Privacy

1. Controller

2. General information on data processing

This website is operated by Katja Grahl for informational purposes and to present her work. Personal data is processed in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3. Collection and processing of data

3.1 Data collected automatically

When you visit this website, the following data is collected automatically by our hosting provider:

• • The visitor's IP address
• • Timestamp of the request
• • Page or resource requested
• • HTTP status code
• • Volume of data transferred
• • User agent and browser information

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the security, operation and improvement of the service)

Retention: This data is stored by the hosting provider Hetzner Online GmbH (Germany) in its standard server logs and is usually deleted automatically after a few days. A data processing agreement under Art. 28 GDPR is in place with Hetzner. Further details are set out in Hetzner's privacy policy.

3.2 Contact form

The contact form on this website collects the following personal data:

• • Name
• • Email address
• • Topic of the enquiry (for example theatre, event, education)
• • Date and place (optional)
• • Message text

Purpose: answering your enquiry and getting in touch

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) or Art. 6 (1) (a) GDPR (consent)

Processing: Your data is transmitted in encrypted form and used solely to send an email notification to the provider. We use the email service Resend for this.

Retention: The data is not stored on our server. It is transmitted to Resend only in order to send the email and is processed there in accordance with their privacy policy. No local storage takes place.

Your email address may be recorded in server logs by the hosting provider Hetzner (see 3.1).

3.3 Video content (Mux)

Video clips can be played on individual pages. A video is only loaded and played once you actively select the play control or the „Watch the video“ button. No connection to the video service is made before that.

We use the service Mux (Mux, Inc., San Francisco, USA) to stream the videos. When you start a video, your IP address is transmitted to Mux so that the video can be delivered to your browser. For technical reasons, further connection data (for example browser type and the video segments requested) may arise.

No viewer analytics: The analytics function built into the Mux player (Mux Data) is switched off. No cookies are set and no usage or analytics data is transmitted to Mux.

Purpose: delivery and presentation of video content

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in presenting the work appropriately); the connection to Mux is established only after you actively choose to play a video.

Data transfer to the USA: see section 6. Further information is set out in Mux's privacy policy.

4. Disclosure of data to third parties

Contact details from the contact form are passed on only to the email service Resend, in order to send your enquiry. When you actively play a video, your IP address is also transmitted to the video service Mux (see section 3.3). No disclosure for other purposes takes place.

Further information is set out in Resend's privacy policy and Mux's privacy policy.

5. Cookies & tracking

This website uses no cookies. No tracking or behavioural analysis takes place. No analytics services such as Google Analytics or similar are used. No cookies are set and no analytics data is collected when videos are played either (see section 3.3).

6. International data transfers

Hosting: The website is hosted with Hetzner Online GmbH in Germany (EU). No personal data is transferred to a third country outside the EU or the EEA for hosting purposes.

Resend: The email service Resend, used to send contact form messages, is a US company. When an enquiry is sent, the transmitted data is therefore transferred to the USA. The transfer takes place on the basis of appropriate safeguards under Art. 46 GDPR (standard contractual clauses).

Mux: The service Mux, used to deliver videos, is a US company. When you actively play a video, your IP address is transferred to the USA. The transfer takes place on the basis of appropriate safeguards under Art. 46 GDPR (standard contractual clauses).

7. Your rights (Art. 15–22 GDPR)

You have the right to request the following from us:

• Access (Art. 15 GDPR): which of your data is processed
• Rectification (Art. 16 GDPR): correction of inaccurate data
• Erasure (Art. 17 GDPR): removal of your data, where legally permitted
• Restriction (Art. 18 GDPR): limitation of processing

To exercise these rights, or to ask a question about data protection, please write to: info@katjagrahl.de

Response time: Requests are answered within 30 days, extendable to 90 days for complex requests.

8. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a data protection supervisory authority. This may be the authority of your federal state or the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

9. Changes to this privacy policy

This privacy policy is updated when necessary. Last change: July 2026

10. Contact

For questions about data protection, please contact:
info@katjagrahl.de