Data protection guidelines

Updated: 27 October 2026. This policy explains how Culterim GmbH processes personal data through its website and digital services, including studio enquiries, Meta advertising and our internal application Culterim Rental OS. Instructions for requesting deletion are set out below under “Data deletion instructions — Culterim Rental OS / Meta”. Simply visiting or continuing to use our website does not constitute consent to tracking, advertising or international data transfers.

Controller and contact

The controller is Culterim GmbH, Rosa-Luxemburg-Straße 35, 10178 Berlin, Germany. For privacy questions and requests to delete data, contact info@culterim.de or write to the postal address above.

Studio enquiries and internal administration

When you submit a studio enquiry, we process your first and last name, email address, telephone number, artistic medium, date of birth, the selected studio house and studios including their city, and a PDF portfolio or the website/Instagram link you provide. We also process any message, the form language, submission time and technical reference identifiers. These data are used to respond to your enquiry, contact you and take steps towards a rental agreement at your request (Article 6(1)(b) GDPR).

The enquiry is sent through Wix to our internal Culterim Rental OS, recorded in our Notion database for studio applications and forwarded by email to the responsible rental team. The relevant staff and service providers for our website, hosting, data administration and email delivery receive access where necessary for their tasks. Further enquiries from the same email address about the same house are combined, and additional studio interests are added. After a contract is signed, the name and email address may be matched internally to the enquiry. This matching and internal analysis serve the organisation of our rental operations and are based on Article 6(1)(f) GDPR. Our marketing system does not make automated decisions on who receives a studio.

Meta advertising and measurement of enquiries

We use Meta Ads to advertise our studio houses and measure and improve our advertising. The provider for the European Economic Area is Meta Platforms Ireland Limited, Merrion Road, Ballsbridge, Dublin D04 X2K5, Ireland. Following your consent, the Meta integration on our Wix website may transmit information about page visits and successful enquiries to Meta. This may include the event and its time, the visited URL, IP address, browser and device information, and cookie or advertising identifiers. Meta may associate this information with an existing Facebook or Instagram account and use it for advertising attribution, measurement and personalisation.

Our form triggers the “studio_inquiry_submit” and “Lead” events only after a new enquiry that is not recognised as a test has been successfully saved and consent for advertising and sharing data with third parties has been given. The event content programmed by us describes the successful enquiry and the studio house. It does not include the applicant’s name, email address, telephone number, date of birth, message, portfolio or enquiry identifier. Internally matching a later rental contract does not mean that the contract is sent to Meta.

Consent is voluntary. You can submit a studio enquiry without advertising tracking. The legal basis for this measurement is Article 6(1)(a) GDPR. Storing or reading non-essential information on your device additionally requires consent under section 25(1) of the German TDDDG. You may withdraw consent for the future at any time, including by emailing info@culterim.de. You can also remove or block stored cookies in your browser. Withdrawal does not affect the lawfulness of processing carried out before it.

Where Culterim and Meta are jointly responsible for collecting and transmitting event data, the joint controller addendum applies. Meta’s subsequent processing for its own purposes is covered by its own privacy information. Further details about purposes, legal bases, retention, settings and data subject rights are available in Meta’s Privacy Policy and the Meta Business Tools Terms. You can also contact us to exercise your rights.

The internal Meta app “Culterim Rental OS”

Culterim Rental OS is our internal administration application. The Meta Marketing API connects it to the business assets authorised by Culterim, including its advertising account, Facebook Page, Instagram business account and pixel/dataset. Website visitors and studio applicants do not need to log in with Facebook or grant the app access to their own Meta accounts.

The application processes identifiers and names of connected assets, permission and connection information, campaigns, ad sets and ads, including their status, budgets, audience settings, text, media and destination URLs. It also processes aggregate performance figures such as spend, impressions, clicks, landing-page views and attributed enquiry events. These data are retrieved from Meta and stored in the OS to plan, create and manage advertising within the authorised scope, evaluate results and identify technical problems. We use the designated website/CMS media for advertisements; applicants’ submitted portfolios are not used for this purpose.

The connection uses an access token stored in encrypted form in the OS. Connection management and campaign controls are intended for authorised internal users. Where personal data are involved, internal account administration, logging and campaign management are based on our legitimate interest in secure and efficient advertising operations (Article 6(1)(f) GDPR). This does not replace the separate consent required for tracking website visitors.

Retention and international transfers

Enquiry data and portfolios are retained for as long as needed to handle the enquiry, an ongoing pre-contractual process or a resulting contractual relationship. Additional retention is limited to what is justified by statutory obligations or the establishment, exercise or defence of legal claims. Personal connection, campaign and log data are retained only as needed for the described operation, analysis or records, and are then deleted or effectively anonymised. Ending the Meta connection stops further access but does not automatically delete all previously stored data.

Meta and our cloud service providers may process data outside the European Economic Area, particularly in the United States. Such transfers are subject to Articles 44 et seq. GDPR: an applicable adequacy decision or appropriate safeguards, especially EU Standard Contractual Clauses and supplementary measures where necessary, must apply. You can request details of the safeguards used for a particular transfer from us. Visiting our website alone does not constitute consent to a transfer to a third country.

Data deletion instructions — Culterim Rental OS / Meta

1. Request deletion: Email info@culterim.de, for example with the subject “Data deletion — Culterim Rental OS”. You may also write to our postal address above. You do not need a Meta account or a Rental OS login.

