Privacy policy
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Thomas Weiß – Don Whites Atelier Johann-Goercke-Allee 14 14469 Potsdam Germany Email: donwhite.arthouse@gmail.com
2. General information about data processing
We process personal data only to the extent necessary to provide this website, handle orders, process payments, deliver goods, respond to enquiries or meet legal obligations.
Depending on the processing activity, this is based in particular on the following legal grounds:
Article 6(1)(b) GDPR, where processing is necessary to take steps before entering into a contract or to perform a contract;
Article 6(1)(c) GDPR, where we are subject to a legal obligation;
Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests and these are not overridden by the interests or rights of the person concerned;
Article 6(1)(a) GDPR, where we obtain consent for a particular processing activity.
3. Accessing the website and hosting with Vercel
This website is hosted by Vercel Inc., USA.
When you access the website, connection and log data needed for technical operation may be processed. This includes, in particular:
IP address;
date and time of access;
page or file requested and amount of data transferred;
referrer URL;
browser type and version;
operating system and device information;
HTTP status code and technical error and performance data.
This processing is necessary to deliver the website, ensure its stability and security, and detect attacks or misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient provision of our online service.
Vercel may also process data in the USA or other countries outside the European Economic Area. Vercel states that it uses appropriate safeguards for transfers from the EEA and participates in the EU–US Data Privacy Framework. Further information is available in Vercel’s privacy notice: https://vercel.com/legal/privacy-notice
Log data is retained only for as long as necessary for these purposes, unless longer retention is needed for security reasons or to meet legal obligations. [Technical check: add the specific log retention period of the Vercel plan used, if configured for this project.]
4. Content and media provided by Sanity
We use Sanity to manage and deliver website content. The provider is Sanity AS, Norway, together with the affiliated companies named in Sanity’s privacy information.
When text, product information or images are retrieved, requests may be made directly to Sanity’s systems or content delivery network. This may involve processing the IP address, date and time of the request, browser and device information, the previously visited URL, and technical performance and error data. Sanity also states that it logs source IP addresses to prevent abusive or fraudulent use.
This processing enables fast, stable and secure delivery of website content and is based on Article 6(1)(f) GDPR. Our legitimate interests are the reliable display of our online shop and the security and performance of the website.
Sanity AS is based in Norway, within the European Economic Area. Where Sanity or its subprocessors process data in other countries, transfers take place under the applicable legal conditions, in particular on the basis of an adequacy decision or appropriate safeguards such as standard contractual clauses. Further information: https://www.sanity.io/legal/privacy
5. Orders in the online shop
When you place an order through our online shop, we process the information you provide during checkout. This may include, in particular:
first and last name;
billing and delivery address;
email address and, where applicable, telephone number;
products ordered, prices and shipping costs;
order number, order time and order status;
selected payment method;
payment-related status and transaction information;
communications concerning the order.
We process this data to accept and fulfil the order, match the payment, dispatch the goods, respond to questions, withdrawals or defect claims, and meet statutory record-keeping obligations.
The legal basis is Article 6(1)(b) GDPR. Where data is processed and retained for commercial or tax records, the legal basis is Article 6(1)(c) GDPR.
We share data with payment and shipping providers only to the extent required to fulfil the contract. The information needed for the order must be provided for the contract to be concluded. Without it, we cannot process the order.
Contract and accounting data is retained for the statutory retention periods under commercial and tax law. Accounting vouchers must generally be kept for eight years and certain other business records for six years. Data may also be retained for as long as necessary to establish, exercise or defend legal claims.
[Technical check: Does the website also store order data in Sanity, a Vercel database, Vercel functions, an email system or another service? If so, add that service here.]
6. Payment processing with Stripe
We use Stripe to process payments. For customers in the European Economic Area, the service is provided in particular by Stripe Payments Europe, Limited, Ireland.
When you choose a payment method offered through Stripe and begin the payment process, data needed for payment is transferred to Stripe or collected directly by Stripe. This may include, in particular:
name and contact details;
billing address;
payment details, depending on the payment method selected;
amount, currency and order information;
IP address and device and browser information;
transaction, authentication, security and fraud-prevention data.
As a rule, we do not receive complete card or bank account details. We receive, in particular, confirmation of payment status, transaction identifiers and the information needed for accounting, refunds and fulfilment of the contract.
Where the transfer and processing are necessary to process payment and fulfil the contract, the legal basis is Article 6(1)(b) GDPR. Where Stripe or we process data for fraud prevention, IT security or legal enforcement, Article 6(1)(f) GDPR may be the legal basis. Processing required by law is based on Article 6(1)(c) GDPR. Stripe also processes certain data as an independent controller, particularly to meet regulatory obligations and prevent misuse and fraud.
