This privacy notice explains how personal data is processed when you visit punimstudio.com or contact Punim Studio. Updated: 7 October 2026.
1. Controller
Ahmed Ismaili, Punim Studio
Hohensteiner Weg 11
71229 Leonberg, Germany
Email: hello@punimstudio.com
You can contact this address with privacy questions or to exercise your rights.
2. Hosting and technical access data
Our website and email account are hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. Visiting the website involves processing technically necessary connection data. This may include your IP address, date and time, requested address, data transferred, HTTP status, browser, operating system and any referring page sent by your browser.
This processing enables website delivery, stability, troubleshooting and protection against abuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.
Technical logs are retained only as long as needed for operation, troubleshooting and security checks, and processed according to the hosting provider's deletion or anonymisation routines. Following a specific security incident, relevant data may be retained as needed for investigation and legal enforcement. Information about our hosting logs is available on request.
IONOS receives the data necessary for hosting and email operation. This processing is subject to Article 28 GDPR. Provider information: IONOS privacy information .
3. Contact forms and email
When you contact us, we process your name, email address, message or project selection and selected services. The project configurator may also submit your company, industry, location, style, brand and product colours, layout, requested website features, logo and print design choices, and an optional phone number. The general contact form may include company and budget details. Please do not send sensitive information that is unnecessary for your project enquiry.
While you use the project configurator, your input remains in your browser's memory. It is neither saved as a draft nor sent to us automatically. Your contact details and selected configuration are transmitted only when you deliberately submit the enquiry. Generated mockup images are not sent or permanently stored. Reloading the page discards any unsent configuration.
We use these details to respond, understand your request and, where appropriate, prepare a quote. For enquiries about a potential contract, the legal basis is Article 6(1)(b) GDPR. Other business communication, particularly with company contacts, is processed under Article 6(1)(f) GDPR; our legitimate interest is handling enquiries and business communication.
The form sends your details to a PHP endpoint on our hosting space, which sends an email to hello@punimstudio.com. The application does not maintain a separate database of form messages. Messages are processed and stored in the email system. The form confirmation means the server has accepted the message for sending.
If direct sending is unavailable, the contact form and configurator offer a prepared email link. Only when you open it is the draft passed to your email application; you send it from there yourself. Your email provider processes data according to its own privacy notice.
Providing details is voluntary. Without a name, reachable email address and information about your request, we cannot meaningfully respond. No automated decision is made about your enquiry.
4. Contact form protection
To prevent automated enquiries, we use a field hidden from visitors and limit sending attempts. A hash is generated from the IP address and a server-side value, then stored with timestamps in a temporary file. This hash is a pseudonymous technical identifier, not a contact address. Your message is not stored in that file.
The limit considers the last 15 minutes; older timestamps are discarded at the next check. The technical file remains until it is processed again or the server's temporary directory is cleaned. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is preventing spam, overload and misuse. No external CAPTCHA service is used.
5. Cookies, local storage and embedded content
The website does not set cookies or store visitor identifiers in Local Storage, Session Storage or IndexedDB. It contains no analytics or advertising trackers, external videos, maps or booking tools. Fonts, images, icons and animations are served from our own hosting space, without external font or image services. Your manually selected language is stored locally as a language preference; it is not a visitor identifier.
The current website therefore has no consent banner for optional cookies or tracking. If we introduce services requiring consent, we will obtain it before activation and update this notice accordingly.
Your manually chosen language is stored locally as a language preference. It is not a visitor identifier and is not used for tracking.
6. Google Search Console
We use Google Search Console to review our visibility in Google Search and technical indexing information. It is an administration tool for website owners. We have not added analytics or tracking code for it. Our use of Search Console does not cause your browser to send an additional request to Google when you visit this website.
Google's crawling of publicly accessible pages is separate from your visit. This website does not include Google Analytics or Google Ads.
7. Recipients and retention
Your details are processed by the owner of Punim Studio and the technical providers needed for hosting and email. Personal data is not sold or shared for advertising. Disclosure may be necessary to meet a legal obligation or establish, exercise or defend legal claims.
Enquiries and correspondence are deleted once processing is complete and the data is no longer needed for further business communication. Where statutory retention duties or legal claims require records to be kept, deletion follows when those grounds no longer apply. Business and tax records are subject to the applicable statutory periods, usually six, eight or ten years depending on the document. This does not mean every non-binding enquiry is retained for that long.
8. Your rights
Subject to statutory conditions, you have the right to access your personal data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20).
Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation under Article 21 GDPR. We will then stop processing the data unless overriding grounds provided by law apply.
Where processing relies on consent, you may withdraw it at any time with future effect. Processing before withdrawal remains lawful.
You may also complain to a data protection supervisory authority (Article 77 GDPR). The authority particularly relevant to our registered location is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg: www.baden-wuerttemberg.datenschutz.de .
9. Security and changes
When you use HTTPS, data is encrypted in transit between your browser and our web server. This does not guarantee complete protection during subsequent email processing. We update this privacy notice when functionality, services or legal requirements change.