Privacy policy
Which data this website processes, for what purpose and which rights you have.
1. Controller
2. Visiting the website and hosting
The website is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit, technically necessary data such as your IP address, time, requested page and browser details are processed to deliver the page and protect it against attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; a data processing agreement is in place with Cloudflare.
3. Contact by email
If you write to us at hello@getpuzzleandart.com, we process your email address, your name if provided and the content of your message in order to answer your request. Cloudflare Email Routing forwards incoming emails to our mailbox at Google Gmail (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
The legal basis is Art. 6(1)(b) GDPR if your request concerns a contract, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete your message once the request has been dealt with and no statutory retention obligation applies.
4. Waiting list and email newsletter
When you sign up, we process your email address, the selected language, the time of sign-up and, where applicable, campaign parameters from the link. We use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) with a double opt-in: you are only added once you confirm the link in our email.
As proof of your consent, Brevo stores the time and IP address of your sign-up and confirmation (Art. 6(1)(c) and (f) GDPR). In our emails, Brevo measures whether they are opened and which links are clicked so that we can improve the content. This measurement is part of your consent to the newsletter.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link or by email. Your email address is required for the newsletter; without it we cannot add you.
5. Protecting the form
To protect against automated sign-ups we use Cloudflare Turnstile. Technically necessary connection and verification data is sent to Cloudflare. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The access to your browser this requires is strictly necessary (Section 25(2) no. 2 TDDDG).
6. Essential storage
We store the language you choose in the cookie puzzleart_locale and your cookie choice in the cookie and local storage entry puzzleart_consent_v2, each for up to one year. The legal basis is Section 25(2) no. 2 TDDDG.
7. Audience measurement with Google Analytics 4
Only if you agree and a measurement ID is active do we load Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). It measures page views, clicks and sign-ups. Advertising features are disabled. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. For this, Google sets the cookies _ga and _ga_<ID> with a lifetime of up to two years. We keep the measurement data in Google Analytics for no longer than 14 months. A data processing agreement is in place with Google.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time in the cookie settings.
8. Meta Pixel
Only if you agree to marketing do we load the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It measures page views and events such as a confirmed sign-up and links them with browser, device and cookie information. Data may be transferred to the USA; Meta is certified under the EU-US Data Privacy Framework. For this, Meta sets the cookie _fbp with a lifetime of 90 days.
This lets us measure our ads on Facebook and Instagram and build audiences for advertising. Meta may also process the data for its own purposes. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time in the cookie settings.
We are joint controllers with Meta for collecting the data on our website and transmitting it to Meta (Art. 26 GDPR). The agreement on this (Meta Controller Addendum) provides that we inform you about the processing and that Meta is responsible for fulfilling your rights regarding the data stored by Meta. You can exercise your rights with us and with Meta. Meta alone is responsible for any further processing.
9. Recipients
Recipients are Cloudflare, Brevo, Google (Gmail for emails and, only with your consent, Google Analytics) and, only with your consent, Meta. Data processing agreements are in place with Cloudflare, Brevo and Google. Joint controllership as described in section 8 applies to the Meta Pixel.
10. Storage period
We only store data for as long as is necessary for the respective purpose. We delete newsletter data after you unsubscribe; we keep proof of your consent for up to three years. Cookie lifetimes are listed in sections 6 to 8.
11. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw consent at any time with effect for the future. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
12. Right to object
Where we process data on the basis of legitimate interests (sections 2, 3 and 5), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). An email to hello@getpuzzleandart.com is sufficient.
13. Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
14. Version
Version: 20 October 2026. In case of doubt, the German version applies.