Products Compare Your Cube Custom Order Room Concepts Journal Guides About Partner Contact DE

Privacy Policy

This is a convenience translation of our German privacy policy. If the two versions differ, the German version applies.

1. Data protection at a glance

General information

The following notes give you a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information on data protection can be found in the sections below.

Data collection on this website

Who is responsible for data collection on this website?
Data on this website is processed by the website operator:
Laura Korthaus, COLB, Haasestraße 8, 10245 Berlin, Germany
Email: colb.creations@gmail.com

How do we collect your data?
Firstly, your data is collected when you provide it to us – for example when you send an enquiry via the cart, the contact window or one of our enquiry assistants (custom order, room concepts) or sign up for our waiting list. Other data is collected automatically by our IT systems when you visit the website, or after you have given your consent (for example technical data such as browser, operating system and time of the page view, and – only with your consent – usage data for web analytics).

What do we use your data for?
Some of the data is collected to ensure the website is provided without errors. We use enquiry data exclusively to process your enquiry and to carry out any subsequent contract. With your consent, usage data may be used to analyse your user behaviour.

2. Hosting and server log files

This website is hosted by Vercel Inc., 340 Pine Street, Suite 701, San Francisco, California 94104, USA. Vercel is a recipient of your personal data and acts as a processor on our behalf. Vercel Inc. is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists. Details can be found in Vercel's privacy policy: vercel.com/legal/privacy-policy.

When our pages and the related server functions are accessed, the host automatically processes technical access data (server log files): IP address, date and time of access, requested URL, amount of data transferred, status code, and browser and operating system information. This data is needed for the secure and stable operation of the website and to prevent abuse; as a rule it is kept only for a short time and is not combined with other data sources. The legal basis is our legitimate interest in the secure and error-free operation of the website (Art. 6(1)(f) GDPR). The connection between your browser and our website is TLS-encrypted (recognisable by “https://” and the padlock symbol).

3. General information and mandatory disclosures

Data protection

The operator of these pages takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Controller

The controller responsible for data processing on this website is:
Laura Korthaus, COLB
Haasestraße 8, 10245 Berlin, Germany
Email: colb.creations@gmail.com

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose of the processing no longer applies. If you assert a legitimate request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing it (for example retention periods under tax or commercial law); in that case the data is deleted once those grounds no longer apply.

Recipients of personal data

In the course of our business we work with the following recipients to whom data may be passed on: our host Vercel (section 2), Google (technical handling of enquiries, section 4, and – only with your consent – Google Analytics, section 6), the carriers we commission (UPS, GLS, DHL, DPD, section 4) and our bank (for payment by bank transfer). Data is transferred to countries outside the EU/EEA only within the scope of the services named in this policy (Vercel, Google), on the basis of the EU-US Data Privacy Framework or the safeguards provided by these providers. Should the European Commission’s adequacy decision on the EU-US Data Privacy Framework cease to apply in the future, the transfers will rely on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR), to the extent the providers make them available.

Necessity of the information, automated decisions

You do not have to provide us with any personal data merely to visit this website. If you wish to submit an enquiry or enter into a contract with us, we need the information required for this (in particular name, email address and delivery address); without it we cannot process your enquiry or perform the contract. There is no automated decision-making that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

Your rights

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data (Art. 15 GDPR). You also have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR), i.e. to receive the data concerning you that you have provided to us in a common, machine-readable format.

Withdrawal of your consent: Many data processing operations are only possible with your express consent. You can withdraw a consent you have already given at any time with effect for the future (see the sections on analytics and the waiting list for details). The lawfulness of the processing carried out before the withdrawal is not affected.

Right to object (Art. 21 GDPR): If data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with a supervisory authority: In the event of violations of the GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged violation. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, email: mailbox@datenschutz-berlin.de, www.datenschutz-berlin.de.

You can contact us at any time with questions about data protection or to exercise your rights: colb.creations@gmail.com.

4. Data collection on this website

Enquiries by email and through our forms

If you contact us by email or through our enquiry forms, your enquiry including all personal data arising from it (name, enquiry, email address) is stored and processed by us for the purpose of handling your request. We do not pass this data on to third parties without your consent, except for the service providers named in the following sections, which we use for technical handling, contract performance and shipping.

