studioRAYY
Legal notice & privacy
Imprint
1. Legal notice under section 5 DDG (German Digital Services Act)
studioRAYY is a brand of RAYY GmbH. RAYY GmbH Schönsteinstraße 12a 50825 Cologne Germany
2. Representation and contact
Represented by managing director Jens-Henrik Heinen. Telephone: +49 172 2474148 Email: info@studiorayy.com
3. Commercial register and VAT
Register court: Amtsgericht Köln (Cologne Local Court) Commercial register: HRB 97279 VAT identification number under section 27a of the German VAT Act: DE322781997
4. Locations
Cologne, Germany · Los Angeles, USA The Cologne address above is the business address of the responsible website operator. The Los Angeles location does not identify an additional legal entity.
Privacy
1. Controller and scope
The controller for personal data processed through this website is RAYY GmbH, Schönsteinstraße 12a, 50825 Cologne, Germany, represented by Jens-Henrik Heinen. Contact: info@studiorayy.com or +49 172 2474148. This notice covers the public website, contact forms, downloads and linked information packages. Last updated: 25 October 2026. Our services are offered exclusively to businesses and agencies, not private consumers. This does not affect the data protection rights of individuals.
2. Hosting and technical delivery
The website, its application functions and data are provided through Replit, Inc., USA, and its technical infrastructure. Access may involve processing your IP address, browser and device information, requested URL, access time and technical error data. The purposes are delivery, operational security, troubleshooting and abuse prevention. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure, functioning website. Hosting, storage and technical providers receive data as required to provide these services. Replit: https://replit.com/privacy Processing terms and the EU Standard Contractual Clauses provided for there: https://replit.com/dpa
3. Contact and show enquiries
If you contact us by form, email or telephone, we process the details you provide, including your name, email address, company, telephone number, message and any event information. We use them to handle your enquiry, prepare offers and, where applicable, perform a contract, and record the enquiry in our CRM. The legal basis is Article 6(1)(b) GDPR for a contract with you or steps requested before a contract. For communication with company representatives and other enquiries, we rely on Article 6(1)(f) GDPR and our legitimate interest in handling business enquiries. Required form fields are marked; without the necessary information we cannot handle the relevant request. Appointed email providers may technically process the correspondence.
4. Trailer downloads and information packages
For downloads requiring an email address, we record your email address, requested content, chosen language and any additional voluntary details in our CRM. We provide the requested content and may email an access link. For personalised information-package links, the first access and its time are associated with the request. This helps document delivery and handle your enquiry. The legal basis is Article 6(1)(b) GDPR, or Article 6(1)(f) GDPR for business contacts and access documentation. You may object to processing based on legitimate interests under Article 21 GDPR. Dropbox links take you to Dropbox, whose privacy notice also applies. Requesting a download is not consent to a newsletter. Dropbox: https://www.dropbox.com/privacy
5. Form protection with Cloudflare Turnstile
Our forms use Cloudflare Turnstile, supplied by Cloudflare, Inc., USA, to prevent automated requests and abuse. This may transmit IP addresses, browser, device and technical interaction data to Cloudflare. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in preventing spam and attacks. Device access strictly necessary for the expressly requested protected form function falls under section 25(2)(2) TDDDG. Any additional non-essential storage or access requires consent under section 25(1) TDDDG. Without a successful security check, the protected form may not submit; alternatively, contact us by email or telephone. Cloudflare: https://www.cloudflare.com/privacypolicy/ Turnstile: https://www.cloudflare.com/turnstile-privacy-policy/
6. Local preferences and Google Analytics 4
The website may store your language choice and analytics decision in your browser's local storage. A technical browser identifier may also be used to limit abuse of form submissions. The legal bases are Article 6(1)(f) GDPR and, for storage strictly necessary for the requested function, section 25(2)(2) TDDDG. You can delete this data through your browser. We have configured Google Analytics 4 with measurement ID G-7CQQR9MP6R to understand website usage and the success of contact enquiries. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, USA, and other Google processors may also process data. The Google script loads only on our website domains and only after explicit analytics consent. Without consent we do not send analytics events to Google. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. You can change your choice or withdraw consent for the future through “Analytics settings” in the footer. We measure page views and, separately, visits to the contact page (contact_page_view) and successfully submitted contact enquiries (generate_lead). Google may receive technical device and browser data, online identifiers and usage events. Our own events do not contain names, email addresses, telephone numbers or message contents. We remove URL query parameters and fragments from the page addresses we send. We enable neither Google Signals nor personalised advertising; agreeing to analytics does not grant advertising consent. The configured lifetime of the _ga and _ga_* analytics cookies is at most 90 days without automatic extension on activity. Separate retention of event and user data is configured in the GA4 property; you may ask the controller about that setting. Google services may involve transfers to the USA; see section 8 on international transfers. Google: https://policies.google.com/privacy Google Analytics information: https://support.google.com/analytics/answer/6004245
7. Videos, thumbnails and external links
Our own video files are delivered through the website infrastructure. We also use YouTube, provided by Google Ireland Limited and Google LLC, USA. YouTube players load when activated and use youtube-nocookie.com. This mode does not prevent all data transfers. External YouTube thumbnails may connect to Google as soon as the image loads, transmitting your IP address and technical access data. Playback may involve further processing and, if you are signed in, association with your Google account. Exclusively local delivery or complete blocking of external media before consent requires corresponding technical implementation; the analytics choice does not control these media. External media require a separate privacy assessment and any necessary consent must be obtained before activation. Links to LinkedIn, Instagram and other external websites lead to independent providers, whose privacy notices apply after you follow a link. Google/YouTube: https://policies.google.com/privacy
8. Recipients and international transfers
In addition to the named providers, authorised staff and appointed hosting, storage, IT and email providers may receive data within their duties. Data may also be disclosed where necessary to perform a contract or meet legal obligations. US providers and their infrastructure may process data outside the EU or EEA. Transfers must meet Articles 44 et seq. GDPR, for example through an applicable adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses. EU-US Data Privacy Framework certification is relevant only if it covers the actual recipient and processing. You can ask us for information about the recipients and safeguards applicable to a particular processing activity. This notice does not promise reliance on the former Privacy Shield.
9. Retention
We retain personal data while needed to handle your enquiry, supply requested content or manage a business relationship. Further retention depends on statutory record-keeping obligations or the establishment, exercise or defence of legal claims. Technical logs and security data are assessed against operational, troubleshooting and abuse-prevention needs. Local browser data remains until you or your browser delete it; provider-cookie lifetimes also depend on the relevant service configuration. Data no longer needed must be deleted or anonymised unless a retention ground remains.
10. Your rights
Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). You may withdraw consent at any time for the future without affecting the lawfulness of earlier processing. For processing based on Article 6(1)(f), you may object on grounds relating to your particular situation (Article 21). You may object to direct marketing at any time. Contact info@studiorayy.com to exercise your rights. You may also complain to a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. The State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia is a relevant authority for our registered location. https://www.ldi.nrw.de
11. Automated decisions and security
This website does not make solely automated decisions producing legal or similarly significant effects under Article 22 GDPR. Connections to the website use HTTPS encryption; this does not mean complete protection against every data-processing risk.