Privacy Policy

• • 1. Introduction
    • 1.1 Objectives of this Policy
    • 1.2 What is GDPR?
    • 1.3 Scope of this Policy
    • 1.4 What Information is Collected
  • 2. Contact Information
  • 3. Lawfulness of Processing
    • 3.1 Legal Basis for Processing
    • 3.2 Summary
  • 4. Rights of Concerned Individuals
    • 4.1 Right of Access
    • 4.2 Right to Rectification
    • 4.3 Right to Erasure / Right to Be Forgotten
    • 4.4 Right to Restriction of Processing
    • 4.5 Right to Data Portability
    • 4.6 Right to Object
    • 4.7 Right Not to Be Subject to Automated Decision-Making
    • 4.8 Summary
  • 5. Data Collection
    • 5.1 Information Provided Directly by the User
    • 5.2 Information Automatically Collected
    • 5.3 Information from Third-Party Services
  • 6. Use of Your Personal Data
    • 6.1 Communication and Service
    • 6.2 Service Improvement
    • 6.3 Legal Compliance
  • 7. Sharing of Your Personal Data
    • 7.1 Service Partners
    • 7.2 Legal Requirements
    • 7.3 International Transfers
  • 8. Data Collected
    • 8.1 Cookies
    • 8.2 Consent Management via Real Cookie Banner
    • 8.3 WordPress Comments
    • 8.4 Contact Form 7
    • 8.5 Google reCAPTCHA
    • 8.6 Google Fonts
    • 8.7 Google Maps
    • 8.8 Jetpack Stats
    • 8.9 Jetpack Comments
    • 8.10 Jetpack Notifications
    • 8.11 Jetpack Subscriptions
    • 8.12 Akismet
    • 8.13 Flickr
    • 8.14 WooCommerce
    • 8.15 WPForms
    • 8.16 WPML
    • 8.17 Vimeo
    • 8.18 Cloudflare Turnstile
    • 8.19 Google Analytics 4
  • 9. Third-Party Service Providers
    • 9.1 Web Hosting
  • 10. Security Measures
    • 10.1 Technical and Organisational Measures
    • 10.2 SSL Encryption
    • 10.3 Breach Notification Process
    • 10.4 Data Retention Period
  • 11. Changes to Our Privacy Policy
  • 12. Managing Your Privacy Settings
    • 12.1 Graphicatelier Privacy Center
    • 12.2 Browser Privacy Controls
    • 12.3 Privacy-Enhancing Extensions
    • 12.4 Advanced Privacy Tools
  • 13. Conclusion

Welcome to www.graphicatelier.com (hereinafter referred to as the “Site”), a website operated by graphicatelier (hereinafter referred to as “We”, “Our”, or “graphicatelier”). If you use this Site, you are considered a user (hereinafter referred to as “You” or “Your” or “User”). This Privacy Policy (hereinafter referred to as the “Policy”) governs how We collect, use, store, and disclose information about You when You use this Site. This Policy also applies to information collected by third-party services We use to enhance Your experience on the Site (hereinafter referred to as “Third-Party Services”).

The objectives of this Policy are to inform You about:

• The types of information We collect and process
• How We use and share this information
• With whom We share this information and why
• Your data protection rights under applicable regulations
• How to exercise Your rights and manage Your privacy preferences
• Our compliance with the General Data Protection Regulation (GDPR), the ePrivacy Directive (2002/58/EC), and applicable Austrian data protection laws

GDPR, or the General Data Protection Regulation (Regulation (EU) 2016/679), is a European Union law that came into effect on May 25, 2018. GDPR aims to give EU citizens and residents full control over their personal data and to harmonise data protection regulations within the EU. It establishes strict requirements for organisations that collect, process, and store personal data, and provides individuals with enhanced rights regarding their personal information. The Regulation applies to all organisations processing personal data of data subjects residing in the EU, regardless of the organisation’s location.

This Policy applies to all personal data processing activities carried out by graphicatelier through the Site. It covers:

• Data You provide directly to Us (e.g., through contact forms, comments, subscriptions)
• Data We collect automatically (e.g., through cookies, analytics, server logs)
• Data We receive from Third-Party Services integrated into the Site
• Data processed by third-party service providers acting on Our behalf

This Policy does not apply to third-party websites that may be linked from our Site. We encourage You to review the privacy policies of those websites before providing them with any personal information.

