DRAFT FOR REVIEW — 20 September 2026. The full business address and the outstanding details marked below must be completed before this document is used as a final legal notice.

1. Controller and scope

Milo Kopper, trading as Mxlx, is responsible for the processing described here. Sole proprietor, Hessen, Germany. Postal address: [FULL STREET ADDRESS, POSTCODE AND TOWN REQUIRED]. Email: info@mxlx.studio. Telephone: +49 1715307699.

This notice covers the Mxlx studio website, its contact and newsletter forms, and communications about our services. It also applies when the same site is available under mxlx.studio. Independently operated client websites have their own privacy notices.

2. Website delivery and technical information

When you visit, hosting infrastructure receives technical information such as your IP address, requested URL, request time, browser information and response status. This is needed to deliver pages, diagnose problems and protect the service. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in operating a reliable, secure website.

The site is hosted with Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands. Framer and its infrastructure providers deliver pages, fonts, images and video assets. Its data processing addendum describes processor arrangements and international-transfer safeguards. Provider review still required: confirm the applicable agreement, sub-processors and actual retention settings for this account.

3. Audience statistics

The inspected website loads Framer’s built-in analytics. Framer describes this service as using aggregate statistics without analytics cookies or persistent device identifiers. Technical request data can still be processed to produce those statistics. We use audience information to understand which pages are useful and improve the site, based on Article 6(1)(f) GDPR.

No Google Analytics, Google Tag Manager or Meta Pixel integration was identified in the inspected pages. A tool logo in the “Powered by” section is not a statement that its tracking or payment service runs on this website. The configuration must be checked again if integrations change.

4. Contact forms, email and telephone

If you contact us, we process the details you provide, such as your name, email address, telephone number, message and project requirements. The visible contact form uses Framer’s form functionality. Enquiries concerning a potential or existing contract are processed under Article 6(1)(b) GDPR; other business correspondence is handled under Article 6(1)(f) GDPR, based on our interest in answering enquiries.

Please avoid sending sensitive personal information that is not needed for your enquiry. Fields marked as required are needed to handle the form; otherwise you may use the published email address or telephone number.

Configuration still to be confirmed: the form’s delivery destination, the email provider, any webhook or connected service, and how long messages and submissions remain in those systems. These back-office settings cannot be established reliably from the public website alone.

5. Newsletter

A newsletter email field is present on the website. Before newsletter subscriptions are activated or used, the sending service, confirmation process, unsubscribe mechanism and retention periods must be verified and this section completed. Submitting a project enquiry must not automatically enrol you in marketing emails.

Where a newsletter is offered on the basis of consent, we use the subscription address and consent record to send the requested updates under Article 6(1)(a) GDPR. Consent can be withdrawn at any time, without affecting earlier lawful processing. Contact info@mxlx.studio to withdraw; each newsletter should also provide a direct unsubscribe option. No specific mailing platform or completed double opt-in process is claimed in this draft.

6. Cookies, storage and external content

No advertising-cookie service was identified in the inspected pages. This does not amount to a guarantee that every integration or browser interaction is free of device storage. Non-essential storage or access requires consent under section 25 TDDDG; strictly necessary operations may fall under its statutory exceptions. Consent-dependent services must be blocked until consent is given.

The inspected case-study preview component displays screenshots and video files, with links to the client websites. It does not embed those websites in a live iframe. Following an external link connects you to the destination provider, whose privacy information then applies. Adding live previews, maps or third-party video players requires a fresh assessment before activation.

7. Recipients and international processing

Website information is handled by the hosting provider and relevant infrastructure providers. Enquiry information is also handled by the configured form and email services; the outstanding recipients must be confirmed as noted above. We may disclose information to advisers or authorities where necessary for a legal obligation or a specific legal claim.

Framer’s published terms allow processing outside the EEA using an applicable adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses. The actual recipient and transfer mechanism depend on the service and sub-processor. You can request information about relevant safeguards from us. The studio’s German location does not imply that all technical processing stays in Germany.

8. How long information is kept

Information should be kept only as long as needed for the purpose for which it was collected, or where a legal retention obligation or a concrete legal claim requires it. An enquiry that leads to a contract may form part of the project records. Consent records may need to be retained to demonstrate the lawfulness of earlier communications.

Before this draft is finalised, the controller must set and document practical deletion periods for contact submissions, email, hosting logs and newsletter records, and confirm the applicable statutory periods for accounting and business documents. No blanket five-year retention promise is made.

9. Your rights

Subject to the applicable requirements, you may request access, correction, erasure, restriction and data portability. You may withdraw consent at any time. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation; you may object to direct marketing at any time. Contact info@mxlx.studio. We may need proportionate information to verify your identity.

You may complain to a supervisory authority, including the authority in your place of habitual residence, place of work or where an alleged infringement occurred. For Hessen, contact the Hessian Commissioner for Data Protection and Freedom of Information (HBDI): https://datenschutz.hessen.de/kontakt.

10. Automated decisions and updates

No account system or automated decision process with legal or similarly significant effects was identified in the inspected studio website. If the services or processing change, this notice must be updated before the new processing starts. Review date: 20 September 2026.