Privacy

Visiting this website

Our content pages set no cookies and load nothing from other companies' servers. Our host processes technical data (IP address, time, page requested) to deliver the pages and keep them secure, and deletes server logs after a short time.

If our servers hit an error, we send an error report to Sentry. These reports leave out form contents, addresses, email addresses and any other personal data.

[for the lawyer: confirm the visitor statistics set-up (Plausible or Vercel Web Analytics, cookieless) and the log retention period]

What we process, and why

• Private buyers: name, email, billing and payment details (through Shopify) to take and fulfil your order.
• Business customers: company, contact person, email, phone, VAT ID and invoice address, to make the proof, write the cards, invoice and stay in touch.
• Recipients: the name and address on the envelope and the text of the card, only to write and post that card. More on our page for recipients.
• Forms: an anonymised bot check (Cloudflare Turnstile) before a form is sent.

Legal bases

• Art. 6(1)(b) GDPR: to perform our contract with you.
• Art. 6(1)(c) GDPR: to meet legal duties, for example keeping invoices.
• Art. 6(1)(f) GDPR: our legitimate interest in a secure website and in writing the cards you ask us to write to the people you name.

How long we keep it

• Card texts, recipient names and addresses: deleted automatically 30 days after posting.
• Card drafts that were never paid: deleted after 7 days.
• Uploaded address lists: deleted with the cards they created.
• Invoices and booking records: 10 years, as tax law requires.
• Business contacts in our customer records: until no longer needed, or earlier on request.

Who processes data for us

We work with these processors under data processing agreements. Card texts and recipient addresses are stored only in our own database in Frankfurt.

• Vercel Inc. (hosting of this website and the staff hub, region Frankfurt)
• Supabase Inc. (database and file storage, region Frankfurt; card texts, recipients and orders)
• Shopify International Ltd. (shop, checkout and payment for private orders; sees no card text or recipient address)
• Brevo (Sendinblue SAS, France; order and status emails)
• Cloudflare Inc. (DNS for our domain and Turnstile, the bot check on our forms)
• HubSpot Ireland Ltd. (customer records for business orders and enquiries; EU data centre; no card texts or recipient addresses)
• Google Ireland Ltd. (Google Workspace, our email)
• Functional Software Inc. (Sentry, error reports from our servers, EU region, without personal data)
• Plausible Insights OÜ (cookieless visitor statistics, EU), if used

Transfers outside the EU

[for the lawyer: list the safeguards for providers based in the US (EU-US Data Privacy Framework, standard contractual clauses) per provider]

Your rights

You can ask us what we hold about you, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format. Write to hallo@grussatelier.com. You can also complain to a data protection authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information.