We collect various types of information to provide and improve Our services. This information may include, but is not limited to:

• Personal identification data: name, email address, phone number, postal address
• Technical data: IP address, browser type and version, operating system, device type
• Usage data: pages visited, time spent on the Site, referring URLs, click patterns
• Preference data: language preferences, cookie consent choices, subscription settings
• Communication data: message content submitted through forms, comment content
• Transactional data: order history, purchase information (if applicable)

The specific information We collect and how We use it is detailed throughout this Policy, particularly in Section 8 – Data Collected.

If You have any questions or concerns about this Policy or how We handle Your data, please contact Our Data Protection Officer, who is the data controller for Your personal information:

You also have the right to lodge a complaint with the Austrian Data Protection Authority if You believe that the processing of Your personal data infringes the provisions of the GDPR:

In this section, We explain the legal bases on which We rely for processing Your personal data in accordance with the provisions of the GDPR. Each processing activity carried out by graphicatelier is grounded in at least one legal basis, as required by Article 5(1)(a) of the GDPR (lawfulness, fairness, and transparency).

The processing of Your personal data is based on one or more of the following legal bases, as established in Article 6 of the GDPR:

The lawfulness of processing Your personal data by graphicatelier is established on several legal bases. For processing activities that may pose a high risk to Your rights and freedoms, We conduct Data Protection Impact Assessments (DPIAs) as required by Article 35 of the GDPR, in accordance with EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR.

As a User, You have certain rights regarding the processing of Your personal data. We are committed to respecting these rights and facilitating their exercise, in accordance with the provisions of Articles 12–22 of the GDPR. We will respond to all requests without undue delay and at the latest within one month, unless the request is particularly complex or We have received numerous requests, in which case We may extend the response period by up to two additional months in accordance with Article 12(3) of the GDPR.

If You wish to exercise any of these rights, please refer to Section 2 – Contact Information. We will respond to Your request without undue delay and at the latest within one month in accordance with Article 12(3) of the GDPR.

When You use Our Site, various categories of information may be gathered to provide You with an optimal user experience, in line with Our service objectives. This data collection is carried out in full compliance with the GDPR and the ePrivacy Directive.

When You browse the Site or use certain of Our services, You have the option to provide Us with data such as Your name, email address, phone number, and more. Examples of when You might provide this information include:

• When filling out contact forms
• When subscribing to newsletters or email notifications
• When posting comments on articles
• When participating in surveys or contests
• When creating a user account (if applicable)
• When placing an order or making a purchase (if applicable)

When You visit the Site, certain information may be automatically collected, such as Your IP address, browser details, operating system, and more. The automatically collected information includes:

• IP address and approximate location derived from it
• Browser type and version
• Operating system and device type (desktop, mobile, tablet)
• Referring website and exit pages
• Pages visited and time spent on each page
• Actions taken on the Site (clicks, scrolls, form interactions)
• Date and time of visit
• Language preferences
• Screen resolution and colour depth

We may also receive information about You from Third-Party Services We use to enhance Our Site and services. For detailed information about each Third-Party Service and the data they collect, please refer to Section 8 – Data Collected. If You have questions regarding the collection of Your personal data, please refer to Section 2 – Contact Information.

The personal data We collect is used for various purposes, always in strict compliance with applicable laws.

We process Your data, such as Your email address, to communicate with You, keep You informed of Our service updates, or respond to Your requests. This use arises from Our contractual obligation to provide You with the service for which You have registered, in accordance with Article 6(1)(b) of the GDPR.

Automatically collected information helps Us understand how users interact with Our Site. This understanding allows Us to enhance Our services to better meet Your needs, in accordance with Article 6(1)(f) of the GDPR (legitimate interest).

We may also use Your data to comply with Our legal obligations, for example, to respond to a request from a judicial authority or to maintain required business records, in accordance with Article 6(1)(c) of the GDPR.

If You have questions regarding the use of Your personal data, please refer to Section 2 – Contact Information.

We attach great importance to the privacy of Your data. However, in certain situations, it may be necessary to share Your personal data. Each sharing is strictly regulated by the GDPR, ensuring the highest protection of Your information.

We may share Your data with third-party partners who assist Us in operating the Site, providing Our services, or processing transactions on Our behalf. These third parties are required to process this data in accordance with the law and in compliance with Our commitment to protecting Your privacy, in alignment with Article 28 of the GDPR (processors). We have Data Processing Agreements (DPAs) in place with each service partner, as required by Article 28(3) of the GDPR.

