PRIVACY POLICY
Shibari Studio Berlin
Last updated: 04.08.2026. This policy explains how we process your personal data when you visit www.shibari-studio.com, contact us, subscribe to our newsletter, or make a purchase. We process data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
1. Controller
The controller responsible for data processing on this website is:
Dan Carabas / Shibari Studio Berlin Hannoversche Str. 19A, 10115 Berlin, Germany Email: info@shibari-studio.com
2. Your rights at a glance
Under the GDPR you have the right to: access your data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing (Art. 21). Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Art. 7 (3)). To exercise any of these rights, contact us at info@shibari-studio.com.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin.
Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interests, you have the right to object at any time for reasons arising from your particular situation. Where data is processed for direct marketing, you may object at any time; we will then stop that processing.
3. Hosting
This website is hosted by Squarespace, provided in Europe by Squarespace Ireland Ltd., Le Pole House, Ship Street Great, Dublin 8, Ireland. Squarespace processes data on our behalf under a data processing agreement (Art. 28 GDPR) to display our website reliably and securely. Legal basis: our legitimate interest in a secure, efficient website (Art. 6 (1)(f) GDPR). Where data is transferred to Squarespace's parent company in the USA, this is safeguarded by EU Standard Contractual Clauses and/or the EU–U.S. Data Privacy Framework. See Squarespace's privacy policy: https://www.squarespace.com/privacy.
4. Server log files
When you visit the site, our hosting provider automatically collects and stores information in server log files that your browser transmits: browser type and version, operating system, referrer URL, host name of the accessing device, time of the request and IP address. This data is not merged with other data sources and is processed on the basis of our legitimate interest in the technically error-free presentation and security of our website (Art. 6 (1)(f) GDPR).
5. Cookies & consent
Our website uses cookies. Essential cookies are required for the site and shop to function and are set on the basis of our legitimate interest (Art. 6 (1)(f) GDPR) and § 25 (2) TTDSG. Non-essential cookies (e.g. for analytics) are only set once you give your consent via our cookie banner (Art. 6 (1)(a) GDPR, § 25 (1) TTDSG). You can accept, reject or manage cookies at any time via the cookie settings on our site and withdraw your consent with effect for the future.
6. Web analytics
Squarespace Analytics. Squarespace provides us with aggregated statistics about site usage (e.g. page views, referral sources). Where this uses non-essential cookies, it runs only after your consent (Art. 6 (1)(a) GDPR).
Google Analytics. If enabled, this website uses Google Analytics, a service of Google Ireland Ltd., to analyse how visitors use the site. Google Analytics uses cookies; the information generated (including a truncated IP address) is transmitted to and stored by Google. This only takes place with your consent (Art. 6 (1)(a) GDPR, § 25 (1) TTDSG), which you can withdraw at any time. Data may be transferred to the USA under the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses. More: https://policies.google.com/privacy.
7. Contacting us
If you contact us by email or contact form, we process the data you provide (e.g. name, email, your message) to handle your enquiry. Legal basis is our legitimate interest in responding (Art. 6 (1)(f) GDPR) or, where your request aims at concluding a contract, Art. 6 (1)(b) GDPR. We retain this data until your request is dealt with and thereafter in line with statutory retention periods.
8. Newsletter
If you subscribe to our newsletter, we use the email address you provide to send you news about our workshops, events and products. Subscription uses a double opt-in procedure: you receive a confirmation email and are only added once you confirm. Legal basis is your consent (Art. 6 (1)(a) GDPR). You can unsubscribe at any time via the link in every newsletter or by emailing us; this withdraws your consent for the future. The newsletter is sent via Squarespace's email service, acting as our processor.
9. Online shop, bookings & payment
When you book a workshop or session, purchase an online course or buy a store product, we process the data needed to perform the contract: name, billing/shipping address, email, phone number and order details. Legal basis is the performance of the contract (Art. 6 (1)(b) GDPR). Payment is handled by the payment providers offered at checkout (e.g. Stripe, PayPal etc.), which process your payment data as independent controllers or processors under their own privacy policies. We store order data as required to fulfil the contract and to comply with statutory commercial and tax retention obligations (generally 6–10 years, Art. 6 (1)(c) GDPR).
10. Customer accounts & online course access
If you create an account to access online courses or manage bookings, we store the data you provide there to give you access to your purchases and course content. Legal basis is the performance of the contract (Art. 6 (1)(b) GDPR). You can request deletion of your account at any time; statutory retention obligations remain unaffected.
11. Social media
We maintain a profile on Instagram (Meta Platforms Ireland Ltd.). When you visit our profile or interact with our content there, your data is processed by the platform under its own responsibility and privacy policy. We have no influence over this processing. We use these channels on the basis of our legitimate interest in communication and marketing (Art. 6 (1)(f) GDPR).
12. Recipients & processors
We only pass on personal data where necessary: to our hosting, email, analytics and payment providers acting as processors under Art. 28 GDPR, and where we are legally obliged to do so. We do not sell your personal data.
13. Third-country transfers
Some of our providers are based in or process data in the USA. Such transfers are safeguarded by the EU–U.S. Data Privacy Framework, EU Standard Contractual Clauses or another valid transfer mechanism under Chapter V GDPR.
14. Data retention
We store personal data only as long as necessary for the purposes described or as required by statutory retention periods (in particular under commercial and tax law). Once these no longer apply, the data is deleted or anonymised.
15. Minors
Our services and content are directed at persons aged 18 and over. We do not knowingly collect data from children.
16. Changes to this policy
We may update this privacy policy to reflect changes to our processing or legal requirements. The current version always applies and is available on this page.