Privacy Policy
This site shows and sells paintings. It works without cookies, without tracking networks and without any embedded third-party content. All data sits on our own server in Germany. What is nevertheless processed is listed below, one processing activity at a time.
Controller
Luis Meyer
Bopserwaldstraße 20
70184 Stuttgart
Germany
General contact: atelier@mosaics.studio
Data protection, access, erasure, objection: datenschutz@luismeyer.eu
No cookies, no banner
This website sets no cookies and stores nothing in your browser’s local storage. No information is stored on or read from your device in a way that would require consent under § 25 TDDDG. That is why there is no cookie banner and no consent prompt.
Hosting and server logs
The website runs on the controller’s own server in Hetzner’s data centre in Falkenstein, Germany. Hetzner only provides the infrastructure and acts as a processor under Art. 28 GDPR. No content delivery network is used.
The web server (Caddy) logs every request: IP address, timestamp, requested path, HTTP status and user agent. We need this to keep the site running, spot attacks and track down errors. The legal basis is our legitimate interest in a secure and working site (Art. 6(1)(f) GDPR). Logs are kept for a short time only and then deleted.
Fonts
All fonts are served from our own server. No connection is made to Google Fonts or any other external provider, so your IP address is not passed on to anyone for this.
Analytics with GoatCounter
To see which works and pages are actually looked at, we use GoatCounter. The software runs on our own server at stats.luismeyer.eu; the figures never leave that server and are not shared with third parties.
GoatCounter works without cookies and without fingerprinting. To roughly recognise repeat visits it stores a salted hash of your IP address, your user agent and the current day, which cannot be traced back to you; the salt rotates daily. It also stores the page path, the referring page, browser, screen size and country.
The legal basis is our legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR). Since no information is stored on or read from your device, no consent is required.
Spam protection with ALTCHA
The enquiry form is protected against automated submissions by ALTCHA, which runs on our own server. Instead of a puzzle, your browser computes a small task (proof of work) and returns the result with the form.
Unlike captchas from large providers, nothing is sent to an external service. No cookies are set, nothing is written to local storage, and no requests go to third parties. The only thing processed is the challenge we sign with an HMAC; it contains no personal data and expires after ten minutes. The legal basis is our legitimate interest in preventing spam (Art. 6(1)(f) GDPR).
Enquiries via the contact form
When you send an enquiry we store your name, your email address, an optional delivery preference, your message and the time of the enquiry in a database on our server. We also forward the same content by email and as a push notification to the controller so the enquiry does not go unanswered.
The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns a particular work or a possible purchase, otherwise our legitimate interest in answering you (Art. 6(1)(f) GDPR). We delete the enquiry once it has been settled and no retention duty applies.
Orders and payment
For an order we store your name, email address, street, postal code, city, country, the delivery method you chose, an optional message, the total and the order status. We need this data to perform the contract (Art. 6(1)(b) GDPR).
Payment is by bank transfer only. No payment service provider is involved and we process no card data. You receive our bank details and pay from your own account; of the payment itself we only see the money arriving in our account.
Invoice-relevant data must be retained under German tax and commercial law (§ 147 AO, § 257 HGB) for up to ten years. During that time it is blocked for everyday use and deleted afterwards (Art. 6(1)(c) GDPR).
Shipping
For delivery we pass your name and delivery address to the carrier we commission (Art. 6(1)(b) GDPR). This does not apply if you pick the work up at the studio.
Our email runs on our own mail server (mailcow at mail.mosaics.studio, located in Germany). A copy of incoming messages is forwarded to the controller’s personal mailbox at Proton Mail (Proton AG, Switzerland). The European Commission has recognised an adequate level of data protection for Switzerland by an adequacy decision, so no additional safeguards are required.
We process the content and traffic data of your email in order to reply to you — depending on the occasion on the basis of Art. 6(1)(b) or Art. 6(1)(f) GDPR.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). Any consent you have given can be withdrawn at any time with effect for the future.
To exercise these rights, write to datenschutz@luismeyer.eu.
Complaints to a supervisory authority
You may lodge a complaint with a data protection supervisory authority at any time. The authority competent for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg).