Privacy Policy As of 29 September 2026. 1. Controller: OFF/BRIEF GmbH, represented by the managing directors Nina Waiser and Matthias Storath, OFF/BRIEF GmbH · Linienstraße 40 · 10119 Berlin, Germany. Email: servus@offbrief.de Website: https://offbrief.de 2. Accessing and hosting the website: Our website is provided via Squarespace. When you visit the website, technical access data is processed. This may include, in particular, your IP address, the date and time of access, the content accessed, information about your browser and operating system, and the referrer URL. This processing is necessary to provide the website and to ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of the website. Where Squarespace processes personal data on our behalf, it does so on the basis of a data processing agreement pursuant to Art. 28 GDPR. 3. Cookies and similar technologies: Our website uses cookies and similar technologies. Some of them are necessary for the website to function. For example, they may be used to store security settings or your choice in the cookie banner. Under Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG), their use does not require consent. Where personal data is processed in this context, the legal basis is Art. 6(1)(f) GDPR. In addition, and only if you have given your consent, we use non-essential cookies to analyse how our website is used. These help us understand how often the website is visited and which content is viewed. These cookies are stored or read on the basis of your consent under Section 25(1) TDDDG. The associated processing of personal data is based on Art. 6(1)(a) GDPR. You can reject non-essential cookies in the cookie banner. You can withdraw or change your consent at any time, with effect for the future, via the cookie settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Information on the cookies used, their purposes and their storage periods can be found in the cookie settings. 4. Website analytics with Squarespace: We use Squarespace’s analytics features to evaluate the use of our website and to improve what we offer. This may include, in particular, page views, visitor numbers, the sources of visits and interactions with the website. Where non-essential cookies or similar technologies are used for this purpose, processing takes place only after you have given your consent. The legal basis is Art. 6(1)(a) GDPR. Technical access data that is processed regardless of your consent in order to provide and secure the website is described in Section 2. 5. Contact by email: If you contact us by email, we process the data you send us, in particular your email address and, where applicable, your name and the content of your message, in order to handle your enquiry. If your enquiry relates to a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. In all other cases, processing is based on our legitimate interest in responding to enquiries pursuant to Art. 6(1)(f) GDPR. 6. Recipients and transfers to third countries: We only share personal data where this is necessary to provide our website, to handle your enquiry or to comply with a legal obligation. Recipients may include service providers we use, in particular Squarespace and our email service providers. When Squarespace is used, personal data may be processed outside the European Economic Area. In that case, the requirements of Art. 44 et seq. GDPR for transfers to third countries must be observed. Information on the specific service providers we use and the legal bases for any transfers is available on request at servus@offbrief.de. 7. Storage period: We store personal data only for as long as is necessary for the purposes stated or for as long as statutory retention obligations apply. The storage period of individual cookies is shown in the cookie settings. We delete email enquiries once they have been dealt with, unless a retention obligation or another legitimate reason requires us to keep them. 8. Your rights: Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may object to processing based on legitimate interests (Art. 21 GDPR). You may withdraw any consent you have given at any time, with effect for the future (Art. 7(3) GDPR). To exercise your rights, please contact servus@offbrief.de. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany. 9. Changes: We will update this privacy policy if the data processing on our website or the legal requirements change.