Alina Volando

Privacy Policy

Last updated: November 2026

1. Controller

The controller responsible for processing personal data on this website is:

Alina Voinescu
Schliemannstraße 4
10437 Berlin, Germany
Email: info@alinavolando.com

2. Summary

  • This website does not use cookies or cookie-based tracking.
  • I only use data from the contact and booking forms to answer your request and plan your event. You only receive a newsletter if you have explicitly signed up for it.
  • I do not sell data or share it for advertising.
  • I use a few service providers to run this website. They process data only on my behalf (data processing agreements under Art. 28 GDPR).

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, Vercel processes technically necessary data, in particular your IP address, the date and time of access, the page requested, the previously visited page (referrer) and browser and operating system details. This data is needed to deliver the website and keep it secure and stable.

The legal basis is my legitimate interest in running the website securely and reliably (Art. 6(1)(f) GDPR). Vercel deletes server log files automatically after a short time.

Data may be transferred to the USA. Vercel is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). I have also concluded a data processing agreement with Vercel that includes the EU Standard Contractual Clauses.

4. Contact and booking requests

When you write to me through a form on this website (contact form, booking requests for events, the Day Camp and kids' birthdays) or send me an email, I process the data you provide. Depending on the form, this is your name, email address, phone number, your message and details of the requested event (e.g. date, time, number, names and ages of participants, chosen technique and colours).

I use this data to answer your request and to plan and run the event with you. The legal basis is taking steps prior to entering into a contract or performing a contract (Art. 6(1)(b) GDPR); for other requests, my legitimate interest in answering them (Art. 6(1)(f) GDPR).

Health information: If you voluntarily tell me about things like participants' allergies, I use this only to run the event safely. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time for the future by email.

Children's data: For kids' birthdays and the Day Camp, parents or guardians provide the details of the participating children. Please only give the details needed for planning.

Service providers: Form submissions are stored in a database at Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 (server location: Frankfurt am Main, Germany). The notification to me and the confirmation to you are sent via Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) from servers in the EU (Ireland). I receive and answer emails on my own mail server, hosted by Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA (server location: USA). I have data processing agreements with these providers. Where data may be transferred to the USA or other third countries, this is based on the EU-US Data Privacy Framework (Art. 45 GDPR) or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Retention: I delete your request once it has been dealt with and no further communication is expected, at the latest 12 months after our last contact. If a contract is concluded, I keep the necessary records for as long as statutory retention obligations require (usually 6 or 10 years under German commercial and tax law).

Temporary storage in your browser: The kids' birthday booking form remembers your entries in your browser's local storage (localStorage) so that they are not lost if the page is reloaded. This data stays on your device until you send the request or clear your browser storage. This is strictly necessary for the function you requested (Section 25(2) No. 2 TDDDG).

5. Buying a voucher and payment

When you buy a voucher, I process your name and email address, the voucher you chose, the recipient’s name and email address if you give them, your personal message, the delivery method and, for delivery by post, the delivery address. I use these data to create, deliver and later redeem the voucher. The legal basis is the performance of the purchase contract (Art. 6(1)(b) GDPR); I process the recipient’s data on the basis of my and your legitimate interest in delivering and redeeming the gift (Art. 6(1)(f) GDPR).

Payment: Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details (e.g. card number, bank account, PayPal or Klarna account) directly on Stripe’s payment page; I do not receive them. Stripe also processes your email address, the delivery address and technical data to prevent fraud, partly as a controller in its own right (see Stripe’s privacy policy). Depending on the payment method, PayPal or Klarna are also involved. Data may be transferred to the USA; Stripe is certified under the EU-US Data Privacy Framework and also uses EU Standard Contractual Clauses.

Voucher data are stored at Supabase and the emails with the voucher are sent via Resend (see section 4).

Storage period: I keep voucher data until the voucher has been redeemed or has expired; records of the purchase are kept as long as statutory retention obligations require (usually 6 or 10 years under commercial and tax law).

6. Newsletter

In the kids' birthday booking form you can choose to sign up for my newsletter, in which I occasionally send news about events, workshops and new artwork. Signing up is not needed for the booking.

If you tick the box, I add you to the list. The confirmation of your request mentions the sign-up and includes a link to unsubscribe again straight away.

What data: email address, first and last name, language, the form you signed up on and, as proof of your consent, the text you agreed to and the times of sign-up and, if applicable, unsubscribing.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) No. 2 UWG). You can withdraw it at any time for the future: with the unsubscribe link in every newsletter or by email to info@alinavolando.com. The data is stored at Supabase and the emails are sent via Resend (see section 4).

Retention: I keep your data for as long as you receive the newsletter. After you unsubscribe, I keep your email address and the records of your consent and unsubscribing for up to three years so that I can show I acted lawfully (Art. 6(1)(f) GDPR); I no longer use them to send anything.

7. Analytics with PostHog (without cookies)

To understand how the website is used and to detect technical errors, I use PostHog (PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA). PostHog runs without cookies: no information is stored permanently in your browser, and you are not recognised on a later visit. It records pages viewed, approximate location (country/city, derived from the IP address), browser, device type, screen size and referrer, as well as clicks on links and buttons and certain actions such as successfully sending a form or starting a video – but not what you type into forms. Technical error messages are also recorded. Session recording (session replay) is turned off.

The data is processed on servers in the EU (Frankfurt am Main, Germany). The legal basis is my legitimate interest in statistical analysis and fixing errors (Art. 6(1)(f) GDPR). I have a data processing agreement with PostHog; possible transfers to the USA are covered by the EU Standard Contractual Clauses. You can object to this processing at any time (see section 10), e.g. by email to info@alinavolando.com.

The server that processes the forms also sends anonymous status messages to PostHog (e.g. "request accepted" or "sending failed"), without names, email addresses or any other content of your request.

8. Fonts, videos and external links

Fonts and videos are loaded directly from this website; no data is passed to third parties such as Google.

The website contains links to other services, e.g. Google Maps, Instagram, YouTube and partner websites. The linked page only opens when you click such a link; the privacy policy of that provider then applies.

9. Contact via Instagram

If you contact me via Instagram, I process your message in order to answer it (Art. 6(1)(b) or (f) GDPR). Meta Platforms Ireland Ltd. is responsible for the processing by Instagram; its privacy policy applies.

10. Your rights

You have the right to

  • access the data I process about you (Art. 15 GDPR),
  • have incorrect data corrected (Art. 16 GDPR),
  • erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

Just write to me at info@alinavolando.com.

You can also lodge a complaint with a data protection supervisory authority, e.g. the authority responsible for me, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin.

11. Obligation to provide data

You are not obliged to give me any data. Without the fields marked as required, however, I cannot process your request.

12. Changes

I update this privacy policy when the website or legal requirements change. The version published here applies.