Privacy policy

1. Controller and contact

Nando Patera · Patera Violins, Richthofenstr. 29, 31137 Hildesheim, Germany; info@pateraviolins.de; telephone +49 173 9026166. Contact us here with privacy questions or requests to exercise your rights.

2. Website, hosting and security

The website is provided through OpenAI Sites, using Cloudflare infrastructure for delivery, database and file storage. Necessary connection data includes IP address, time, requested address, browser, operating system, referrer and technical errors. Processing supports operation, delivery, troubleshooting and attack prevention under Art. 6(1)(f) GDPR; our legitimate interest is a working and secure website.

Form protection uses shortened hash values derived from IP address and browser information, together with a time window and request counter. These are pseudonymous security data, not anonymous data. They support limited protection windows; expired counters are removed during cleanup. Administrative actions may be logged with administrator identity, time, action and affected record.

Recipients include OpenAI as platform provider and infrastructure/storage providers, particularly Cloudflare. Some content or product images may also come from Cloudinary or Vercel, whose providers receive necessary connection data. Fonts are served by this website. Processing is not necessarily limited to Germany or the EU; see section 11.

3. Cookies, browser storage and choices

The selected language is retained in the “patera_lang” cookie for up to twelve months; your privacy choice is retained in local browser storage for up to twelve months. Session information controls, among other things, the once-per-session brand introduction. During PayPal checkout, the reference, upload authorisation and amount are temporarily placed in session storage so the payment can be matched on return. Dealer and administrator areas use authentication/session mechanisms; the B2B session cookie lasts at most 30 days. Do not share payment-return or upload authorisations.

Storage/access strictly necessary for a service you request relies on section 25(2)(2) German TDDDG; related personal-data processing relies on Art. 6(1)(b) or (f) GDPR. Optional analytics requires consent. Reopen the privacy settings in the footer to change your choice for the future without losing necessary website functions.

4. Optional audience measurement

Only after you allow analytics does the website send its own measurement requests. Aggregated data comprises day, page path/title, source category, device type and language. These analytics records contain no IP addresses or names; no analytics cookie or individual visitor profile is used. Infrastructure connection data described in section 2 is separate from this analytics data.

The basis is consent under Art. 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG. During analytics cleanup, aggregated measurement records older than 730 days are deleted. Withdrawing consent stops future measurement requests without affecting the lawfulness of previous processing.

5. Contact and confidential marketplace enquiries

We process your name, email, optional phone number, preferred contact channel, message and instrument information; sale enquiries may include location, asking price and photographs. Records are stored in the protected administration area and are not published as listings.

The purpose is to respond personally, review enquiries and potentially enter a contract, under Art. 6(1)(b) GDPR. General business enquiries rely on our legitimate interest in appropriate communication under Art. 6(1)(f). Acknowledging the privacy notice is not marketing consent. Personal contact data or documents identifying you are not disclosed to prospects or intermediaries without prior agreement. Please avoid unnecessary third-party personal information.

If you choose WhatsApp or open a WhatsApp link, WhatsApp Ireland Limited is involved as a separate provider; phone, communication and connection data may be processed outside the EEA. Email or telephone remain available alternatives. Social links connect to the respective service only when activated.

6. Identification orders, contractual records and withdrawal

For identification we process contact details, billing address (street/house number, postal code, city, country and optional company), instrument quantity and details, messages, photographs assigned to each instrument, chosen contact channel, payment method/status and reference. We also retain the agreed price, version and content of contractual information, the acknowledgement time and your early-performance choice. Photographs are personally assessed and are not published. Attribution is not exclusively automated.

The withdrawal function records your name, identifying contract information, confirmation email, declaration, reference and time of receipt. We handle the withdrawal and send acknowledgement. No account, reason or identity document is required.

The bases are Art. 6(1)(b) GDPR for the contract, Art. 6(1)(c) for statutory information, confirmation and retention obligations, and Art. 6(1)(f) for necessary evidence and legal claims. Requesting early performance is not privacy consent for additional purposes.

7. PayPal and bank transfers

PayPal payment uses an externally hosted checkout. PayPal receives the amount, currency, service description, order reference and return address. You enter payment credentials with PayPal. We retain payment-order and transaction identifiers, amount and status to verify receipt and avoid duplicate charges. This website does not collect complete card or PayPal login details.

For EEA customers the provider is generally PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, acting as an independent controller; other PayPal entities may apply by country. Its security checks and international processing are explained at https://www.paypal.com/de/legalhub/paypal/privacy-full.

For bank transfers we process booking information supplied by banks, including payer, amount, reference and, where supplied, account details. The bases are Art. 6(1)(b) GDPR and Art. 6(1)(c) for required tax/commercial records.

8. Emails and newsletters through Brevo

Receipt, order and withdrawal confirmations and internal notifications are delivered through Brevo (Sendinblue). Necessary data includes recipient email, name, message, reference, time and delivery status. Limited technical error records support retries. A failed email does not remove a stored order or withdrawal. These are transactional messages, not newsletters, and rely on the relevant enquiry/contract purpose or statutory confirmation duty.

