Privacy Policy
This policy explains what personal data is processed when you visit mirunavasi.com, use the contact form, subscribe to the newsletter, buy a guide, work with us as a brand or partner, or interact with our Instagram presence — on what legal basis, who receives it, how long it is kept, and the rights you have under the General Data Protection Regulation (GDPR). Terms are used in a gender-neutral sense.
1. Controller
The controller responsible for data processing on this website and for the activities described here is:
Miruna Pangerl (“Miruna Vasi”)
Lenaustr. 1
81373 Munich, Germany
Email: hello@mirunavasi.com
Imprint: mirunavasi.com/imprint
We are not required to appoint a data protection officer.
2. Applicable law and legal bases
We process personal data on the basis of the GDPR — in particular consent (Art. 6 (1) (a)), performance of a contract or pre-contractual steps (Art. 6 (1) (b)), legal obligations (Art. 6 (1) (c)) and our legitimate interests (Art. 6 (1) (f)) — and, in addition, the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG). The specific legal basis for each processing activity is stated in the relevant section below.
3. When you visit this website (hosting and server logs)
This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, and delivered through Vercel’s globally distributed edge network (a content delivery network, CDN), so pages load from a server close to you. When you open a page, your browser transmits technical data that Vercel processes in server log files to deliver the site and keep it stable and secure: your IP address, the browser type and version, the operating system, the referring URL, the requested page and the date and time of the request. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in the secure and reliable operation of the website. Log data is deleted or anonymised after a short period unless it has to be kept to investigate a specific incident. A data-processing agreement pursuant to Art. 28 GDPR applies. Because Vercel is based in the USA, see section 15 on international transfers.
4. Web fonts
The fonts “Cormorant Garamond” and “Jost” are hosted on our own server and delivered directly from this website. No connection to Google or any other third party is made to load fonts, and no data is transmitted to such a provider for this purpose.
5. Web analytics (cookieless)
We use Vercel Web Analytics to understand, in aggregate, how the website is used (for example which pages are viewed and roughly where visitors come from). This service works without cookies and without storing information on your device; it does not create cross-site profiles and does not store your IP address. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in measuring and improving the site. Because no information is stored on or read from your device, no consent under § 25 TDDDG is required.
6. Contact and collaboration inquiries
When you contact us — through the inquiry form on our contact page, by email or by direct message on Instagram — we process the data you provide (your name and email address, and optionally your company, website or Instagram handle, the type of collaboration and your message) solely to receive, handle and respond to your inquiry. Form inquiries are stored in our customer-relationship system (Brevo, see section 14) as a contact and an inquiry record, and a notification and an automatic acknowledgement email are sent via Brevo. Our mailbox hello@mirunavasi.com is hosted by Namecheap (see section 14), so emails you send us and our replies are stored there. Legal basis: Art. 6 (1) (b) GDPR (steps taken at your request prior to a possible contract) and Art. 6 (1) (f) GDPR (our legitimate interest in handling and documenting inquiries). Providing this data is voluntary, but without at least your name and a valid email address we cannot reply.
7. Brand collaborations and business partners
When we work with brands, agencies, hotels or other partners, we process the personal data of our contact persons at those companies (name, role, business contact details, correspondence) as well as contract, billing and payment data (subject matter and term of the collaboration, deliverables, fees, invoices, bank details) to negotiate, perform and settle the collaboration and to communicate about it. Legal basis: Art. 6 (1) (b) GDPR (contract and pre-contractual steps), Art. 6 (1) (c) GDPR (commercial and tax record-keeping obligations) and Art. 6 (1) (f) GDPR (our legitimate interest in an orderly business administration, in documenting our work and in asserting or defending legal claims). Where necessary, data is shared with service providers such as our tax adviser, bank or IT providers. Contract data is kept for the statutory retention periods set out in section 16.
8. Newsletter “Partner Notes”
You can subscribe to our newsletter with your email address. It contains news about our work, collaborations, guides and offers. We use the double opt-in procedure: after signing up you receive a confirmation email, and you are only added to the list once you click the link in it. To document your consent, the sign-up and confirmation are logged with the timestamp. The newsletter is sent via Brevo (see section 14) on the basis of our legitimate interest in an efficient and secure mailing system. Legal basis for the newsletter itself: Art. 6 (1) (a) GDPR (consent). You can withdraw your consent at any time with effect for the future via the unsubscribe link in every issue or by emailing us; withdrawal does not affect the lawfulness of processing before it.
