Privacy Policy

This English version is a convenience translation. Only the German version (Datenschutzerklärung) is legally binding.

Last updated: [DATUM]

This privacy policy explains which personal data we process when you visit our website ha-ceramics.com, place an order, book a workshop or send us a request. In short: we use no analytics tools, no tracking or marketing cookies and no embedded third-party content (no external fonts, no social media plugins, no maps, no third-party videos).

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Héloïse Aslanidis, HA Ceramics Studio
[STRASSE HAUSNUMMER]
[PLZ ORT]
Germany
Email: ha-ceramics@gmail.com
Phone: [TELEFON (optional)]

We have not appointed a data protection officer, as we are not legally required to do so.

2. Legal bases at a glance

We process personal data on the following legal bases:

• Art. 6(1)(b) GDPR: to perform a contract with you or to take steps at your request before entering into a contract (for example an order, a workshop booking, a commission request).
• Art. 6(1)(c) GDPR: to comply with legal obligations (for example retention duties under tax and commercial law).
• Art. 6(1)(f) GDPR: for our legitimate interests, unless your interests override them (for example secure operation of the website, answering general enquiries).
• Art. 6(1)(a) GDPR: on the basis of your consent, where we ask for it in a specific case. You can withdraw consent at any time with effect for the future.

3. Hosting and server log files

Our website runs on our own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a data centre in [Germany / Finland, CHECK LOCATION]. We have a data processing agreement with Hetzner under Art. 28 GDPR. We do not use a content delivery network (CDN); all content, including fonts, is served directly from our server.

Each time you access our website, the web server automatically stores information in server log files:

• IP address of the requesting device,
• date and time of access,
• page or file requested, amount of data transferred and HTTP status code,
• referrer URL (the page visited before, if transmitted),
• browser and operating system used (user agent),
• further technical details of the request (protocol, response time, other request headers such as the preferred language; cookies and login data are not stored).

We need this data to deliver the website, keep it stable and secure, and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free operation of the website. Log files are deleted automatically after 14 days, unless they are needed for longer in an individual case to investigate a security incident.

4. Cookies and local storage

We use only technically necessary cookies. Storing and reading this information on your device is permitted without consent under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), because it is strictly necessary to provide the service you have explicitly requested. The subsequent processing is based on Art. 6(1)(b) GDPR (shopping cart, order) or Art. 6(1)(f) GDPR (login to the admin area, preview of the design variants).

We do not use cookies for analytics, advertising or tracking. That is why we do not show a cookie banner.

5. Fonts

The fonts used on our website are stored locally on our server. No connection to third-party servers (for example Google Fonts) is made when you load a page.

6. Contact form and email

When you write to us via the contact form or by email, we process the data you provide (name, email address, your message and any further voluntary details) to handle your enquiry. To protect against spam, we briefly store your IP address when the form is submitted, to limit too many requests within a short time; it is deleted after [24 hours] at the latest.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or its preparation, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries and preventing abuse).

We delete your enquiry once it has been dealt with and no statutory retention obligations apply, usually no later than [12 months] after the last contact.

7. Commission requests

For custom-made pieces you can send us your name, email address, the type of piece, quantity, budget, timeline, a message and optionally reference images via a request form. We use this information to assess your request, make you an offer and carry out the commission. Please only upload images you hold the rights to and no images in which other people can be identified.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps and performance of the contract). If no contract is concluded, we delete the request including images no later than [6 months] after the last contact. If a contract is concluded, the retention periods for orders apply (section 15).

8. Orders in the online shop

When you order from us, we process the data needed to handle the order: name, billing and delivery address, email address, phone number if given, items ordered, prices, payment method and payment status, and the order history. We do not create a customer account.

We use this data to conclude and perform the contract, send you the order confirmation and shipping information by email, ship the goods, handle warranty claims and withdrawals, and keep our accounts. The legal bases are Art. 6(1)(b) GDPR and, for retention under tax and commercial law, Art. 6(1)(c) GDPR.

Providing this data is necessary to conclude the contract. Without it we cannot process your order.

9. Workshop bookings and workshop requests

When you book a workshop online or send a workshop request, we process your name, email address, phone number if given, the chosen date, the number of seats, your message and, for online bookings, payment data (see section 10). We use this data to process the booking, send you the confirmation and inform you about any change of date. Voluntary information (for example about allergies or limitations relevant to the workshop) is used only to run the workshop and deleted after the date.

The legal basis is Art. 6(1)(b) GDPR; for retaining invoices Art. 6(1)(c) GDPR. We process voluntary health information only with your explicit consent (Art. 9(2)(a) GDPR), which you give by submitting it and can withdraw at any time.

10. Payment processing

Stripe

For payments by credit card, Apple Pay, Google Pay, PayPal and, where offered, Klarna and SEPA Direct Debit, we use the payment service Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). Payment takes place on a payment page provided by Stripe (Stripe Checkout). You enter your card or account details directly with Stripe; they are not stored on our server.

