Privacy Policy

Last updated: 27 October 2026

1. Data Controller

The data controller responsible for the processing of personal data described in this Privacy Policy is:

Franziska Boemer
Paul-Grasse-Str. 36
10409 Berlin
Germany

Email: franziska.boemer@gmx.de
Website: https://www.franziskaboemer.com

For questions about this Privacy Policy or the processing of your personal data, please contact me using the email address above.

2. General Information

I take the protection of personal data seriously. This Privacy Policy explains how I collect, use, store and share personal data when you visit my website, contact me, commission an artwork, request a free download, sign up for emails or interact with me through Instagram and related services.

I process personal data in accordance with applicable data protection law, including the General Data Protection Regulation (GDPR).

Depending on the circumstances, the legal basis for processing may be your consent, the performance of a contract or pre-contractual measures, compliance with a legal obligation, or my legitimate interests, provided that the applicable legal requirements are met.

I collect only personal data reasonably necessary for the relevant purpose.

3. Website Hosting and Technical Data

Squarespace

This website is hosted by Squarespace. When you visit the website, technical information may be processed to deliver the website, maintain security and support its functionality.

Depending on the features used and your browser settings, this information may include your IP address, browser and device information, referring page, pages visited, and the date and time of access.

Further information is available in the Squarespace Privacy Policy.

Squarespace Activity Log and Analytics

Squarespace provides an activity log and built-in website analytics. The activity log is enabled on my website.

These features may process technical information and information about website visits, including IP addresses, browser or device details, referral information and pages visited. The scope of processing depends on the features used and the relevant technical and privacy settings.

I do not currently configure external analytics integrations for my Kit landing pages. If I introduce additional tracking services, I will review whether this Privacy Policy and my consent settings need to be updated.

4. Cookies and Similar Technologies

My website uses cookies and similar technologies. Some are technically necessary for the website to function. Others may support analytics, security or additional features.

Where required by law, non-essential cookies and similar technologies will only be used after you have given your consent.

The website's cookie banner allows you to accept cookies, reject them or manage your preferences. You can revisit your choices through the Cookie Settings option, where available. You can also manage cookies through your browser settings.

Blocking technically necessary cookies may affect website functionality.

Further information is available in Squarespace's cookie documentation.

5. Contact Form and Spam Protection

Contact Form

You can contact me using the contact form on this website. The form requests your first name, last name, email address and message.

The form is provided through Squarespace. When you submit it, the information you provide is processed so that I can respond to your enquiry. Form submissions are sent to my email address, franziska.boemer@gmx.de.

The legal basis for processing is Article 6(1)(b) GDPR where your enquiry relates to pre-contractual measures or a contract. For other enquiries, the legal basis may be Article 6(1)(f) GDPR, based on my legitimate interest in responding to messages.

I retain your information for as long as necessary to handle your enquiry and any subsequent communication, subject to applicable statutory retention requirements.

Google reCAPTCHA on Squarespace

This website uses Google reCAPTCHA through Squarespace to help protect the contact form against spam, automated submissions and abuse.

reCAPTCHA analyses technical information and interactions with the website to help distinguish human visitors from automated activity. Depending on the implementation, this may include your IP address, browser and device information, and interaction data.

Google processes reCAPTCHA data as a service provider in accordance with the applicable Google Cloud data processing terms.

The legal basis for processing is Article 6(1)(f) GDPR, based on my legitimate interest in protecting the website and contact form against spam and misuse, where that legal basis is applicable. Where the use of cookies or access to information stored on your device requires consent under applicable law, the relevant consent requirements must also be met.

6. Commissioned Artwork and Client Data

When you commission an original artwork from me, I process personal data necessary to discuss, create, deliver and administer your commission.

Depending on the commission, this may include:

  • Your name and contact details, such as your email address.

  • Your billing and delivery address, where required.

  • Information you provide about your commission, artistic preferences, requested themes, colours or intended use.

  • Reference materials, images, messages and other information you voluntarily share to help me create your artwork.

  • Order details, correspondence, delivery information and records needed for invoicing and accounting.

I use this information to communicate with you, clarify your requirements, create and deliver the commissioned artwork, manage payment and invoicing where applicable, handle questions or complaints, and fulfil my contractual and legal obligations.

The legal basis is generally the performance of a contract or pre-contractual measures under Article 6(1)(b) GDPR. Statutory retention obligations, such as tax and accounting requirements, may require me to retain certain records for the legally prescribed period.