Performance measurement: our newsletters contain a tracking pixel (a tiny image loaded from Brevo’s servers when the email is opened) and links that record clicks. This tells us whether and when an issue was opened, which links were clicked, and technical details such as the email client, browser, operating system and approximate location derived from the IP address. This information is stored in your recipient profile at Brevo and used to understand which content is relevant to our readers and to improve the newsletter; it is not passed on to third parties or used to build cross-site profiles. Legal basis: Art. 6 (1) (a) GDPR — the measurement is part of the consent you give when subscribing, and § 25 (1) TDDDG. A separate objection to the measurement alone is not possible; if you do not want it, please unsubscribe from the newsletter, which ends the measurement as well. Many email clients also let you block the loading of remote images, which prevents open tracking. After you unsubscribe we may keep your email address for up to three years solely to be able to prove that consent was given, and thereafter on a suppression list to honour your opt-out, unless you request full erasure.
9. Guides (shop)
The digital guides are sold through Payhip Ltd, 1st Floor, 2 Woodberry Grove, London N12 0DR, United Kingdom. When you buy a guide, the checkout, payment, invoicing and delivery are handled by Payhip. When you click “Buy the guide”, this website loads a script from Payhip’s servers that opens the checkout as an overlay on this page; Payhip then receives your IP address and technical browser data. If the overlay cannot be loaded, the button opens the guide’s page on payhip.com instead. Within the checkout, Payhip and the payment provider you choose (for example Stripe or PayPal) may use cookies or similar technologies that are strictly necessary to process the payment and prevent fraud (§ 25 (2) no. 2 TDDDG). Payhip processes the data you enter there (name, email address, billing country, the product bought and the payment) on our behalf under a data-processing agreement pursuant to Art. 28 GDPR so that we can conclude and fulfil the purchase contract, issue invoices and meet our commercial and tax record-keeping obligations. In addition, Payhip processes data for its own purposes (operating the platform, payment processing with its payment providers, fraud prevention) under its own responsibility; Payhip’s privacy policy at payhip.com/privacy applies to that. Legal basis for our processing: Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (c) GDPR (legal retention obligations). The United Kingdom is covered by an EU adequacy decision (Art. 45 GDPR).
10. Form security and abuse prevention
To protect the forms from automated abuse without using a captcha, submissions pass through a hidden honeypot field, a signed time-based token and a short-term rate limit per IP address. Your IP address is processed only transiently in memory for the rate limit and is not stored for this purpose. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in protecting the website and its forms against spam and abuse.
11. Our presence on Instagram and TikTok
We maintain profiles on Instagram ( instagram.com/mirunavasi), operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and on TikTok (tiktok.com/@miruna.vasi), operated for users in the EEA by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, to communicate with the people active there and to present our work. When you visit or interact with our profiles, the respective provider processes your data under its own responsibility and, as a rule, also for market research and advertising purposes, including the creation of usage profiles; data may be processed outside the European Union (Meta: USA, certified under the EU–US Data Privacy Framework; TikTok: among others USA, Singapore, Malaysia and China, on the basis of Standard Contractual Clauses). Details and opt-out options are set out in the providers’ privacy policies at privacycenter.instagram.com/policy and tiktok.com/legal/privacy-policy-eea. Both providers give us aggregated statistics about the use of our profiles (“insights”/ “analytics”); for this processing the provider and we are joint controllers within the meaning of Art. 26 GDPR under the terms each provider publishes for that purpose. Legal basis for our own processing: Art. 6 (1) (f) GDPR — our legitimate interest in public relations and in communicating with our audience. Requests concerning your rights are most effectively addressed to the provider, which alone has access to the underlying data; you can of course also contact us.
12. Security measures
We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, taking into account the state of the art, the costs of implementation and the risks involved. In particular, this website is delivered exclusively over encrypted connections (TLS/HTTPS), access to our systems and accounts is restricted and secured, and we choose service providers and settings with data protection in mind (data protection by design and by default).
