1. Controller
The controller for data processing on this website is:
Ben Hammond, trading as Weserhalle
Weserstraße 56
12045 Berlin, Germany
Email: info@weserhalle.com
We are not required to appoint a data protection officer.
2. Overview
We process personal data only where the law allows it. The legal bases we rely on under the EU General Data Protection Regulation (GDPR) are:
- your consent (Art. 6(1)(a) GDPR, and § 25(1) TDDDG for cookies and similar technologies),
- performing a contract with you or steps before one, such as processing an order (Art. 6(1)(b) GDPR),
- legal obligations, such as tax and accounting retention (Art. 6(1)(c) GDPR),
- our legitimate interests in running a secure, working website and gallery business (Art. 6(1)(f) GDPR).
We delete personal data once the purpose has ended, unless a legal retention period requires us to keep it longer.
3. Hosting and server logs
This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Our servers are located in the EU. We have a data processing agreement with Hetzner under Art. 28 GDPR.
When you visit the site, the server automatically records technical data: IP address, date and time, the page requested, referrer URL, browser and operating system. We use this to deliver the site and keep it secure (Art. 6(1)(f) GDPR). Log files are deleted after 14 days unless we need them to investigate a security incident.
The site is served over an encrypted connection (TLS/SSL).
4. Cookies
Our shop uses cookies that are strictly necessary for it to work, for example to keep items in your cart and to complete checkout (§ 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR). These are deleted when your session ends or after a short period.
Any cookies that are not strictly necessary, such as analytics cookies, are set only with your consent, which you can give or withdraw at any time through the Cookie settings link in the footer.
5. Visitor statistics (Independent Analytics)
We use Independent Analytics, a statistics plugin that runs on our own server at Hetzner. No data is passed to third parties and no cookies are set. When you view a page, we record the page, the time, the referring website, the type of device, browser and operating system, and the country and city derived from your IP address. Your IP address itself is not stored. To count visits without identifying you, the plugin forms a pseudonymous visitor ID from your IP address and browser details together with a random value that is replaced every day, so you cannot be recognised from one day to the next. We keep these statistics for 14 months and then delete them.
Legal basis: our legitimate interest in understanding how our website is used and improving it (Art. 6(1)(f) GDPR). As no information is stored on or read from your device, no consent is required under § 25 TDDDG. You can object to this processing at any time (Art. 21 GDPR) by emailing us.
6. Contact
If you email us, we use your details to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the correspondence once it is no longer needed, unless tax or commercial law requires us to keep it.
7. Forms, waitlists and newsletter
Our forms (for example edition waitlists, the newsletter sign-up and enquiries) run on Fluent Forms, and our mailing lists on FluentCRM. Both are installed on our own server at Hetzner, so the data stays with us.
Waitlists and newsletter. When you sign up, we store your name, email address and the details you choose to give (for example country, how many prints you are interested in, and whether it is a gift), together with the page or link you came from and the time of sign-up. We use this to tell you when a release goes live and to send you news about Weserhalle.
We use double opt-in: you receive an email asking you to confirm your address, and we only write to you once you have confirmed. We log the time of sign-up and confirmation to prove your consent.
Releases with artists and partners. Some sign-up forms belong to a release we run together with an artist, their studio or another partner, who is named on the form. If you tick the optional box to hear from that partner as well, we pass your name, email address and country to them so they can contact you about their own work. They are then responsible for that data themselves, and their own privacy policy applies. If a partner is based outside the EU, we say so on the form. Legal basis: your consent (Art. 6(1)(a) GDPR). Ticking the box is not required to join a waitlist. You can withdraw this consent at any time by writing to us; we then stop sharing your details and tell the partner. If you do not tick the box, the partner receives only anonymous totals, such as the number of sign-ups per country.
Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the link in every email or by writing to us. We then delete your data from the list, except for a record of the unsubscribe so we do not contact you again.
Our emails are sent through Amazon Simple Email Service, provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, using servers in Frankfurt, Germany. Amazon processes this data on our behalf (Art. 28 GDPR). Amazon Web Services, Inc. is certified under the EU-US Data Privacy Framework. We record whether emails are opened and which links are clicked, to improve our mailings. You can object to this at any time by unsubscribing.
8. Online shop and orders
Our shop runs on WooCommerce, installed on our own server. When you order, we process the data needed to fulfil the contract: name, billing and delivery address, email address, phone number, order details and payment status (Art. 6(1)(b) GDPR). For tax reasons, the billing and delivery address must match.
We keep invoices and accounting records for the periods required by German law, generally 10 years (§ 147 AO, § 257 HGB; Art. 6(1)(c) GDPR).
Withdrawal function. If you withdraw from a contract using the withdrawal function on our website, we process your name, email address, the order or invoice number, the items you name, and the date and time of your withdrawal. We use this data to handle your withdrawal and to confirm its receipt to you by email. Legal basis: Art. 6(1)(c) GDPR (legal obligation under §§ 355, 356a BGB). We keep it for as long as we need it to handle the withdrawal and as statutory retention periods require. To protect the form against spam, we use the same check as on our other forms.
9. Payment with Stripe
Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. At checkout, your payment details go directly to Stripe; we do not see or store your full card details.
Stripe processes your data to carry out the payment and to prevent fraud (Art. 6(1)(b) and (f) GDPR). Data may be transferred to Stripe, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. More information: stripe.com/privacy.
10. Shipping with DHL
We ship with DHL: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany, for parcels within Germany, and Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany, for international parcels. To deliver your order, we pass on your name and delivery address (Art. 6(1)(b) GDPR).
If you agree at checkout, we also pass on your email address so DHL can notify you about delivery (Art. 6(1)(a) GDPR). You can withdraw this consent at any time.
For deliveries outside the EU, the customs data required by law (name, address, description and value of the goods) is transmitted to the customs authorities of the destination country, which may be outside the EU. This is necessary to deliver your order (Art. 6(1)(b) and (c), Art. 49(1)(b) GDPR).
11. Instagram embeds
Some older blog posts quote Instagram posts as plain text with a link. No content is loaded from Instagram and no data is sent to Meta until you click such a link. For how Meta handles your data, see Instagram’s privacy policy.
Links to our Instagram profile are plain links: no data is sent to Meta until you click them.
12. Your rights
You have the right to:
- access the personal data we hold about you (Art. 15 GDPR),
- have it corrected (Art. 16) or deleted (Art. 17),
- restrict its processing (Art. 18),
- receive it in a portable format (Art. 20),
- withdraw any consent at any time, with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where we process data based on our legitimate interests, you can object at any time on grounds relating to your particular situation. You can object to direct marketing at any time, without giving reasons.
To use any of these rights, email info@weserhalle.com.
You also have the right to complain to a data protection authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.
13. Changes
We update this policy when our services or the law change. The current version is always on this page.