Privacy
1. Controller
The controller responsible for data processing on this website is Rodan Can, can we studios (sole proprietorship), Zum Schacht 7, 45731 Waltrop, Germany. Email: sayhi@canwestudios.com. Telephone: on request.
2. General information and legal bases
We only process personal data where necessary to provide a working website, our content and services. Legal bases: Art. 6(1)(a) GDPR (consent), (b) (contract/enquiry), (c) (legal obligation), (f) (legitimate interest). Access to end devices: § 25 TDDDG.
3. Hosting
The website is a static Astro site hosted by Netlify, Inc., San Francisco (USA). When you visit the site, Netlify processes technically necessary data on our behalf (in particular IP address, date and time, page requested, referrer and browser type) (Art. 28 GDPR). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing a secure and stable website). Transfers to the United States rely on the EU-US Data Privacy Framework and on the European Commission’s standard contractual clauses.
Images and videos are delivered via Sanity’s content delivery network (cdn.sanity.io). The provider is Sanity AS, Trondheimsveien 2K, 0560 Oslo, Norway. Norway is part of the European Economic Area. According to Sanity, delivery uses a global CDN (based on Google’s CDN). Technically necessary data (e.g. your IP address) may therefore also be transferred to countries outside the EEA, including the United States. The legal basis is likewise Art. 6(1)(f) GDPR.
4. Server log files
When you visit the website, the host Netlify automatically creates server log files. These typically include IP address, date and time, page requested, referrer, and browser type and version. The logs are used for security, troubleshooting and technical operation. The legal basis is Art. 6(1)(f) GDPR. According to Netlify’s public statements, access logs are generally deleted after no more than 30 days. The logs are not used for analytics or marketing.
5. Cookies and consent
The only technically necessary storage is your consent choice (localStorage “cws-consent”, § 25(2) TDDDG). External media (embedded videos from YouTube or Vimeo) only load after your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). No analytics or statistics tool is currently installed. Rejecting is as easy as accepting; you can change or withdraw your choice at any time via “Cookie settings” in the footer.
6. Contact form and email
If you contact us via the form or by email, we process your name, email address, company, club or management (optional), the area you select (Sports or Brands) and your message, in order to handle the enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract or steps prior to entering into one, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to your message).
The form is received via Netlify Forms (Netlify, Inc., USA); for transfers to the United States, see the “Hosting” section. Emails to sayhi@canwestudios.com are received via mailboxes at Strato AG, Berlin. We delete or restrict the data once your enquiry has been closed, unless statutory retention duties apply.
7. Web analytics (consent only)
No analytics or statistics tool is currently installed. No analytics script is loaded and no audience measurement takes place. If we introduce such a tool in the future, we will update this notice, offer consent in the banner and load the tool only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).
8. Embedded videos
Videos that we upload ourselves are delivered via the Sanity CDN (cdn.sanity.io) and play without a separate consent step; see the “Hosting” section.
The site can also embed videos from external providers (YouTube or Vimeo). Those embeds only load once you consent to “External media” in the banner. Until then, no connection to the provider is made; only a notice with a link to the cookie settings is shown. After consent, the provider may process personal data (in particular your IP address), including in the United States where applicable. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You may withdraw consent at any time via “Cookie settings” in the footer.
No external video link is currently set on the published cases. Instagram appears on the site only as a regular link, not as an embedded player.
9. Fonts
Fonts (Instrument Serif, Geist) are self-hosted. No connection to Google or other font providers is made.
10. Social media links
Instagram and LinkedIn are plain links, no plugins. Data only flows if you click them.
11. SSL/TLS encryption
The site uses SSL/TLS encryption for security.
12. Retention
We store personal data only for as long as needed for the respective purpose or as required by law. According to the host, server log files are generally deleted after no more than 30 days. We delete or restrict contact enquiries once they have been fully handled. Where a contract follows or tax or commercial-law duties apply, retention periods of up to ten years may apply (in particular § 147 AO, § 257 HGB). Your cookie choice is stored in your browser (localStorage “cws-consent”) until you change it or clear the data in your browser.
13. Your rights
You have the right of access, rectification, erasure, restriction, data portability, objection and withdrawal of consent (Arts. 15–21, 7(3) GDPR).
14. Right to lodge a complaint
You may lodge a complaint with a supervisory authority, in particular with the authority responsible for us: the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, telephone: +49 211 38424-0, email: poststelle@ldi.nrw.de, website: https://www.ldi.nrw.de. You may also contact the supervisory authority at your place of residence or work.
15. Last updated
November 2026