrics (consent management): Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany. Website: usercentrics.com.

When you contact us (e.g., via contact form, email, phone, or social media), we process the personal information provided, to the extent necessary to respond to inquiries or requested actions.

If the inquiry is made within a contractual or pre-contractual context, processing is based on our obligations under that relationship. Otherwise, it is based on our legitimate interest in responding to inquiries.

We handle support requests by email using Google Workspace (see Section 20).

Types of data processed: Basic data (e.g., names, addresses), contact details (e.g., emails, phone numbers), content data (e.g., text input, photos, videos).

Affected persons: Communication partners.

Purpose of processing: Responding to contact requests and communication.

Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR), Legitimate Interests (Art. 6(1)(f) GDPR).

To provide our online services securely and efficiently, we use one or more web hosting providers. These services may include infrastructure, platform services, computing capacity, storage, databases, security and maintenance.

This can involve processing user-related data arising from use and communication, such as IP addresses necessary for delivering website content and any data entered on our website.

Email transmission and hosting: Our hosting services also cover sending, receiving and storing emails. Note that emails sent via the internet are generally not end-to-end encrypted, so we cannot guarantee their security during transmission.

Access logs and log files: Our hosting provider collects server log data such as the address/name of retrieved websites/files, date/time of access, transferred data amounts, browser version, operating system, referrer URL, IP addresses and provider details, for security (e.g., detecting DDoS attacks) and server stability.

Content Delivery Network (CDN): We use a CDN to deliver content, especially large media files like graphics or scripts, more efficiently and securely via distributed servers.

Types of data processed: Content data (e.g., text, photos, videos), usage data, meta/communication data, inventory data, contact data.

Affected persons: Users (e.g., website visitors, online users), Members.

Purpose of processing: Providing and securing our online services, member accounts and live classes; content delivery (CDN); sending and receiving emails, error logging.

Legal basis: Contract performance (Art. 6(1)(b) GDPR) for member accounts, Membership and live classes; Legitimate Interests (Art. 6(1)(f) GDPR) in the secure and efficient operation of our online services.

Service Providers Used:

• Cloudflare (CDN): cloudflare.com
• Railway (hosting of parts of our website, including the Studio Directory; data is stored in the USA): railway.com
• Fastly (CDN): fastly.com
• Better Stack (error logs): betterstack.com. Provider: Better Stack, Inc., USA.
• Resend (emails from our Studio Directory): resend.com. Provider: Plus Five Five, Inc., USA.
• Uscreen (website and forms, video hosting, member accounts, Membership checkout, community area and our iOS and Android apps): uscreen.tv. Provider: UScreen.tv, LLC, USA.
• StreamYard (production and streaming of our live classes): streamyard.com. Provider: Bending Spoons US, Inc., USA.

You can download our iOS and Android app from the respective app stores. When you download an app, Apple or Google processes your data under its own privacy policy as an independent controller.

If you subscribe in our iOS app, Apple processes your payment. We receive information about your subscription status from Apple, but not your payment details.

Types of data processed: Inventory data, contact data, usage data, meta/communication data, order and payment data. Affected persons: Users, Members. Legal basis: Contract performance (Art. 6(1)(b) GDPR).

Service Providers Used: Apple App Store: Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

When you pay for a Membership, a gift membership or a shop order, your payment is handled by the payment provider you choose. The provider processes your payment details, such as card or bank account details, and we do not store full card or bank details ourselves. We receive transaction details, such as the payment status, amount, date and payment method.

At checkout we offer card payments, SEPA Direct Debit, iDEAL | Wero and other bank and wallet payments through Stripe, as well as PayPal. Depending on your country, we also offer payment by installments or later payment through Klarna, Afterpay and Affirm. These providers may check your identity and creditworthiness under their own privacy policies. Purchases in our iOS app are handled by Apple (see Section 14).

Types of data processed: Inventory data, contact data, order and payment data. Affected persons: Customers, Members. Purpose of processing: Processing payments, preventing fraud, accounting. Legal basis: Contract performance (Art. 6(1)(b) GDPR); Legal Obligation (Art. 6(1)(c) GDPR) for tax and accounting records; Legitimate Interests (Art. 6(1)(f) GDPR) for fraud prevention.

Service Providers Used:

• Stripe: Stripe Payments Europe, Limited, Ireland. Website: stripe.com.
• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Website: paypal.com.
• Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Website: klarna.com.
• Afterpay, in the UK Clearpay: Clearpay Finance Limited, United Kingdom. Website: afterpay.com.
• Affirm: Affirm, Inc., USA. Website: affirm.com.

