Privacy policy

1. Controller and contact

Ronnie Nando Patera · Patera Violins, Richthofenstr. 29, 31137 Hildesheim, Germany. Email: info@pateraviolins.de; phone: +49 173 9026166. You can send data-protection questions and requests to exercise your rights to this address. A data protection officer is not legally required and has not been appointed.

2. Website, hosting and security

The website is operated on Cloudflare, Inc. (USA). Cloudflare acts as our processor under Art. 28 GDPR for delivery, computing, database, file storage, image processing and protection against attacks. When pages are requested, technically necessary connection data is processed, in particular IP address, time, requested address, browser, operating system, referrer and technical error data. This data is used for operation, delivery, error analysis and defence against attacks. Technical logs are deleted automatically; application logs normally after no more than seven days, aggregated access and security statistics after no more than 30 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a functioning and secure website.

Form protection uses shortened hash values derived from IP address and browser information, together with a time window and request counter. These are pseudonymous security data, not anonymous data. They support limited protection windows; expired counters are removed during cleanup. Administrative actions may be logged with administrator identity, time, action and affected record. The administration area is additionally protected by sign-in through Cloudflare Access; only the email addresses of authorised administrators are checked.

Some product images are loaded directly from the image service Cloudinary (Cloudinary Ltd., Israel; data centres including in the USA). Cloudinary receives your IP address and the connection data needed for delivery. The legal basis is Art. 6(1)(f) GDPR; our interest is fast and reliable image delivery. Fonts, the photo-guide videos and all other images are delivered by this website itself; external font services such as Google Fonts are not used. See section 11 for processing outside the EU.

3. Cookies, browser storage and choices

The selected language is retained in the “patera_lang” cookie for up to twelve months; your privacy choice is retained in local browser storage for up to twelve months. Session information controls, among other things, the once-per-session brand introduction. During PayPal checkout, the reference, upload authorisation and amount are temporarily placed in session storage so the payment can be matched on return. Dealer and administrator areas use authentication/session mechanisms; the B2B session cookie lasts at most 30 days. Do not share payment-return or upload authorisations.

Storage/access strictly necessary for a service you request relies on section 25(2)(2) German TDDDG; related personal-data processing relies on Art. 6(1)(b) or (f) GDPR. Optional analytics requires consent. Reopen the privacy settings in the footer to change your choice for the future without losing necessary website functions.

4. Optional audience measurement

Only after you allow analytics does the website send its own measurement requests. Aggregated data comprises day, page path/title, source category, device type and language. These analytics records contain no IP addresses or names; no analytics cookie or individual visitor profile is used. Infrastructure connection data described in section 2 is separate from this analytics data.

The basis is consent under Art. 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG. During analytics cleanup, aggregated measurement records older than 730 days are deleted. Withdrawing consent stops future measurement requests without affecting the lawfulness of previous processing.

5. Contact and confidential marketplace enquiries

We process your name, email, optional phone number, preferred contact channel, message and instrument information; sale enquiries may include location, asking price and photographs. Records are stored in the protected administration area and are not published as listings.

The purpose is to respond personally, review enquiries and potentially enter a contract, under Art. 6(1)(b) GDPR. General business enquiries rely on our legitimate interest in appropriate communication under Art. 6(1)(f). Acknowledging the privacy notice is not marketing consent. Personal contact data or documents identifying you are not disclosed to prospects or intermediaries without prior agreement. Please avoid unnecessary third-party personal information.

If you choose WhatsApp or open a WhatsApp link, WhatsApp Ireland Limited is involved as a separate provider; phone, communication and connection data may be processed outside the EEA. Email or telephone remain available alternatives. Social links connect to the respective service only when activated.

6. Identification orders, contractual records and withdrawal

For identification we process contact details, billing address (street/house number, postal code, city, country and optional company), instrument quantity and details, messages, photographs assigned to each instrument, chosen contact channel, payment method/status and reference. We also retain the agreed price, version and content of contractual information, the acknowledgement time and your early-performance choice. Photographs are personally assessed and are not published. Attribution is not exclusively automated.

The guided camera and the photo check for sharpness and brightness run entirely in your browser. The camera requires your permission in the browser, and you can stop it at any time. The camera image is not streamed – only photos you accept are uploaded with the order.

On the status page you can check the progress of an order with its reference and your email address. Both are used only to match the stored order and are not stored again for this purpose.

The withdrawal function records your name, identifying contract information, confirmation email, declaration, reference and time of receipt. We handle the withdrawal and send acknowledgement. No account, reason or identity document is required.

The bases are Art. 6(1)(b) GDPR for the contract, Art. 6(1)(c) for statutory information, confirmation and retention obligations, and Art. 6(1)(f) for necessary evidence and legal claims. Requesting early performance is not privacy consent for additional purposes.

7. PayPal and bank transfers

PayPal payment uses an externally hosted checkout. PayPal receives the amount, currency, service description, order reference and return address. You enter payment credentials with PayPal. We retain payment-order and transaction identifiers, amount and status to verify receipt and avoid duplicate charges. This website does not collect complete card or PayPal login details.

For EEA customers the provider is generally PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, acting as an independent controller; other PayPal entities may apply by country. Its security checks and international processing are explained at https://www.paypal.com/de/legalhub/paypal/privacy-full.

For bank transfers we process booking information supplied by banks, including payer, amount, reference and, where supplied, account details. The bases are Art. 6(1)(b) GDPR and Art. 6(1)(c) for required tax/commercial records.

