Privacy — GDPR

Last updated: August 2026 1. Controller Alessandro Behl & Alina Lutz GbR (3 — 6 — 9 .studio) Triftstraße 55, 13353 Berlin, Germany Email: info@3-6-9.studio A data protection officer is not legally required; please direct all privacy questions to the address above. 2. Principles We process personal data solely on the basis of the GDPR and the German Federal Data Protection Act. We collect only the data required to operate this website and to handle bookings, payments and enquiries. We never sell data. 3. Hosting and server log files This website is operated on Lovable (Lovable Labs Incorporated) and delivered via Cloudflare. When you visit, server log files are processed automatically (IP address, date and time, page requested, referrer, browser type, operating system). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation). Log data is deleted after 30 days at the latest. 4. Cookies and consent Strictly necessary cookies and comparable storage (e.g. local storage for language choice, login session, cart, cookie consent) are used without consent on the basis of Section 25(2) TDDG and Art. 6(1)(f) GDPR. All optional cookies (statistics, marketing) are only set after your explicit consent under Section 25(1) TDDG and Art. 6(1)(a) GDPR. You can change or withdraw your consent at any time with future effect via the "Cookie settings" link in the footer. 5. Audience measurement We use privacy-friendly, cookieless audience measurement by Lovable Analytics. It records aggregated information such as pages viewed, referrer, device type and country; no profiles are created and no data is shared with third parties for advertising. Legal basis: Art. 6(1)(a) GDPR where consent is required, otherwise Art. 6(1)(f) GDPR. 6. Accounts, bookings and memberships For user accounts, event bookings, studio bookings and memberships we process your name, email address, booking and payment data and any details you submit in forms. Database and authentication services are provided by Supabase (Supabase Inc.) as a processor in the EU. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (statutory retention periods, generally 6 or 10 years). 7. Payments Payments are processed via Stripe (Stripe Payments Europe Ltd., Ireland). Payment details you enter are transmitted directly to Stripe; we never receive full card data, only transaction status, amount and contact details. Legal basis: Art. 6(1)(b) GDPR. Stripe's privacy policy applies. 8. Sign in with Google You may optionally sign in with your Google account (Google Ireland Ltd.). Your name, email address and profile picture are transmitted to us. Legal basis: Art. 6(1)(b) and (a) GDPR. 9. Email For confirmations, password resets and booking emails we use an email delivery provider acting as a processor. Newsletters or programme emails are only sent with your consent (Art. 6(1)(a) GDPR); every email contains an unsubscribe link. 10. Contact and facilitator enquiries If you write to us via a form or by email, we process your details to handle the enquiry (Art. 6(1)(b) or (f) GDPR) and delete them once they are no longer needed and no retention obligations apply. 11. Fonts and external content We load fonts via Google Fonts (Google Ireland Ltd.), which transmits your IP address to Google. Legal basis: Art. 6(1)(f) GDPR (consistent presentation). 12. Transfers to third countries Where providers process data outside the EU/EEA, this is based on EU standard contractual clauses or an adequacy decision (EU-US Data Privacy Framework). 13. Your rights You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). You may withdraw consent at any time with future effect. Please send requests to info@3-6-9.studio. 14. Right to complain You may lodge a complaint with a supervisory authority, e.g. the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany. 15. Data security The website is delivered exclusively over TLS/HTTPS. Access to database content is restricted by role-based and row-level permissions.

This version is effective as of August 2026. Questions: info@3-6-9.studio.