Privacy policy

Hoffmann, Smilla & Kudernak, Tanja GbR, Schießgartenstraße 25b, 63303 Dreieich, Germany.

Contact for data protection requests: info@offstudios.de · phone: +49 177 8583201.

Our website is hosted by Netlify, Inc. When you access the site, technically necessary server logs (IP address, user agent, timestamp, requested resource) are processed for the duration of the connection (Art. 6 (1) (f) GDPR; legitimate interest in secure operation).

We use Supabase (EU region) as our database backend. Data processing agreements under Art. 28 GDPR are in place or will be concluded with the providers named above.

When you join a waitlist (e.g. Mat Pilates), we process your first name, email address, selected language and optionally a note. The legal basis is your consent (Art. 6 (1) (a) GDPR).

For the survey, we process your selected weekdays, time slots and, optionally, free-text preferences, a comment and an email address for follow-up. The legal basis is your consent (Art. 6 (1) (a) GDPR).

When you use the contact form on /kontakt we process your name, email address, the selected topic and your message in order to respond. The legal basis is your consent (Art. 6 (1) (a) GDPR) and pre-contractual measures (Art. 6 (1) (b) GDPR).

For workshop registrations we process first and last name, email address and optionally phone and notes to run the registration and related communication (Art. 6 (1) (b) GDPR).

For kids' art holiday courses we process the child's details (first and last name, optionally allergies/notes) and the parent or guardian's name, email and phone for registration and supervision (Art. 6 (1) (b) GDPR).

For kids' art membership reservations via our form (where applicable) we process the contact and course details needed for the reservation (Art. 6 (1) (b) GDPR or consent, Art. 6 (1) (a) GDPR).

For pop-up registrations we process first and last name, email address and optionally phone, how you found us and experience level, based on your consent or to run the registration (Art. 6 (1) (a) or (b) GDPR).

For applications via /karriere we process the information you submit (including name, contact details, qualifications, availability and message) to review your application (Art. 6 (1) (b) GDPR or legitimate interest, Art. 6 (1) (f) GDPR).

You can withdraw consent at any time with effect for the future by sending a short message to info@offstudios.de.

We send confirmation, cancellation and internal notification emails via Resend (Resend, Inc.). This involves processing the recipient address, message content and technical delivery data. The legal basis is performance of a contract or pre-contractual steps (Art. 6 (1) (b) GDPR) or our legitimate interest in reliable communication (Art. 6 (1) (f) GDPR). A data processing agreement under Art. 28 GDPR is in place or will be concluded with Resend.

For workshops and kids' art holiday courses, payment may be handled via SumUp (payment link in the confirmation email). SumUp processes payment data as an independent payment provider; we typically receive confirmation of payment, not full card details. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR). Further details are in SumUp's privacy policy.

Based on your explicit consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), we use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to measure reach. Cookies and similar technologies are used, and pseudonymised usage data is processed.

GA4 uses IP truncation by default, so no full IP address is stored by Google. We additionally use Google Consent Mode v2 with a default of "denied", meaning that no analytics cookies are set without your consent.

The storage period is 14 months. You can withdraw your consent at any time via "Cookie settings" in the footer.

If you opt in to marketing and reach measurement in the cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), we load the Meta Pixel (Facebook Pixel) from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. Cookies and similar technologies are used; usage and device data are processed, among other things, to measure reach and the performance of our ads. Details: facebook.com/privacy/policy.

In addition, when you successfully join the waitlist, submit a request via the /kontakt form, or submit the survey (if you provide an email), we send a server-side event to Meta (Conversion API) so sign-ups and enquiries can be matched to campaigns as reliably as possible. This may include your email address in hashed form (SHA-256), the page URL, and optionally your IP address and user agent.

You can withdraw your consent at any time via the cookie settings in the footer.

To show the class schedule and booking flow, we embed widgets from Eversports (including scripts and content served from widget-static.eversports.io and eversports.de). This involves transferring your IP address, user agent and possibly further technical or usage data to Eversports; Eversports may set its own cookies and use similar technologies. The legal basis is our legitimate interest in offering working online booking for our classes (Art. 6 (1) (f) GDPR) and, once you book, performance of the contract (Art. 6 (1) (b) GDPR). Further information: Eversports GmbH privacy policy at eversports.de.

If you book through an aggregator platform (e.g. Wellhub/Gympass, EGYM Wellpass, ClassPass, Urban Sports Club), that platform processes your data under its own responsibility and terms. We typically receive from the platform the information needed for participation (e.g. booking or check-in details).

Some of the providers named above (including Netlify, Resend, Google and Meta) may process personal data in countries outside the European Economic Area, in particular the United States. Where no adequacy decision of the European Commission applies, transfers are based on appropriate safeguards under Art. 46 GDPR (e.g. standard contractual clauses) and, where applicable, the EU-US Data Privacy Framework. Further details are provided in the respective providers' privacy policies.

To remember your language preference and your consent decision, we use the browser's local storage. These entries are technically necessary or result from your active choice and are not automatically transmitted to third parties.

We store personal data only as long as needed for the respective purpose or as required by statutory retention rules. Waitlist, survey and similar consent-based data are kept at most until you withdraw consent. Registration and contract data are retained for fulfilment and legal periods. Server logs are deleted or anonymised after 30 days at the latest.

You have the right to information (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw any consent at any time with effect for the future.

Right to lodge a complaint with the supervisory authority: The Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

This privacy policy is currently valid and was last updated in September 2026.