13. Cookies
When you browse this website, no cookies are set and no tracking or advertising cookies are used. Analytics runs without cookies (section 5). Cookies are used only in two cases, each strictly necessary for a function that is actively used (§ 25 (2) no. 2 TDDDG): in the Payhip checkout once you click “Buy the guide” (section 9), and for our internal, password-protected editorial login, which only we use.
14. Recipients and processors
We only pass personal data to service providers who process it on our behalf under a data-processing agreement pursuant to Art. 28 GDPR, or where we are otherwise legally entitled or obliged to. The providers involved are:
- Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA — hosting, content delivery network and cookieless web analytics (sections 3 and 5).
- Brevo (Sendinblue SAS), 17 rue Salneuve, 75017 Paris, France, with its German subsidiary Brevo GmbH, Köpenicker Str. 126, 10179 Berlin — contact management, inquiry records, transactional emails and newsletter delivery (sections 6 and 8). Data is stored on servers within the EU.
- Namecheap, Inc., 4600 East Washington Street, Suite 305, Phoenix, AZ 85034, USA — hosting of our email mailbox (section 6).
- Payhip Ltd, 1st Floor, 2 Woodberry Grove, London N12 0DR, United Kingdom — checkout, payment, invoicing and delivery of the guides (section 9).
- Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland — Instagram, and TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland — TikTok; each as an independent or, for profile statistics, joint controller (section 11).
In addition, data may be disclosed to our tax adviser, bank, or legal advisers where necessary for the purposes described in section 7, and to authorities where we are legally obliged to do so.
15. Transfers to third countries
Hosting and analytics involve Vercel Inc. in the USA. Vercel is certified under the EU–US Data Privacy Framework (DPF), which the European Commission has recognised as providing an adequate level of protection (Art. 45 GDPR); in addition, we have concluded the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR) with Vercel as a fallback. Our email mailbox is hosted by Namecheap, Inc. in the USA on the basis of the EU Standard Contractual Clauses contained in its data-processing agreement. Processing by Brevo takes place within the EU. The United Kingdom (Payhip) is recognised by the European Commission as providing an adequate level of protection (Art. 45 GDPR). Data processed by Meta and TikTok in connection with our social-media profiles may be transferred to third countries as described in section 11; Meta Platforms is certified under the DPF. A list of DPF-certified companies is available at dataprivacyframework.gov.
16. How long we keep your data
We delete personal data as soon as the purpose for which it was collected no longer applies and no legal retention obligation stands in the way. In particular:
- Server log data: deleted or anonymised after a short period (section 3).
- Inquiry data: kept for as long as needed to handle your inquiry and any resulting business relationship; thereafter for the periods required by commercial and tax law, unless you object earlier and no retention obligation stands in the way.
- Contract, billing and purchase data (sections 7 and 9): 10 years for books and records, 8 years for accounting vouchers such as invoices, and 6 years for business correspondence and other tax-relevant documents (§ 147 (1) and (3) AO), and 3 years for data needed to handle possible contractual claims (§§ 195, 199 BGB). Where a period does not begin on a specific date, it starts at the end of the calendar year in which the triggering event occurred; for ongoing contracts, that is the year in which the contract ends.
- Newsletter: your email address is kept until you unsubscribe, then for up to three years to prove consent, and thereafter only on a suppression list to honour your opt-out (section 8).
- Purchase data held by Payhip: governed by Payhip’s policy and statutory retention periods.
Where several periods apply to the same data, the longest one prevails.
17. Your rights
Under the GDPR you have the right to access your data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to withdraw any consent you have given at any time with effect for the future (Art. 7 (3)). To exercise any of these, email hello@mirunavasi.com.
Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time on grounds relating to your particular situation. Where your data is processed for direct marketing, you may object to that processing at any time without giving reasons.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
18. Automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
19. Changes to this policy
We may update this policy to reflect changes to the website or to the services described here. The current version always applies and is published on this page. Provider addresses stated here may change over time; please check them before contacting a provider.
Last updated: 10 October 2026.