Last updated: 1 July 2026

1. Controller

Benjamin Ballicas

ARU STUDIO

Bundesstraße 31

20146 Hamburg, Germany

Email: ben@aru-studio.co

2. Overview

This Privacy Policy explains what personal data we collect, why we collect it, and how we handle it. It applies to our website, contact form, newsletter, and any services we provide.

3. Hosting (Framer)

Our website is hosted by Framer B.V., Overtoom 197, 1054 HT Amsterdam, Netherlands. When you visit our website, Framer automatically collects server log data including your IP address, browser type, operating system, referring URL, and access time. This data is processed on the basis of our legitimate interests (Art. 6(1)(f) GDPR) to ensure the technical operation and security of our website. Log files are stored for a maximum of 30 days and then deleted.

4. Contact Form (Tally)
This website uses Tally (Tally So BV, Koningin Astridlaan 167, 9000 Ghent, Belgium) to operate the contact form. When you submit a form, the data you enter — such as your name and email address — is transmitted to and stored on Tally's servers. Tally processes this data on my behalf as a data processor, and a Data Processing Agreement (DPA) is in place. For further information, please refer to Tally's Privacy Policy at tally.so/privacy. Tally is a Belgian company, meaning your data remains within the European Union and no international data transfer concerns apply. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry) or, where you have explicitly consented, Art. 6(1)(a) GDPR. Data is retained only as long as necessary to respond to your enquiry and is not shared with third parties beyond what is required to operate the service.

5. Web Analytics (Google Analytics)

We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies to analyse how visitors use our website. The information generated (including a pseudonymous user ID and usage data) is transmitted to and stored on Google's servers.

We have enabled IP anonymisation, meaning your IP address is truncated before transmission within EU member states. Google may transfer this data to the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses.

Legal basis: Your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time by adjusting your browser settings or using the Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout

Google's privacy policy: https://policies.google.com/privacy

6. Newsletter (Substack)

Our newsletter (TRUTH) is operated via Substack, Inc., 548 Market Street PMB 72296, San Francisco, CA 94104, USA. If you subscribe to our newsletter via the link on our website, you are redirected to Substack's platform. Substack processes your email address and any additional information you provide when subscribing. This data is processed by Substack under their own privacy policy: https://substack.com/privacy

We link to Substack but do not directly collect or store your email address through our website. Legal basis for the referral link: our legitimate interests in communicating with our audience (Art. 6(1)(f) GDPR).

7. Social Media (Instagram)

Our website contains a link to our Instagram profile, operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Clicking this link will take you to Instagram's platform. We do not control how Instagram processes your data.

For more information, please refer to Instagram's privacy policy: https://privacycenter.instagram.com/policy/

Legal basis for the link: legitimate interests in public communications (Art. 6(1)(f) GDPR).

8. Social Media (LinkedIn)

Our website contains a link to our LinkedIn profile, operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland. Clicking this link will take you to LinkedIn's platform. We do not control how LinkedIn processes your data.

Please note that we and LinkedIn Ireland are jointly responsible for the collection (but not the further processing) of data from visitors who interact with our LinkedIn profile, specifically for the creation of Page Insights (statistics).

For more information, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy

Legal basis: legitimate interests in public communications (Art. 6(1)(f) GDPR).

9. Cookies

Our website uses cookies — small text files stored on your device. We use:

– Technically necessary cookies: required for the website to function correctly (no consent required).

– Analytics cookies (Google Analytics): only set with your prior consent.

You can manage or withdraw your consent at any time via your browser settings.

10. Data Transfers to Third Countries

Some of the tools we use (Google Analytics, Substack) may transfer personal data to the United States. These transfers are carried out on the basis of the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) and/or Standard Contractual Clauses approved by the European Commission.

11. Retention Periods

We retain personal data only for as long as necessary for the purposes described above, or as required by law. Contact form data is deleted once your enquiry has been resolved. Server log files are deleted after 30 days. Data subject to statutory retention obligations (e.g. tax and commercial law: 6–10 years) is retained for the legally required period.

12. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

– Right of access (Art. 15 GDPR)

– Right to rectification (Art. 16 GDPR)

– Right to erasure (Art. 17 GDPR)

– Right to restriction of processing (Art. 18 GDPR)

– Right to data portability (Art. 20 GDPR)

– Right to object (Art. 21 GDPR)

– Right to withdraw consent at any time (Art. 7(3) GDPR)

To exercise any of these rights, please contact us at: ben@aru-studio.co

You also have the right to lodge a complaint with a supervisory authority. The competent authority for ARU STUDIO is: Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

13. Updates to this Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices or legal requirements. We recommend checking this page periodically. The date at the top of this document indicates when it was last updated.