Newsletters require a separate signup and email-link confirmation (double opt-in). We process email, language, chosen topics, signup source/time, consent evidence and confirmation/unsubscribe status under Art. 6(1)(a) GDPR. Unsubscribe through an email link or by contacting us. Necessary consent or suppression evidence may remain for legal defence or to avoid further messages.

Brevo receives necessary delivery data and technical delivery information. No Brevo visitor tracker is embedded on this website. Provider information: https://www.brevo.com/de/legal/privacypolicy/. Delivery/bounce records are distinct from any opening or click measurement by the delivery provider; website forms are not used to obtain consent to personal advertising profiles.

9. Dealer area and auction account

Registration and use involve company and business contact information, address, country, VAT ID where relevant, language, approval status, enquiries and authentication records. Passwords are not stored in plain text. Time-limited verification/reset links protect accounts. Non-German EU VAT numbers may be checked through VIES with the European Commission and national tax authorities; the result, time and available reference are retained.

The purposes are verifying business status, protecting access and facilitating business relationships under Art. 6(1)(b) and (f) GDPR, and applicable tax-record duties under (c). Approval is personal. Accounts can be deleted or suspended on request, subject to statutory retention of business records.

For an auction account, we use the account identifier and email address supplied by the sign-in service, or the identifier of an existing signed-in dealer account. New auction customers sign in through ChatGPT; Patera Violins does not collect an additional password. We also store name, telephone number, address, account type and, where applicable, company name, together with registration time, acknowledgement of the information and the personally assigned approval status. Changes to contact details are reviewed again.

For auction administration, we store bid amount, time, reference, the accepted version of the lot conditions, total amount and the contact details valid at the time of bidding. Customers can see their own bids in their account. Other visitors do not receive bidder names or contact details. The administrator can review bids for verification and fulfilment. Registration does not subscribe customers to a newsletter. The purposes and legal bases for entering into contracts and retaining evidence, and the general information on retention and rights, apply accordingly.

10. External videos and content

YouTube players load only after your active choice. Google/YouTube then receives connection and usage data and may use storage technologies, including processing in third countries. Loading the player relies on consent under Art. 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG. The website is usable without it. Reloading or leaving the page ends loaded connections but cannot retrieve data already sent to the provider.

Google-review, Instagram, Facebook and other external destinations are links. The respective provider’s information also applies after you open them. Displayed review text alone does not require a Google login.

11. Recipients and international processing

Only people and providers needed for handling and operation receive access. In addition to hosting, storage and delivery services, recipients may include banks/payment services, tax or legal advisers and authorities where necessary. Processing on our behalf is governed by Art. 28 GDPR; independent controllers act under their own legal responsibilities.

OpenAI, Cloudflare, Brevo, PayPal and external-content providers may use international infrastructure and subprocessors. Transfers outside the EEA are governed by Arts. 44 et seq. GDPR, including an applicable adequacy decision or suitable safeguards such as EU Standard Contractual Clauses and necessary supplementary measures. We do not make a blanket promise of German-only or EU-only storage. Request details of the recipients and safeguards applicable to your data at info@pateraviolins.de.

Further provider information: https://help.openai.com/en/articles/20001340-complying-with-data-protection-laws-for-chatgpt-sites · https://www.cloudflare.com/privacypolicy/ · https://cloudinary.com/privacy · https://vercel.com/legal/privacy-policy.

12. Retention

Data is retained for its purpose. Enquiries and related photographs are deleted after communication is complete and no further matching or evidential purpose remains, unless legal obligations or specific claims require retention. For order photographs and working material, the criteria are performance, outstanding questions and possible service-related claims. A hypothetical future use does not justify indefinite storage.

Statutory tax/commercial periods apply to the relevant records: generally eight years for accounting vouchers, six for commercial correspondence and ten for books and specified records, with the statutory starting rules. Other contract/claim evidence is retained only for the necessary legal-claim period. Proceedings or special rules can require longer periods. These periods do not automatically apply to every uploaded photograph.

Newsletter data is processed until unsubscribe or expiry of its purpose; necessary consent/suppression evidence is limited to that purpose. Browser and analytics periods are stated above.

13. Rights and required information

Subject to the law you have rights of access, rectification, erasure, restriction and portability under Arts. 15–20 GDPR. You may withdraw consent for the future without affecting prior lawful processing. Contact info@pateraviolins.de; proportionate identity-verification questions may be necessary.

Objection: you may object on grounds relating to your particular situation to processing based on Art. 6(1)(f), under Art. 21 GDPR. You may object at any time without giving reasons to direct marketing and related profiling.

Required fields are needed for the requested enquiry, contract, payment matching or account check; without them the relevant function cannot be performed. Optional data is voluntary. Patera Violins does not make solely automated decisions, including profiling, with legal or similarly significant effects.

You may complain to a supervisory authority, particularly where you live or work or where an alleged infringement occurred. Our relevant authority is the State Commissioner for Data Protection of Lower Saxony: https://www.lfd.niedersachsen.de/.