We may be obligated to disclose Your data if required by law, when We believe such disclosure is necessary to protect Our rights, the safety of others, or to respond to a judicial or governmental request, in accordance with Article 6(1)(c) of the GDPR.

If We need to transfer Your data outside of the European Economic Area (EEA), We ensure that these transfers comply with the requirements of the GDPR, thus ensuring adequate protection of Your data, in accordance with Chapter V of the GDPR (Articles 44–49). This includes implementing appropriate safeguards such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission in accordance with Commission Implementing Decision (EU) 2021/914 (the new modular SCCs).
• EU-US Data Privacy Framework (DPF) for transfers to participating US organisations, as established by the European Commission’s adequacy decision (EU) 2023/1795.
• Transfer Impact Assessments (TIAs) conducted in accordance with EDPB Recommendations 01/2020.
• Supplementary measures as necessary to ensure an adequate level of protection.

The EU-US Data Privacy Framework (DPF) became operational in July 2023 following the European Commission’s adequacy decision (EU) 2023/1795. This framework is supported by Executive Order 14086 (October 2022) and includes a UK Extension and a Swiss-US DPF. You can verify an organisation’s participation status on the official Data Privacy Framework website.

If You have any questions regarding the sharing of Your personal data, please refer to Section 2 – Contact Information.

Our Site uses various technologies to collect and store information when You visit it. This may include the use of cookies, local storage, session storage, IndexedDB, or similar technologies. In accordance with Article 5(3) of the ePrivacy Directive (2002/58/EC) and in line with EDPB Guidelines 02/2023, We provide detailed information about each storage technology used on this Site.

Cookies are small text files that websites place on Your device to store information about Your preferences, enhance site functionality, and collect analytics data. In addition to HTTP cookies, websites may use other storage technologies:

• LocalStorage: Stores data persistently in the browser with no expiration date.
• SessionStorage: Stores data for the duration of the browser session only.
• IndexedDB: A client-side database that can store significant amounts of structured data.
• Fingerprinting: Techniques that collect device and browser characteristics to create a unique device identifier.

Cookies serve several important functions on websites:

• Essential cookies: Required for the website to function properly. Exempt from consent under the ePrivacy Directive.
• Functional cookies: Help to enhance the functionality and personalisation of the website.
• Statistics cookies: Help website owners understand how visitors interact with websites.
• Marketing cookies: Used to track visitors across websites.

The use of cookies is primarily regulated by two key pieces of legislation in the European Union:

• GDPR: Regulation (EU) 2016/679 applies when cookies collect personal data, requiring a lawful basis for processing such data in accordance with Article 5 of the GDPR.
• ePrivacy Directive: Article 5(3) of Directive 2002/58/EC requires websites to obtain user consent before storing or accessing information on a user’s device, with exceptions for strictly necessary cookies.
• EDPB Guidelines 05/2020 on Consent: These guidelines clarify the requirements for valid consent.

Cookies come in different types: First-party (issued by the site You visit), Third-party (issued by domains other than the site You visit), Session (deleted when browser closes), and Persistent (stored for a specified period).

Essential cookies are exempt from the consent requirement under Article 5(3) of the ePrivacy Directive. Functional, Statistics, and Marketing cookies require prior informed consent under Article 6(1)(a) of the GDPR.

You can manage Your cookie preferences through Our consent management tool or Your browser settings. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

We use Real Cookie Banner to ensure legal compliance with cookie consent regulations while providing You with a transparent way to manage Your privacy preferences. It supports IAB TCF v2.2 and uses a blocking mode that prevents third-party scripts from loading until consent has been obtained.

Real Cookie Banner processes: Your consent choices, timestamp of consent, UUID, browser type and version, anonymized IP address, language preferences, operating system, and referrer URL.

Real Cookie Banner is self-hosted on Our web server. No data is transferred outside the EEA by the plugin itself. If You consent to third-party services through the banner, those services may transfer data internationally according to their own privacy policies.

Consent records are stored for 12 months from the date consent was given, or until You withdraw Your consent, as required by Article 7(1) of the GDPR.

