Privacy Policy

Last updated: August 3, 2026 · In case of doubt, the German version prevails.

1. Controller

firestarter.business UG (haftungsbeschränkt)
Dietmar Hölscher
Blomenesch 3, Altes Forsthaus
48653 Coesfeld, Germany
Email: mail@firestarter.business

2. Hosting

This website is hosted by Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you access the website, Strato processes technically necessary data (e.g. IP address, time of access, page requested) in server log files in order to provide the website securely and reliably. The legal basis is our legitimate interest in the secure operation of the website (Art. 6 (1) (f) GDPR). A data processing agreement is in place with Strato.

3. Self-hosted visitor statistics

We run our own, self-hosted visitor statistics to understand how many people visit the website, how often they return, how long they stay and where they come from. For this purpose we process:

• Truncated IP address: Your IP address is anonymized before storage (for IPv4 the last octet is removed, for IPv6 the trailing part). The full IP address is never stored.
• Visitor cookie ("pjv"): A randomly generated identifier (with no personal reference) is set as a cookie for 24 months so that returning visits can be counted.
• Visit data: Time and duration of the visit, pages viewed, device type, browser identifier (user agent), the selected language version (German/English) and the referring website (referrer).
• Approximate origin: The approximate country and region are derived from the already truncated IP address via the service ip-api.com; only the truncated, anonymized IP address is transmitted.

The legal basis is our legitimate interest in reach-related analysis of our website (Art. 6 (1) (f) GDPR) and — as far as the visitor cookie is concerned — Section 25 of the German TDDDG. You can object to this collection at any time by blocking or deleting cookies for this website in your browser. Raw statistical data is deleted after 24 months at the latest.

4. Language preference (cookie)

If you switch the language of the website (German/English), we store your choice in a technically necessary cookie ("pjl", lifetime 12 months) so that the website appears in your language on your next visit (Section 25 (2) TDDDG, Art. 6 (1) (f) GDPR).

5. Interest list (email sign-up)

If you sign up to our list to be informed about the current art project, we store your email address, the time of sign-up and your truncated IP address (to prevent abuse). The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw your consent and unsubscribe at any time — an informal email to mail@firestarter.business is sufficient. To protect against automated sign-ups we use an invisible form field (honeypot), a timing check and a limit on sign-up attempts; no additional personal data is collected in the process.

6. Application form "Become Part of the Art"

We offer an application form for taking part in the current art project. As part of your application we process the information you voluntarily provide in the form:

• full name and date of birth (to verify that you are of legal age),
• email address and WhatsApp number (for establishing contact),
• postal code, city and country,
• the description of the activity during which you would like to be photographed and filmed (optionally: what this activity means to you),
• a current selfie (clothed; it will not be published and is stored outside the publicly accessible area of our website),
• your indication of whether artistic nude photographs are generally an option for you.

During the application process we also record anonymous usage events (e.g. "form opened", "application sent") without any application content, in order to improve the process.

Purpose: selection of participants, establishing contact, and planning and carrying out the recordings. Applications are only possible from the age of 18. The application is a non-binding expression of interest; complete project information, usage terms, compensation details and contracts are provided exclusively to selected applicants before any further decision.

Legal basis: your consent (Art. 6 (1) (a) GDPR). Where your information concerns special categories of personal data — in particular the indication of your willingness to take part in nude recordings — processing is based on your explicit consent (Art. 9 (2) (a) GDPR). All information is voluntary; you can withdraw your consent at any time with effect for the future (an email to mail@firestarter.business is sufficient).

Recipients: your application data is not passed on to third parties and is processed exclusively by the controller.

Storage period: we store applications until a decision on participation has been made. Unsuccessful applications are deleted no later than six months after the selection process has been completed. If you participate, further storage is governed by the contractual agreements made at that point.

7. Registration and login

You can create a user account to access the internal area. We store your email address, an encrypted password (hash), the time of registration and of your last login. The legal basis is the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR). For logged-in users, the visit is linked to the account. A technically necessary session cookie is set for the login (Section 25 (2) TDDDG).

8. Recipients and transfers to third countries

Data is not passed on to third parties, with the exception of the technical service providers mentioned in sections 2 and 3. For determining the approximate origin via ip-api.com, only the already anonymized IP address is transmitted; the service cannot establish any personal reference from it.

9. Storage periods

Statistical data: a maximum of 24 months. List sign-ups: until withdrawal or until the end of the project. Applications: see section 6. User accounts: until the account is deleted. Statutory retention obligations remain unaffected.

10. Your rights

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 (3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (www.ldi.nrw.de).

11. Changes to this policy

We will update this privacy policy whenever the data processing on this website changes. The current version published here applies.