The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Deleyna, Berlin, Germany, represented by Daria Komuniewska. Email: info@deleyna.co. Further details can be found in our legal notice (Impressum).
For all questions about data protection and to exercise your rights, please contact us at info@deleyna.co.
We only process personal data to the extent necessary to provide this website, handle your requests and applications, and represent our talents. We do not sell data, do not carry out advertising tracking and do not use advertising or analytics cookies.
Where we use service providers, they process data solely on our instructions under a data processing agreement pursuant to Art. 28 GDPR.
This website and our content management system run on our own servers at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. Our database is also operated there by us and is not outsourced to cloud database providers.
When you visit the website, the server processes technically necessary data: IP address, date and time, page requested, amount of data transferred, referrer and browser identifier (user agent). We need this data to deliver the website, ensure its security and prevent misuse.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and stable operation. Server log files are deleted after no more than [14] days unless they are needed to investigate a specific security incident.
Images and videos are delivered via the content delivery network and the "R2" object storage of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes your IP address and technical connection data to deliver the files quickly and securely.
Our storage buckets are assigned to the EU jurisdiction; the files are stored in the European Union. A transfer of connection data to the USA cannot be ruled out. Cloudflare is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); EU Standard Contractual Clauses are in place in addition.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in fast, reliable and protected delivery of our content.
We do not use cookies for analytics, tracking or marketing purposes and therefore do not need a cookie banner. The following information is stored in your browser solely to provide features you actively use:
This information does not leave your device unless you submit a request together with your shortlist. Storage is strictly necessary for the features you request (Section 25(2) No. 2 TDDDG); further processing is based on Art. 6(1)(f) GDPR. You can delete this data at any time in your browser settings.
To understand which content is used, we use the open-source software Rybbit. Rybbit is operated by us or our agency Con Radius Design on servers in Germany; no data is transferred to the software vendor or other third parties.
Rybbit does not set cookies and does not store an identifier in your browser. Your IP address is not stored. We record pages viewed, time on page, referrer, browser and device type, and the country of access. To count unique visits, a daily rotating, irreversible hash value is generated, which rules out recognition beyond that day. URL parameters, form input and session recordings are not collected. Rybbit is completely disabled on pages with forms.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the statistical analysis and improvement of our offering. The data is evaluated only in aggregated form and deleted after [24] months. You can object at any time, for example by emailing the address given above.
If you contact us via a form (such as "Make a Move", talent booking, job or class request) or by email, we process the data you provide, in particular name, company, email address, phone number, project details and any saved talents, in order to handle your request.
The legal basis is Art. 6(1)(b) GDPR insofar as your request aims at concluding a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in responding to your enquiries. Mandatory fields are marked; without this information we cannot process your request.
Your request is stored in our content management system. To notify our team and to send you a possible confirmation of receipt, we use the email delivery service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Resend is certified under the EU-U.S. Data Privacy Framework; EU Standard Contractual Clauses are in place in addition.
We delete requests six months after they have been fully processed if no contract is concluded. If a contract is concluded, we store the data to perform it and subsequently for the statutory retention periods (up to ten years under Sections 147 AO and 257 HGB).
To protect our forms from automated submissions, we use ALTCHA. The check runs as a short computation in your browser and is verified on our own server. No cookies are set, no data is transferred to third parties and no behaviour is analysed across websites. In addition, we limit the number of requests per IP address; the IP address is only processed briefly in memory for this purpose and is not stored permanently.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protection against spam and abuse.
If you apply to join the Deleyna Collective via our application form, we process your contact details, information about your disciplines, experience and availability, your portfolio link and, if you upload them, your photos.
Uploaded photos are stored in a separate, non-public storage within the EU. They cannot be accessed via the internet and can only be viewed after login by staff involved in the selection process. We do not retrieve a portfolio link automatically, only to review your application.
The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract). You additionally give your consent via the checkbox in the form (Art. 6(1)(a) GDPR); it can be withdrawn at any time with effect for the future.
If we accept you into our collective, we continue to process your data to carry out the collaboration (see "Talent profiles"). Otherwise we delete your application including uploaded photos six months after the selection process has ended, unless you have consented to longer storage for future projects.
For the talents we represent, we publish a profile on the basis of the respective contract (Art. 6(1)(b) GDPR) with name or stage name, photos, disciplines, selected references and public social media profiles. We do not publish talents' contact details.
For internal management of talent data we use Notion by Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, USA. Notion is certified under the EU-U.S. Data Privacy Framework; EU Standard Contractual Clauses are in place in addition. After the collaboration ends, the public profile is removed; we delete further data unless statutory retention obligations apply.
Our website contains links to Instagram. These are simple links, not embedded content or plugins. Data is only transferred to Instagram (Meta Platforms Ireland Ltd.) when you click a link and visit the platform; Instagram's privacy policy applies to processing there.
The fonts used on this website are hosted locally on our server. No connection to servers of Google or other font providers is established when you visit the website.
Apart from our responsible staff, recipients of your data are exclusively the service providers named in this policy. Transfers to third countries outside the EU only take place to the named providers based in the USA (Cloudflare, Resend, Notion), which are certified under the EU-U.S. Data Privacy Framework; we have additionally concluded EU Standard Contractual Clauses. We only share talents' data with clients within a specific project and with the talents' knowledge.
Subject to the statutory requirements, you have the following rights:
Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.
Providing personal data is neither a statutory nor a contractual requirement. However, without the information marked as mandatory we cannot process requests and applications. No automated decision-making including profiling (Art. 22 GDPR) takes place.
We update this privacy policy when our website or the services we use change. The version published here applies.
Last updated: October 2026