01 · Controller
The controller responsible for processing personal data on this website is KOA Studio UG (haftungsbeschränkt), Porzer Ringstraße 60, 51149 Cologne, Germany. Email: hi@koastudio.de.
PRIVACY.
Privacy information for KOA Studio UG (haftungsbeschränkt).
02 · Hosting & server logs
The website is hosted on server infrastructure provided by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. When the website is accessed, technically necessary information such as IP address, access time, requested URL, referrer, browser and device information may be processed in server logs. Processing serves the secure, stable and efficient provision of the website and is based on Art. 6(1)(f) GDPR. Log data is retained only for as long as required for operation, security and troubleshooting, subject to statutory obligations.
03 · Contact form & email
If you use the contact form or contact us by email, we process the information you provide in order to handle your enquiry and continue project communication. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to entering into or performing a contract, otherwise Art. 6(1)(f) GDPR. Sending and internal delivery are handled through Google Workspace; website enquiries are delivered to the group address hi@koastudio.de. The EEA provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data is deleted when it is no longer required for the enquiry and no statutory retention obligation applies.
04 · Consent & essential storage
We use an essential consent cookie to store your privacy choices. It contains only the selected categories and consent version. Optional analytics or marketing technologies are not loaded before consent. You can change or withdraw your choice at any time via Cookie Settings in the footer.
05 · Google Tag Manager
We use Google Tag Manager by Google Ireland Limited as the technical management layer for analytics and marketing tags. In our Basic Consent configuration, Tag Manager is only loaded once you have consented to at least one optional category. The tags that may execute depend on your selection. Optional access and processing are based on your consent under applicable ePrivacy rules and Art. 6(1)(a) GDPR.
06 · Google Analytics 4
After consent to Analytics, we use Google Analytics 4 to measure website use, page views, interactions with projects and services and the success of contact enquiries. The provider is Google Ireland Limited. Analytics may process identifiers and information about the device, browser, page visit, referrer and interactions. Google states that IP addresses of users in the EU are discarded before logging. Processing is based on your consent under applicable ePrivacy rules and Art. 6(1)(a) GDPR. Consent can be withdrawn at any time through Cookie Settings.
07 · Marketing & future advertising platforms
The website is technically prepared to use marketing tags for campaign measurement and retargeting after explicit consent. Providers such as Google Ads, Meta, LinkedIn, TikTok or Microsoft Ads are not activated merely because this capability exists. Before an additional provider is activated, the consent configuration and this privacy policy will be updated accordingly. Marketing tags may only execute when Marketing consent is active.
08 · Campaign & attribution data
If you consent to Analytics or Marketing, campaign parameters such as UTM values, referrer information and – where Marketing consent exists – advertising click identifiers may be stored to understand how an enquiry originated. The website stores limited first- and last-touch attribution information locally in the browser for a limited period. Without consent, these values are not persistently stored or transmitted to analytics or advertising providers.
09 · Locally served fonts
The webfonts used on this website are delivered with the website itself. Displaying the fonts therefore does not establish a connection to Google Fonts, Adobe Fonts or another external font CDN.
10 · International transfers
Where a service provider processes data outside the European Economic Area, transfers take place only on the basis of applicable legal safeguards, such as an adequacy decision or appropriate standard contractual clauses. The actual transfer depends on the service that is activated and its configuration.
11 · Your rights
Subject to the statutory requirements, you have rights including access, rectification, erasure, restriction, data portability and objection. Consent may be withdrawn at any time with effect for the future. You also have the right to lodge a complaint with a competent data protection supervisory authority.
12 · Version
This privacy policy is current as of 26 August 2026. We will update it if the services used or the tracking configuration changes.