This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases the processing is based on our legitimate interest in handling the enquiries addressed to us effectively (Art. 6(1)(f) GDPR).

We delete enquiries that do not lead to a contract no later than twelve months after the matter is closed, unless you ask us to delete them earlier. Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Technical handling of enquiries (cart, contact window, enquiry assistants)

When you send an enquiry through the cart, the contact window or one of our enquiry assistants (custom order, room concepts), your browser transmits your details in encrypted form to a server function of our host Vercel (see section 2). From there they are passed on to a Google service (Google Apps Script), stored in a spreadsheet (Google Sheets) in our Google account and delivered to us by email (Gmail). After sending, you automatically receive a confirmation of receipt at the email address you provided; this is also sent via Gmail.

The following data is processed: name, email address, where applicable phone number and delivery address (for custom-order enquiries: destination country, postcode and city, which we need to calculate delivery costs; for room-concept enquiries: location), the content of your enquiry (selected products, configuration, dimensions, wishes, budget, time frame, prices, shipping zone, message), the page from which you sent the enquiry, the language of the page and the time of the enquiry. For individually configured Cubes we also store that you acknowledged the notice about the right of withdrawal before sending, and the version of that notice.

If you reached our website through a link with a campaign tag (for example the link in our Instagram profile), we store this tag (so-called UTM parameters, e.g. “instagram”) together with your enquiry. The tag contains no information about you personally; it only shows us through which channel the enquiry came about. It is kept only for the duration of your visit in your browser's session storage (sessionStorage) and is deleted automatically when you close the browser window.

Voluntary information: The phone number in the enquiry form is optional. If you provide it, we pass it on, when shipping, solely for delivery to the carrier commissioned so that it can reach you at delivery; we do not call you ourselves. The legal basis is your voluntary provision (Art. 6(1)(a) GDPR); you can have the number deleted at any time with effect for the future (email to colb.creations@gmail.com). Likewise optional is the question how you heard about us (selection list, a short free text for “Other”). We store the answer together with your enquiry and analyse it to understand through which channels customers find us (Art. 6(1)(f) GDPR); you can object at any time. Please do not enter personal data of third parties in the free text. We can still process your enquiry in full without this information.

Voucher codes: If you enter a voucher code in the cart, the code is transmitted in encrypted form to a server function at Vercel for verification; no further information about you is transmitted for this. Which single-use codes you have already redeemed is remembered only by your browser (see “Local storage in your browser”).

The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at concluding a contract; otherwise it is our legitimate interest in handling enquiries reliably and traceably and in evaluating through which channels enquiries arise (Art. 6(1)(f) GDPR). Storing the acknowledgement of the withdrawal notice serves our legitimate interest in proving that this information was given (Art. 6(1)(f) GDPR).

The provider of the Google services mentioned is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer of data to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists. More information: policies.google.com/privacy.

Contract handling, payment and shipping

If a contract is concluded on the basis of your enquiry, we process the data required for handling it (name, address, email address, where applicable phone number, ordered goods, invoice and payment data) on the basis of Art. 6(1)(b) GDPR, and for obligations under tax and commercial law on the basis of Art. 6(1)(c) GDPR.

Payment: Payment is made exclusively in advance by SEPA bank transfer. No payment service providers are integrated on this website and no payment data is collected here. We receive payment data (e.g. account holder and IBAN of the sender) through our bank statement.

Shipping: For delivery we pass on your name and delivery address and, where necessary for delivery or notification, your email address or the phone number you voluntarily provided to the carrier commissioned. We work mainly with UPS, GLS, DHL and DPD; which company is used depends on the shipment and the destination country. The carriers process the data for delivery as independent controllers under their own privacy policies.

Retention: We keep invoices, accounting records and business letters in accordance with the statutory retention periods (six or eight years under commercial and tax law, depending on the document).

