Privacy policy

Last updated: 27 October 2026

In short

This website sets no cookies, uses no analytics or tracking tools, has no contact form and loads no content from other providers. The fonts are served from this website’s own hosting. Personal data is processed when you visit the site (technical data, see “Hosting”) and when we are in contact – for example when you write to me, or when I contact your business about my services using contact details it publishes itself, such as on its website.

Who is responsible

Where I work

I am based in Thailand and not established in the European Union. Your messages are received and answered by me there. Thailand has no adequacy decision of the European Commission, so Thai law may not offer the same level of data protection as the GDPR.

Hosting

This website is hosted on Cloudflare Pages by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which acts as my processor. When you visit the site, Cloudflare processes technical data such as your IP address, the time of your visit, the page requested and information about your browser, in order to deliver the site and protect it against attacks. Legal basis: Art. 6 (1) (f) GDPR – my legitimate interest in a secure and reliable website. Cloudflare is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are based on the adequacy decision of the European Commission (Art. 45 GDPR). Cloudflare deletes or anonymises this data under its own retention periods; I do not keep or evaluate access logs myself.

Contacting me by email

If you email me, I process your address, your message and any information you include, to answer your enquiry and, where applicable, to prepare and carry out a contract. Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a contract, otherwise Art. 6 (1) (f) GDPR – my legitimate interest in answering enquiries about my services.

Emails to max@maxstarkstudio.com are received by Cloudflare Email Routing (Cloudflare, Inc., see above, as my processor) and forwarded to my Gmail account. Google processes these emails as an independent controller under its own privacy policy and may transfer them to the USA. I send my replies via Brevo (Brevo SAS, 17 rue Salneuve, 75017 Paris, France), which acts as my processor and may use sub-processors outside the EU, including in the USA and India. Brevo adds an invisible image to outgoing emails that shows whether and when an email was opened. You can prevent this by not loading images in your email program.

Enquiries that do not lead to a contract are deleted no later than 12 months after our last contact. Correspondence about a contract is kept for as long as statutory retention periods require (up to 10 years).

Contacting me on WhatsApp

If you contact me on WhatsApp, your message is also processed by WhatsApp (part of Meta) under its own privacy policy; data may be transferred to the USA. I use WhatsApp only to answer your enquiry. Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a contract, otherwise Art. 6 (1) (f) GDPR. If you prefer, simply email me instead.

Links to other websites

This site links to LinkedIn, WhatsApp and silverbackcapital.fund. No data is passed on to these providers until you click a link; after that, their own privacy policies apply.

Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), and to receive it in a portable format (Art. 20). A short email is enough. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work.

Right to object: Where I process your data on the basis of my legitimate interest (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). If I contact you about my services, you can object to this at any time without giving reasons; I will then stop contacting you.

You are not obliged to provide personal data; without it I simply cannot answer your enquiry. I do not use automated decision-making or profiling.