8. Emails and newsletters through Brevo

Receipt, order and withdrawal confirmations, notices when the status of your identification order changes, and internal notifications are delivered through Brevo (Sendinblue). Necessary data includes recipient email, name, message, reference, time and delivery status. Limited technical error records support retries. A failed email does not remove a stored order or withdrawal. These are transactional messages, not newsletters, and rely on the relevant enquiry/contract purpose or statutory confirmation duty.

Newsletters require a separate signup and email-link confirmation (double opt-in). We process email, language, chosen topics, signup source/time, consent evidence and confirmation/unsubscribe status under Art. 6(1)(a) GDPR. Unsubscribe through an email link or by contacting us. Necessary consent or suppression evidence may remain for legal defence or to avoid further messages.

The provider is Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France, acting as our processor under Art. 28 GDPR. Brevo receives necessary delivery data and technical delivery information. No Brevo visitor tracker is embedded on this website. Provider information: https://www.brevo.com/de/legal/privacypolicy/. Delivery/bounce records are distinct from any opening or click measurement by the delivery provider; website forms are not used to obtain consent to personal advertising profiles.

9. Dealer area and auction account

Registration and use involve company and business contact information, address, country, VAT ID where relevant, language, approval status, enquiries and authentication records. Passwords are not stored in plain text. Time-limited verification/reset links protect accounts. Non-German EU VAT numbers may be checked through VIES with the European Commission and national tax authorities; the result, time and available reference are retained.

The purposes are verifying business status, protecting access and facilitating business relationships under Art. 6(1)(b) and (f) GDPR, and applicable tax-record duties under (c). Approval is personal. Accounts can be deleted or suspended on request, subject to statutory retention of business records.

Auctions are currently in preparation. For an auction account, we use the identifier and email address of a dealer account approved by us; no additional password is collected for this. We also store name, telephone number, address, account type and, where applicable, company name, together with registration time, acknowledgement of the information and the personally assigned approval status. Changes to contact details are reviewed again.

For auction administration, we store bid amount, time, reference, the accepted version of the lot conditions, total amount and the contact details valid at the time of bidding. Customers can see their own bids in their account. Other visitors do not receive bidder names or contact details. The administrator can review bids for verification and fulfilment. Registration does not subscribe customers to a newsletter. The purposes and legal bases for entering into contracts and retaining evidence, and the general information on retention and rights, apply accordingly.

10. External videos, reviews and links

YouTube players load only after your active choice. Google/YouTube then receives connection and usage data and may use storage technologies, including processing in third countries. Loading the player relies on consent under Art. 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG. The website is usable without it. Reloading or leaving the page ends loaded connections but cannot retrieve data already sent to the provider.

On the home page we show selected Google reviews verbatim, together with the name under which the authors published them on Google. The legal basis is Art. 6(1)(f) GDPR; our interest is an authentic presentation of customer experiences. Authors can object to the display at any time, and we will then remove the quote promptly.

Google-review, Instagram, Facebook and other external destinations are links. The respective provider’s information also applies after you open them. Displayed review text alone does not require a Google login.

11. Recipients and processing outside the EU

Only people and providers needed for handling and operation receive access. In addition to hosting, storage and delivery services, recipients may include banks/payment services, tax or legal advisers and authorities where necessary. Processing on our behalf is governed by Art. 28 GDPR; independent controllers act under their own legal responsibilities.

Cloudflare (USA), Cloudinary (Israel and USA) and – only when you use the relevant function – PayPal, YouTube/Google and WhatsApp/Meta may process data outside the European Economic Area. An EU Commission adequacy decision exists for Israel. Cloudflare and Cloudinary are certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision under Art. 45 GDPR; EU Standard Contractual Clauses under Art. 46(2)(c) GDPR are also in place. Brevo is a company based in the EU. We do not make a blanket promise of German-only or EU-only storage. Information on the recipients and safeguards used is available from info@pateraviolins.de.

Further provider information: https://www.cloudflare.com/privacypolicy/ · https://cloudinary.com/privacy · https://www.brevo.com/legal/privacypolicy/ · https://www.paypal.com/de/legalhub/paypal/privacy-full · https://policies.google.com/privacy · https://www.whatsapp.com/legal/privacy-policy-eea.

12. Retention

Data is retained for its purpose. Enquiries and related photographs are deleted after communication is complete and no further matching or evidential purpose remains, unless legal obligations or specific claims require retention. For order photographs and working material, the criteria are performance, outstanding questions and possible service-related claims. A hypothetical future use does not justify indefinite storage.

Statutory tax/commercial periods apply to the relevant records: generally eight years for accounting vouchers, six for commercial correspondence and ten for books and specified records, with the statutory starting rules. Other contract/claim evidence is retained only for the necessary legal-claim period. Proceedings or special rules can require longer periods. These periods do not automatically apply to every uploaded photograph.

Newsletter data is processed until unsubscribe or expiry of its purpose; necessary consent/suppression evidence is limited to that purpose. Browser and analytics periods are stated above.

13. Rights and required information

Subject to the law you have rights of access, rectification, erasure, restriction and portability under Arts. 15–20 GDPR. You may withdraw consent for the future without affecting prior lawful processing. Contact info@pateraviolins.de; proportionate identity-verification questions may be necessary.

Objection: you may object on grounds relating to your particular situation to processing based on Art. 6(1)(f), under Art. 21 GDPR. You may object at any time without giving reasons to direct marketing and related profiling.

Required fields are needed for the requested enquiry, contract, payment matching or account check; without them the relevant function cannot be performed. Optional data is voluntary. Patera Violins does not make solely automated decisions, including profiling, with legal or similarly significant effects.

You may complain to a supervisory authority, particularly where you live or work or where an alleged infringement occurred. Our relevant authority is the State Commissioner for Data Protection of Lower Saxony: https://www.lfd.niedersachsen.de/.