Privacy Policy

This is an English translation provided for convenience. The legally binding version is the German Datenschutzerklärung.

As of 26 May 2026

1. Controller and contact

Controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws:

Ben Touati
TwoEighty Studios
Björnmossegången 20
135 34 Tyresö
Sweden
Email: ben@twoeightystudios.com

2. Data protection at a glance

This website is deliberately built to collect as little data as possible. No cookies are set. There is no web analytics. There are no trackers, no pixel, no advertising networks. When the site is accessed, technically necessary server data is processed, as described below.

3. Hosting

This website is hosted by Netlify, Inc. (44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). Each time the website is accessed, the hosting provider automatically processes data in what are known as server log files:

• IP address of the accessing device
• Date and time of the request
• URL accessed
• Browser type and browser version
• Operating system used
• Referrer URL (the page visited previously, if any)

Processing takes place on the basis of Art. 6 (1)(f) GDPR (legitimate interest in the technical provision and security of the website). The data is not combined with other data sources.

As Netlify is based in the USA, personal data may be transferred to the USA. Netlify is certified under the EU-US Data Privacy Framework (www.dataprivacyframework.gov); appropriate safeguards within the meaning of Art. 45 GDPR therefore apply. Further information on data protection at Netlify: netlify.com/privacy.

4. Third-party fonts

This site loads fonts from two external providers in order to render its typography:

• Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — the font "Newsreader" is used.
• Fontshare (Indian Type Foundry, India) — the font "Switzer" is used.

When the page is accessed, the IP address is transmitted to these services so that the fonts can be delivered. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in an appealing presentation). No cookies are set by the font services on this site.

5. Contact by email

If you send me a message by email, your details (email address, name if given, content of the message) are stored for the purpose of processing the enquiry and for any follow-up questions. Depending on the context, the legal basis is Art. 6 (1)(b) GDPR (pre-contractual measures) or Art. 6 (1)(f) GDPR (legitimate interest in efficient correspondence).

This data remains in my email inbox (Google Workspace, Google Ireland Limited) and is not passed on to third parties unless there is a legal obligation to do so. It is deleted once the correspondence is no longer needed, and at the latest once statutory retention periods have expired.

6. Protection of sources

Communications from sources and whistleblowers, as well as information shared on a background or confidential basis, are handled in line with the standards of journalistic care and with protection of sources pursuant to § 53 (1) no. 5 of the German Code of Criminal Procedure (StPO). For particularly sensitive communications I recommend Signal or another end-to-end-encrypted channel. Please make initial contact by email.

7. Your rights

You have the following rights vis-à-vis the controller in respect of the personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw a consent given (Art. 7 (3) GDPR)

To exercise these rights, an informal email to ben@twoeightystudios.com is sufficient.

8. Right to lodge a complaint with a supervisory authority

You have the right to complain to a data protection supervisory authority about the processing of your personal data. Depending on your place of residence, the supervisory authority of the relevant EU member state is responsible. In Sweden this is the Integritetsskyddsmyndigheten (IMY). In Germany the state data protection authorities are responsible; an overview is available from the Federal Commissioner for Data Protection and Freedom of Information (BfDI).

9. Currency and changes to this privacy policy

This privacy policy may be adapted if the legal or technical circumstances change. The current version is always available on this page.