If you share personal or sensitive information as part of your commission, I will use it only to the extent reasonably necessary for the agreed purpose and subject to applicable legal requirements. Please do not share sensitive information that is not needed to create your artwork.

Confidentiality and Use of Artwork

Information you share for a commission is not automatically used for marketing.

If I wish to publish an artwork, your name, your personal story, a testimonial or other material that identifies you, I will consider the applicable legal requirements and obtain your consent where required. Commissioning an artwork does not, by itself, constitute consent to publish your personal information or use your story for promotional purposes.

Recipients and Retention

I do not sell client data. Personal data may be shared with service providers where necessary to fulfil the commission or meet legal obligations, for example with a delivery provider or accounting service where applicable.

I retain client information for as long as necessary to fulfil the commission and manage related matters. Records that must be kept under statutory retention requirements will be retained for the applicable period. Other information will be deleted or anonymised when it is no longer needed, subject to legal obligations.

7. Free Downloads and Email Sign-Ups Through Kit

Kit Landing Pages and Forms

I use Kit to provide free digital content, including my Erblühen mobile wallpaper, and to manage email sign-ups.

When you submit a Kit landing page or form, the information you provide, such as your email address and any name you enter, is processed to manage your request and provide access to the requested content.

Kit may also process technical information associated with visits and form submissions to operate and secure its services.

Further information is available in the Kit Privacy Policy.

CAPTCHA and Spam Protection on Kit

Kit provides CAPTCHA and other anti-spam measures for its forms to help prevent automated or abusive sign-ups. Depending on the form and settings used, this may include CAPTCHA challenges or an invisible reCAPTCHA feature on a Kit landing page.

These mechanisms may process technical information and interactions to assess whether a sign-up is likely to be automated. The specific information processed depends on the protection mechanism used and the circumstances in which it is triggered.

The purpose is to protect the sign-up process and email lists against spam and misuse. The legal basis for processing may be Article 6(1)(f) GDPR, based on the legitimate interest in protecting the service and subscriber lists against abuse, where applicable.

Kit operates these security features as part of its service. For more information, please consult the Kit Privacy Policy.

Email Confirmation

The sign-up process uses email confirmation. After submitting the form, you receive an email asking you to confirm your email address. Your subscription is confirmed when you complete that step.

Optional Marketing Emails

Where a form offers the optional checkbox “A Note from Franziska”, you can separately choose whether you would like to receive occasional emails about new artwork, seasonal wallpapers and special offers.

This marketing option is voluntary and is not required to request the free wallpaper. Where you select it, your preference is recorded so that I can manage your subscription.

Marketing emails are sent on the basis of your consent. You can withdraw that consent at any time using the unsubscribe link in an email or by contacting me directly.

Requesting a free download without selecting the optional marketing checkbox does not, by itself, constitute consent to receive marketing emails.

Download Delivery

The wallpaper is hosted on Squarespace and made available through a download link. When you access the link, Squarespace may process technical data as described in the website hosting section above.

8. Instagram and ManyChat

I use Instagram to share my artwork and communicate with people who interact with my content. I may also use ManyChat to automate certain Instagram interactions, such as sending a direct message when someone comments on a Reel with a specified keyword, for example “Wallpaper”.

Information Processed Through Instagram

When you comment on a post or Reel, send me a direct message, or interact with my Instagram account, I may be able to access personal data associated with that interaction. Depending on your settings and the interaction, this may include your Instagram username, profile information, comments and message content.

Instagram is operated by Meta. Your use of Instagram is also subject to Meta's own privacy terms and data processing practices.

Automated Messages Through ManyChat

ManyChat may be used to manage and automate certain messaging interactions on Instagram.

When you trigger an automated interaction, for example by commenting with a specified keyword, ManyChat may process information relating to your Instagram account, your comment or message, and the subsequent interaction. Depending on the automation, this may include sending you a direct message containing a link to a Kit landing page or providing further information about a requested download.

If a download or sign-up is handled partly or entirely through ManyChat, the information processed will depend on the specific flow and the information you provide.

I use these interactions to respond to your request, deliver the relevant link or content, and operate the automated messaging process. A keyword comment or a request for a free download does not, by itself, constitute consent to receive unrelated marketing emails.

Further information is available in the ManyChat Privacy Policy and its Data Processing Addendum.

Email Sign-Up and Marketing

If you follow a link to a Kit landing page and submit your email address, the processing described in the Kit section of this Privacy Policy applies.

