The controller for data processing on this website is:
Ben Hammond, trading as Weserhalle
Weserstraße 56
12045 Berlin, Germany
Email: info@weserhalle.com
We are not required to appoint a data protection officer.
2. Overview
We process personal data only where the law allows it. The legal bases we rely on under the EU General Data Protection Regulation (GDPR) are:
- your consent (Art. 6(1)(a) GDPR, and § 25(1) TDDDG for cookies and similar technologies),
- performing a contract with you or steps before one, such as processing an order (Art. 6(1)(b) GDPR),
- legal obligations, such as tax and accounting retention (Art. 6(1)(c) GDPR),
- our legitimate interests in running a secure, working website and gallery business (Art. 6(1)(f) GDPR).
We delete personal data once the purpose has ended, unless a legal retention period requires us to keep it longer.
3. Hosting and server logs
This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Our servers are located in the EU. We have a data processing agreement with Hetzner under Art. 28 GDPR.
When you visit the site, the server automatically records technical data: IP address, date and time, the page requested, referrer URL, browser and operating system. We use this to deliver the site and keep it secure (Art. 6(1)(f) GDPR). Log files are deleted after [14] days unless we need them to investigate a security incident.
The site is served over an encrypted connection (TLS/SSL).
4. Cookies
Our shop uses cookies that are strictly necessary for it to work, for example to keep items in your cart and to complete checkout (§ 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR). These are deleted when your session ends or after a short period.
Any cookies that are not strictly necessary, such as analytics cookies, are set only with your consent, which you can give or withdraw at any time through [the cookie settings link in the footer].
5. Google Analytics (via Google Site Kit)
With your consent, we use Google Analytics 4, connected through the Google Site Kit plugin, to understand how visitors use the site. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics uses cookies and similar technologies to collect usage data, such as pages viewed, time on site, device and approximate location. IP addresses are not stored in Google Analytics 4. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, on the basis of the European Commission’s adequacy decision.
Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time through [the cookie settings link]. Analytics data is deleted after [14] months.
6. Contact
If you email us, we use your details to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the correspondence once it is no longer needed, unless tax or commercial law requires us to keep it.
7. Forms, waitlists and newsletter
Our forms (for example edition waitlists, newsletter sign-up, auction bids and open-call submissions) run on Fluent Forms, and our mailing lists on FluentCRM. Both are installed on our own server at Hetzner, so the data stays with us.
Waitlists and newsletter. When you sign up, we store your name, email address and the details you choose to give (for example country, how many prints you are interested in, and whether it is a gift), together with the page or link you came from and the time of sign-up. We use this to tell you when a release goes live and to send you news about Weserhalle.
We use double opt-in: you receive an email asking you to confirm your address, and we only write to you once you have confirmed. We log the time of sign-up and confirmation to prove your consent.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the link in every email or by writing to us. We then delete your data from the list, except for a record of the unsubscribe so we do not contact you again.
Our emails are sent through [email sending provider, e.g. name and address, or: our own mail server at Hetzner]. [If FluentCRM open and click tracking is switched on: We record whether emails are opened and which links are clicked, to improve our mailings. You can object to this at any time by unsubscribing.]
8. Online shop and orders
Our shop runs on WooCommerce, installed on our own server. When you order, we process the data needed to fulfil the contract: name, billing and delivery address, email address, [phone number,] order details and payment status (Art. 6(1)(b) GDPR). For tax reasons, the billing and delivery address must match.
We keep invoices and accounting records for the periods required by German law, generally 10 years (§ 147 AO, § 257 HGB; Art. 6(1)(c) GDPR).
9. Payment with Stripe
Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. At checkout, your payment details go directly to Stripe; we do not see or store your full card details.
Stripe processes your data to carry out the payment and to prevent fraud (Art. 6(1)(b) and (f) GDPR). Data may be transferred to Stripe, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. More information: stripe.com/privacy.
10. Shipping with DHL
We ship with DHL: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany, for parcels within Germany, and Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany, for international parcels. To deliver your order, we pass on your name and delivery address (Art. 6(1)(b) GDPR).
If you agree at checkout, we also pass on your email address so DHL can notify you about delivery (Art. 6(1)(a) GDPR). You can withdraw this consent at any time.
For deliveries outside the EU, the customs data required by law (name, address, description and value of the goods) is transmitted to the customs authorities of the destination country, which may be outside the EU. This is necessary to deliver your order (Art. 6(1)(b) and (c), Art. 49(1)(b) GDPR).
11. Instagram embeds
Some pages show Instagram posts. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When an embedded post loads, your browser connects to Meta’s servers, which receive your IP address and may set cookies, especially if you are logged in to Instagram. Data may be transferred to Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework.
[We load embedded posts only after you consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).] For how Meta handles your data, see Instagram’s privacy policy.
Links to our Instagram profile are plain links: no data is sent to Meta until you click them.
12. Your rights
You have the right to:
- access the personal data we hold about you (Art. 15 GDPR),
- have it corrected (Art. 16) or deleted (Art. 17),
- restrict its processing (Art. 18),
- receive it in a portable format (Art. 20),
- withdraw any consent at any time, with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where we process data based on our legitimate interests, you can object at any time on grounds relating to your particular situation. You can object to direct marketing at any time, without giving reasons.
To use any of these rights, email info@weserhalle.com.
You also have the right to complain to a data protection authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.
13. Changes
We update this policy when our services or the law change. The current version is always on this page.