Privacy policy
Last updated: 15 November 2026
At a glance
These pages do not set cookies, do not load anything from third-party services and do not measure who visits them. We only receive data from you if you write to us, make a booking, or cancel or withdraw from a contract.
1. Who is responsible
CUBE4DEV GmbH, Auf den Scheffeln 13E, 44894 Bochum, Germany, email: mail@cube4dev.de. More information in the legal notice.
This privacy policy applies to CUBE4COLOR at cube4color.com, cube4color.de and cube4color.cube4dev.de: to this promotional website, to booking, to logging in and to the forms for enquiries, cancellation and withdrawal.
2. Our customers’ sites
Artists, galleries, associations and other organisations run their own sites, studios and application forms on CUBE4COLOR, often under their own web address. The respective organisation is responsible for the data there. We process it only on its behalf and in accordance with its instructions (Art. 28 GDPR). The organisation’s privacy policy applies. Questions about your data there should be addressed to the organisation. If such questions reach us, we forward them to the organisation.
3. When you visit these pages
To deliver a page to you, our server processes, with every request, your IP address, the address requested, the date and time, and the information that your browser sends of its own accord, such as the type and language of the browser. We do not keep an access log. We hold the IP address only in memory in order to curb abuse, such as mass requests or attempts to guess passwords. It is deleted from there after one day at the latest.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to deliver the pages and to operate them securely.
4. Cookies and browser storage
This promotional website does not set cookies and does not store anything in your browser’s storage. That is why there is no cookie notice either.
Only when you log in to a studio or to the control panel does CUBE4COLOR set a session cookie. It keeps you logged in, is technically necessary for this purpose and ends when you log out or when the session expires (Section 25(2) no. 2 TDDDG). Your browser remembers some display settings on your device. They are not sent to us.
5. Enquiries
If you send an enquiry via “Your real space” (“Euer echter Raum”) or enquire about more exhibitions, we store your name, your email address, your message and, if you provide them, your organisation and your website or your location. We use this to answer the enquiry and to prepare an offer. The enquiry is stored on our server and is visible only to us.
The legal basis is Art. 6(1)(b) GDPR where a contract is concerned, otherwise Art. 6(1)(f) GDPR. We delete the enquiry once it has been dealt with and there is no statutory obligation to retain it.
6. Booking and logging in
If you make a booking, we store the address and name of your organisation, its type, the email address, what you have booked and, if you provide them, a contact person, postal address, country, VAT identification number, your current website and your message. Your contract and your studio are created from this. To log in, you use either a password, which we store only as a hash, or a passkey, of which we only know the public key.
We need this information to set up access and to perform the contract (Art. 6(1)(b) GDPR). It is kept for as long as the account exists. Once it ends, we delete the account. It is then kept aside for a further 30 days and disappears from the backups seven days later. Anything that commercial and tax law require us to retain, such as invoices, we keep for as long as prescribed there.
7. Cancellation and withdrawal
If you cancel or withdraw via “Cancel contracts here” (“Verträge hier kündigen”) or “Withdraw from a contract” (“Vertrag widerrufen”), we store your name, email address, the address of your site, the contract, in the case of extraordinary termination the reason, and the date and time. We use this to carry out your declaration, to confirm it to you and to be able to prove it later. The legal basis is Art. 6(1)(b) and (c) GDPR. We retain this information for as long as claims arising from the contract can be asserted.
8. When you write to us
If you send us an email, it arrives in our mailbox at Microsoft 365. We use your information to reply to you (Art. 6(1)(b) or (f) GDPR) and keep the email for as long as the matter requires and statutory obligations apply. Microsoft processes the emails on our behalf as a processor. Where Microsoft processes data outside the European Union in doing so, this is based on an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) or on standard contractual clauses.
Emails that CUBE4COLOR sends itself, such as invoices, reminders and login codes, also go via Microsoft 365.
9. Server and backups
CUBE4COLOR runs on a server of Hetzner Online GmbH in Nuremberg, Germany, which acts as our processor. All pages are transmitted in encrypted form (HTTPS). Each organisation has its own separate storage. A backup copy is created every day; we delete it after seven days.
10. No third-party services
These pages do not load fonts, scripts, videos, maps or buttons from third-party servers and do not use any analytics, tracking or advertising services. Here, your browser only loads content from our own web addresses. This is laid down in a security rule (Content Security Policy). References to other sites are plain links. Only when you click on one do the rules of the respective provider apply there.
11. Invoices and payment
We issue an invoice for every booking, showing name and postal address, email address, country, where applicable the VAT identification number, the services, the amounts and the payment status. We send it by email, remind you of outstanding amounts and, after prior notice, temporarily block access if they remain unpaid. The legal basis is Art. 6(1)(b) and (c) GDPR. We retain invoices for eight years (§ 147 AO, § 14b UStG). Our tax advisers see them, as do the tax authorities in the event of an audit.
If you pay by bank transfer, we see the details from our bank’s account statement.
If you pay by credit card, you enter your card details only with Stripe (Stripe Payments Europe Ltd., Dublin, Ireland), on a Stripe page. We never see your card number. Stripe receives from us your name, email address, the amount and what you have booked, and processes the payment partly on our behalf and partly as an independent controller, for example to prevent fraud. In the process, data may be transferred to Stripe, LLC in the USA; this is based on the EU-U.S. Data Privacy Framework and on standard contractual clauses. More information in Stripe’s privacy policy. The legal basis is Art. 6(1)(b) GDPR and, for fraud prevention, point (f).
12. Measurement page in the demo
The demo includes a page that measures how fast CUBE4COLOR runs on your device. Only if you submit the report there do we receive the measurements and information about your device: browser identifier, window size, pixel density, number of processor cores, RAM and graphics card. Without your IP address and without your name. We use the report to make CUBE4COLOR faster (Art. 6(1)(f) GDPR).
13. Your rights
You have the right of access, to rectification, to erasure, to restriction of processing and to data portability (Articles 15 to 20 GDPR). An email to mail@cube4dev.de is sufficient.
Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).
You can lodge a complaint with any data protection supervisory authority, in particular in the country where you live or work (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
14. Other provisions
You can view these pages without providing any information about yourself. For an enquiry, a booking or a cancellation, we need the information marked as mandatory there. No automated individual decision-making, including profiling, takes place. We do not sell data and do not pass it on for advertising purposes.
This privacy policy is available in several languages; this English version is a translation. The German original is authoritative. If what we process changes, we will update this policy.