PRIVACY POLICY

1. Who is responsible for your data

The controllers responsible for processing personal data on this website (www.futureartlabs.com) within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) are:

Hristiyana Vucheva and Violeta Vasileva (Future Art Labs)
Sinsheimer Weg 3A
12059 Berlin, Germany
Email: hello@futureartlabs.com

We have not appointed a data protection officer because we are not legally required to do so (Art. 37 GDPR, § 38 BDSG). For any question about your data or to exercise your rights, write to the email address above.

2. Overview

We process personal data only where the GDPR, the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG) allow it. We do not sell your data or use it for automated decision-making or profiling.

  • Technical access data (IP address, browser, time of visit): to deliver a secure, working website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest) and § 25(2) TDDDG.

  • Form entries (name, email, message): to answer your enquiry or register you. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR.

  • Email address for the newsletter: to send our newsletter. Legal basis: Art. 6(1)(a) GDPR (consent).

  • Analytics and third-party cookies: to understand how the site is used and to show embedded content. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent).

Where we rely on consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). Processing carried out before the withdrawal remains lawful.

3. Hosting and access data

This website is built and hosted on Squarespace, provided for European customers by Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08N12C, Ireland.

When you visit the site, Squarespace automatically collects access data that your browser sends: IP address, browser type and version, operating system, referring page, pages visited, and date and time of access. This is needed to deliver the pages, keep the site stable and protect it against attacks and fraud. The legal basis is our legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR).

Squarespace processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Squarespace also uses some of this data, such as IP addresses, for its own security purposes as an independent controller; see the Squarespace Privacy Policy.

4. Contact and sign-up forms

When you use a form on this website or email us, we process the details you provide: usually your name, email address and message, plus any other fields you fill in. We use them only to answer your enquiry or handle your registration.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to an agreement or a registration, and otherwise our legitimate interest in answering messages sent to us (Art. 6(1)(f) GDPR). Form submissions are stored in our Squarespace account [and forwarded to our email inbox]. We do not share them with anyone else.

Forms may be protected by Google reCAPTCHA (Google Ireland Limited) to block spam. reCAPTCHA analyses your behaviour on the page and sends data, including your IP address, to Google. [Delete this paragraph if your forms do not use reCAPTCHA.]

5. Newsletter

If you subscribe to our newsletter, we use your email address (and your name, if you give it) to send you news about our work. The legal basis is your consent (Art. 6(1)(a) GDPR). After you sign up, we send a confirmation email and add you to the list only once you click the link in it (double opt-in). We record the time of sign-up and confirmation to be able to prove your consent.

We send the newsletter with Squarespace Email Campaigns (Squarespace Ireland Limited, see section 3). [If you use another service, e.g. Mailchimp, replace this sentence with its name and address.] Newsletters contain small tracking elements that show us whether an email was opened and which links were clicked. We use this only in aggregate, to improve our newsletter.

You can unsubscribe at any time via the link at the bottom of every newsletter or by emailing us. We then delete your address from the list; we may keep it on a block list so that you are not added again by mistake (Art. 6(1)(f) GDPR).

6. Cookies, consent and analytics

We only set cookies that are strictly necessary without asking you. All other cookies and similar technologies are used only after you agree in our cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via [the “Cookie settings” link in the footer].

We use the following cookies:

  • crumb (Squarespace, necessary): protects forms against cross-site request forgery. Duration: session.

  • ss_performancecookiesAllowed, ss_marketingcookiesAllowed (Squarespace, necessary): store your cookie banner choice. Duration: 30 days.

  • _ssid (Squarespace, necessary): recognises devices to prevent fraud. Duration: 4 years.

  • ss_cid, ss_cpvisit, ss_cvr (Squarespace, analytics, only with consent): count unique visitors and sessions. Duration: 2 years.

  • ss_cvisit, ss_cvt (Squarespace, analytics, only with consent): track the current visit. Duration: 30 minutes.

  • _ga, _ga_* (Google, analytics, only with consent): Google Analytics visitor statistics. Duration: 2 years.

Source for Squarespace cookies: Squarespace cookie list.

Squarespace Analytics. With your consent, Squarespace records how visitors use the site (pages viewed, time on page, referring site, approximate location, device). We see only aggregated statistics.

Google Analytics. [Delete if not used.] With your consent, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google receives your shortened IP address, device data and usage data and may transfer it to the USA (see section 7). We have signed Google's data processing terms. More: Google Privacy Policy.

Embedded content. [Delete what you don't use.] Some pages embed videos from YouTube or maps from Google Maps (Google Ireland Limited). When such content loads, your IP address is sent to Google and cookies may be set. We load this content only after you consent, or we show it in privacy-enhanced mode.

7. Recipients and transfers outside the EU

We share your data only with the service providers named in this policy, who process it on our behalf under data processing agreements, or where the law requires us to.

Squarespace and Google may transfer data to their parent companies in the USA (Squarespace, Inc. and Google LLC). Both companies are certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR). In addition, they have agreed to the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which apply if the Framework does not cover a transfer. See the Squarespace Data Processing Addendum, sections 6.2–6.5.

8. How long we keep your data

We delete personal data as soon as it is no longer needed for its purpose, unless a legal retention period requires us to keep it.

  • Contact form entries and emails: deleted [6 months] after your enquiry is fully dealt with, unless commercial or tax law requires longer storage (up to 6 or 10 years, § 257 HGB, § 147 AO).

  • Newsletter address: kept until you unsubscribe; unconfirmed sign-ups are deleted after [30 days].

  • Cookies: kept for the duration given in section 6, or until you delete them in your browser.

  • Access data in Squarespace logs: kept according to Squarespace's retention rules, only as long as needed for security and operation.

9. Your rights

Under the GDPR you have the right to:

  • Access the data we hold about you (Art. 15)

  • Rectification of inaccurate data (Art. 16)

  • Erasure of your data (Art. 17)

  • Restriction of processing (Art. 18)

  • Data portability: receive your data in a common format (Art. 20)

  • Withdraw consent at any time, with effect for the future (Art. 7(3))

Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interest (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop processing it unless we can show compelling legitimate grounds that override your interests, or the processing serves legal claims.

To exercise any of these rights, email hello@futureartlabs.com.

Right to complain. You can lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany; phone +49 30 13889-0; mailbox@datenschutz-berlin.de; datenschutz-berlin.de.

10. Security and changes to this policy

This website uses TLS (SSL) encryption, shown by “https://” and the lock icon in your browser. You are not obliged to provide personal data; without it, we simply cannot answer an enquiry or send you the newsletter.

We update this policy when our website or the law changes. The current version is always available on this page.

Last updated: 29.10.2026