Our online shop at shop.shibaristudy.com runs on Shopify. When you order, we process your name, email address, billing and shipping address, the products you ordered and your payment status, in order to fulfill, ship and support your order. We pass the data needed for delivery, such as your name and shipping address, to DHL. We also use apps in our shop that receive customer or order data, for shipping, subscriptions, upselling, reviews, our affiliate program, accounting and automation. Some of these providers are based outside the EU (see Section 10).

Types of data processed: Inventory data, contact data, order and payment data, usage data, meta/communication data. Affected persons: Customers. Purpose of processing: Order fulfillment, shipping, customer support, subscriptions, upselling, reviews, affiliate marketing, accounting. Legal basis: Contract performance (Art. 6(1)(b) GDPR); Legal Obligation (Art. 6(1)(c) GDPR) for tax and accounting records; Legitimate Interests (Art. 6(1)(f) GDPR) in offering additional products, collecting reviews and running our affiliate program.

Service Providers Used: Shopify: Shopify International Limited, Ireland. Website: shopify.com. DHL (parcels): DHL Paket GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany. DHL Express: DHL Express Germany GmbH, Heinrich-Brüning-Straße 5, 53113 Bonn, Germany. Website: dhl.com.

We send emails about our content, courses, challenges, offers, events and community activity. You can switch them off individually or all at once at any time in your email preferences, or by using the unsubscribe link in every email. You can also subscribe through one of our sign-up forms; in that case we ask you to confirm your subscription by email (double opt-in).

If you have an account, we pass your name, email address, membership status and email choices from our platform to our email provider and keep both in sync. Our email provider may measure whether emails are opened and which links are clicked.

Types of data processed: Contact data, usage data, membership status. Affected persons: Users with an account & newsletter subscribers.

Service Providers Used: Mailchimp: The Rock et Science Group LLC, USA. Website: mailchimp.com.

The community area on our website is provided through our platform provider (see Section 13). We also run a community Discord server, open to our community. Discord is a third-party platform. When you join our Discord server, Discord processes your data as an independent controller under its own privacy policy. For users in the EEA, Discord is operated by Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands; parent company: Discord Inc., 444 De Haro Street, San Francisco, CA 94107, USA. Privacy Policy: discord.com/privacy.

We moderate the spaces we administer, but we do not control Discord’s own data practices. Please review Discord’s privacy policy before joining. Posts in community spaces are visible to other members, so please think carefully about what personal information you share there.

Types of data processed: Content data, usage data, contact data. Affected persons: Users, Members. Legal basis: Legitimate Interests (Art. 6(1)(f) GDPR) in operating a community space. Joining Discord is optional.

Our podcast is hosted by Buzzsprout. When you listen to an episode on our website or in a podcast app, Buzzsprout processes your IP address and technical data about your device to deliver the episode and to create listening statistics. The podcast player on our website only loads with your consent (see Section 11).

Types of data processed: Usage data, meta/communication data. Affected persons: Users. Legal basis: Consent (Art. 6(1)(a) GDPR) for the player on our website; Legitimate Interests (Art. 6(1)(f) GDPR) for delivering episodes in podcast apps.

Service Providers Used: Buzzsprout: Higher Pixels, USA. Website: buzzsprout.com.

We use internet-accessible software (so-called “cloud services” or “Software as a Service”) for document storage, calendars, email, spreadsheets, presentations, file sharing, publishing web content, and communication (e.g., chat, audio/video conferencing).

Personal data may be processed and stored on these providers’ servers if it is part of our communication or necessary for business purposes. This includes user data, contact details, transaction data, and metadata used for security or service improvement.

If we share forms or content publicly via cloud services, providers may also store cookies on users’ devices for analytics or settings.

Types of data processed: Basic data, contact data, content data, usage data, meta/communication data.

Affected persons: Customers, employees, prospects, communication partners.

Purpose of processing: Office and organizational workflows.

Legal basis: Consent (Art. 6(1)(a) GDPR), Contract fulfillment (Art. 6(1)(b) GDPR), Legitimate Interests (Art. 6(1)(f) GDPR).

Service Providers Used:

• Google Workspace (email, including customer support, calendar and file storage). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: cloud.google.com

We process personal data for online marketing purposes, especially showing promotional or relevant content based on user interests and measuring effectiveness.

We create user profiles, store them in cookies or similar technologies, and collect relevant information like viewed content, websites, networks used, communication partners, browser/system info, and usage times. If location access is granted, that may be processed too.

We also use IP masking to anonymize IP addresses. Typically, only pseudonymous data is used, not real names or emails, unless a service (e.g., social network) links it.

Profiles may be stored in cookies and used across websites using the same marketing service. In rare cases, real identities may be matched (e.g., via social networks with consent).

We usually only see aggregate success metrics for our ads. For example, conversion tracking shows whether an ad led to a purchase or sign-up.