Waiting list for deliveries outside Germany and the EU

We currently deliver to Germany and the other EU Member States. If you select the option “Other country” in the cart, you can sign up for a waiting list to be informed by email as soon as we deliver to your country. We store your email address, the country entered, the language, the time of sign-up and confirmation, and the wording of your consent. Technical handling takes the same route as enquiries (Vercel, Google Apps Script, Google Sheets, Gmail – see the previous section).

So that we can show visitors from countries outside our delivery area an appropriate notice with this sign-up option and suggest your delivery country in the cart, our host Vercel determines from your IP address the country from which you are visiting when a page is loaded. Our website receives only the country code (e.g. “GB”); we do not store your IP address for this purpose. The legal basis is our legitimate interest in informing you early about our delivery area and making it easier for you to select your delivery country (Art. 6(1)(f) GDPR). The detected country is only a suggestion that you can change in the cart at any time; we do not store it. If you close the notice, your browser remembers this decision so that it does not appear again.

We use the double opt-in procedure: after signing up you receive an email with a confirmation link. Only when you click this link is your sign-up effective. This ensures that nobody enters someone else's email address. We do not use unconfirmed sign-ups and delete them after 30 days.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future, for example by email to colb.creations@gmail.com. Your data will then be deleted from the waiting list. We keep the proof of your consent (time and wording) on the basis of our legitimate interest (Art. 6(1)(f) GDPR) for as long as we need it to prove that consent was properly given.

Instagram giveaway

If you take part in a giveaway that we run on our Instagram account @colb.studio (currently the 100k giveaway for the reel with the ceramic Cube), we process the following data:

On Instagram itself, Meta Platforms Ireland Limited is responsible for data processing (see section 5). There we see your username, your comment and your follow and like status. We do not contact the tagged person; we use their username only to check whether the terms and conditions are met. For the draw we temporarily copy usernames and comments into a list. To determine the winner we read in the publicly visible comments with our own script via the official Instagram interface or with a draw tool.

Purposes and legal bases: We process the data to run the giveaway, to determine and notify the winner and to ship the prize (Art. 6(1)(b) GDPR). We document the draw with a screen recording in order to be able to prove that it was carried out properly (Art. 6(1)(f) GDPR). We announce the winner's Instagram username in our Instagram story so that participants can see that the giveaway took place (Art. 6(1)(f) GDPR). You can object to this at any time; we will then not name anyone. We keep invoices and records because of statutory obligations (Art. 6(1)(c) GDPR).

Disclosure: To deliver the prize we pass on name, delivery address and, where necessary for delivery, phone number or email address to the transport company we engage (see “Contract handling, payment and shipping”).

Retention: We delete the lists of usernames and comments of all participants no later than one month after the end of the giveaway. We delete the winner's data once handling is complete, unless statutory retention periods prevent this. We keep the screen recording of the draw for three years after the end of the year in which the giveaway took place.

Participation is voluntary. Without your details we cannot include you in the draw or ship the prize. You can find your rights as a data subject under section 3.

Partner area (B2B)

There is a closed partner area for business customers. We assign the access credentials ourselves. At login we process the username and password; the password is not stored in plain text but only compared as a protected hash value. After a successful login our server sets a technically necessary session cookie (colb_b2b, valid for 12 hours, transmitted only over an encrypted connection, not readable by scripts). It serves only to keep you logged in to the partner area and contains no tracking. Your name and company are stored in the cookie for this purpose. Orders in the partner area are transmitted by email. The legal basis is Art. 6(1)(b) GDPR or our legitimate interest in protecting the partner area (Art. 6(1)(f) GDPR); under Section 25(2) no. 2 TDDDG the cookie is permissible without consent.

Local storage in your browser

So that the cart, your selection and your settings are retained after changing pages or visiting again, our website stores some information exclusively on your device (in your browser's local storage or session storage). This information is not transmitted to us unless you send an enquiry. It consists of the following:

This storage is necessary for the functions you expressly request or serves to retain your choices, and is therefore permissible without consent under Section 25(2) no. 2 TDDDG; the processing of the data it contains is based on Art. 6(1)(b) and (f) GDPR. You can delete this information yourself at any time – via your browser settings or with this button:

The button deletes the cart, enquiry entries, wish list and language and notice settings from this browser. Your cookie choice and the list of vouchers already redeemed are kept (you can change your cookie choice under section 6).

