--- title: "Website privacy" description: "Unisu website privacy: hosting, contact forms, email notifications, data recipients, retention and deletion, and your rights over personal data." lang: "en" canonical: "https://unisu-sudoku.app/en/website-privacy/" --- Pola Labs # Website privacy Privacy information for the Unisu website: hosting, contact enquiries, recipients and your rights. **Date:** October 28, 2026 ## Scope These notices cover visits to the Unisu website and enquiries sent through it. The mobile Unisu app has a separate app privacy policy. ## Controller **Stubbe + Finke PartG** Masen 52 22419 Hamburg Germany Contacts: Anna Stubbe and Julian Finke. Privacy contact: [hello@pola-studio.de](mailto:hello@pola-studio.de). Website: [pola-studio.de](https://pola-studio.de/). No data protection officer is currently appointed. ## Hosting and access data The website, contact backend and database are hosted by **DigitalOcean, LLC, USA**, in our selected server region of **Frankfurt am Main, Germany**. DigitalOcean uses **Cloudflare, Inc., USA**, for content delivery and infrastructure protection. This involves IP addresses, timestamps and technical connection data. Article 6(1)(f) GDPR applies to our interest in secure, reliable operation. Message contents are processed under the legal basis applicable to the enquiry. Selecting Frankfurt does not mean all CDN, support and email processing takes place exclusively in Germany. Server requests may involve IP address, time, requested address, browser and operating-system information, referrer, transferred volume, and status or error data. We use these for delivery, troubleshooting and security under Article 6(1)(f) GDPR. No uniform fixed deletion period for these technical logs has yet been established. ## Cookies, fonts and local functions The website code contains no analytics or advertising trackers and sets no cookies or persistent identifiers for those purposes. Fonts, images and store badges are served locally. Article search and filters run in your browser without sending search terms to a search service. The hosting infrastructure may set security cookies such as Cloudflare’s \_\_cf\_bm. This cookie helps detect automated traffic and, according to Cloudflare, expires after 30 minutes of continuous inactivity. Access to a device that is strictly necessary for the expressly requested website function falls under section 25(2)(2) TDDDG. Non-essential device access requires separate consent. ## Contact form We process your name, email address, topic, message, form language and acknowledgement of the privacy notice. Name, email, topic and message are required form fields; you are under no legal obligation to contact us. The form sends these details to our contact server using HTTPS. The enquiry is stored in a database and a complete copy is emailed to our team. We also store the receipt time and notification status. The saved enquiry remains available if the internal email fails. Without JavaScript, the form prepares an email in your own email application for you to review and send. An additional form field and a server-side sending limit help prevent spam. A forwarded IP address, or the email address if no IP is available, temporarily serves as a technical key. It is not stored as a separate enquiry field. The limit uses a 15-minute window; expired keys are removed during a subsequent check or when the process ends. Article 6(1)(b) GDPR applies to contractual enquiries or pre-contractual steps you request. Other enquiries and abuse prevention rely on Article 6(1)(f), reflecting our interests in responding to requests and protecting the contact service. Acknowledging the notice does not consent to advertising or analytics. ## Email and recipients For email enquiries, we process the sender address, message and any other information you provide to handle your request. The legal basis is Article 6(1)(b) GDPR for contractual matters, or Article 6(1)(f) for our interest in responding to other enquiries. Authorised team members handle enquiries. DigitalOcean and its infrastructure providers process technical data and hosted content. **Brevo** sends complete internal contact notifications. **Google** provides our team’s email mailbox. These services process message contents, email addresses and technical delivery/receipt data. Brevo is used here for sending messages, not to subscribe you to a newsletter. Details: [DigitalOcean DPA](https://www.digitalocean.com/legal/data-processing-agreement), [Brevo terms including its DPA](https://www.brevo.com/legal/termsofuse/), [Google privacy information](https://policies.google.com/privacy). ## International processing In addition to our Frankfurt server region, the infrastructure and email services may process data internationally, including in the USA. DigitalOcean’s published DPA provides for the EU-U.S. Data Privacy Framework for covered US transfers and EU standard contractual clauses in the fallback situations specified there. Applicability depends on the recipient, valid certification and contractual coverage. The inclusion of all required processing and transfer terms for every service we use has not yet been fully documented. We therefore do not claim verified safeguards for every international data flow. You can ask our privacy contact for information and, where applicable, copies of the relevant safeguards. ## Retention and deletion We have not yet established fixed deletion periods or a comprehensive automatic deletion process for technical logs, enquiries and backups. Enquiries are stored in the database and as email copies and are currently managed manually. Retention depends on the need to handle and follow up requests, maintain security, meet applicable retention obligations or pursue legal claims. Data must be deleted once its purpose ends unless another legal basis permits retention. You can contact us about deletion. Deleting data from an active system does not automatically remove existing backup copies. ## Your rights Subject to legal conditions, you can request access to, correction and deletion of your personal data at [hello@pola-studio.de](mailto:hello@pola-studio.de). The usual response period is one month; any legally permitted extension must be explained. You may request restriction of processing under the legal conditions, including where data accuracy is disputed, processing is unlawful or an objection is being assessed. Where data is processed automatically on the basis of consent or a contract, the legal conditions may entitle you to data portability in a commonly used, machine-readable format. Where processing relies on valid consent, you can withdraw it for the future without affecting the lawfulness of processing before withdrawal. **Objection under Article 21 GDPR:** Where processing relies on Article 6(1)(f), you can object at any time for reasons arising from your particular situation. Processing may then continue only where overriding compelling grounds or legal claims justify it. You may complain to a data protection authority, particularly where you live, work or believe an infringement occurred. The authority for our registered location is the [Hamburg Commissioner for Data Protection and Freedom of Information](https://datenschutz-hamburg.de/service-information/beschwerde-oder-hinweis-einreichen), Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany. ## External links and security Store badges and other external references are links. Following them visits another provider’s service, where its own privacy information applies. Store content is not embedded in our pages. Our contact forms use HTTPS to send information to the endpoint. This does not automatically make email communication end-to-end encrypted. We do not make solely automated decisions about you with legal or similarly significant effects under Article 22 GDPR. ## Changes We update these notices when the described processing changes. Any newly required consent must be obtained separately; continued use alone does not constitute consent.