Click on the “Change Privacy Settings” button (finger icon) located in the bottom-left corner of every page. You can also clear cookies through Your browser settings. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

For questions specific to Our implementation, please refer to Section 2 – Contact Information. For more information about Real Cookie Banner, visit devowl.io/rcb/data-processing.

WordPress Comments allows users to engage in discussions on Our published content. This helps enhance community engagement and provides valuable feedback.

When You leave a comment: name, email address, website URL (optional), IP address, browser user agent string, comment content, and timestamp.

WordPress Comments is self-hosted. However, if You use a Gravatar-linked email address, Your browser may request profile images from Automattic’s servers in the US. For more information, refer to Automattic’s Privacy Policy.

Comments and their metadata are retained indefinitely. Registered users can see, edit, or delete their personal information.

You can request deletion of Your comments by referring to Section 2 – Contact Information. You can also manage comment-related cookies through Your browser settings.

For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

Please refer to Section 2 – Contact Information. For WordPress’s general data handling, visit WordPress Privacy Policy.

Contact Form 7 enables You to communicate with Us through forms on Our website. Form submissions are processed entirely on Our server.

Name, email address, phone number (if requested), message content, subject line, IP address, timestamp, and browser user agent.

Contact Form 7 is self-hosted. No data is transferred outside the EEA by the plugin itself. If reCAPTCHA is integrated with the form, please refer to the reCAPTCHA section for data transfer details.

Form submissions are retained for up to 3 years, after which they are securely deleted unless there is a legitimate business or legal reason to retain them longer.

Please refer to Section 2 – Contact Information to request access to, correction, or deletion of Your personal data submitted through the form.

For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

Please refer to Section 2 – Contact Information. For plugin information, visit contactform7.com.

Google reCAPTCHA helps prevent automated spam and abuse by verifying that the user is human.

When You use reCAPTCHA: IP address, browser user agent string, anonymized IP address, and timestamp.

Google reCAPTCHA loads Google scripts and sends security and interaction signals to Google. Data may be processed outside the EEA as described in the warning below.

Consent records are stored for 12 months from the date consent was given, or until You withdraw Your consent, as required by Article 7(1) of the GDPR.

Click on the “Change Privacy Settings” button (finger icon) located in the bottom-left corner of every page. You can also clear cookies through Your browser settings. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

For questions specific to Our implementation, please refer to Section 2 – Contact Information. For more information about reCAPTCHA, visit Google’s reCAPTCHA.

Google Fonts allows users to select and use custom fonts on Our website.

When You use Google Fonts: IP address, browser user agent string, anonymized IP address, and timestamp.

If Google Fonts is loaded from Google servers, the browser requests font resources from Google and technical data such as the IP address may be transmitted. If fonts are genuinely self-hosted, this external request does not occur; the implementation must be verified before publication.

Consent records are stored for 12 months from the date consent was given, or until You withdraw Your consent, as required by Article 7(1) of the GDPR.

Click on the “Change Privacy Settings” button (finger icon) located in the bottom-left corner of every page. You can also clear cookies through Your browser settings. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

For questions specific to Our implementation, please refer to Section 2 – Contact Information. For more information about Google Fonts, visit Google Fonts.

Google Maps allows users to view and interact with maps on Our website.

When You use Google Maps: IP address, browser user agent string, anonymized IP address, and timestamp.

Google Maps is not self-hosted when an embedded map, JavaScript API, or Google map tiles are loaded. The browser connects directly to Google services and may transmit technical, location, search, and interaction data. A static, locally hosted map image would be a different implementation.

Consent records are stored for 12 months from the date consent was given, or until You withdraw Your consent, as required by Article 7(1) of the GDPR.

Click on the “Change Privacy Settings” button (finger icon) located in the bottom-left corner of every page. You can also clear cookies through Your browser settings. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

For questions specific to Our implementation, please refer to Section 2 – Contact Information. For more information about Google Maps, visit Google Maps.

Jetpack Stats provides analytics and insights into user engagement on Our website.

When You use Jetpack Stats: IP address, browser user agent string, anonymized IP address, and timestamp.

Jetpack Stats is not self-hosted. The Jetpack module sends measurement data to Automattic/WordPress.com services for analytics. The applicable transfer safeguards are described in the warning below.

Consent records are stored for 12 months from the date consent was given, or until You withdraw Your consent, as required by Article 7(1) of the GDPR.

