Data Protection

The controller, meaning the person who determines the purposes and means of processing personal data on this website, is:

Studio

CASA IPSA

Represented by

Hannah Neuburger

Address

Schellingstraße 87 80799 München Germany

Email

hello@casaipsa.com

Telephone

+49 (0) 176 22333715

Reading this site sets two first-party cookies at most: one that remembers the language you picked, and one that records your decision about analytics. Neither is shared with anyone.

Google Analytics is only loaded if you have accepted it. Until you do, nothing is requested from Google and no analytics cookie exists. You can change your mind at any time through the cookie settings in the footer or on the Cookies page.

Everything else happens only because you started it: sending the enquiry form, booking a consultation, paying for it and picking an appointment. Those steps are described one by one below. Typefaces and photographs are served from our own domain, so simply loading a page sends nothing to an external provider.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, which acts as a processor on our behalf under Art. 28 GDPR on the basis of a data processing agreement. Pages are delivered from Vercel’s edge network, which includes servers outside the European Economic Area; transfers to the United States are covered by the EU standard contractual clauses and, where applicable, by Vercel’s certification under the EU–US Data Privacy Framework.

Our hosting provider automatically collects and stores information that your browser transmits with each request:

• Browser type and version
• Operating system
• Referrer URL
• Host name of the accessing device
• Date and time of the request
• IP address

This data is not merged with other sources and is not used to identify you. The legal basis for hosting and for these logs is Art. 6(1)(f) GDPR, our legitimate interest in the secure, reliable and technically error-free delivery of this website. Log data is kept only as long as is necessary for those purposes and is then deleted.

If you contact us by email or telephone, we store your name, your contact details and the content of your enquiry so that we can deal with it and answer any follow-up questions.

Where your enquiry relates to a contract or to steps taken before entering into one, processing is based on Art. 6(1)(b) GDPR; otherwise it rests on our legitimate interest in answering enquiries effectively (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future. We keep this data until you ask us to erase it, withdraw your consent, or the purpose for storing it no longer applies. Statutory retention periods, in particular under commercial and tax law, remain unaffected.

Projects above 2,000 m² are quoted individually, so instead of a checkout the booking dialogue offers an enquiry form. It is the only form on this site.

Purpose

Preparing an individual quotation and replying to your enquiry

Data

Name, email address, telephone number (optional), the service selected, the floor area in m², the time of submission and the language you used on the site

Legal basis

Steps prior to entering into a contract (Art. 6(1)(b) GDPR)

Processor

Resend, Inc. (2261 Market Street #5039, San Francisco, CA 94114, USA) delivers the two notification emails

Transfer

To the USA, on the basis of the EU standard contractual clauses and Resend’s certification under the EU–US Data Privacy Framework

Retention

In our mailbox only, until the enquiry is settled and no further questions arise; statutory retention periods remain unaffected

Nothing from the form is written to a database of ours: the submission is turned into two emails, one to us and one confirming receipt to you, and that is where it stays. A telephone number is optional and is used only if replying by email is impractical. The form carries a hidden field and a minimum submission time to catch automated spam; neither is a cookie, neither profiles you, and no third-party captcha service is involved.

Consultations are paid for before an appointment is chosen. Payment runs through Stripe Checkout, a page hosted by Stripe that you are redirected to. Card details are entered there and never reach our server.

Purpose

Taking payment for the consultation you selected, and issuing the invoice

Data

Name, email address, payment details entered on Stripe’s own page, and the metadata we attach to the checkout session: the service, the floor area in m², the rate applied (standard or student) and the address of the property

Legal basis

Performance of the contract (Art. 6(1)(b) GDPR)

Recipient

Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, and Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA

Transfer

To the USA, on the basis of the EU standard contractual clauses and Stripe’s certification under the EU–US Data Privacy Framework

Retention

Payment and invoice records for ten years, as required by § 147 AO and § 257 HGB

Stripe is an independent controller for the payment data it processes for fraud prevention and its own regulatory obligations. Their notice is at stripe.com/privacy.

