1. Controller

The controller responsible for processing personal data on this website is:

Fatin Rahmouni
Zum Brühl 8
78315 Radolfzell
Germany

Telephone: +49 151 28735150
Email: studio@fatin-rahmouni.com

2. General information

Protecting your personal data is important to me. Personal data means any information through which a natural person can be identified directly or indirectly.

I process personal data only where this is necessary to operate this website, respond to enquiries, provide the Collector Circle or comply with legal obligations.

This website presents my artistic work. No direct sales or purchase contracts are concluded through the website. Visitors may, however, express an interest in an artwork and contact me.

3. Hosting

This website is hosted by:

ALL-INKL.COM – Neue Medien Münnich
Owner: René Münnich
Hauptstraße 68
02742 Friedersdorf
Germany

When you access this website, the hosting provider processes information that is technically necessary to deliver the website. This may include:

• IP address
• date and time of access
• requested page or file
• amount of data transferred
• browser type and version
• operating system
• referrer URL
• access status and HTTP status code

This processing is necessary to deliver the website, maintain its stability and security and detect potential attacks or technical errors.
The legal basis is Article 6(1)(f) GDPR. My legitimate interest is the secure and reliable operation of this website.

Server logs are retained only for as long as necessary to maintain security, analyse errors and prevent misuse. Further retention takes place only where required by law or necessary for the establishment, exercise or defence of legal claims.

Where required, a data processing agreement under Article 28 GDPR is in place with the hosting provider.Where required, a data processing agreement under Article 28 GDPR is in place with the hosting provider.

4. SSL/TLS encryption

This website uses SSL or TLS encryption. Information submitted through the website is therefore transmitted in encrypted form between your browser and the server.

5. Contact by email or telephone

If you contact me by email or telephone, I process the information you provide to respond to your enquiry.

This may include:

• your name
• email address
• telephone number
• content of your message
• information concerning a particular artwork
• any other information provided voluntarily

Where your enquiry concerns the possible purchase of an artwork or pre-contractual steps, the legal basis is Article 6(1)(b) GDPR.

For general enquiries, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is the proper handling and response to incoming enquiries.

The information is deleted once the enquiry has been fully resolved, unless statutory retention requirements or legitimate reasons require longer storage.

6. Artwork enquiry form

An enquiry form may be available on individual artwork pages.

Depending on the information you provide, the following data may be processed:

• name
• email address
• message
• title of the artwork concerned
• date and time of submission
• technically required connection data
• confirmation that you have acknowledged the privacy information

The information is processed exclusively to handle your enquiry.

For specific enquiries concerning a possible purchase, the legal basis is Article 6(1)(b) GDPR. Other enquiries are processed on the basis of my legitimate interest in handling incoming messages pursuant to Article 6(1)(f) GDPR.

Form submissions are stored in the WordPress database for ten days and are then deleted automatically. The resulting email is retained only for as long as necessary to process the enquiry. Statutory retention obligations remain unaffected.

The WordPress extension Forminator is used to provide the form. Processing takes place within my WordPress installation and the infrastructure of my hosting provider.

7. Spam protection

The enquiry form uses honeypot protection. This places a field invisible to ordinary visitors within the form in order to identify automated submissions made by spam bots.

No interaction with an external CAPTCHA provider is required. In particular, the honeypot protection does not establish a connection to Google reCAPTCHA.

The legal basis is Article 6(1)(f) GDPR. My legitimate interest is protecting the form and website against spam, misuse and automated attacks.

8. Collector Circle and newsletters

You may voluntarily subscribe to the Collector Circle. Subscription is independent of an artwork enquiry and occurs only if you actively select the separate option provided for this purpose.

The following information may be processed:

• name
• email address
• date and time of registration
• date and time of confirmation
• where technically recorded, the IP address used for registration and confirmation
• subscription and unsubscribe status

Processing is based on your consent pursuant to Article 6(1)(a) GDPR.

Double opt-in procedure

After registering, you will first receive a confirmation email. Your registration is completed only after you click the confirmation link contained in that email.

The double opt-in procedure provides evidence that the registration was made by the holder of the email address concerned. Documentation of this procedure is additionally based on Article 6(1)(f) GDPR. My legitimate interest is demonstrating a lawful registration and preventing unauthorised subscriptions.

Unconfirmed registrations are deleted after 30 days.

Content and introductory sequence

After confirming their subscription, new members initially receive a welcome sequence consisting of six Collector Letters. They may subsequently receive occasional studio letters, previews of new works, Collector Previews and information about exhibitions.

Mailing software

MailPoet is used within my WordPress installation to manage recipients and send the emails. Messages are sent through the email infrastructure of my hosting provider. The external MailPoet Sending Service is not currently used.

FluentSMTP is also used for the technical transmission of emails.

Technical delivery logs may contain the recipient address, sending time, delivery status and technical error information. These logs are deleted after seven days.

No open or click tracking

Activity analysis is disabled for Collector Circle emails. I therefore do not measure on a personal basis whether an email has been opened or whether a link within an email has been clicked.