Click on the “Change Privacy Settings” button (finger icon) located in the bottom-left corner of every page. You can also clear cookies through Your browser settings. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

For questions specific to Our implementation, please refer to Section 2 – Contact Information. For more information about Jetpack Stats, visit Jetpack Stats.

Jetpack Comments provides analytics and insights into user engagement on Our website.

When You use Jetpack Comments: IP address, browser user agent string, anonymized IP address, and timestamp.

Jetpack Comments may exchange comment and authentication data with Automattic/WordPress.com services. The native WordPress comment database remains on the Site, but the Jetpack feature itself is not self-hosted.

Consent records are stored for 12 months from the date consent was given, or until You withdraw Your consent, as required by Article 7(1) of the GDPR.

Click on the “Change Privacy Settings” button (finger icon) located in the bottom-left corner of every page. You can also clear cookies through Your browser settings. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

For questions specific to Our implementation, please refer to Section 2 – Contact Information. For more information about Jetpack Comments, visit Jetpack Comments.

Jetpack Notifications provides analytics and insights into user engagement on Our website.

When You use Jetpack Notifications: IP address, browser user agent string, anonymized IP address, and timestamp.

Jetpack Notifications communicates with Automattic/WordPress.com services to generate and deliver notifications. It is not a wholly self-hosted service.

Consent records are stored for 12 months from the date consent was given, or until You withdraw Your consent, as required by Article 7(1) of the GDPR.

Click on the “Change Privacy Settings” button (finger icon) located in the bottom-left corner of every page. You can also clear cookies through Your browser settings. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

For questions specific to Our implementation, please refer to Section 2 – Contact Information. For more information about Jetpack Notifications, visit Jetpack Notifications.

Jetpack Subscriptions provides analytics and insights into user engagement on Our website.

When You use Jetpack Subscriptions: IP address, browser user agent string, anonymized IP address, and timestamp.

Jetpack Subscriptions sends subscription data to Automattic/WordPress.com services for subscription management and email delivery. It is not self-hosted.

Consent records are stored for 12 months from the date consent was given, or until You withdraw Your consent, as required by Article 7(1) of the GDPR.

Click on the “Change Privacy Settings” button (finger icon) located in the bottom-left corner of every page. You can also clear cookies through Your browser settings. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

For questions specific to Our implementation, please refer to Section 2 – Contact Information. For more information about Jetpack Subscriptions, visit Jetpack Subscriptions.

Akismet helps prevent spam and abuse by identifying and filtering out automated content.

When You use Akismet: IP address, browser user agent string, anonymized IP address, and timestamp.

Akismet is a cloud-based spam filtering service. Comment and form metadata may be sent to Automattic/Akismet for spam analysis; the plugin itself is installed locally but the filtering service is not self-hosted.

Consent records are stored for 12 months from the date consent was given, or until You withdraw Your consent, as required by Article 7(1) of the GDPR.

Click on the “Change Privacy Settings” button (finger icon) located in the bottom-left corner of every page. You can also clear cookies through Your browser settings. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

For questions specific to Our implementation, please refer to Section 2 – Contact Information. For more information about Akismet, visit Akismet.

Flickr allows users to share and view images on Our website.

When You use Flickr: IP address, browser user agent string, anonymized IP address, and timestamp.

Flickr is an external image-hosting and embedding service. Embedded images, scripts, or players may cause the browser to connect directly to Flickr services and transmit technical data.

Consent records are stored for 12 months from the date consent was given, or until You withdraw Your consent, as required by Article 7(1) of the GDPR.

Click on the “Change Privacy Settings” button (finger icon) located in the bottom-left corner of every page. You can also clear cookies through Your browser settings. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

Please refer to Section 2 – Contact Information. For more information about Flickr, visit Flickr Privacy.

WooCommerce provides shopping-cart, checkout, customer-account, order-management, and product-delivery functionality where e-commerce is enabled.

Depending on the checkout and account configuration: name, billing and shipping address, email address, telephone number, account credentials, order and download history, IP address, device data, and payment or transaction references. Full payment-card details should normally be processed by the selected payment provider, not stored by WooCommerce.

WooCommerce core is hosted on the Site. Any payment gateway, shipping, tax, email, fraud-prevention, or other extension is a separate service and may transmit data outside the EEA. The applicable provider and safeguard must be identified before activation.

Order and accounting records are retained for the period required by applicable Austrian tax and commercial law. Account data is retained while the account is active, subject to legal-hold and dispute exceptions.