Reach measurement with Vercel Web Analytics

We use Vercel Web Analytics, a service of our host Vercel Inc. (see section 2), to understand how many visitors our website has, which pages are viewed and through which channels visitors reach us. Vercel Web Analytics sets no cookies and stores no information on your device. Visitors are not tracked across websites; to tell visits apart, a hash value is formed from the incoming request and is automatically discarded after 24 hours. IP addresses are not stored.

In particular, the following is processed: page viewed, referring page (referrer), browser, operating system, device type and the country derived from the request. The data is evaluated only in aggregated form and does not allow us to identify individual persons.

The legal basis is our legitimate interest in data-minimising reach measurement and in improving our offering (Art. 6(1)(f) GDPR). Since no information is stored on or read from your device, no consent under Section 25 TDDDG is required. Vercel Inc. is certified under the EU-US Data Privacy Framework. You can object to this processing at any time by sending us an email at colb.creations@gmail.com.

Cube in your room (photo preview)

If you use your own photo in our “Cube in your room” tool, it is processed exclusively locally in your browser. The photo is not transmitted to us or to third parties and is not stored.

Fonts (self-hosted)

This website uses the typeface “Space Grotesk”. The font files are stored locally on our server at Vercel (directory /fonts/) and are delivered directly from there. No connection is made to Google Fonts or other third-party CDNs. Your browser loads the font files exclusively from our website – no personal data is transmitted to external providers.

This website contains links to our Etsy shop (colbcreations.etsy.com), to our Instagram profile, to a direct message to us via Instagram (ig.me) and to our TikTok profile. These are simple links; no plugins, pixels or embeds from these providers are integrated into our pages. Only when you click a link are you forwarded to the website or app of the respective provider, and the provider receives the usual technical data (e.g. your IP address and the information from which page you came). Our links to Etsy contain a tag (utm_source=colbstudio) that lets Etsy recognise that you come from our website.

The respective provider is responsible for data processing on these sites: Etsy (for customers in the EU: Etsy Ireland UAB; information: etsy.com/legal/privacy), Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; privacycenter.instagram.com/policy) and TikTok (tiktok.com/legal/privacy-policy-eea). With your consent we also measure how often the links to Etsy and to the Instagram message are clicked (see section 6); only the click is counted, not your identity.

6. Cookies and consent management

Google Analytics 4

We use Google Analytics 4 (measurement ID G-JE3KSB9QR0) to analyse the use of our website and to improve our offering. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; the data collected may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.

Google Analytics is loaded only after your express consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). As long as you have not consented, neither the Google Analytics script is loaded nor is a connection to Google servers established, and no analytics cookies are set. We use Google Consent Mode v2; consents for advertising purposes (ad_storage, ad_user_data, ad_personalization) are always denied, and we do not use advertising features.

After your consent, Google Analytics sets cookies (_ga, _ga_*) and collects usage data that we evaluate pseudonymously: pages viewed, time spent, origin of the visit, browser, device, approximate location and interactions such as clicks on Etsy and the Instagram message, steps in the configurator, opening the enquiry form and sending an enquiry (without the content of your enquiry). Google Analytics 4 does not log IP addresses. Data in Google Analytics is kept for a maximum of 14 months.

Consent management

When you first visit our website, a cookie banner appears through which you can manage your consents. Your choice is stored in your browser (colb_consent_v1) and applies to future visits. You can change your settings at any time:

Withdrawal and deletion

To withdraw your consent, open the cookie settings and deactivate analytics cookies. On withdrawal, all Google Analytics cookies already set (_ga, _ga_*) are deleted from your browser and measurement stops. Alternatively you can delete cookies in your browser settings or install the browser add-on to deactivate Google Analytics at tools.google.com/dlpage/gaoptout.

Last updated: October 2026 · Deutsche Fassung

Contact

We'll get back to you within 48 hours.

Prefer Instagram? Send us a DM →

Your data is treated confidentially. More in our privacy policy.