pete john

Privacy Policy

Last updated: September 14, 2026 · In case of doubt, the German version prevails.

1. Controller

firestarter.business UG (haftungsbeschränkt)
Dietmar Hölscher
Blomenesch 3, Altes Forsthaus
48653 Coesfeld, Germany
Email: mail@firestarter.business

2. Hosting

This website is hosted by Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you access the website, Strato processes technically necessary data (e.g. IP address, time of access, page requested) in server log files in order to provide the website securely and reliably. The legal basis is our legitimate interest in the secure operation of the website (Art. 6 (1) (f) GDPR). A data processing agreement is in place with Strato.

3. Self-hosted visitor statistics

We run our own, self-hosted visitor statistics to understand how many people visit the website, how often they return, how long they stay and where they come from. For this purpose we process:

The legal basis is our legitimate interest in reach-related analysis of our website (Art. 6 (1) (f) GDPR) and — as far as the visitor cookie is concerned — Section 25 of the German TDDDG. You can object to this collection at any time by blocking or deleting cookies for this website in your browser. Raw statistical data is deleted after 24 months at the latest.

4. Technically necessary cookies (language, blog heart)

If you switch the language of the website (German/English), we store your choice in a technically necessary cookie ("pjl", lifetime 12 months) so that the website appears in your language on your next visit (Section 25 (2) TDDDG, Art. 6 (1) (f) GDPR).

If you mark a blog post with the heart, we set a cookie containing a randomly generated identifier ("pjlike", lifetime 12 months) so that your heart is counted only once per device and displayed correctly on your next visit. The identifier cannot be traced back to you; we store solely the association between post and identifier (as a hash). The cookie is only set on your first heart click (Section 25 (2) TDDDG).

5. Interest list (email sign-up)

If you sign up to our list to be informed about the current art project, we store your email address, the time of sign-up and your truncated IP address (to prevent abuse). The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw your consent and unsubscribe at any time — an informal email to mail@firestarter.business is sufficient. To protect against automated sign-ups we use an invisible form field (honeypot), a timing check and a limit on sign-up attempts; no additional personal data is collected in the process.

6. Application form "Become Part of the Art"

We offer an application form for taking part in the current art project. As part of your application we process the information you voluntarily provide in the form:

During the application process we also record anonymous usage events (e.g. "form opened", "application sent") without any application content, in order to improve the process.

Reminder for unfinished applications: When you complete the first step of the form (clicking "Continue"), we store the details entered there (name, date of birth, email address, WhatsApp number, postal code, city, country) so we can remind you once of your unfinished application if you abandon it. The reminder email contains a personal link that lets you continue your application with the details you already entered — which you can review and change — without starting over. The legal basis is our legitimate interest in the completion of started applications (Art. 6 (1) (f) GDPR). If you complete the application, this entry is deleted immediately; otherwise after 30 days at the latest. You can object to the reminder at any time (an informal reply is sufficient).

Session location and activity (step 3): Verified applicants can provide the address of the session location, a photo of that place and a short description of the activity to be shown in their portal, and can change or add to these details at any time. They are stored as part of the application and are used solely to prepare the session (Art. 6 (1) (b) GDPR). The location photo is visible only to pete john and will not be published. To verify the address, it is transmitted (without your name or any other application data) to the Photon geo service by komoot GmbH (Germany, based on OpenStreetMap data) and the corresponding coordinates are stored.

Contract and digital signature (step 4): Selected applicants can digitally sign the participation and usage agreement with firestarter.business UG (haftungsbeschränkt) in their portal. In doing so we process name, date of birth, residential address, optionally the ID card number (stored encrypted; used solely for the on-site identity check and recorded there at the latest), the bank details for the payout of the fee deposited in the portal (bank name, BIC and the IBAN, which is stored encrypted; can be added or changed until the session), the chosen form of credit (no name, real name or pseudonym), performer number, the location and activity details, the image of the digital signature and — as evidence of the conclusion of the contract — the time, the full IP address and the browser identifier. The signed contract is stored as a PDF outside the publicly accessible area and can be accessed in the portal by the contracting party. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR); storage lasts for the duration of the contractual relationship and the statutory retention periods.