You may manage or delete an account where available, and you may request access, correction, restriction, or erasure by referring to Section 2 – Contact Information. For privacy-setting instructions, please refer to Section 12 – Managing Your Privacy Settings.

Please refer to Section 2 – Contact Information. For plugin documentation, visit WooCommerce Documentation.

WPForms enables contact, registration, survey, quotation, and other forms configured by the Site operator.

The fields You submit, such as name, email address, telephone number, message content, attachments, IP address, user agent, referrer, and timestamp. The exact fields depend on the form.

The WPForms plugin is self-hosted, but configured integrations such as Google reCAPTCHA, Cloudflare Turnstile, payment providers, SMTP services, or marketing platforms may receive data. Please refer to the relevant service section.

Entries are retained only as long as necessary to respond, administer the relationship, establish or defend claims, and satisfy legal obligations. The configured retention period must be checked in WPForms and any connected storage or email system.

Do not submit optional information if You do not wish to provide it. To request access, correction, restriction, or deletion, please refer to Section 2 – Contact Information. For privacy-setting instructions, please refer to Section 12 – Managing Your Privacy Settings.

Please refer to Section 2 – Contact Information. For WPForms information, visit WPForms Privacy Policy.

WPML provides multilingual content, language switching, translated URLs, and related WordPress language functionality.

Language preference, browser language, IP address or approximate location only if a browser-redirection or geolocation feature is enabled, and technical request data. Translation-service features may process content sent for translation.

Core WPML language switching is primarily executed on the Site. Automatic translation, translation-management, license, update, or remote support features may connect to OnTheGoSystems or a selected translation provider, including outside the EEA. The specific feature and provider must be verified before publication.

Language-preference cookies expire according to the configured WPML feature. Translation content and account or license records are retained according to the relevant Site and provider retention settings.

Select a language manually, disable browser redirection, or delete the language cookie through Your browser. For data-rights requests, please refer to Section 2 – Contact Information. For privacy-setting instructions, please refer to Section 12 – Managing Your Privacy Settings.

Please refer to Section 2 – Contact Information. For provider information, visit WPML Privacy Policy and GDPR Compliance.

Vimeo hosts and delivers embedded video content on the Site.

IP address, browser and device information, referrer URL, playback interactions, and viewing preferences. Vimeo may associate viewing activity with a Vimeo account if You are signed in.

Embedded Vimeo content causes the browser to connect to Vimeo. Data may be processed in the United States or other countries under Vimeo’s documented safeguards.

Vimeo retains data according to its privacy and retention policies and the configuration of the embedded player.

Click “Change Privacy Settings” (finger icon, bottom-left) and disable the relevant category before Vimeo is loaded. For further instructions, please refer to Section 12 – Managing Your Privacy Settings.

Please refer to Section 2 – Contact Information. For provider information, visit Vimeo Privacy Policy.

Turnstile helps protect forms and other interactive features against automated abuse and bots. It evaluates signals for security and bot detection; it is not used by Us to identify or advertise to visitors.

Cloudflare states that Turnstile may process client IP address, TLS fingerprint, user-agent header, sitekey, associated origin, challenge timestamp, hostname, action, and security signals. The Site may also send a remote IP address for server-side validation if configured.

Turnstile loads Cloudflare resources and may send signals to Cloudflare. Cloudflare states that transfers from the EEA may rely on the EU-U.S. Data Privacy Framework, the UK Extension, the Swiss-U.S. DPF, or Standard Contractual Clauses with supplementary measures, as applicable.

Turnstile tokens expire after five minutes and may be validated only once. Other signals and records are retained according to Cloudflare’s Turnstile Addendum and applicable customer configuration.

Turnstile may be necessary to protect forms and therefore may not be disabled while using the protected feature. You may use an alternative contact method where available. For privacy controls and rights, please refer to Section 12 – Managing Your Privacy Settings and Section 2 – Contact Information.

Please refer to Section 2 – Contact Information. For provider information, visit Cloudflare Turnstile Privacy Addendum and Cloudflare’s DPO contact.

Google Analytics 4 measures how visitors use the Site, including page views, events, approximate location, device and browser information, and campaign attribution. We must not send directly identifying information or special-category data to Google Analytics.

