Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is Catharina Daniëls, Cathy Daniels Ceramics, Gustav-Müller-Platz 7, 10829 Berlin, Germany.

Email: info@cathydaniels-ceramics.com

No data protection officer has been appointed because there is no legal obligation to appoint one.

2. Hosting and server logs

The website and its API run on a server provided by Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany. The server is located in Germany. Contabo processes data as a processor where necessary to provide the server infrastructure.

Technically necessary access data are processed when the website is opened. These may include the IP address, date and time, requested address or file, transferred data volume, referrer, browser type and version, operating system and request status. Processing is necessary to provide a secure, stable and reliable website and to detect and prevent attacks. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure and reliable operation of the website.

The upstream Caddy server and systemd-journald store access data in logs. The logs are retained for security and troubleshooting for no more than seven days, then deleted or rotated.

3. Contact form and enquiries

When a visitor uses the contact form or sends an email, the information provided is processed. For the contact form, this includes the name, email address, message and technically necessary transmission data.

Form messages are transmitted to the Cathy Daniels Ceramics mailbox using the Mailjet email service operated by Sinch Email. Mailjet receives the sender details and message content and processes these data as a processor for technical email delivery. Mailjet states that content and contact data are stored in data centres within the European Union.

Where an enquiry concerns entering into or performing a contract, the legal basis is Article 6(1)(b) GDPR. General enquiries are processed under Article 6(1)(f) GDPR; the legitimate interest is responding to the enquiry.

Enquiries are retained for as long as necessary to handle them. They are deleted once the matter has been concluded unless statutory retention duties apply or continued storage is necessary to establish, exercise or defend legal claims.

4. Newsletter

The newsletter provides occasional information about new work, market dates and studio news. At least an email address is processed for registration. If registration is requested through the contact form, the submitted name and registration source may also be stored.

Registration uses a double opt-in process. A confirmation email is sent after registration, and the address is added to the Mailjet newsletter list only after the confirmation link is opened. For evidentiary purposes, the PostgreSQL database provided by Neon Inc., 209 Orange Street, City of Wilmington, County of New Castle, Delaware 19801, USA, stores the email address, optional name, registration source, status, a hashed confirmation token, and creation, modification, expiry and confirmation timestamps. The production project uses the Germany/Frankfurt region.

The legal basis for sending the newsletter and related processing is consent under Article 6(1)(a) GDPR in conjunction with Section 7(2)(2) UWG. Consent may be withdrawn at any time for the future through the unsubscribe link in a newsletter or by emailing info@cathydaniels-ceramics.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Unconfirmed registrations expire after 72 hours and are deleted promptly thereafter. Confirmed subscription data are retained until unsubscribe. After unsubscribe, the minimum data required to demonstrate the former consent are retained for up to three years and then deleted unless a longer statutory obligation or a specific legal dispute requires continued storage.

Mailjet, operated by Sinch Email, acts as a processor for confirmation emails, mailing-list management and newsletter delivery. Mailjet states that the relevant data are stored in data centres within the European Union.

5. Cloudflare Turnstile

Cloudflare Turnstile protects the contact and newsletter forms against automated submissions and abuse. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

Turnstile processes technical signals to detect automated access. These include the IP address, TLS characteristics, user agent, site key and associated origin, and signals from the browser environment. The server also sends the IP address and the verification token generated by Turnstile to Cloudflare's verification API. Contact and newsletter field contents are not sent to Turnstile.

Processing is based on Article 6(1)(f) GDPR. The legitimate interest is protecting forms and technical infrastructure against spam, bots and abuse. To the extent Turnstile accesses information on the visitor's device, this is necessary to provide the protected form function expressly requested by the visitor in accordance with Section 25(2)(2) TDDDG.

The optional Turnstile pre-clearance feature is disabled, so this configuration does not issue an additional cf_clearance cookie. Processing in the United States or other third countries cannot be ruled out. Where required, transfers rely on an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR.

Cloudflare R2 is also used to store and deliver gallery and media objects through images.cathydaniels-ceramics.de. Personal data are processed in this context only where a stored media object or related metadata contains personal data.

6. External links

The website links to external services, particularly Instagram. Merely visiting this website does not transmit data through an ordinary external link. Data are transmitted to the external platform only when the link is followed. The external provider is responsible for processing on its website.

7. Recipients and international transfers

Personal data are available only to recipients that require them for the purposes described above. Processors include Contabo GmbH for the website and API server infrastructure, Neon Inc. for PostgreSQL, STRATO GmbH for management of the .com DNS zone and email/mailbox service, and Mailjet, a Sinch Email brand, for form and newsletter emails. Cloudflare, Inc. processes technical Turnstile data and, where applicable, personal data in R2 media objects to provide the respective services; Cloudflare processes Turnstile data partly as a processor and partly under its own responsibility for security and service-improvement purposes.

Data are disclosed to public authorities or other third parties only where required by law, necessary to pursue legal rights or supported by another legal basis.

8. Data-subject rights

Subject to the statutory requirements, data subjects have the right of access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction under Article 18, portability under Article 20 and objection under Article 21. Consent may be withdrawn at any time for the future under Article 7(3) GDPR.

To exercise these rights, email info@cathydaniels-ceramics.com. Data subjects also have the right to complain to a supervisory authority. The competent authority is, in particular, the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany, email: mailbox@datenschutz-berlin.de.

9. Objection to processing based on legitimate interests

Where personal data are processed under Article 6(1)(f) GDPR, the data subject may object at any time on grounds relating to their particular situation under Article 21 GDPR. Processing will then cease unless there are compelling legitimate grounds or processing is necessary to establish, exercise or defend legal claims.

10. Requirement to provide data and automated decisions

Providing data through the contact and newsletter forms is not a statutory or contractual requirement. However, the relevant enquiry or registration cannot be processed without the fields marked as required. No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.