Sign-in links in emails: Our emails contain personal portal links that sign you in automatically without a password when clicked. Please treat these emails like access credentials. You can additionally set a password in the portal at any time.

Performer profile: In the portal you make a one-time choice of how you are credited on the works (performer number only, your real name or a pseudonym of your choosing). This choice is irrevocable; for documentation purposes we store the time of the decision and the email address of your login (Art. 6 (1) (b) GDPR). Optionally you can add links to your social media profiles (Instagram, TikTok, YouTube) if you would like them linked in publications; this information is voluntary (Art. 6 (1) (a) GDPR) and can be changed or removed in the portal at any time.

Gender information: Before signing the contract you choose your gender (male, female or diverse) — this is part of the artistic documentation of the series and of contract performance (Art. 6 (1) (b) GDPR). If you choose "diverse", you can voluntarily select a more specific self-description (e.g. non-binary, trans, intersex) or "Prefer not to specify" — this voluntary detail is processed only with your explicit consent (Art. 9 (2) (a) GDPR) and can be revoked informally via the portal chat; it will then be deleted.

On-hold status ("waiting for performer"): If we do not hear from you for a longer period, we may place your application on hold; automatic reminders then pause. On your next portal login you can reactivate yourself with one click — your application progress remains fully intact (Art. 6 (1) (b) GDPR).

Account deletion: Until the contract is signed, you can fully delete your account in the portal at any time; providing a reason is required. To document the deletion and prevent abuse, we permanently store your email address, the application step reached, the reason given and the date (Art. 6 (1) (f) GDPR). After the contract has been signed, deletion via the portal is no longer possible due to statutory documentation duties.

Pausing and withdrawing: You can move your application to the waiting list or withdraw it completely in the portal at any time; withdrawing deletes all your data as described above. The reason you give is stored without any link to your name or email address for statistical purposes (Art. 6 (1) (f) GDPR).

Email display confirmation: Our emails related to the application and participation contain an invisible tracking pixel that lets us see whether an email has been displayed (time of first opening). This serves solely to organise the application process and to avoid unnecessary reminders (Art. 6 (1) (f) GDPR). It only works if your email client loads images; you can prevent it by blocking external images.

Purpose: selection of participants, establishing contact, and planning and carrying out the recordings. Applications are only possible from the age of 18. The application is a non-binding expression of interest; complete project information, usage terms, compensation details and contracts are provided exclusively to selected applicants before any further decision.

Legal basis: your consent (Art. 6 (1) (a) GDPR). Where your information concerns special categories of personal data — in particular the indication of your willingness to take part in nude recordings — processing is based on your explicit consent (Art. 9 (2) (a) GDPR). All information is voluntary; you can withdraw your consent at any time with effect for the future (an email to mail@firestarter.business is sufficient).

Recipients: your application data is not passed on to third parties and is processed exclusively by the controller.

Portal account: When your application is received, we set up a user account for your email address for our portal, through which all communication about your application takes place. You will receive an email with a link to set your password (Art. 6 (1) (b) GDPR). The account will be deleted at any time upon request.

Verification of selected applications: If your application is selected for the next step, we ask you to confirm that you have read the project information and to provide a photo of the front of your ID card with the ID number covered. The photo is used solely to verify your identity and age during the selection process, is stored encrypted outside the publicly accessible area, and is neither published nor passed on to third parties (Art. 6 (1) (b) GDPR). During verification you will receive automatic confirmation emails regarding your application. The verification photo is deleted as soon as it is no longer required for the selection process or contract handling, at the latest when your application is deleted.

Storage period: we store applications until a decision on participation has been made. Unsuccessful applications are deleted no later than six months after the selection process has been completed. If you participate, further storage is governed by the contractual agreements made at that point.

7. Registration, login and portal messages

You can create a user account to access the internal area. We store your email address, an encrypted password (hash), the time of registration and of your last login. The legal basis is the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR). For logged-in users, the visit is linked to the account. A technically necessary session cookie is set for the login (Section 25 (2) TDDDG). To protect against automated registrations we use an invisible form field (honeypot) and a timing check; no additional personal data is collected in the process.

