This policy explains what personal data we process when you use this website, why we process it, the legal bases under the General Data Protection Regulation (GDPR), and the rights you have. Ascora Studio is one of the independent digital brands operated by Yasser Derhem.
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing (Art. 21). Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7 (3)). To exercise any right, email hello@ascorastudio.com.
You have the right to lodge a complaint with a supervisory authority (Art. 77). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
This website is hosted by Vercel Inc. (USA). When you visit the site, our hosting provider automatically processes server log data that your browser transmits — including your IP address, date and time of the request, the page requested, referrer, and browser/operating-system information. This is technically necessary to deliver the website securely and reliably. Legal basis: our legitimate interest in a secure, functioning website (Art. 6 (1) (f) GDPR). A data-processing agreement is in place with the provider.
If you submit the inquiry form, we process the information you provide: name, and optionally company name, email address, phone number, industry, project type, budget range, goal, and project details. We use this to respond to your request, prepare proposals, and manage our relationship with you. This data is stored in our database, which is hosted by Supabase (Supabase Inc.) on servers within the European Union, with row-level access controls. Legal bases: steps prior to entering into a contract and performance of a contract (Art. 6 (1) (b)), our legitimate interest in responding to inquiries (Art. 6 (1) (f)), and — where you tick the consent box — your consent (Art. 6 (1) (a)). The form includes a hidden anti-spam field ("honeypot") that stores no personal data, and is protected by Cloudflare Turnstile (Cloudflare, Inc.), which checks that submissions come from a human; for this purpose it processes technical data such as your IP address and browser characteristics. Legal basis for the protection check: our legitimate interest in preventing abuse of the form (Art. 6 (1) (f) GDPR).
We store a small number of functional values in your browser's local storage: the language you selected (English or Arabic) and — where applicable — your cookie choice. These are strictly necessary to provide the functions you requested (§ 25 (2) TDDDG) and contain no personal data; you can clear them at any time via your browser settings. In addition, this website uses Google Ads conversion cookies as described in section 7. For visitors in the EU/EEA, the United Kingdom, and Switzerland, these cookies are set only after you accept them via the cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); if you decline, no advertising cookies are set. You can change your choice at any time here. The public website does not create a login session.
We use Vercel Web Analytics to understand, in aggregate, how the site is used (e.g., which pages are visited). It is privacy-friendly and cookieless: it does not set cookies, does not track you across websites, and does not store data that identifies you personally. Legal basis: our legitimate interest in improving our website (Art. 6 (1) (f) GDPR).
We also use Google Ads conversion tracking (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to measure whether our online advertisements lead to inquiries — for example, when the project form is submitted after clicking one of our ads. For this purpose the Google tag processes technical data (IP address, browser information, pages visited, and an ad-click identifier) and may set cookies. We use Google Consent Mode v2: for visitors in the EU/EEA, the United Kingdom, and Switzerland, advertising cookies remain disabled until you consent via the cookie banner; without consent, only aggregated, cookieless signals are transmitted. Legal bases: your consent (Art. 6 (1) (a) GDPR) where required, and otherwise our legitimate interest in measuring the effectiveness of our advertising (Art. 6 (1) (f) GDPR). Details: business.safety.google/adscookies.
We use the "Space Grotesk" and "Space Mono" typefaces, which are delivered via Google Fonts (Google Ireland Ltd. / Google LLC). When a page loads, your browser connects to Google's servers, which receive your IP address in order to serve the fonts. Legal basis: our legitimate interest in a consistent, professional presentation (Art. 6 (1) (f) GDPR).
Some technical components (for example the 3D engine and the database client library) are loaded from the content-delivery networks cdnjs (operated by Cloudflare, Inc.) and esm.sh. To deliver these files, your browser connects to these services, which receive your IP address. Legal basis: our legitimate interest in fast, reliable delivery of the website (Art. 6 (1) (f) GDPR).
Some pages display photographs provided by Unsplash (Unsplash Inc.) and website-preview thumbnails generated by the service thum.io. Loading this content transmits your IP address to the respective provider. Legal basis: our legitimate interest in presenting our work (Art. 6 (1) (f) GDPR).
For business correspondence and to send invoices to clients, we use the email-delivery service Resend (Resend, Inc.). Where we email you, your email address and the content of the message are processed by this provider on our behalf. Legal bases: performance of a contract (Art. 6 (1) (b)) and our legitimate interest in efficient communication (Art. 6 (1) (f) GDPR).
Some of the providers named above (including Google, Vercel, Cloudflare, Unsplash, thum.io, Resend, and Supabase's parent company) are based in the United States or may process data there. Such transfers are safeguarded by the EU Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.
We keep personal data only as long as necessary for the purposes described above, or as required by statutory retention periods (for example under tax and commercial law), after which it is deleted. You may request deletion of your inquiry data at any time, subject to any legal retention obligations.
This website is delivered over an encrypted TLS/HTTPS connection. Access to inquiry data is restricted to authorised persons and protected by row-level security in the database.
We may update this policy to reflect changes to our services or to the legal requirements. The version published here is the one that applies.
← Back to Ascora Studio