Privacy Policy
As of: October 2026. This English version is provided for convenience. Only the German version is legally binding.
1. Controller
The controller responsible for data processing on this website is:
Svonja Studio – Luka Švonja
Fritz-Remy-Straße 5
63071 Offenbach am Main
Germany
Email: hello@luka-svonja.de
Phone: +49 152 26374294
2. General information on data processing
We only process personal data to the extent necessary to provide a functioning website and our content and services, or when you actively send us data (e.g. via the request form).
The legal bases are in particular Art. 6 (1) (b) GDPR (contract or pre-contractual measures), Art. 6 (1) (f) GDPR (legitimate interest in a secure, functioning website) and, where you consent, Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.
3. Hosting and server log files
This website is hosted by an external service provider: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. [check: contracting party according to your Hostinger contract]
On our behalf, the host processes the data transmitted via the website (including access/log data, content, contact and meta data). This is based on our legitimate interest in secure and efficient provision (Art. 6 (1) (f) GDPR) and a data processing agreement (Art. 28 GDPR) with the provider.
Every time the website is accessed, the server automatically collects information in server log files that your browser transmits:
- IP address of the accessing device
- date and time of access
- name and URL of the file requested
- referrer URL (the previously visited page)
- browser and operating system used and, if applicable, the provider
This data is not combined with other data sources. Processing is based on Art. 6 (1) (f) GDPR to ensure the operation, security and stability of the website. The log files are deleted after 7 days at the latest, unless they are needed longer to investigate a specific security incident.
4. SSL/TLS encryption
For security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the “https://” in the address bar and the lock icon in your browser. This means the data you send us cannot be read by third parties.
5. Request form (“Design request vehicle wrap”)
When you fill in and submit the multi-step request form on this website, we process the information you enter there in order to handle your request and make you an offer.
Data processed (depending on your input):
- vehicle details (make/model, year of manufacture, current colour)
- desired scope and purpose of the wrap
- your design ideas or references as free text
- optionally a file you upload (image or PDF)
- time frame and, if provided, budget range
- contact details: email address (required), optionally name, phone number and a free message
- time of submission
Recipients: the form data is processed on our server (see section 3) and delivered exclusively by email to our mailbox hello@luka-svonja.de. It is not passed on to any other third parties; only our email/hosting provider is involved in the delivery. No cookies are set for this form and no third-party services (e.g. analytics or CAPTCHA services) are integrated. To protect against spam, a technical “honeypot” field is used that does not collect any personal data.
Legal basis: if your request is aimed at concluding a contract, the legal basis is Art. 6 (1) (b) GDPR. In all other cases, processing is based on our legitimate interest in handling requests (Art. 6 (1) (f) GDPR); if you have given consent, Art. 6 (1) (a) GDPR applies, which you can withdraw at any time.
Storage period: we store the request data until your request has been fully processed and no further correspondence is to be expected. If a contract is concluded, the statutory retention periods apply (in particular under HGB and AO, usually 6 or 10 years). You can request deletion at any time, unless statutory retention obligations prevent this.
6. Contact by email or phone
If you contact us by email or phone, your details including the contact information you provide will be stored to process your request and in case of follow-up questions. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual/contractual) or Art. 6 (1) (f) GDPR (legitimate interest in processing the request). The data is deleted as soon as it is no longer required for the purpose and there are no statutory retention obligations.
7. Appointment booking via Calendly
To book a free first call, we embed the calendar of the Calendly service. The provider is Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. [check]
The calendar is only loaded when you click “Load calendar” (two-click solution). Before that, no data is transmitted to Calendly. After the click, Calendly receives technical data such as your IP address and browser and device information; Calendly may set its own cookies. If you book an appointment, Calendly also processes the data you enter (e.g. name, email address, chosen appointment, message) and passes it on to us.
The legal basis for loading the calendar is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); for the booking itself it is Art. 6 (1) (b) GDPR. Calendly LLC is certified under the EU-US Data Privacy Framework, which is intended to ensure an adequate level of protection for transfers to the USA. [check: dataprivacyframework.gov] A data processing agreement is in place with Calendly. Alternatively, you can open Calendly directly in a new tab or contact us by email or phone.
8. Fonts
This website uses the fonts “Fira Sans Condensed” and “Mango Grotesque”. The font files are stored locally on our server. When you visit the website, no connection is made to servers of Google or other font providers.
9. Cookies and consent management
We use technically necessary cookies and comparable storage technologies where they are strictly necessary for operating the website (§ 25 (2) no. 2 TDDDG). All other cookies and services (statistics, external media) are only activated with your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR).
To manage your consent, we use the WordPress plugin “WPConsent”. It stores your choice in a cookie on your device for 30 days so that the banner doesn’t appear again on every page view. The legal basis is Art. 6 (1) (c) GDPR (proof of consent). You can change or withdraw your choice at any time via the cookie settings link in the footer. An overview of all cookies can be found in our cookie policy.
10. Web analytics with Google Analytics
If you have given your consent, this website uses Google Analytics 4, integrated via the WordPress plugin “MonsterInsights”. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics uses cookies that enable an analysis of how the website is used (e.g. pages viewed, time spent, approximate location, device and browser information). IP addresses are not stored by Google Analytics 4. The information generated may be transferred to servers of Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework. A data processing agreement is in place with Google.
The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via the cookie settings. The data is automatically deleted after 14 months. [check: retention period in Google Analytics under data collection]
11. External links (Instagram, Google Drive)
On this website we link to our Instagram profile and to a portfolio on Google Drive. These are simple links; no data is transmitted to these providers when you visit this website. Only when you click a link do the privacy terms of the respective provider apply.
12. Your rights as a data subject
Under the GDPR you have the following rights:
- access to the data stored about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)
- withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
- complaint to a supervisory authority (Art. 77 GDPR)
An informal message to hello@luka-svonja.de is enough to exercise these rights.
Competent supervisory authority: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information), Postfach 3163, 65021 Wiesbaden, Germany, poststelle@datenschutz.hessen.de, datenschutz.hessen.de
13. Updates to this privacy policy
This privacy policy is as of October 2026. Further development of the website or changes in legal or official requirements may make it necessary to adapt this privacy policy. The current version can always be found on this page.