Privacy notice
This notice describes the processing of personal data on nikosam-art.de, including the historical archive. Updated: 19 September 2026.
1. Data controller
Timotheos Samartzidis
Kostheimer Landstr. 17A
55246 Mainz-Kostheim
Germany
Email: timmy@timosam.com
2. Website delivery and hosting
When you access the website, data processed includes your IP address, the time and target of the request, browser information, HTTP status and, where applicable, the referring page. This is necessary to deliver the website, diagnose errors and maintain security. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure operation of the website.
The hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes the hosting data within the EU.
Technical logs are used to diagnose errors and prevent abuse. Retention depends on the period necessary for these purposes and the automatic deletion configured with the hosting provider. In the event of a specific security incident, relevant entries may be retained until the incident is resolved. Hetzner describes its processing in its hosting data-protection information.
3. Contacting us
The contact page can transmit your name, email address, artwork reference and message to the web server, which passes the enquiry to the contact mailbox. These details are used to respond to your enquiry. The older forms on the home, exhibition and dossier pages prepare an email locally in your email application. The email fallback likewise sends only when you send the message in your email application. The server uses a keyed hash of the IP address with a short-lived counter to limit repeated submissions. Counters expire after one hour and are removed on subsequent submissions; enquiry messages are not stored by the form endpoint.
The legal basis is Article 6(1)(b) GDPR for contract-related enquiries, or otherwise Article 6(1)(f) GDPR based on our interest in handling your message. Correspondence is deleted once its purpose no longer applies and no statutory retention duties or legitimate interests in preserving evidence require further storage.
The contact mailbox timmy@timosam.com uses Google's email infrastructure. Google therefore receives the email data necessary for delivery and storage. For users in the European Economic Area, the relevant provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing may involve transfers to third countries, in particular the USA. Google explains the safeguards used in its information on international data transfers and its processing in the privacy policy. Your own email provider is also involved in sending the message. Please do not send particularly sensitive data that is unnecessary for handling your enquiry.
4. Fonts, external content and archive
The new website's fonts are loaded locally from our own web server. External websites are opened only through links. The historical archive preserves earlier content; its former forms and external embeds are not offered as active services.
The website uses no analytics or advertising trackers. The gallery stores your current browsing context (filters, result order and scroll position) in session storage in your browser so you can return to the same place. This is not sent to the server as analytics and ends with the browser session. Only resources from this website are used for display; historical external embeds are disabled. External links you open are subject to their respective providers’ privacy policies.
5. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability (Articles 15–20 GDPR). You may withdraw any consent you have given at any time with effect for the future.
Where processing is based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. Please use the email address above.
You may lodge a complaint with a data-protection supervisory authority, in particular in the place of your habitual residence, workplace or the suspected infringement (Article 77 GDPR). In Hesse: the Hessian Commissioner for Data Protection and Freedom of Information.
6. Automated decisions
The website does not use automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR.