Privacy Policy

Last updated: 2026-07-27

1. Controller

The controller for data processing on this website (door667.com) is the operator of the site. Full contact details will appear in the imprint once business registration is complete; until then, please reach the controller at hello@door667.com.

2. Purposes and legal bases

We process personal data only to the extent necessary to provide a working website and to protect it from abuse. The legal basis is generally Art. 6 (1)(f) GDPR (legitimate interest in a stable, secure web service).

3. Hosting via bunny.net

This website is a static site delivered through the bunny.net content-delivery network (BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia). As part of this delivery, bunny.net necessarily processes your IP address, date/time, the requested path and user-agent information in order to serve the request and protect against attacks.

The underlying storage origin for this website's static files — like the origin behind cdn.door667.com (see § 8) — is hosted at Scaleway SAS (France, EU); visitors connect only to bunny.net, and Scaleway receives no visitor IP addresses. bunny.net is a company established in the EU (Slovenia) and acts as our processor within the meaning of Art. 28 GDPR under a data-processing agreement. IP addresses are anonymised in the server logs. Delivery happens via bunny.net's global edge network; depending on a visitor's location, content may be served from edge locations outside the EU — safeguarded by that data-processing agreement. More information: bunny.net/privacy.

4. Server logs

bunny.net logs technical request data (anonymised IP, timestamp, HTTP status, user agent) for operational and abuse-prevention purposes. These logs are deleted automatically after a short time. We access them only for debugging or where there is reasonable suspicion of abuse.

5. Audience measurement (Umami)

The public pages of this website — the home page and the /inspirations and /items sections (not the legal pages or certificate pages) — use the self-hosted, cookieless analytics tool Umami (hosted at ax.y0.rs, operated by the controller within the EU). Umami records visit statistics without setting cookies and without tracking across sites. To deduplicate daily visitors it briefly caches an anonymous fingerprint (a hash of IP, user agent and date) for at most 24 hours; this does not allow identification of individuals. Legal basis: Art. 6 (1)(f) GDPR.

6. Cookies

This website does not set tracking cookies. When you first load the home page and your browser clearly prefers German or Danish, a strictly-necessary cookie (lang, max. 1 year) is set to redirect you once to the matching language variant and remember that choice on future visits. This is permitted without consent under § 25 (2) no. 2 TDDDG because the storage is strictly required for the localised delivery you have implicitly or explicitly requested. You can delete the cookie at any time via your browser settings.

7. Self-hosted fonts

The fonts Switzer and Fraunces are served directly from this website. No request is made to Google Fonts, Fontshare or other third-party CDNs, and your IP address is not transmitted to them.

8. High-resolution images via cdn.door667.com

The inspirations pages (/inspirations/...) display digitised source material — for example a complete photographic digitisation of Gustave Doré's Paradise Lost. These images are served via the bunny.net content-delivery network under the cdn.door667.com subdomain; the storage origin behind that CDN is hosted at Scaleway SAS (8 rue de la Ville-l'Évêque, 75008 Paris, France). Visitors connect only to bunny.net — Scaleway does not receive visitor IP addresses; it only serves image files to the bunny.net CDN. Both providers act as processors under an Art. 28 GDPR data-processing agreement. No data beyond the technical request data already covered in §§ 3/4 (anonymised IP, timestamp, user-agent) is processed. Images are content-addressed (the path contains a hash of the image contents) and served with a long cache lifetime of one year. The photographs themselves are licensed under CC BY-NC 4.0.

9. External links

The home page links to our profiles on Bluesky, Instagram and Pinterest. These are plain HTML links — no third-party content is loaded automatically. You leave this website only after you click a link; the privacy policy of the respective provider applies from that point on.

10. Recipients and third-country transfers

The processors we use are established in the EU. Transfers to third countries take place only insofar as bunny.net serves content from its global edge network depending on visitor location; safeguarded by the data-processing agreements with bunny.net and Scaleway, and with IP addresses anonymised in the logs.

11. Retention

We retain personal data only for as long as necessary for the purposes listed above or as required by law. bunny.net's logs are deleted automatically after a short period.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection to processing based on Art. 6 (1)(f) (Art. 21). Please contact hello@door667.com.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR), in particular at your place of residence or the controller's place of business.

14. Changes to this policy

We update this policy when processing or legal bases change. The version published here is the current one; the date above shows when it was last updated.