Online identifiers, cookie or client identifiers, IP-derived approximate location, device and browser information, page URL and referrer, event data, language, screen information, and campaign parameters. Google Analytics prohibits customers from sending personally identifiable information.

Google Analytics loads Google measurement resources and transmits measurement data to Google. Google may process data in the United States and elsewhere. The configured implementation should use consent mode and privacy controls appropriate to the Site, including disabling Google signals and advertising personalization unless separately consented.

Google Analytics user-level and event-level retention is configurable. Google Analytics 4 properties generally allow two or fourteen months for user and event data, with longer options for certain Analytics 360 properties. Aggregated standard reports are not necessarily affected by this setting. The retention setting configured for this Site must be verified and recorded.

Click “Change Privacy Settings” (finger icon, bottom-left) and disable Statistics or Analytics consent. You may also use Google’s Analytics opt-out browser add-on or delete Site cookies. For detailed instructions, please refer to Section 12 – Managing Your Privacy Settings.

Please refer to Section 2 – Contact Information. For Google’s documentation, visit Safeguarding your data in Google Analytics, Google Analytics privacy controls, and Google Analytics data retention.

We engage third-party service providers to assist Us in managing and improving Our website. These providers may process or store personal data as part of providing these services. We ensure that these third-party service providers adhere to the same privacy and security standards as Us and only share Your personal data with them to the extent necessary for them to provide the respective services. We have Data Processing Agreements (DPAs) in place with these providers as required by Article 28 of the GDPR.

These third parties include:

• Web hosting and IT service providers
• Website analytics and tracking service providers
• Content delivery networks
• Security service providers
• Communication and email service providers

We use Hetzner Online GmbH to store, maintain, and deliver Our website content to visitors. This service is essential for making Our website accessible on the internet.

IP addresses, date and time of requests, browser type, operating system, referring URLs, files accessed, form submissions, database content, and server logs. All data is processed on servers located in Germany (EEA).

Server logs retained for up to 14 days. User data retained according to the purposes described in this Policy.

ISO 27001 certified data centers, network security, firewalls, intrusion detection, regular updates, backups, access controls, and SSL/TLS encryption.

Please refer to Section 2 – Contact Information. For more information about Hetzner’s data processing, visit Hetzner Privacy Policy.

The security of Your personal data is of paramount importance to Us. We have implemented comprehensive technical and organisational measures in accordance with Article 32 of the GDPR. These measures include:

• Encryption: SSL/TLS encryption for data in transit
• Access controls: Strict authentication and authorization mechanisms
• Regular security assessments: Periodic audits, vulnerability scans, and penetration tests
• Staff training: Regular data protection training for employees
• Data minimization: Collecting only necessary personal data
• Backup procedures: Regular backups for disaster recovery
• Incident response plan: Procedures to detect, report, and investigate breaches

SSL (Secure Socket Layer) encryption establishes an encrypted link between Our web server and Your browser, ensuring that all data transmitted remains private and integral. This complies with Article 32 of the GDPR. You can verify this by checking for the padlock icon and “https://” prefix in Your browser’s address bar.

If We become aware of a personal data breach that is likely to result in a risk to Your rights and freedoms, We will act promptly in accordance with Articles 33 and 34 of the GDPR. Our breach notification process includes:

• Breach identification and containment: Immediate steps to identify and contain the breach
• Impact assessment: Assessment of nature, scope, and potential consequences
• Notification to supervisory authority: Within 72 hours to the Austrian Data Protection Authority
• Notification to affected individuals: Without undue delay if high risk to rights and freedoms
• Documentation: Full documentation of all breaches and remedial actions

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law:

• Account data: As long as account is active, plus a reasonable period afterward
• Communication data: Up to 3 years from last interaction
• Transaction data: 7-10 years for tax and accounting requirements
• Consent records: As long as data is processed based on that consent, plus additional period for compliance
• Log data: 30-90 days for security and performance analysis

At the end of the retention period, personal data is securely deleted or anonymized. You have the right to request deletion in certain circumstances, as described in Section 4.3 – Right to Erasure.

We reserve the right to modify this Privacy Policy at any time to reflect changes in Our practices, services, or legal requirements. When We make substantial changes, We will notify You through a prominently displayed notice on Our website before the changes take effect. The date of the last update is clearly indicated at the top of this Policy. We encourage You to review this Policy regularly. If You have questions or concerns about changes, please refer to Section 2 – Contact Information.

