Privacy Policy
Last updated: 14 October 2026
1. Data Controller
The controller responsible for the processing of personal data on this website is:
Tobias Stubbe
commerc|ai|ls
Gabelsbergerstraße 19
50674 Cologne
Germany
Email: hallo@tobiasstubbe.de
2. General Information
At commerc|ai|ls, we respect your privacy and take the protection of your personal data seriously.
This Privacy Policy explains how we collect, process, store and protect personal data when you visit our website, explore our portfolio or contact us.
We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection laws.
Personal data refers to any information relating to an identified or identifiable natural person.
We only process personal data where there is a lawful basis for doing so and only for specified, legitimate purposes.
3. Website Hosting - Framer
Our website is created and hosted using Framer, a website development and hosting platform operated by:
Framer B.V.
Rozengracht 207B
1016 LZ Amsterdam
The Netherlands
When you visit our website, certain technical information may be processed automatically to ensure that the website functions correctly and securely.
This information may include:
IP address
Date and time of access
Requested pages and files
Browser type and version
Operating system and device information
Referring website, where provided
Technical connection and request information
The processing of this data is necessary to provide, maintain and secure our website.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to ensure the reliable, secure and efficient operation of our website.
Framer acts as a data processor on our behalf in relation to the relevant website services, subject to a Data Processing Agreement in accordance with Article 28 GDPR.
Further information:
https://www.framer.com/legal/privacy-statement
4. Website Analytics - Framer Analytics
We use Framer Analytics to understand how visitors interact with our website and to improve its content, usability and performance.
Framer Analytics provides statistical information such as:
Page views
Daily unique visitors
Most visited pages
Traffic sources
Browser and device information
According to Framer, its built-in analytics system does not use analytics cookies or persistent tracking identifiers.
To calculate daily unique visitors, Framer uses a hashing process based on technical information, including IP addresses and browser user-agent data, combined with a secret value that changes daily.
The analytics results are presented as aggregated statistics.
The legal basis for this processing is Article 6(1)(f) GDPR, based on our legitimate interest in understanding website usage and improving our services.
5. Contact Form and Enquiries
Our website includes a native Framer contact form that allows visitors to contact us regarding projects, services, potential collaborations and other business enquiries.
When you submit the contact form, we process the information you provide.
Depending on the information entered, this may include:
Name
Email address
Message content
Additional information voluntarily provided
The submitted information is processed through Framer and delivered to our business email address:
We process this information for the following purposes:
Responding to enquiries
Discussing potential projects and collaborations
Preparing business proposals
Communicating with prospective or existing clients
Managing business relationships
The legal basis for processing is Article 6(1)(b) GDPR where your enquiry concerns pre-contractual measures requested by you or an existing contractual relationship.
For other general business enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to respond to communications and maintain professional business relationships.
Providing personal data through the contact form is voluntary. However, sufficient contact information is necessary for us to respond to your enquiry.
Submitting an enquiry does not automatically subscribe you to newsletters or marketing communications.
6. Email Hosting - United Domains
We use United Domains as our business email hosting provider.
The provider is:
united-domains GmbH
Gautinger Straße 10
82319 Starnberg
Germany
United Domains provides the technical infrastructure required for receiving, sending and storing business email communications.
When you contact us by email or through our website's contact form, the following personal data may be processed:
Sender and recipient email addresses
Names and contact information
Message content
Attachments
Email metadata
Technical information required for transmission and security
We use this information solely for business communication, responding to enquiries and managing professional relationships.
The legal basis is Article 6(1)(b) GDPR for contractual and pre-contractual communications and Article 6(1)(f) GDPR for other business communications.
Our legitimate interest is to provide secure and reliable communication channels.
Further information about United Domains and its data processing practices is available at:
https://www.united-domains.de/unternehmen/datenschutz/
7. Contact Form Spam Protection
Our contact form uses Framer's built-in spam protection to reduce automated submissions and prevent misuse.
This protection may involve automated technical checks carried out when the form is used, including processing technical information associated with the submission.
