This is a convenience translation. The binding version of this text is the German one, available at https://heloatelier.com/datenschutz.
This website is deliberately built to collect as little as possible. It sets no cookies, embeds no third-party analytics and does not recognise you on a second visit. There is no consent banner because nothing is stored on or read from your device.
So that we know which pages are opened at all, we count views. This counter runs on our own server; no third party is involved.
Stored as daily totals only: which address was opened, the hostname of the page you came from (for example instagram.com, not the full address), the hour of the view, and the number of clicks on “Add to cart” and “Continue to payment”.
When we place a link somewhere else, for example in our Instagram profile or on a card in a parcel, we append a short tag to it, for example ?von=ig-bio. It tells us where the link was placed, and it is needed because many programs send no referrer when you click through. The only values accepted are ig-bio, ig-post, ig-story, karte, handel, kleinanzeigen, mail, salon, probe; everything else is discarded. This tag is the same for everyone who clicks the same link, it contains nothing about you, and once counted we remove it from the address bar.
Search engines and other programs open the page as well. We classify such requests by the identifier the program sends itself, and count them separately so that they do not distort the audience figures. Only the name from a fixed list is stored, for example googlebot, not the identifier itself.
Not stored: your IP address, identifiers of any kind, device or browser characteristics, the full referrer with its parameters. Nothing is placed on your device, neither a cookie nor comparable technology, and nothing is read from it. Neither a person nor an individual visit can be reconstructed from this data; we see totals only. No personal reference arises.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in learning whether and which content is found). Section 25 TTDSG does not apply because no information is stored on or retrieved from your device. We delete the totals after twelve months.
This website is hosted on Firebase Hosting, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the site is called up, the host processes technically necessary access data (including IP address, time of access, file requested, volume of data transferred, browser type). This processing is technically required to provide the website.
The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a technically faultless presentation). A data processing agreement under Art. 28 GDPR is in place with the provider.
The products offered, their descriptions and images are held in Cloud Firestore and Firebase Storage, likewise services of Google Ireland Limited. Your browser loads this content directly from there when the page is called up. For technical reasons your IP address is transmitted to the provider in the process. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a functioning product display).
The typeface used (Inter) is served locally from this server. No connection is made to Google Fonts servers and no data is transmitted to third parties.
When you order a piece that is paid through Stripe, you move to a page operated by Stripe. Name, delivery address, email address and payment details are entered there; none of it passes through our website. For pieces we reserve without immediate payment, you enter name, email address and delivery address in our form instead; we store that data in Cloud Firestore.
After successful payment we receive from Stripe your name, delivery address, email address, the amount paid and your optional note. We never receive card details or account numbers. We need this information to perform the contract; the legal basis is Art. 6 (1) (b) GDPR. We pass your address to the shipping company as soon as we send your piece.
Order data is subject to retention obligations under commercial and tax law and is therefore kept for six or ten years respectively after the end of the financial year (§ 257 HGB, § 147 AO). After that we delete it.
Payment is handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. During checkout you leave our website and enter your data on a page operated by Stripe. Stripe processes this data to carry out the payment, to prevent fraud and to meet its own legal obligations, and is independently responsible for doing so.
The legal basis for the transfer is Art. 6 (1) (b) GDPR (performance of the contract). A transfer to Stripe, Inc. in the USA is possible; it is covered by the European Commission’s standard contractual clauses. You can find Stripe’s privacy policy at stripe.com/de/privacy.
At heloatelier.com/feedback you can tell us how a piece holds up in daily use. We store what you enter: your answers to the four questions and, if you give them, your name and email address. Both are optional; without them the feedback is worth no less.
We use it only to improve the pieces and to answer if we have a question. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with a line to info@heloatelier.com We then delete the entry. Nothing is passed on.
You can sign up to four lists: „Der Brief“ and the list for the planned print edition in the journal, the notice for Second Chances, and the welcome list on the home page. We store your email address, your first name if you give one, the time of the sign-up, the page you signed up from, the language of the page and a random string. That string sits in the links for confirming and unsubscribing, and that is the only purpose it serves. All of it is stored in Cloud Firestore.
Nothing goes to your address until you have confirmed the sign-up through a link in a confirmation email (double opt-in). The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time: every message carries an unsubscribe link at the bottom, one click is enough. That deletes your entry rather than merely disabling it. An informal note to info@heloatelier.com does the same.
When you confirm the welcome list, we create a personal discount code for you at Stripe. Only the code itself goes to Stripe, not your address and not your name. The code works once and expires after ninety days.
Signing up to a list is not an order and creates no obligation to pay. Entries that are not confirmed are deleted automatically after six months.
On the pages of the digital edition we count a handful of events: that the page was opened, that someone opened the preview or clicked the buy button. Only the number is counted. We set no cookie, store no identifier, leave nothing on your device and cannot attribute the numbers to any person. That is why no consent under § 25 TTDSG is required. These numbers allow no conclusions about you.
If you write to us by email, we process your address and the content of your message in order to answer it. The legal basis is Art. 6 (1) (b) and (f) GDPR. We delete these messages once the matter is settled and no retention obligation stands in the way.
We store personal data only for as long as is necessary for the respective purpose or as statutory retention periods require.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
This site is served exclusively over encrypted HTTPS.