In the logged-in area ("portal") you can send us messages, for example questions about your application or the project. We store the content of the messages and the time they were sent in order to answer your enquiries and conduct the communication regarding possible participation (Art. 6 (1) (b) GDPR). Messages are not published and not passed on to third parties; they are stored until your account is deleted. We notify you of new replies in the portal by email (without the message content).

WhatsApp communication: If you communicate with us via the WhatsApp number you provided, we document the content and time of these messages in our application management system in order to keep the communication regarding possible participation traceable (Art. 6 (1) (b) GDPR). WhatsApp's (Meta's) own privacy terms additionally apply to the transmission; our documentation is removed when your account is deleted.

Session recordings in the portal: After a completed session, we store the resulting recordings in a protected area that is not publicly accessible. Selected recordings are shown to you in your portal as a preview (Art. 6 (1) (b) GDPR — performance of a contract). The scope, use and rights to the recordings are governed by the signed participation and usage agreement.

8. Messages to the artist and the persons portrayed (series pages)

On the public series pages you can leave a personal message for pete john and the person portrayed. For this we process your first name, your email address, the message text, the selected language version, the time and your truncated IP address (to prevent abuse). The message only takes effect once you confirm it via the link in our confirmation email (double opt-in); the pete john team then reviews and approves it. Approved messages are visible exclusively to pete john and the person portrayed in their portal — with your first name and the text. Your email address is never displayed and not passed on to the person portrayed; no reply is intended and you will not receive any further emails. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time informally via mail@firestarter.business; the message will then be deleted. Unconfirmed messages are deleted automatically after 7 days; approved or rejected ones at the latest at the end of the project. To protect against automated submissions we use an invisible form field (honeypot), a timing check and a limit on attempts.

9. Video access via work-code scan (camera access in the browser)

On the "Video" page you can access the freely available video works by pointing your device's camera at a work; the work code printed on the work is read using text recognition. Camera access only takes place after your active confirmation in the browser and can be revoked there at any time. Text recognition runs entirely locally in your browser: camera images are never transmitted to us or to third parties and are not stored. Only the recognised six-digit work code is sent to our server in order to provide the corresponding video; the work code contains no personal data. The legal basis is the performance of the service you requested (Art. 6 (1) (b) GDPR, Section 25 (2) TDDDG).

The software library required for text recognition (Tesseract.js) is only loaded from the content delivery network jsDelivr when you start the scan. For technical reasons, jsDelivr receives your IP address in the process. The legal basis is our legitimate interest in providing the feature reliably (Art. 6 (1) (f) GDPR). If you do not use the scan feature, no such request takes place; alternatively, you can enter the work code manually.

Access statistics: When a video is actually played, we store the work code, the time, the access route (image scan, manual entry or direct link), the selected language version and the association with the current visit and the anonymous visitor identifier described in section 3. This lets us see which works are accessed how often and by which route. No camera images and no personal data are stored; the evaluation is purely internal. The legal basis is our legitimate interest in measuring the reach of our works (Art. 6 (1) (f) GDPR); the deletion periods from section 3 apply accordingly.

10. Recipients and transfers to third countries

Data is not passed on to third parties, with the exception of the technical service providers mentioned in sections 2 and 3. For determining the approximate origin via ip-api.com, only the already anonymized IP address is transmitted; the service cannot establish any personal reference from it. When the scan feature is started (section 9), the recognition library is loaded via the content delivery network jsDelivr.

11. Storage periods

Principle of storage limitation: We store personal data only for as long as is minimally necessary for the respective purpose (Art. 5(1)(c) and (e) GDPR — data minimisation and storage limitation). Once the purpose no longer applies and no statutory retention obligation exists, the data is deleted or anonymised.

In detail: Statistical data: a maximum of 24 months. List sign-ups: until withdrawal or until the end of the project. Applications: see section 6. User accounts: until the account is deleted. Statutory retention obligations remain unaffected.

12. Your rights

You have the following rights with regard to your personal data:

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (www.ldi.nrw.de).

13. Changes to this policy

We will update this privacy policy whenever the data processing on this website changes. The current version published here applies.

💬