Privacy policy

Version: 14 November 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Katharina Mertens (Prismarella)
Burgsteinfurter Damm 182
48432 Rheine
Germany

Phone: +49 160 92365884

A data protection officer is not required by law. For any questions about data protection, please contact the address above directly.

2. General information on data processing

I process personal data only to the extent necessary for a functioning website, for answering your enquiries and for providing my services. The legal bases are Art. 6 (1) (a) GDPR (consent), (b) (contract and pre-contractual enquiries), (c) (legal obligation) and (f) (legitimate interest in a secure and functioning website).

Data is deleted as soon as the purpose of storage no longer applies and no statutory retention obligations stand in the way.

3. Hosting and provision of the website

The website is technically operated on behalf of the controller by:

IDENTIC Projects eGbR, Kreuzberg 71, 59846 Sundern, Germany (processor pursuant to Art. 28 GDPR).

IDENTIC uses the following infrastructure for this purpose:

• Google Cloud Run (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — runs the website in the europe-west1 region (Belgium).
• Sanity (Sanity AS, Oslo, Norway) — content management system and image delivery (CDN); data is held in Google Cloud data centres in Belgium.

Data processing agreements are in place with both providers. The legal basis is Art. 6 (1) (f) GDPR (interest in secure, fast and resilient provision).

4. Access data and server log files

Each time the website is accessed, the following data is processed in log files for technical reasons: IP address, date and time of access, page requested, amount of data transferred, browser type and version, operating system, referrer URL.

Legal basis: Art. 6 (1) (f) GDPR (operational security, error analysis, defence against attacks).
Retention: Logs are deleted automatically after 30 days.

5. Cookies

This website sets no cookies for visitors. The language setting (German/English) is controlled via the page address (/de or /en), not via cookies. A cookie banner is therefore not required.

A technically necessary cookie is set only when the operator herself logs in to the preview view of the editorial system. Visitors are not affected.

6. Getting in touch

This website contains no contact form. You can reach me via the channels linked on the contact page, Instagram and WhatsApp, as well as by phone. The website itself transmits no data in the process; the respective service only opens once you click a link.

If you write to me, I process your details (name or profile name, contact details, content of the message) in order to answer your enquiry and arrange a shoot.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual enquiry).
Retention: I delete messages once your enquiry has been fully dealt with and no retention obligations apply (e.g. after a contract is concluded, § 147 AO).

For Instagram and WhatsApp, the privacy policies of the respective provider also apply (Meta Platforms Ireland Ltd. for Instagram and WhatsApp).

7. Photographs and reviews

On this website I show photographs of people (cosplayers) as well as reviews with names or Instagram handles. This content is published only with the consent of the persons depicted or quoted (Art. 6 (1) (a) GDPR, § 22 KUG). Consent can be withdrawn at any time with effect for the future, in which case I will remove the content concerned.

8. External links and fonts

The website links to Instagram, Spotify and WhatsApp. No content from these services is embedded; data flows only when you actively click a link. Fonts are served locally from the web server; no connection is made to Google Fonts or other font providers.

9. Processors and third-country transfers

Provider · Purpose · Location / place of processing · Basis

--- · --- · --- · ---

IDENTIC Projects eGbR · Development, operation and maintenance of the website · Sundern, Germany · DPA, Art. 28 GDPR

Google Ireland Ltd. (Cloud Run, Cloud Logging) · Hosting, logs · EU (Belgium) · DPA (Google Cloud DPA)

Sanity AS · Content, images · EU (Belgium) · DPA (Sanity DPA)

No data is transferred to countries outside the EU/EEA.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw any consent given at any time with effect for the future (Art. 7 (3)). Please use the contact details in section 1.

11. Right to lodge a complaint with a supervisory authority

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Web: https://www.ldi.nrw.de

12. Changes

I will amend this privacy policy if the website or the legal situation changes. The version published here applies in each case.