Privacy Policy
1. Controller
Emil Rüegg Bruchstraße 38 40235 Düsseldorf Germany E-mail: contact@emilrueegg.com Phone: +49 174 6619 401
2. General information on data processing
This Privacy Policy explains what personal data are processed when you visit this website, for which purposes, on which legal bases, and how long such data are retained. It also informs you about your rights as a data subject under the General Data Protection Regulation (GDPR) and the German Telecommunications-Digital-Services-Data-Protection-Act (TDDDG).
3. Definitions
“Personal data” means any information relating to an identified or identifiable natural person (e.g. name, address, e-mail address, IP address).
4. Legal bases
Processing of personal data takes place in accordance with: • Article 6(1)(a) GDPR – consent (e.g. Google Analytics after acceptance in the privacy banner) • Article 6(1)(b) GDPR – performance or initiation of a contract (e.g. handling enquiries) • Article 6(1)(c) GDPR – compliance with legal obligations • Article 6(1)(d) GDPR – protection of vital interests in emergencies • Article 6(1)(f) GDPR – legitimate interests (e.g. operation, security and technical optimisation of the website) For storing or accessing information on a user’s device, Section 25 (1) and (2) TDDDG apply in addition.
5. Provision of the website, hosting and media delivery
Hosting: This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit the site, Vercel processes technical connection data (e.g. IP address, browser type, requested URL, timestamps) to deliver pages and protect the service.
Media CDN: Videos, images and audio are delivered via bunny.net, a service provided by BunnyWay d.o.o. (Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia). When you load or play media on this site (including short, muted preview videos on the landing page and streams on project pages), your browser connects to Bunny so the portfolio can function. Images and posters may also be fetched server-side and delivered from this website.
Both providers act as processors under Article 28 GDPR. Because BunnyWay d.o.o. is located in Slovenia (EU), no third-country transfer takes place for media streaming. Where processing involves transfers to the USA (Vercel), appropriate safeguards apply under the EU–U.S. Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs).
Purpose: Secure, performant and reliable provision of the online offer. Legal basis: Article 6(1)(f) GDPR.
6. Server log files
When pages are accessed, certain technical information is automatically collected and stored in server log files by the host (Vercel) and, for media requests, by bunny.net. These may include: • IP address • Date and time of access • URL requested • Referrer URL • HTTP status code • Amount of data transferred • Browser type and version • Operating system Purposes: System security, technical administration, error analysis, and protection against attacks. Retention period: typically short-lived according to the provider’s defaults; longer only if required for investigation of incidents. Legal basis: Article 6(1)(f) GDPR.
7. Cookies and similar technologies
This website does not use advertising cookies. With your consent, Google Analytics 4 may set analytics cookies / similar storage to measure visits. Local storage: Your privacy-banner choice is stored in the browser’s localStorage (key: emil-cookie-consent) so we do not show the banner again on every visit and know whether to enable Google Analytics. This preference does not control media playback. The value stays on your device until you clear site data or change your choice. Essential technical storage may also be used by the hosting platform for security and delivery. Legal basis: Article 6(1)(f) GDPR in conjunction with Section 25(2) TDDDG. You can clear or change your stored choice at any time via the “Cookie settings” button in the site footer. Withdrawing consent stops further Analytics loading; already collected data remain subject to Google’s retention settings until deleted.
8. Google Analytics
If you accept in the privacy banner, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for users in the EEA/Switzerland, and Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Measurement ID: G-9L1EY33L3X. The Google tag loads only after active acceptance. Usage data (e.g. approximate location derived from IP, device/browser info, pages viewed, interaction events) are processed to understand how the portfolio is used. Cookies used upon consent: • _ga (distinguishes users, duration: 2 years) • _ga_9L1EY33L3X (maintains session state, duration: 2 years) Legal basis: Article 6(1)(a) GDPR (consent) in conjunction with Section 25(1) TDDDG. You can withdraw consent at any time. IP anonymisation is enforced. Data may be transferred to the USA; Google is certified under the EU–U.S. Data Privacy Framework. Further information: Google Privacy Policy and Google Analytics Help.
9. Embedded media (video & audio)
Video and audio on this website are streamed from bunny.net (BunnyWay d.o.o., Slovenia). Your browser connects to Bunny’s servers when media loads or plays. Technical data (IP address, browser info) are transmitted to Bunny when streaming occurs. Legal basis: Article 6(1)(f) GDPR (legitimate interest in operating a responsive portfolio website that showcases audiovisual creative work). Declining Analytics does not disable media playback.
10. External links to social media
This website contains simple hyperlinks to external profiles on Instagram and LinkedIn. No data are transmitted to these platforms when loading this website. Data processing by these providers occurs only after actively clicking a link and is governed solely by their respective privacy policies.
11. Contact by e-mail or telephone
When contacting us by e-mail or phone, we process your transmitted data (name, e-mail address, telephone number, message content) to respond to your enquiry. Legal bases: Article 6(1)(b) GDPR for contractual or pre-contractual enquiries; Article 6(1)(f) GDPR for general enquiries (legitimate interest in effective communication). Data will be deleted once your enquiry has been concluded unless legal retention obligations apply.
12. Recipients and third-country transfers
Within the scope of commissioned processing (Article 28 GDPR), the following recipients process personal data on our behalf: • Vercel Inc. (Hosting / edge delivery, USA — EU-U.S. Data Privacy Framework) • BunnyWay d.o.o. (Media CDN, Slovenia / EU) • Google Ireland Limited / Google LLC (Google Analytics 4 — only with active consent, USA/Ireland — EU-U.S. Data Privacy Framework) Where data are processed in the USA, appropriate safeguards (EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses) ensure an adequate level of data protection.
13. Storage periods
Unless otherwise specified, personal data are stored only for as long as necessary to fulfil the respective purposes. After the end of the purpose or expiry of legal retention periods, data are deleted or anonymised.
14. SSL/TLS encryption & security
For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the address line of the browser changing from 'http://' to 'https://' and by the lock symbol in your browser line. Technical and organizational measures (encryption, strict Content Security Policy, integrity hashing) are continuously adapted to state-of-the-art standards.
15. Rights of data subjects
You have the following rights under Chapter III of the GDPR: • Right of access (Art. 15 GDPR) • Right to rectification (Art. 16 GDPR) • Right to erasure (Art. 17 GDPR) • Right to restriction of processing (Art. 18 GDPR) • Right to data portability (Art. 20 GDPR) • Right to object to processing based on legitimate interests (Art. 21 GDPR) • Right to withdraw consent with future effect (Art. 7(3) GDPR) To exercise your rights, please contact the Controller at contact@emilrueegg.com.
16. Right to lodge a complaint
You have the right to lodge a complaint with a competent supervisory authority (Art. 77 GDPR). The competent authority for our place of business is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) Kavalleriestraße 2–4, 40213 Düsseldorf Postfach 20 04 44, 40102 Düsseldorf, Germany Website: www.ldi.nrw.de
17. Search Console
We may use Google Search Console to monitor how this website appears in search results. This tool does not place tracking cookies on visitors’ browsers; it provides aggregated data on search queries and technical indexing. Legal basis: Article 6(1)(f) GDPR.
18. Updates to this Privacy Policy
This Privacy Policy may be updated to reflect technical, operational, or legal developments. The current version is always available at: https://emilrueegg.com/privacy Last updated: September 2026