Confirmations of an enquiry or a paid booking are sent through Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, which acts as our processor under Art. 28 GDPR: your email address, name and the details of the enquiry or booking pass through their infrastructure in order to be delivered. The legal basis is Art. 6(1)(b) GDPR, since the email is part of performing or preparing the contract. Transfers to the USA rest on the EU standard contractual clauses together with Resend’s certification under the EU–US Data Privacy Framework, and delivery logs are kept only as long as Resend needs them to evidence delivery.

Once payment has gone through, the confirmation page shows Google’s appointment booking page for the relevant consultation, embedded in a frame. It is loaded only on that page and only after a successful payment, never on any other page of this site and never before you have paid.

Purpose

Letting you choose a session time in our calendar

Data

The name, email address and time you enter on Google’s page, plus the technical data Google receives when it is loaded, including your IP address

Legal basis

Performance of the contract (Art. 6(1)(b) GDPR)

Recipient

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

Transfer

Google may transfer data to Google LLC in the USA, on the basis of the EU standard contractual clauses and Google’s certification under the EU–US Data Privacy Framework

Retention

The appointment stays in our calendar until it has taken place and any queries about it are settled

Google sets its own cookies on calendar.google.com and processes that data under its own privacy policy, policies.google.com/privacy. A link is shown beside the frame so you can open the booking page directly instead, which is what we recommend on a phone. Google also sends you its own calendar confirmation, separately from ours.

We use Google Analytics 4 to understand which pages are read and how visitors reach the site. It runs only if you have accepted it in the consent banner. Until then, and after any withdrawal, no script is requested from Google and no analytics cookie exists.

Purpose

Reach and usage statistics for improving the site

Data

A randomly generated client ID, pages viewed, referrer, approximate location derived from a truncated IP address, device, browser and operating system

Legal basis

Your consent under Art. 6(1)(a) GDPR for the processing and under § 25(1) TDDDG for storing and reading the cookies

Recipient

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Transfer

To the USA, on the basis of Google’s certification under the EU–US Data Privacy Framework and the EU standard contractual clauses

Retention

2 months in the Google Analytics property; the cookies expire after two years

The site implements Google Consent Mode v2. Before you decide, every consent signal is set to denied: analytics storage, advertising storage, advertising personalisation and advertising user data. Only analytics storage is switched to granted, and only if you accept. We use no advertising features, no Google Signals, no remarketing and no data sharing with Google advertising products. Google Analytics 4 truncates IP addresses before storing them and never records the full address, and we have entered into a data processing agreement with Google under Art. 28 GDPR.

You can withdraw your consent at any time, with effect for the future, using the cookie settings link in the footer or the button on the Cookies page. Withdrawing deletes the Google Analytics cookies from your browser and stops any further measurement. Google’s own notice is at policies.google.com/privacy.

Two cookies are strictly necessary and are set without consent, as permitted by § 25(2) TDDDG: casaipsa_locale, which remembers whether you are reading the site in German or English, and casaipsa_consent, which records the decision you made about analytics so that you are not asked again. Both are first-party, contain no identifier that could be traced back to you, and are never transmitted to a third party.

The booking dialogue keeps your progress through it in the browser’s session storage, so closing it by accident does not lose what you had entered. That is not a cookie: it never leaves your device, is not readable by us, and is discarded when you close the tab. Every cookie and storage item, with its purpose, provider and lifetime, is listed on the Cookies page.

Under the GDPR you have the right to:

• Access the personal data we hold about you, free of charge (Art. 15)
• Have inaccurate data corrected (Art. 16)
• Have your data erased (Art. 17)
• Have processing restricted (Art. 18)
• Receive your data in a portable, machine-readable format (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time, with effect for the future (Art. 7(3))

To exercise any of these rights, write to hello@casaipsa.com. There is no charge, and we will respond within one month.

Where processing is based on Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims (Art. 21(1) GDPR).

You may also lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

Authority

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)

Address

Promenade 27 91522 Ansbach Germany

Web

lda.bayern.de

We update this policy when changes to the site or to legal requirements make it necessary. The version published here is always the one that applies. Last updated: 15 September 2026.