Legal basis: We use the services in this section only with your consent through our cookie banner (Art. 6(1)(a) GDPR, § 25 TDDDG).

Types of data processed: Usage data, meta/communication data, location data. Affected persons: Users and prospects. Purpose of processing: Tracking, remarketing, interest-based marketing, profiling, conversion tracking, reach measurement, audience building, cross-device tracking. Security measure: IP masking.

Opt-out tools, if no direct opt-out is offered by a provider (disabling cookies in your browser may limit functionality):

• Europe: youronlinechoices.eu
• Canada: youradchoices.ca
• USA: aboutads.info/choices
• Global: optout.aboutads.info

Services and Providers Used:

• Google Analytics (online marketing and web analysis): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://policies.google.com/privacy. Transfers to the USA: see Section 10. Opt-out: http://tools.google.com/dlpage/gaoptout and https://adssettings.google.com/authenticated
• Google Tag Manager (tag management; does not itself set tracking cookies): Google Ireland Limited, Dublin, Ireland.
• Google Ads (conversion tracking and remarketing): Google Ireland Limited, Dublin, Ireland. Opt-out: https://adssettings.google.com/authenticated
• Facebook Pixel: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; parent company: Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. Privacy Policy: https://www.facebook.com/about/privacy. Transfers to the USA: see Section 10. Opt-out: https://www.facebook.com/settings?tab=ads
• Microsoft Clarity (web analysis, including session recordings of clicks, scrolling and mouse movements): Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; parent company: Microsoft Corporation, USA. Privacy Policy: https://privacy.microsoft.com/privacystatement

We integrate functional and content elements into our online offering that are sourced from the servers of their respective providers (hereinafter “third-party providers”). These may include, for example, graphics, videos, social media buttons, and posts (collectively “content”).

Such integration always requires that the third-party providers of this content process the IP address of the users, as they cannot send the content to the user’s browser without the IP address. The IP address is therefore necessary for displaying these contents or functions. We strive to use only those contents whose respective providers use the IP address solely for delivering the content.

Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as “web beacons”) for statistical or marketing purposes. These may evaluate information such as visitor traffic. The pseudonymized information may also be stored in cookies on the user’s device and may contain technical information about the browser and operating system, referring websites, time of visit, and other usage details, and may be combined with such information from other sources.

Note on Legal Bases: If we ask users for their consent to use third-party providers, the legal basis is consent. Otherwise, user data is processed based on our legitimate interests (i.e., interest in efficient, economic, and user-friendly services). We also refer to the information about the use of cookies in this privacy policy.

Types of Data Processed: Usage data (e.g., pages visited, interest in content, access times), meta/communication data (e.g., device information, IP addresses). Data Subjects: Users (e.g., website visitors, users of online services). Purposes of Processing: Provision of our online offering and user-friendliness, performance of contractual services and customer support. Legal Bases: Legitimate interests (Art. 6(1)(f) GDPR).

Services and Providers Used:

• Google Fonts: We integrate fonts provided by Google, where user data is only used to display fonts in the user’s browser. Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://policies.google.com/privacy. Transfers to the USA: see Section 10.

We use services, platforms, and software from other providers (hereinafter “third-party providers”) for purposes of organization, administration, planning, and the provision of our services. When selecting third-party providers and their services, we observe legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers. This may include master data and contact information of users, data relating to processes, contracts, other procedures, and their content.

If users are referred to the third-party providers or their software or platforms in the course of communication, business, or other relationships with us, these third-party providers may process usage data and metadata for security purposes, service optimization, or marketing purposes. We therefore ask you to refer to the respective third-party providers’ privacy policies.

Note on Legal Bases: If we ask users for consent, the legal basis is consent. Their use may also be part of our (pre-)contractual services if agreed within that context. Otherwise, user data is processed on the basis of our legitimate interests.

Types of Data Processed: Inventory data, contact data, content data, usage data, meta/communication data. Data Subjects: Communication partners, users. Legal Bases: Consent (Art. 6(1)(a) GDPR), Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR), Legitimate interests (Art. 6(1)(f) GDPR).

If you create or claim a listing in our Studio Directory as a studio, instructor or organizer (“Lister”), for example through our Studio Entry portal, we process your contact details, your listing content and any media you upload, in order to operate the Directory. You sign in to the Studio Entry portal with your Shibari Study account. Listings are public. Your relationship with us as a Lister is described in our Lister Agreement. This section applies to Community Listings and Studio Partners alike. The provision of this data is required to create and maintain your listing; without it, we are unable to include you in the Directory.

