Privacy

Privacy Policy Last updated: June 2026 1. Data Controller The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) and applicable Austrian data protection law is: [Sascha Mayer] [Street and number] [Postal code City] Austria Email: [your@email.com] 2. General Information Protecting your personal data is important to us. Personal data means any information relating to an identified or identifiable natural person. This website is a digital gallery and contact platform for Atelier Nocturne. There is no online shop, no newsletter signup, and no public user registration. We process personal data only to the extent necessary to operate the website, respond to inquiries, or comply with legal obligations. 3. Hosting and Technical Infrastructure This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit the website, technically necessary connection data is processed, including IP address, date and time of access, page requested, browser type, and operating system. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation of the website). The database (Vercel Postgres) and image storage (Vercel Blob Storage) are also operated via Vercel. Images are stored on public storage paths and delivered through the website. For transfers to the USA, Vercel relies on EU Standard Contractual Clauses. Further information: https://vercel.com/legal/privacy-policy 4. Contact Form When you contact us via the contact form, we process the following data: - Name - Email address - Subject - Message - optional: reference to a specific artwork This information is used to handle your inquiry. The data is stored in our database and can be viewed in the admin area. Additionally, a notification email may be sent to us (see section 8). Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures or initiation of communication) and Art. 6(1)(f) GDPR (handling inquiries). Retention: Contact messages are automatically deleted no later than 12 months after submission. You may request earlier deletion at any time. To protect against automated requests (spam), we use an invisible honeypot field and temporary IP-based rate limiting. The IP address is processed only briefly in server memory and is not stored permanently. 5. Visitor Statistics (First-Party Tracking) To evaluate use of this website, we collect statistical information about page views. The following data is processed and stored in our database: - page path visited - optional: reference to an artwork - referring website (referrer host, if available) - approximate country of origin (country code derived from the Vercel geo header) - device type (desktop, tablet, or mobile) - pseudonymised session hash (derived from IP address and date; the IP address itself is not stored) No cookies are set for this tracking. Evaluation takes place exclusively internally in the admin area. We do not use Google Analytics, Google Tag Manager, or comparable third-party tracking. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a data-minimised, anonymised evaluation of website use to improve the offering). Retention: Statistics entries are automatically deleted after 90 days. 6. Cookies This website sets the following cookies — only after your choice in the cookie notice: atelier_consent - Purpose: storing your cookie decision (consent or essential only) - Retention: 1 year - Legal basis: Art. 6(1)(f) GDPR (recording and honouring your decision) atelier_locale - Purpose: storing your language preference (German or English) - Retention: 1 year - Set only after you make a choice in the cookie notice - Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a consistent language choice) In the admin area (/login, /admin), additional session cookies from NextAuth are set. These apply exclusively to internal administration access and not to public visitors. 7. Local Browser Storage (localStorage) On your first visit to the gallery, an entry may be stored in your browser's local storage (key: sa:gallery-intro-v1). It remembers whether a short intro animation has already been shown so it does not appear on every visit. No personal data is transmitted to us in this process. The information remains exclusively on your device. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a pleasant user experience). 8. Email Delivery (Resend) We use Resend (Resend, Inc., USA) to send notification emails for contact inquiries. The data entered in the contact form (name, email, subject, message) is transmitted to Resend to deliver the email. Legal basis: Art. 6(1)(f) GDPR (reliable delivery of contact notifications). Further information: https://resend.com/legal/privacy-policy 9. Fonts The website uses the fonts Fraunces, Newsreader, and JetBrains Mono. These are fetched from Google Fonts via Next.js at build time and served from our server or the Vercel network (self-hosting). No connections to Google servers are made when you visit the website. 10. Google Search Console A meta tag may be placed in the source code to verify ownership in Google Search Console. This tag is used solely for verification and does not set tracking or cookies for visitors. 11. Web Share and Clipboard On artwork detail pages, you can share content via your browser's Web Share API or copy a link to the clipboard. These functions run locally in your browser; no additional data is transmitted to us. 12. No Embedded Third-Party Content The public website does not embed social media plugins, map services, external iframes, or third-party advertising or analytics scripts. 13. Your Rights You have the following rights regarding your personal data: - Access (Art. 15 GDPR) - Rectification (Art. 16 GDPR) - Erasure (Art. 17 GDPR) - Restriction of processing (Art. 18 GDPR) - Data portability (Art. 20 GDPR) - Objection to processing based on legitimate interests (Art. 21 GDPR) To exercise your rights, please contact us at the email address above. 14. Right to Lodge a Complaint You have the right to lodge a complaint with a data protection supervisory authority. In Austria, this is: Austrian Data Protection Authority Barichgasse 40-42 1030 Vienna https://www.dsb.gv.at 15. Changes to This Privacy Policy We reserve the right to update this privacy policy when the website, services used, or legal requirements change. The current version is available on this page.