This is a convenience translation. The binding version of this text is the German one, available at https://heloatelier.com/datenschutz.
This website is deliberately built to collect as little as possible. It sets no cookies, embeds no tracking and no analytics tools . There is no consent banner because there is nothing to consent to.
This website is hosted on Firebase Hosting, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the site is called up, the host processes technically necessary access data (including IP address, time of access, file requested, volume of data transferred, browser type). This processing is technically required to provide the website.
The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a technically faultless presentation). A data processing agreement under Art. 28 GDPR is in place with the provider.
The products offered, their descriptions and images are held in Cloud Firestore and Firebase Storage, likewise services of Google Ireland Limited. Your browser loads this content directly from there when the page is called up. For technical reasons your IP address is transmitted to the provider in the process. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a functioning product display).
The typeface used (Inter) is served locally from this server. No connection is made to Google Fonts servers and no data is transmitted to third parties.
When you order a piece that is paid through Stripe, you move to a page operated by Stripe. Name, delivery address, email address and payment details are entered there; none of it passes through our website. For pieces we reserve without immediate payment, you enter name, email address and delivery address in our form instead; we store that data in Cloud Firestore.
After successful payment we receive from Stripe your name, delivery address, email address, the amount paid and your optional note. We never receive card details or account numbers. We need this information to perform the contract; the legal basis is Art. 6 (1) (b) GDPR. We pass your address to the shipping company as soon as we send your piece.
Order data is subject to retention obligations under commercial and tax law and is therefore kept for six or ten years respectively after the end of the financial year (§ 257 HGB, § 147 AO). After that we delete it.
Payment is handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. During checkout you leave our website and enter your data on a page operated by Stripe. Stripe processes this data to carry out the payment, to prevent fraud and to meet its own legal obligations, and is independently responsible for doing so.
The legal basis for the transfer is Art. 6 (1) (b) GDPR (performance of the contract). A transfer to Stripe, Inc. in the USA is possible; it is covered by the European Commission’s standard contractual clauses. You can find Stripe’s privacy policy at stripe.com/de/privacy.
In the journal you can join two lists: “The Brief” and the list for the planned print edition. We store your email address, for the print edition your first name if you give it, the time you signed up and the page you signed up from. This is stored in Cloud Firestore.
We only send anything to your address once you have confirmed your entry via a link in a confirmation email (double opt-in). The legal basis is your consent under Art. 6 (1) (a) GDPR. You may withdraw it at any time, informally with one line to info@heloatelier.com. We will then delete your entry.
Joining the print edition list is not an order and creates no obligation to pay. Unconfirmed entries are deleted after six months at the latest.
On the pages of the digital edition we count a handful of events: that the page was opened, that someone opened the preview or clicked the buy button. Only the number is counted. We set no cookie, store no identifier, leave nothing on your device and cannot attribute the numbers to any person. That is why no consent under § 25 TTDSG is required. These numbers allow no conclusions about you.
If you write to us by email, we process your address and the content of your message in order to answer it. The legal basis is Art. 6 (1) (b) and (f) GDPR. We delete these messages once the matter is settled and no retention obligation stands in the way.
We store personal data only for as long as is necessary for the respective purpose or as statutory retention periods require.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
This site is served exclusively over encrypted HTTPS.