This section provides a comprehensive guide to managing Your privacy settings across different tools and platforms. Instead of repeating these instructions in every service section, We centralize them here for Your convenience.

Our website features a dedicated privacy management interface accessible from every page:

• Location: Look for the finger icon in the bottom-left corner of every page.
• Action: Click the “Change Privacy Settings” button to open the consent management interface.
• Options: You can individually enable or disable cookie categories: Essential, Functional, Statistics, and Marketing.
• Withdrawal: You can withdraw Your consent at any time by deselecting previously accepted categories and saving Your preferences.
• Persistence: Your preferences are stored for 12 months, after which You will be prompted again.

Most browsers allow You to refuse cookies, delete existing cookies, and control site data. Here are detailed instructions for popular browsers:

1. Click the three dots (⋮) in the upper right corner
2. Select “Settings”
3. Under “Privacy and security,” click “Cookies and other site data”
4. Choose Your preferred setting: “Allow all cookies,” “Block third-party cookies,” “Block all cookies,” or “Block third-party cookies in Incognito mode”
5. You can also clear existing cookies by clicking “Clear browsing data”

Chrome Official Documentation

1. Click the menu button (☰) in the upper right corner
2. Select “Settings”
3. Select “Privacy & Security” from the left menu
4. Under “Enhanced Tracking Protection,” choose Standard, Strict, or Custom
5. Under “Cookies and Site Data,” adjust Your preferences or clear data

Firefox Official Documentation

1. Click the three dots (⋯) in the upper right corner
2. Select “Settings”
3. Click “Cookies and site permissions”
4. Under “Cookies and data stored,” manage Your preferences
5. Toggle “Block third-party cookies” or clear existing cookies

Edge Official Documentation

1. Click “Safari” in the menu bar
2. Select “Preferences” (or “Settings” on macOS Ventura+)
3. Click the “Privacy” tab
4. Adjust cookie preferences: “Prevent cross-site tracking,” “Block all cookies”
5. Manage privacy report and website data

Safari Official Documentation

1. Click the “O” menu (top-left) or “Settings” via the sidebar
2. Select “Settings” then “Privacy & security”
3. Under “Cookies and other site data,” adjust Your preferences
4. Use “Clear browsing data” to remove existing cookies

Opera Official Documentation

1. Click the menu (☰) in the upper right corner
2. Select “Settings”
3. Under “Shields,” adjust global privacy controls
4. Under “Privacy and security,” manage cookies and site data
5. Brave’s built-in Shields block trackers and ads by default

Brave Official Documentation

1. Click “Vivaldi” menu (top-left) then “Settings”
2. Select “Privacy” from the left panel
3. Under “Cookies,” adjust Your preferences
4. Use the “Clear browsing data” button to remove cookies

Vivaldi Official Documentation

1. Click “Arc” in the menu bar then “Settings”
2. Select “Privacy” from the sidebar
3. Manage cookie preferences and tracking protection
4. Arc uses Chrome’s underlying engine, so cookie settings work similarly

Arc Official Documentation

1. Click the shield icon in the address bar
2. DuckDuckGo automatically blocks third-party trackers and cookies
3. Access “Settings” then “Privacy” for granular controls
4. Use the “Fire Button” to clear all data with one click

DuckDuckGo Official Documentation

The following browser extensions can help You enhance Your privacy online:

For users who want additional privacy protection, the following advanced tools are recommended:

Please note that using some of these advanced tools may affect website functionality. We recommend starting with Our built-in “Change Privacy Settings” button (finger icon, bottom-left corner) before installing additional tools.

Thank you for taking the time to read Our Privacy Policy. We are committed to protecting Your privacy and maintaining the security of Your personal information. We believe in transparency and aim to empower You with knowledge about Your data and Your rights. If You have any questions, concerns, or feedback about Our Privacy Policy or data practices, please refer to Section 2 – Contact Information. We value Your input and are committed to addressing any privacy-related inquiries promptly and thoroughly.

This Privacy Policy was created by graphicatelier for use on www.graphicatelier.com. Reproduction, even in part, is prohibited without the author’s authorization under Directive (EU) 2019/790 on copyright and related rights in the Digital Single Market.

And finally, if you’ve made it this far, congratulations! You are among the few people who read privacy policies to the end. Your dedication to understanding how your personal data is handled is commendable. Thank you for your attention and for trusting us with your information.