Any optional marketing subscription is separate from the automated Instagram interaction. Where required, marketing consent must be obtained separately.

9. Purposes and Legal Bases for Processing

Depending on the interaction, I process personal data for the following purposes:

  • Website operation and security: to make the website available and maintain its technical functionality.

  • Spam protection: to protect website forms and email sign-up forms against automated submissions and abuse.

  • Website analytics: to understand website usage through the available logs and analytics, subject to applicable consent requirements.

  • Contact enquiries: to respond to messages submitted through the website.

  • Commissioned artwork: to discuss, create, deliver and administer your commission.

  • Free downloads: to process your request and provide the requested content.

  • Email confirmation: to verify email addresses and manage the sign-up process.

  • Marketing communications: to send emails where the required consent has been obtained.

  • Instagram and ManyChat interactions: to respond to comments and messages and deliver requested links or content through automated messaging.

  • Legal compliance: to fulfil applicable legal and record-keeping obligations.

The legal basis depends on the particular processing activity. It may include consent under Article 6(1)(a) GDPR, contractual necessity or pre-contractual measures under Article 6(1)(b), legal obligations under Article 6(1)(c), or legitimate interests under Article 6(1)(f).

Where consent is required for non-essential cookies or marketing communications, you may refuse or withdraw it without affecting the lawfulness of processing carried out before withdrawal.

10. Recipients and International Data Transfers

Depending on the service used and the purpose of processing, personal data may be processed by the following providers:

  • Squarespace: website hosting, technical functionality, website analytics, contact form submissions and hosting the downloadable wallpaper.

  • Google reCAPTCHA: spam and abuse prevention for the Squarespace contact form.

  • Kit: landing pages, email confirmation, subscriber management, email delivery and built-in spam protection.

  • ManyChat: automated Instagram messaging and management of related interactions.

  • Meta / Instagram: social media interactions, comments and direct messages.

These providers process data in accordance with their applicable terms, privacy information and data processing arrangements. They may use their own service providers and subprocessors.

Depending on the services and infrastructure used, personal data may be processed outside the European Economic Area. Where a transfer is subject to Chapter V GDPR, the applicable legal transfer mechanism and safeguards must be in place.

I do not sell your personal data.

11. Data Retention

I retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by law.

  • Commission records: retained as necessary to fulfil the commission, handle related matters and comply with statutory retention requirements.

  • Contact form enquiries: retained for as long as necessary to respond to the enquiry and manage subsequent communication, subject to applicable legal requirements.

  • Download requests and subscriber records: retained as necessary to manage the request, confirmation process, subscription preferences and applicable legal obligations.

  • Marketing subscriptions: retained while the subscription remains active and for an appropriate period afterward where necessary to document consent or comply with legal obligations.

  • Instagram and ManyChat interactions: retained according to the purpose of the interaction, relevant account settings and the applicable service provider's retention practices.

  • Technical logs and analytics: retained according to the relevant service provider's settings and retention practices.

Where personal data is no longer needed, it will be deleted or anonymised where appropriate, subject to legal retention requirements.

12. Your Rights Under the GDPR

Subject to applicable legal requirements and exceptions, you may have the right to:

  • Request access to your personal data.

  • Request correction of inaccurate or incomplete personal data.

  • Request erasure of your personal data.

  • Request restriction of processing.

  • Receive certain personal data in a portable format.

  • Object to processing based on legitimate interests.

  • Withdraw consent at any time where processing is based on consent.

  • Lodge a complaint with a competent data protection supervisory authority.

To exercise your rights in relation to processing for which I am responsible, contact me at the email address stated in the Data Controller section.

If your request concerns data processed directly by a third-party platform for its own purposes, you may also need to contact that provider.

You may lodge a complaint with a data protection supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.

13. Data Security

I take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

However, no method of transmission or storage can be guaranteed to be completely secure.

14. Third-Party Websites and Services

This website and my social media content may contain links to external websites or platforms. When you use a third-party service, that service's own privacy policy and data processing practices apply.

If I introduce additional integrations or features, such as externally hosted video players, advertising pixels or other analytics services, I will review whether this Privacy Policy and the relevant consent settings need to be updated.

15. Changes to This Privacy Policy

I may update this Privacy Policy when my services, website features, data processing practices or legal obligations change.

The latest version will be published on this page, with the date of the most recent update shown at the top.

16. Contact

For questions about this Privacy Policy or the processing of your personal data, please contact:

Email: franziska.boemer@gmx.de