This notice explains which personal data is processed when you visit this website or send an inquiry, why it is processed and what rights you have. The German version is legally binding.
The controller details will be added once the business is registered. Until then, please contact us via the inquiry form on this website.
1. Controller
The controller under the General Data Protection Regulation (GDPR) is: ERZINO, [name of owner or company], [street and number], [postcode and city], Germany, email: [email address].
No data protection officer has been appointed, as the legal requirements for one are not met.
2. Hosting
This website runs on a server we rent from Tencent Cloud in a data centre in Frankfurt am Main, Germany. The provider processes data only on our behalf and under our instructions (Art. 28 GDPR).
To deliver pages, the server necessarily processes your IP address, the time of access, the requested page and browser and operating system details. We do not keep permanent access logs. To prevent abuse such as automated login attempts, the IP address is held in memory for at most 15 minutes and then discarded.
The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
3. Encryption
The whole website is only available over an encrypted connection (HTTPS). Passwords for the project area are never stored in plain text, only as an irreversible hash.
4. No analytics, advertising or third-party services
We use no analytics or statistics tools, no advertising trackers and no social media plugins. Fonts, images and code are loaded entirely from our own server, so visiting the website sends no data to Google, Meta or other third parties.
5. Cookies
Simply visiting the website sets no cookies. Only when you sign in to the project area is a strictly necessary cookie named "atelier_session" stored. It contains a random identifier, keeps you signed in for 14 days and is deleted when you sign out.
The legal basis is Section 25(2) no. 2 TDDDG together with Art. 6(1)(b) GDPR. No consent is required, so no cookie banner is shown.
6. Inquiry form
When you send an inquiry, we process the information you enter:
- name and a way to contact you (phone, email or other)
- project type, preferred material, budget, location and preferred date
- the story behind the work and further notes
- uploaded files (JPG, PNG, WebP or PDF, up to 10 files of 10 MB each)
We use this data only to answer your inquiry, prepare an offer and plan the project with you. The legal basis is steps taken at your request before a contract (Art. 6(1)(b) GDPR) and the consent you give with the checkbox in the form (Art. 6(1)(a) GDPR).
Providing the data is voluntary, but without contact details we cannot reply.
7. Photos and stories about other people
For portraits and memorial work we often receive photos and personal memories of relatives, including people who have died. We treat this material confidentially and use it only to create the commissioned work.
Please only send photos you are entitled to share for this purpose. We publish nothing, for example in our portfolio or on social media, without your separate, explicit written consent, which you can withdraw at any time.
8. Customer project area
For commissioned projects we may set up a customer account. There we process your name, email address, contact details, project data, progress updates and messages between you and the studio. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
9. Recipients and storage location
Your data is stored on our server in Frankfurt am Main and only the studio has access. We share it only where needed to carry out the commission (for example with a foundry, transport or installation company) or where required by law.
We do not transfer your data to countries outside the European Union or the European Economic Area.
10. Retention and backups
Inquiries that do not lead to a commission, including uploaded files, are deleted no later than twelve months after the last contact. Data for commissioned projects is kept for the duration of the work and afterwards as long as statutory retention duties apply (usually six years for business letters and ten years for accounting records under Section 257 HGB and Section 147 AO).
To prevent data loss we make a daily backup on the same server. Each backup is overwritten automatically after 14 days, so deleted data also disappears from backups by then.
11. Your rights
You have the right at any time to:
- access the data we process (Art. 15 GDPR)
- have incorrect data corrected (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- object to processing based on legitimate interests (Art. 21 GDPR)
- withdraw consent with effect for the future (Art. 7(3) GDPR)
You may also complain to a data protection supervisory authority, in particular in the federal state where you live or where the studio is based.
No automated decision-making or profiling takes place.
12. Changes
We update this notice when the website or legal requirements change. The version published here applies.