In addition, we process your application (Community Listings only), a record of your acceptance of our Lister Agreement, and information about instructors or team members that you add to your listing, which is published together with your listing. For security purposes, we store session data, such as your IP address and browser information. To review applications and moderate the Directory, we keep internal notes, reports and an activity log.

Studio Partners additionally enter into a separate partnership contract with us. We store this contract, partner contact details and notes from our vetting conversations in Google Workspace (see Section 20).

The Studio Directory is hosted by Railway in the USA. Emails from the Studio Directory are sent via Resend, USA (see Sections 10 and 13).

Types of data processed: Inventory data, contact data, content data, meta/communication data. Affected persons: Listers, instructors and team members named in listings. Legal basis: Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Legitimate Interests (Art. 6(1)(f) GDPR) in the security of the Directory, the review of applications and the moderation of listings.

Data processed by us will be deleted in accordance with legal requirements as soon as any consent granted for processing is revoked or other authorizations cease to apply (e.g., if the purpose for processing the data no longer exists or the data is no longer necessary).

If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted to those purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the establishment, exercise, or defense of legal claims or to protect the rights of another natural or legal person.

Further information on the deletion of personal data may also be provided within the individual privacy notices in this Privacy Policy.

You can ask us to delete your account at any time by writing to mail@shibaristudy.com.

We kindly ask you to regularly review the contents of our Privacy Policy. We will adjust the Privacy Policy as soon as changes in our data processing activities make it necessary. We will inform you if the changes require any cooperation on your part (e.g., renewed consent) or any other individual notification.

As a data subject, you are entitled to various rights under the GDPR, in particular Articles 15 to 18 and 21:

• Right to Object: You have the right to object, at any time and on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Article 6(1)(e) or (f) GDPR, including profiling. If your personal data is processed for direct marketing purposes, you have the right to object at any time, including profiling related to direct marketing.
• Right to Withdraw Consent: You have the right to withdraw any consent you have given at any time, including consent for sensitive data under Article 9 GDPR (see Section 6). Withdrawal applies for the future.
• Right of Access: You have the right to obtain confirmation as to whether personal data concerning you is being processed, and, where that is the case, access to that data along with further information and a copy as provided by law.
• Right to Rectification: You have the right to request the completion or correction of inaccurate personal data concerning you.
• Right to Erasure and Restriction of Processing: You have the right to request that personal data concerning you be deleted without undue delay, or alternatively to request restriction of processing, as legally permitted.
• Right to Data Portability: You have the right to receive the personal data concerning you that you have provided to us, in a structured, commonly used, and machine-readable format, and to transmit it to another controller, in accordance with legal requirements.
• Right to Lodge a Complaint with a Supervisory Authority: You have the right to lodge a complaint with a supervisory authority, particularly in the member state of your habitual residence, your place of work, or the place of the alleged infringement, if you believe the processing violates the GDPR.

To exercise your rights, write to us at mail@shibaristudy.com. The supervisory authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

This section provides an overview of the terminology used in this Privacy Policy. Many terms are taken from the law and defined primarily in Article 4 GDPR. The legal definitions are binding; the following explanations are intended to enhance understanding, listed in alphabetical order.

• Conversion Tracking / Conversion Measurement: Methods used to measure the effectiveness of marketing activities, typically by placing a cookie on the user’s device during marketing and accessing it again on a target or completion page (e.g., a purchase).
• Content Delivery Network (CDN): A service that helps deliver content, particularly large media files, faster and more securely using regionally distributed, internet-connected servers.
• Cross-Device Tracking: Collecting behavioral and interest-related information about users across devices in profiles, using an online identifier, generally not linked to personally identifiable information such as names or emails.
• IP Masking: Removing the last octet of an IP address so it can no longer uniquely identify a person; a pseudonymization technique used especially in online marketing.
• Interest-Based and Behavioral Marketing: Determining likely user interests based on previous behavior to show targeted ads, typically stored in a profile using cookies.
• Personal Data: All information relating to an identified or identifiable natural person.
• Profiling: Any automated processing of personal data to analyze or predict personal aspects (e.g., interests, location, purchasing behavior).
• Reach Measurement: Evaluating visitor flows and interests to tailor content; cookies and web beacons are typically used.
• Remarketing / Retargeting: Recording user interest in products to remind them via ads on other websites.
• Special Category Data: Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data; health data; and data concerning a person’s sex life or sexual orientation (Article 9 GDPR).
• Tracking: Following user behavior across multiple online offerings; usually stored in cookies or provider servers and used for targeted advertising.
• Controller: A natural or legal person or body that determines the purposes and means of processing personal data.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• Audience Segmentation (Custom Audiences): Defining specific target audiences for advertising; “Lookalike Audiences” are users with similar profiles to existing groups. Cookies and web beacons are typically used.

Last updated: 28. Oct 2026