Stripe may transfer personal data to affiliated companies and service providers in countries outside the EEA, especially the USA. Stripe describes the legally recognised transfer mechanisms and safeguards it uses. Further information is available in Stripe’s privacy policy: https://stripe.com/de/privacy
[Technical check: Is the integration Stripe Checkout, Stripe Elements, Payment Links or another Stripe product? Add the precise product name here. If Stripe loads scripts or cookies before checkout begins, the cookie implementation must also be checked separately.]
7. Shipping providers
To deliver ordered goods, we share the information needed for delivery, in particular the name, delivery address and any other delivery instructions, with the shipping provider we use. The legal basis is Article 6(1)(b) GDPR.
[Specify before publication: If shipping with DHL, add Deutsche Post DHL Group or the specific DHL company used, together with a link to its privacy information.]
An email address or telephone number is shared with the shipping provider for delivery notifications or arranging delivery only where there is an appropriate legal basis.
8. Contact by email
When you contact us by email, we process the data you provide, in particular your email address, the content of your message and, where applicable, your name and any other information you choose to provide.
If your message relates to an order, a prospective contract or its performance, the legal basis is Article 6(1)(b) GDPR. For other enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to handle your enquiry appropriately.
The data is deleted once the enquiry has been fully handled, unless statutory retention obligations or other legitimate reasons require further storage.
[Add before publication: the provider used for the business email inbox and automatic order or withdrawal confirmations.]
9. Cookies and similar technologies
We use Vercel Web Analytics (Vercel Inc., USA) to measure page views and visitor counts. This processes information such as the page viewed, time, referring website, country, browser and device type. Vercel Web Analytics does not use cookies and counts visitors using a hash generated from the request that is discarded after 24 hours. We do not use marketing or social-media tracking services. Further information: https://vercel.com/docs/analytics/privacy-policy
Where our website uses technically necessary cookies or comparable storage technologies, they are used only to provide functions expressly requested by users, such as the cart, checkout, payment processing or security. Access to or storage of information on a user’s device is based in this case on Section 25(2) of the German Telecommunications and Digital Services Data Protection Act (TDDDG). Depending on its purpose, associated processing of personal data is based in particular on Article 6(1)(b) or (f) GDPR.
Cookies or comparable technologies that are not technically necessary are used only with prior consent under Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR. Consent may be withdrawn at any time with future effect.
[Technical check before publication: Which cookies, local-storage entries and external requests are actually set or triggered on the home page, product page, cart and checkout? Only then can it be determined reliably whether a consent banner is required.]
10. Recipients and processors
Only parties that need personal data for the stated purposes receive it. These may include hosting and content infrastructure providers, payment and shipping providers, email providers, IT service providers, and tax and accounting professionals.
Where a service provider processes personal data solely on our behalf, we conclude a data processing agreement under Article 28 GDPR where legally required.
11. Transfers to countries outside the EEA
Some service providers are based outside the European Economic Area or use subprocessors there. Transfers take place only where the requirements of Articles 44 et seq. GDPR are met. This may be based in particular on an adequacy decision of the European Commission, a valid certification under the EU–US Data Privacy Framework, or standard contractual clauses together with supplementary safeguards.
12. Retention periods
Where this privacy policy does not specify a particular retention period, we store personal data only for as long as needed for its purpose. It is then deleted or anonymised unless statutory retention obligations, ongoing contracts or legitimate reasons require further storage.
13. Your rights
Subject to the applicable legal requirements, you have in particular the following rights:
access to the personal data we process about you under Article 15 GDPR;
rectification of inaccurate data or completion of incomplete data under Article 16 GDPR;
erasure under Article 17 GDPR;
restriction of processing under Article 18 GDPR;
data portability under Article 20 GDPR;
objection to processing based on Article 6(1)(e) or (f) GDPR under Article 21 GDPR;
withdrawal of consent with future effect under Article 7(3) GDPR.
To exercise your rights, you can use the contact details above.
14. Right to lodge a complaint with a supervisory authority
Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. In particular, you may contact the authority in the country of your habitual residence, your place of work or the place where the alleged infringement occurred. For the controller based in Brandenburg, the competent authority is generally the Brandenburg Commissioner for Data Protection and the Right of Access to Files.
15. No automated decision-making by us
We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you. Payment providers may carry out automated security and fraud checks under their own responsibility.
16. Updates to this privacy policy
We update this privacy policy when the website, the service providers we use or the legal requirements change. The version published on this website at any given time applies.