2. Help us locate your data: State the email address you used with us and describe the data you want deleted. For a studio enquiry, your name, the studio house and the approximate submission date are helpful. For a business Meta connection, you may additionally provide a known account or app identifier. Do not send passwords, access tokens or unsolicited identity document copies. We ask for further identification details only when there are reasonable doubts about your identity and only to the extent needed.

3. Processing and response: We assess your request and erase the relevant personal data without undue delay where the legal conditions are met. This includes data under our control in the Rental OS and, where applicable, related records, portfolios and copies in Notion, email and with service providers. We normally respond within one month of receiving the request. If a legally permitted extension is necessary, we notify you within that month and explain why. If some data must be retained to comply with legal requirements or protect legal claims, we explain the reason and restrict further processing to the necessary purpose.

4. Meta access and Meta’s own data: Authorised administrators can also remove the business app connection or revoke permissions in their Meta business account settings. This stops future access but does not replace a deletion request for data already stored by us. For data processed by Meta under its own responsibility, additionally use Meta’s privacy and account settings. Deletion at Culterim does not automatically delete your Facebook/Instagram account or all data independently processed by Meta. We will help clarify the relevant responsibility.

Your privacy rights

Subject to the legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability, and the right to withdraw consent. You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct marketing at any time without giving a reason. You may lodge a complaint with a supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information. You can use the contact details above for all privacy requests.

General information about our website

The following general information supplements the specific explanations above. We process personal data only for specified purposes and on an applicable legal basis: consent (Article 6(1)(a) GDPR), performance of a contract or steps at your request before a contract (Article 6(1)(b)), legal obligations (Article 6(1)(c)) or legitimate interests, taking account of your overriding rights (Article 6(1)(f)).

What data we collect and how

Depending on the service you use, personal data can include names, contact details such as email and postal addresses and telephone numbers, IP addresses, and other information you submit. We also process technical and aggregate usage information. Information is treated as personal data whenever it identifies you or can reasonably be linked to you, including where otherwise non-identifying data are combined with personal data.

Data may be collected when you use our services, contact us, submit information directly or use a third-party sign-in service where one is offered. Data may also come from the third-party sources described in this policy. Applicable consent requirements continue to apply.

Why we use data and who may receive them

We use data to provide and operate our services, respond to requests, provide support, develop and improve our services, understand usage and demand, prepare internal statistics, maintain security, prevent fraud, investigate unlawful activity, protect legal rights and meet applicable legal requirements. Updates, newsletters and promotional communications are sent only where legally permitted; marketing emails include an unsubscribe option.

Service providers may process data to deliver hosting, storage, technical support and other necessary services. Disclosures may also be necessary to investigate or prevent unlawful activity, establish or defend legal claims, protect people or property, comply with legal obligations or deal with a business transfer. These purposes do not constitute an unrestricted authorisation to share data; an applicable legal basis is required. Genuinely anonymous information that cannot reasonably identify individuals is not personal data.

Cookies and similar technologies

Technically necessary cookies and comparable technologies support website operation, security and functions expressly requested by you. Where strictly necessary for those functions, section 25(2) TDDDG applies. Processing of personal data is based on Article 6(1)(b) or (f) GDPR depending on the purpose. Non-essential analytics and advertising technologies require prior consent under section 25(1) TDDDG and Article 6(1)(a) GDPR.

You can withdraw consent for the future at any time, including through our contact address above, and remove or block cookies in your browser. Blocking cookies may limit some website functions. Where you have consented, analytics and advertising providers may assess usage, measure advertising effectiveness and personalise advertising. They may use cookies, pixels or comparable technologies. Their own subsequent processing is also subject to their privacy policies, without limiting Culterim’s obligations or your rights against us. The specific Meta and studio enquiry arrangements are described above.

Where data are stored and how long we retain them

Our website and services use hosting, databases and applications supplied by service providers. Providers may operate in different countries, including the United States, Ireland, South Korea, Taiwan and Israel, depending on the service. Personal data transfers outside the EEA are subject to the international-transfer requirements described above.

We retain personal data only as needed to provide the relevant services, fulfil contractual and legal obligations, resolve disputes or establish, exercise or defend legal claims. Incorrect data are corrected. Data without a continuing lawful retention purpose are deleted or effectively anonymised. The more specific retention information for enquiries and the Meta connection appears above.

Data security

We use technical and organisational measures to protect data and rely on hosting services that provide protected server infrastructure and secure HTTPS access. Where payment services are offered, the relevant payment providers apply the applicable payment-card security standards. No system can guarantee absolute security. Please use secure passwords and avoid sending unnecessary confidential information through email or messaging services.

Children and young people

Where children use our services and personal data are required for particular functions, we follow the applicable legal requirements and obtain parental consent where required. We do not make participation conditional on providing more contact information than reasonably necessary for the activity. Data collected for a requested service are used for that service. Advertising and analytics remain subject to the consent requirements stated above.

Parents or legal guardians may contact us to review, correct or request deletion of their child’s data, or to object to further collection where applicable. We may request proportionate evidence of identity or authority where necessary to protect the child. Statutory retention obligations may prevent immediate deletion of particular records.

California residents

If California privacy law applies to your use of our services, you may have additional rights to access and request deletion of your personal information. Contact us using the details above. We do not sell users’ personal data for the purposes of the California Consumer Privacy Act.

Changes to this policy

We update this policy when our processing activities or legal requirements change. The current version is published on this page. Where a new or changed processing activity requires fresh consent, we obtain it separately. Continued use of the website does not replace that consent.

Contact

Culterim GmbH · Rosa-Luxemburg-Straße 35 · 10178 Berlin · Germany
Email: info@culterim.de