Privacy Policy
This English version is provided for convenience only. The German version is legally binding.
1. Controller
The controller responsible for data processing on this website is:
Cansu Öter
Kälbermoor 48, EG
25492 Heist
Germany
Email: info@cansuoeter.com
Phone: +49 152 27209541
2. In brief
This is a simple, static website. It does not set cookies, does not use analytics or tracking tools and does not embed third-party content (such as videos, social media posts or external fonts). I process personal data only to the extent described below.
3. Website hosting (Cloudflare Pages)
This website is delivered via Cloudflare Pages. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA ("Cloudflare").
When you visit the website, Cloudflare processes data that your browser transmits automatically. This includes in particular your IP address, the date and time of access, the page or file requested, the previously visited page (referrer), browser type and version, operating system and security-related events.
This processing is necessary to deliver the website, to ensure its stability and security and to fend off attacks. I do not analyse this data for statistical or advertising purposes, and I do not store my own server log files.
The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in presenting my website securely and reliably.
Cloudflare processes the data on my behalf under a data processing agreement pursuant to Art. 28 GDPR, which forms part of Cloudflare's terms. Data may be transferred to the USA. Cloudflare is certified under the EU-US Data Privacy Framework. The transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). More information: https://www.cloudflare.com/privacypolicy/
4. Contacting me via the contact form, by email or by phone
If you write to me via the contact form or by email, or call me, I process the information you provide (for example your name, email address, phone number and the content of your message) in order to answer your enquiry.
The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns the purchase of a work or another contract. In all other cases the legal basis is Art. 6(1)(f) GDPR; my legitimate interest lies in answering your enquiry.
For email communication I use Gmail, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the emails as an independent controller. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. More information: https://policies.google.com/privacy
Emails to my address info@cansuoeter.com are forwarded to my Gmail mailbox via Cloudflare's Email Routing service (see section 3).
If you use the contact form, your entries are forwarded to me as an email via Cloudflare (see section 3) and are not stored on the website. Only your email address and your message are mandatory; providing your name is optional.
I delete your enquiry once it has been dealt with, unless statutory retention obligations apply (see section 6).
5. Purchasing works
If you buy a work from me, I process the data required to conclude and perform the purchase contract: name, billing and delivery address, email address, phone number where applicable, details of the work purchased and payment details. The legal basis is Art. 6(1)(b) GDPR.
For delivery, I pass your name and delivery address to the shipping company I use (DHL Paket GmbH). I only pass on your email address or phone number if you have consented beforehand, for example for a delivery notification (Art. 6(1)(a) GDPR). You may withdraw this consent at any time with effect for the future.
Payments by bank transfer are processed by the banks involved.
Providing this data is necessary to conclude the purchase contract. Without it, I cannot conclude or perform the contract.
6. Retention period
I store personal data only for as long as necessary for the respective purpose. Due to tax law obligations, I keep invoices and other accounting records for eight years and tax-relevant business correspondence for six years (§ 147 German Fiscal Code, § 14b German VAT Act). The legal basis for this is Art. 6(1)(c) GDPR.
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).
Right to object: Where I process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence.
A simple email to the address above is sufficient for all requests.
8. Encryption
For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar.
9. No automated decision-making
No automated decision-making, including profiling, takes place.
Last updated: October 2026