No tracking cookies are used for this purpose.

Unsubscribing

You may withdraw your consent at any time with effect for the future. Every email contains an unsubscribe link.

You may also request removal by contacting:

studio@fatin-rahmouni.com

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

After unsubscribing, you will receive no further Collector Circle emails. Where necessary, a limited unsubscribe or suppression record may be retained to ensure that no further emails are sent and to demonstrate compliance with legal obligations.

9. Email delivery through FluentSMTP

This website uses FluentSMTP to send emails reliably and securely through the ALL-INKL.COM email account.

The following data may be processed:

• sender and recipient address
• time of delivery
• subject
• technical delivery status
• technical error information

The connection to the mail server is encrypted and authenticated.

Depending on the content of the message, processing is based on Article 6(1)(b), Article 6(1)(f) or Article 6(1)(a) GDPR.

Technical delivery logs are deleted after seven days.

10. Cookies and similar technologies

This website does not use analytics, marketing or personalised advertising cookies.

Where technically necessary cookies or similar storage technologies are used, they serve only the essential operation, security and administration of the website. In particular, WordPress may set technically necessary login and session cookies for authenticated administrators.

The legal basis for storing or accessing technically necessary information is Section 25(2) TDDDG. Where personal data is processed, the legal basis is Article 6(1)(f) GDPR. My legitimate interest is the secure and reliable operation of the website.

As no analytics, marketing or tracking technologies requiring consent are currently used, no consent banner for such technologies is displayed.

11. External links and social networks

This website may contain links to external websites and social networks such as Instagram or LinkedIn.

These elements are ordinary links only. Merely visiting this website does not generally embed content from the relevant platforms or automatically establish a connection to their servers.

When you click an external link, you leave this website. The external provider may then process personal data in accordance with its own privacy policy.

I have no control over the processing performed by external providers.

12. No web analytics or embedded third-party content

This website currently does not use:

• Google Analytics
• Meta Pixel
• other audience measurement or marketing analytics
• embedded social-media feeds
• embedded maps
• externally embedded videos
• personalised advertising
• advertising profiles

If such services are introduced in the future, this Privacy Policy will be updated beforehand and consent will be obtained where legally required.

13. Recipients of personal data

Personal data is disclosed only where this is necessary for the purposes described in this Privacy Policy, where required by law or where you have given your express consent.

Technical service providers may include the hosting and email provider and software used within the WordPress installation.

Where service providers process personal data on my behalf, they are engaged under a data processing agreement pursuant to Article 28 GDPR where required.

Personal data is not sold or disclosed for advertising purposes.

14. International data transfers

No intentional transfer of personal data to countries outside the European Union or European Economic Area currently takes place as part of the regular operation of this website.

If you click a link to an external service or social network, that provider may process data outside the European Union or European Economic Area. The respective external provider is responsible for that processing.

15. Retention periods

Personal data is retained only for as long as necessary for the respective purpose.

The following periods or criteria currently apply:

• WordPress form submissions: ten days
• unconfirmed newsletter registrations: 30 days
• technical SMTP delivery logs: seven days
• confirmed newsletter data: until unsubscribing or withdrawal of consent
• email enquiries: until the enquiry has been fully resolved, unless statutory retention requirements apply
• server logs: only for the period necessary for security, error analysis and prevention of misuse
• rendered content of previously sent newsletters: 30 days where technically applicable

Statutory retention obligations and storage required for the establishment, exercise or defence of legal claims remain unaffected.

16. Your rights

Subject to the applicable legal requirements, you have the following rights:

• right of access under Article 15 GDPR
• right to rectification under Article 16 GDPR
• right to erasure under Article 17 GDPR
• right to restriction of processing under Article 18 GDPR
• right to data portability under Article 20 GDPR
• right to object under Article 21 GDPR
• right to withdraw consent under Article 7(3) GDPR
• right to lodge a complaint under Article 77 GDPR

To exercise these rights, please contact:

studio@fatin-rahmouni.com

17. Right to object

Where personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you may object to that processing at any time without stating a reason.

18. Withdrawal of consent

You may withdraw consent at any time with effect for the future.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

19. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for Baden-Württemberg is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Germany

Website: www.baden-wuerttemberg.datenschutz.de

You may also contact another data protection supervisory authority responsible for your place of residence or your concern.

20. Requirement to provide data

Providing personal data is generally voluntary.

Without the information required for a contact or artwork enquiry, it may not be possible to process that enquiry.

A valid email address and confirmation of that address are required to receive Collector Circle emails.A valid email address and confirmation of that address are required to receive Collector Circle emails.

21. No automated decision-making

No solely automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

22. Security

I take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration, disclosure and misuse.

These measures include encrypted connections, access restrictions, regular updates, data minimisation, limited logging periods and protected email transmission.

23. Updates to this Privacy Policy

This Privacy Policy will be updated if legal requirements, the services used or the technical design of the website change.

Last updated: August 2026