We transmit the data required for payment to Stripe (in particular amount, currency, order number, name and email address, billing address where applicable). Stripe additionally processes payment and device data to process the payment and prevent fraud. Stripe is itself responsible for certain processing (for example fraud prevention, compliance with financial regulatory obligations). The legal basis is Art. 6(1)(b) GDPR; for fraud prevention additionally Art. 6(1)(f) GDPR.

Stripe may transfer data to Stripe, Inc. in the USA. Stripe, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, Stripe uses the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). More information: https://stripe.com/privacy.

Depending on the payment method you choose, your data is passed via Stripe to the respective payment provider, which processes it under its own responsibility:

• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Privacy notice: https://www.paypal.com/de/legalhub/privacy-full
• Apple Pay: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.
• Google Pay: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Klarna (if offered): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For invoice or instalment purchases Klarna may carry out an identity and credit check. Privacy notice: https://www.klarna.com/de/datenschutz/

Prepayment (bank transfer)

If you choose prepayment, we send you our bank details by email. The transfer is processed by your bank and ours; we receive your name, account details, the amount and the payment reference. The legal basis is Art. 6(1)(b) GDPR.

11. Shipping

To deliver your order, we pass your name and delivery address to the shipping company we use, [VERSANDDIENSTLEISTER, e.g. Deutsche Post AG / DHL Paket GmbH, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany] (Art. 6(1)(b) GDPR). We pass your email address or phone number to the shipping company only if you have expressly consented during checkout, so that it can inform you about the delivery date (Art. 6(1)(a) GDPR). You can withdraw this consent at any time.

12. Sending email and our mailbox

Sending: We send order confirmations, booking confirmations and other emails via the email service provider [E-MAIL-ANBIETER, NAME AND ADDRESS], with whom we have a data processing agreement under Art. 28 GDPR. Data is processed in the EU.

Mailbox: Our business mailbox (ha-ceramics@gmail.com) is provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you send us an email, submit a form, place an order or make a booking, we receive a notification containing your details in this mailbox, so this data is stored at Google. Google may also transfer data to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (our legitimate interest in reliable and cost-efficient communication). Google's privacy policy: https://policies.google.com/privacy

13. Instagram

On our home page we show a selection of our Instagram posts. Our server fetches these posts regularly via the Instagram interface and stores the images on our own server. When you visit our website, your browser therefore makes no connection to Instagram or Meta, and no data about you is sent to Meta.

We also provide a plain link to our Instagram profile (@ha.ceramicsstudio). Only when you click this link are you taken to Instagram, where the privacy policy of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland applies: https://privacycenter.instagram.com/policy.

14. Withdrawal via the website

If you withdraw from a contract using the withdrawal function on our website ("Vertrag widerrufen" / "Withdraw from contract"), we process your name, the details identifying the contract (for example the order number), your email address for the acknowledgement of receipt, your declaration and the date and time of receipt. We need this data to process the withdrawal and confirm receipt to you (Art. 6(1)(b) and (c) GDPR in conjunction with § 356a BGB). The data is stored and deleted together with the order data.

15. Retention periods

We store personal data only as long as necessary for the respective purpose or as required by statutory retention obligations:

• Order, invoice and booking data: books and records 10 years, accounting vouchers such as invoices 8 years, commercial and business letters (for example order confirmations) 6 years (§ 147 AO, § 257 HGB). The period starts at the end of the calendar year in which the document was created.
• Data for possible warranty claims: until the warranty and limitation periods expire (usually 2 to 3 years), unless a longer retention obligation applies.
• Contact and commission requests without a contract: see sections 6 and 7.
• Server log files: 14 days.
• Incomplete orders and expired prepayment reservations: [30 days] after expiry.

After these periods the data is deleted. While a retention obligation applies, we restrict processing to that purpose.

16. Recipients at a glance

Personal data is received only by the parties named in this policy: our hosting provider (Hetzner), our email service provider ([E-MAIL-ANBIETER]), Google as provider of our mailbox, Stripe and the payment providers you choose, our bank (for prepayment), the shipping company ([VERSANDDIENSTLEISTER]) and, where legally required, our tax adviser and public authorities (for example the tax office). We do not sell data or pass it on for advertising purposes.

17. Transfers to third countries

Data is transferred to countries outside the EU and EEA only as part of the services of Stripe (and the payment providers connected through it) and Google, as described in sections 10 and 12. The basis in each case is the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR).

18. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an informal message to ha-ceramics@gmail.com is sufficient.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is: [zuständige Landesdatenschutzbehörde, NAME, ADDRESS, WEBSITE].

19. No automated decision-making

We do not make decisions based solely on automated processing, including profiling (Art. 22 GDPR). Payment providers such as Klarna may carry out credit checks under their own responsibility; see their privacy notices for details.

20. Data security

Our website is encrypted throughout via TLS (HTTPS). We take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

21. Changes

We update this privacy policy when our website, our service providers or the legal situation change. The version published here applies.