Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Hosting

hartmann.art is hosted by Vercel Inc., USA. When the site is accessed, the provider's servers process the technical access data your browser transmits automatically (see section 3). The legal basis is Art. 6 (1)(f) GDPR; the legitimate interest lies in the secure, stable, and efficient delivery of the website.

A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Insofar as personal data is transferred to the USA, the transfer is safeguarded by the EU Commission's adequacy decision on the EU-US Data Privacy Framework and, additionally, by standard contractual clauses (Art. 44 et seq. GDPR).

3. Server log files

On each request, data is automatically stored in server log files: the IP address, the date and time of the request, the page or file requested, the volume of data transferred, the referring URL, and the browser and operating system. This data serves the delivery of the site and the maintenance of its security and stability (Art. 6 (1)(f) GDPR). It is not combined with other data sources and is deleted after a short period.

4. Encryption

hartmann.art is delivered exclusively over a TLS-encrypted connection (HTTPS).

5. Fonts and external resources

All fonts and the site's other design assets are served from the website's own server; no content is loaded from font networks. The work images are the exception: they are served from Sanity's content delivery network (see section 8).

6. Cookies and analytics

hartmann.art sets no cookies. To understand which pages are read, the site uses Plausible Analytics — a privacy-friendly, cookieless analytics tool. No personal data is stored. Plausible does not use cookies, does not track visitors across sites, and does not store IP addresses; a daily-rotating hash derived from IP, user agent, and domain is used only to deduplicate visits within a day and is then discarded. The legal basis is Art. 6 (1)(f) GDPR; the legitimate interest lies in measuring the reach and usability of the site. Because no personal data is processed and no information is stored on the end-user's device, the processing does not require consent (§ 25 (2) no. 2 TDDDG); no consent banner is therefore shown. You may object to the processing at any time (Art. 21 GDPR).

The analytics script is loaded and the events are sent over a same-origin reverse proxy on hartmann.art; the request is forwarded server-side to Plausible Analytics (operated by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia). Hosting and processing take place exclusively within the European Union.

7. Error telemetry (Sentry)

So that faults surface and can be fixed, hartmann.art reports technical errors automatically to Sentry (Functional Software, Inc.). The processing takes place in the service's EU region; the data is processed in Germany. Sentry processes it on our behalf.

Only technical details are transmitted: the type and message of the error, a stack trace truncated to 2,000 characters, the address of the page requested, the platform designation, and technical accompanying data (time stamp, severity level, the version identifier of the deployment, and a random event identifier). No cookies, no user identifiers, no profile.

The report is sent over a same-origin proxy on hartmann.art and forwarded server-side from there; the browser does not connect to the provider directly.

The legal basis is Art. 6 (1)(f) GDPR; the legitimate interest lies in the error-free and secure operation of the site.

8. Image delivery (Sanity)

The work images on this site are held in Sanity's media store and are served from there (cdn.sanity.io). Unlike the other services, your browser connects directly to the provider in doing so; its servers therefore necessarily receive your IP address, the image address requested, and the usual connection data of the request.

No cookies are set and no identifier is assigned.

The legal basis is Art. 6 (1)(f) GDPR; the legitimate interest lies in delivering the works in the quality they require.

9. Contact by email

If you contact us by email, the data transmitted (your email address, your name, and the content of the message) is processed solely to handle your enquiry. The legal basis is Art. 6 (1)(b) GDPR where the enquiry relates to a contract, and otherwise Art. 6 (1)(f) GDPR. The data is deleted once the enquiry has been conclusively handled, unless statutory retention obligations apply.

10. Retention period

Personal data is stored only for as long as is necessary for the respective purpose or as required by statutory retention periods, after which it is deleted.

11. Your rights as a data subject

In respect of your personal data you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and data portability (Art. 20), as well as the right to object to processing based on Art. 6 (1)(f) GDPR (Art. 21). Any consent given may be withdrawn at any time with effect for the future (Art. 7 (3) GDPR). To exercise these rights, a message tohello@hartmann.art is sufficient.

12. Right to lodge a complaint

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your residence or of the alleged infringement.

13. Currency and amendment

This privacy policy is updated whenever the site's data processing changes. Status: 7 August 2026.