Gingerbread Villain mascot Gingerbread Villain

Privacy Policy

Last updated: 7 August 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Nikita Prianichnikov
Denninger Str. 231
81927 Munich
Germany
Email: hello@gingerbreadvillain.com

Further details are available in our Impressum.

2. Overview of processing

The following overview summarises the categories of data processed and the purposes of their processing, and identifies the data subjects concerned.

  • Master data (e.g. email addresses)
  • Contact data (e.g. email)
  • Meta, communication and process data (e.g. IP addresses, timestamps)
  • Usage data (e.g. pages visited, access times)

Data subjects are visitors and users of our online offering as well as newsletter subscribers.

3. Legal bases

Below we set out the legal bases under the GDPR on which we process personal data:

  • Consent (Art. 6(1)(a) GDPR) — for the use of Google Analytics and for sending our newsletter.
  • Legitimate interests (Art. 6(1)(f) GDPR) — for the stable and secure operation of this website (e.g. server log files) and for keeping records of consent given.

4. Your rights as a data subject

Under the GDPR, you have the following rights as a data subject:

  • Right of access to the data we process about you (Art. 15 GDPR)
  • Right to rectification of inaccurate data (Art. 16 GDPR)
  • Right to erasure of your data stored with us (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw consent at any time, with effect for the future (Art. 7(3) GDPR)
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

The competent supervisory authority is usually the data protection authority of your habitual residence, or the authority responsible for our company seat — for Bavaria, the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

5. Provision of the online offering and web hosting

This website is delivered via the platform of Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. In this role, Vercel processes technically necessary data (including IP address, access time, requested page) as a processor on our behalf in order to provide the website in a stable and secure way. The legal basis is Art. 6(1)(f) GDPR. For more information, see the Vercel Privacy Policy.

6. Server log files

When you visit our website, our hosting provider automatically collects information in so-called server log files that your browser automatically transmits. This includes: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, and IP address. This data is used to ensure the trouble-free operation and security of our information technology systems (Art. 6(1)(f) GDPR) and is not merged with other data sources.

7. Cookies and consent management

On your first visit to this website, we show you a cookie banner that lets you choose whether to consent to the use of Google Analytics or to reject it. No Google Analytics script is loaded without your consent. Your choice is stored locally in your browser (local storage) so that we don't have to ask you on every visit. You can change or withdraw your choice at any time via "Cookie settings" in the footer of this website.

The legal basis for using Google Analytics is exclusively your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG, formerly TTDSG). You may withdraw this consent at any time with effect for the future.

Google Analytics

If you have given consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and similar technologies that allow us to analyse your use of this website. The information generated in this process (including truncated IP address, device and browser information, pages visited, and time spent) is typically transferred to a Google server in the USA and stored there.

For the transfer of personal data to the USA, Google has entered into the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). We have also entered into a Data Processing Agreement with Google that secures the requirements of European data protection law.

Google Analytics 4 truncates or anonymises IP addresses before storage within the European Economic Area; a full IP address is only transferred to the USA in exceptional cases and is truncated there. We have limited the retention period for user-related event data in Google Analytics to an appropriate length.

In addition to the cookie banner, you can object to Google Analytics collecting data with effect for the future by downloading and installing the Google Analytics opt-out browser add-on. Further information on how Google handles user data in Google Analytics is available in Google's Privacy Policy.

8. Contacting us

If you contact us by email, we process the data you provide (e.g. email address, name, content of your request) in order to handle your request. The legal basis is Art. 6(1)(b) or (f) GDPR (processing pre-contractual or legitimate requests).

9. Newsletter

When you sign up for our newsletter, we use a double opt-in procedure: after you sign up, we send a confirmation email to the address provided and ask you to confirm your subscription by clicking a link in that email. Your subscription only becomes active after this confirmation; otherwise, your sign-up is automatically deleted after a reasonable period.

At sign-up, we additionally store the following for evidence purposes:

  • the time of your sign-up and your confirmation,
  • the exact wording to which you consented when submitting the form,
  • the IP address used at the time of sign-up.

The legal basis for sending the newsletter is your consent (Art. 6(1)(a) GDPR). The legal basis for storing the sign-up data as evidence of your consent is our legitimate interest (Art. 6(1)(f) GDPR) in being able to demonstrate that consent in the event of a dispute.

To manage our newsletter list, we use Notion Labs, Inc., 2300 Harrison St. #32, San Francisco, CA 94110, USA, as a processor. We have a Data Processing Agreement with Notion and EU Standard Contractual Clauses in place for transferring data to the USA. To send the confirmation email, we use the email delivery service Resend, also as a processor, exclusively for the technical delivery of confirmation and double opt-in emails.

You can withdraw your consent to receive the newsletter at any time and unsubscribe from the newsletter. An unsubscribe link is included at the end of every newsletter email. If you can't find that link, you can also unsubscribe by entering your email address on our unsubscribe page. The lawfulness of any processing carried out before your withdrawal is unaffected.

10. Retention period

Unless a more specific retention period is stated in this policy, we keep personal data until the purpose for the processing ceases to apply. Newsletter sign-up data is kept until you withdraw your consent and for a reasonable period afterwards in order to document the consent given.

11. Changes to this Privacy Policy

We encourage you to review the contents of our Privacy Policy regularly. We update this Privacy Policy whenever the legal situation, the services we use, or our processing activities change.

← Back to the homepage