The purpose of this processing is to protect the contact form against spam, automated requests and other abusive activity.
The legal basis is Article 6(1)(f) GDPR.
Our legitimate interest is to maintain the security and functionality of our website and communication systems.
8. Video Content
Our website includes video content uploaded directly to Framer and displayed using Framer's native video functionality.
These videos are used to present our creative work, projects and portfolio.
When a video is loaded or played, technical information such as IP addresses, browser information and requests for video files may be processed through Framer's hosting and delivery infrastructure.
This processing is necessary to deliver the requested video content and provide a functional website experience.
The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in presenting our work and services in an accessible and engaging format.
Our directly uploaded videos do not use external YouTube or Vimeo players.
9. Cookies and Similar Technologies
Our website uses Framer's built-in analytics system, which, according to Framer, operates without analytics cookies or persistent tracking identifiers.
Technically necessary technologies may be used to ensure the functionality, security and proper delivery of website content.
Based on the services described in this Privacy Policy, we do not use advertising cookies or third-party tracking cookies.
If additional services requiring consent are introduced, we will obtain the necessary consent before activating the relevant technologies and update this Privacy Policy accordingly.
You can also manage cookies and similar technologies through your browser settings.
10. Data Recipients and International Data Transfers
To operate our website and communicate with visitors, personal data may be processed by the following service providers:
Framer B.V. - Netherlands
Website hosting, analytics, contact form processing, video delivery and related technical services.
united-domains GmbH - Germany
Business email hosting, transmission and storage.
These providers process personal data as necessary to deliver the services used on our website.
Depending on the technical infrastructure and subprocessors involved, certain personal data may be processed outside the European Economic Area (EEA).
Where international transfers take place, we ensure that applicable GDPR requirements are observed.
Depending on the destination and recipient, appropriate transfer mechanisms may include an adequacy decision under Article 45 GDPR or suitable safeguards, such as Standard Contractual Clauses under Article 46 GDPR.
Further information about applicable transfer safeguards can be requested by contacting us at hallo@tobiasstubbe.de.
Information about Framer's data processing arrangements is available at:
https://www.framer.com/legal/data-processing-addendum
11. Data Retention
We store personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy.
The applicable retention period depends on the nature of the personal data, the purpose of processing and any relevant legal obligations.
Contact form submissions and email enquiries are retained for as long as necessary to process and respond to the enquiry.
Where an enquiry results in a contractual or ongoing business relationship, relevant correspondence may be retained for the duration of that relationship and any applicable statutory retention period.
Information that is no longer required will be deleted unless further retention is necessary to comply with legal obligations or to establish, exercise or defend legal claims.
Technical information processed for website operation and security is retained in accordance with the applicable operational requirements and retention arrangements of the relevant service providers.
12. Your Rights under the GDPR
Under the GDPR, you have certain rights regarding the processing of your personal data, subject to the applicable legal requirements.
These include:
Right of Access - Article 15 GDPR
You have the right to request information about the personal data we process concerning you.
Right to Rectification - Article 16 GDPR
You have the right to request the correction of inaccurate or incomplete personal data.
Right to Erasure - Article 17 GDPR
You have the right to request the deletion of your personal data where the applicable legal requirements are met.
Right to Restriction of Processing - Article 18 GDPR
You have the right to request that the processing of your personal data be restricted in certain circumstances.
Right to Data Portability - Article 20 GDPR
Where applicable, you have the right to receive personal data you have provided in a structured, commonly used and machine-readable format.
Right to Object - Article 21 GDPR
You have the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR.
Right to Withdraw Consent - Article 7(3) GDPR
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
To exercise your rights, please contact:
13. Right to Lodge a Complaint
If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a competent data protection supervisory authority.
The supervisory authority responsible for our business location is:
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
Website: https://www.ldi.nrw.de
You may also contact another competent supervisory authority in accordance with Article 77 GDPR.
14. Changes to This Privacy Policy
We may update this Privacy Policy when necessary to reflect changes to our website, the services we use or applicable legal requirements.
The current version will always be available on this page.
Last updated: 14 October 2026