PRIVACY.

1. Controller

The operator of Buddy’s Art is responsible for processing personal data on this website:

You can also use these contact details for privacy questions and to exercise your rights. Further provider details are available in the Legal notice.

2. Website and hosting

When you visit, our server processes your IP address, the requested page or file, the time and technical information sent by your browser, such as browser type, operating system and, where applicable, the previously visited page. This is necessary to deliver the website, secure connections and deal with faults. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of this art offering.

The website, its PostgreSQL database and private reference files are hosted on a server provided by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The server is located in Falkenstein, Germany. Hetzner provides the hosting infrastructure and may process data as part of technical operations. Information from the provider is available at Data protection at Hetzner.

Continuous HTTP access logging is not enabled for this website. The short-lived, pseudonymised request counters described below are used to prevent abuse. Fonts, images and locally hosted videos are served by the website server; no connection to Google Fonts is made to load fonts.

3. Enquiries and reference files

Your enquiry language is stored so we can respond in the appropriate language. Switching the website language uses URLs and does not set an additional language cookie. When you switch during configuration, entries are transferred briefly in this page’s memory only; they are not saved in persistent browser storage for this purpose.

In the configurator, we process your name, email address, selected contact method and, where applicable, phone or WhatsApp number. We also process your project choices, dimensions, colours, mood, budget range, preferred date, free text, personalisation and optional reference files. If you start from an artwork, it is linked as your chosen inspiration. We also store the reference number, submission time, processing status and internal project notes.

We use these details to handle your enquiry, discuss your project personally and prepare a possible offer. The legal basis is Article 6(1)(b) GDPR (steps at your request before entering a contract; performance of a contract if you commission a project). The privacy acknowledgement in the form confirms that you have read the notice; it is not consent to advertising or statistics.

Using the configurator is voluntary. A name, email address and initial art type are required to submit an enquiry. If you choose phone or WhatsApp, the relevant number is also required. An enquiry cannot be submitted without these required details. Reference files and additional project information are optional. There is no online checkout, no collection of payment details and no solely automated decision on accepting or pricing your project under Article 22 GDPR.

Selecting files initially shows a local preview. References are uploaded only when you submit your enquiry. The original file, original filename, file type and file size are stored privately. Original images may contain metadata such as location or capture time; please remove unnecessary metadata before uploading. Authorised Studio users and you, through your protected enquiry access, can access the files. References are not automatically published in the portfolio or sent to an AI service. Please submit only content needed for your project and respect the rights of other people shown in images.

4. Contact methods

When you contact us by email or phone, we process your contact details and the information relating to your request. Article 6(1)(b) GDPR applies to project communications; Article 6(1)(f) GDPR applies to other enquiries, based on our legitimate interest in responding to requests. Automatic email delivery from this website is currently disabled. Enquiries are made available in the protected Studio.

If you explicitly choose WhatsApp as your contact method, we may contact you there about your project. Merely opening the website or selecting this contact method does not connect your browser to WhatsApp. When communication actually takes place, WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, also processes data, particularly your phone number and usage and connection data. WhatsApp uses international infrastructure, including outside the EEA. Information about recipients, retention and transfer safeguards (including adequacy decisions and standard contractual clauses) is explained in the WhatsApp privacy policy. You can choose email or phone instead and change your contact preference at any time.

5. Cookies and storage on your device

Necessary cookies are set only when you use the relevant feature. They secure uploads, your private enquiry view and the Studio login. Storage and access for these purposes rely on section 25(2), point 2, TDDDG. The associated processing of personal data is based on Article 6(1)(b) or (f) GDPR, depending on the feature.

You activate “Remember my selection on this device” yourself in the configurator. Only then is a limited draft stored to provide the restoration you requested (section 25(2), point 2, TDDDG). You can turn this feature off there; the draft is also deleted after a successful submission.

Local Storage has no automatic browser deletion mechanism. Expired drafts are discarded the next time you open the configurator; expired privacy choices are discarded the next time you visit the website. Statistics stay off without renewed consent. You can delete these entries earlier in your browser. Session Storage normally ends with the browser session; your browser may retain it longer when restoring a session.

6. Abuse prevention and Studio access

Before submission, your browser solves a short computational challenge. Verification takes place locally and on our server, without an external CAPTCHA provider. A challenge is valid for ten minutes and can be used only once. We also limit excessive requests. For this purpose, a keyed hash is derived from the IP address and the relevant feature area. The full IP address is not stored in the request counter. The hash is pseudonymised, not anonymous.

Counters generally apply for ten minutes, or one minute for statistics requests. Expired counters, used challenges and expired Studio sessions are removed during daily maintenance. The legal basis is Article 6(1)(f) GDPR: protection against spam, automated abuse and unauthorised access.

Only authorised people can log in to the Studio. Account identifiers, password hashes and temporary session credentials are processed for this purpose. Access to customer data is protected. Logging out revokes the session on the server. The legal basis is likewise the legitimate interest in secure administration (Article 6(1)(f) GDPR).

7. Optional usage and source statistics

Statistics are off by default. Only with your voluntary consent in the banner or settings below do we count page views, portfolio and artwork views, and selected configurator steps: starting, choosing an art type, uploading references, choosing a budget, reaching the contact step and submitting an enquiry. We store daily totals by event type, step and source channel, not full page addresses, free text, images or cross-device advertising IDs.

With separate consent to the source of your enquiry, we determine the channel (for example TikTok, Instagram, Google or direct) from campaign parameters and, where applicable, the referring website. The channel and the utm_source, utm_medium and utm_campaign parameters are stored for your browser session. If you then submit an enquiry, these values, together with the time and version of your consent, are linked to it. This part of the analysis therefore involves personal data. Without consent, source and campaign information is not read, stored for analysis or transmitted with your enquiry; the source is recorded as “Not collected”.

The purposes are to improve usability and content and to understand which channels lead to enquiries. The legal bases are section 25(1) TDDDG and Article 6(1)(a) GDPR. Analysis takes place on our server; no external analytics service is used. Statistics requests also technically involve an IP address, which is processed only for transmission and the abuse prevention described above.

You can withdraw either consent independently, at any time and with future effect, below or through “Privacy settings”. Withdrawing source analysis stops further collection for that purpose and removes the locally stored source. Source details linked to previously submitted enquiries are also removed where your still-valid private enquiry access identifies them with this browser. For enquiries from other devices or without valid access, please contact us with your reference. We can no longer attribute aggregated daily totals to a particular person. A “Do Not Track” signal is respected and prevents optional collection even if you previously consented.

8. Social media and external content

Links to Buddy’s Art on TikTok and Instagram are ordinary external links. Simply visiting our website does not load social media scripts or tracking pixels. You visit the relevant platform only when you open its link; its own privacy policy then applies to its processing of data.

9. Retention and other recipients

Project enquiries and associated references are needed while an enquiry is handled, an offer is discussed or a commissioned project is completed. Once a matter is completed or finally resolved, we review which information is still needed for legal obligations or specific legal claims and delete the rest. Archiving in the Studio alone does not delete data.

For documents actually subject to statutory retention, Article 6(1)(c) GDPR applies together with section 147 AO and, where applicable, section 257 HGB: generally six years for business or commercial correspondence, eight years for accounting vouchers and ten years for books and annual financial statements. The period normally begins at the end of the relevant calendar year. These duties do not apply indiscriminately to all reference images or every unsuccessful enquiry. Data needed in a particular case to establish or defend claims may be retained for that purpose under Article 6(1)(f) GDPR until the applicable limitation period ends; the regular period is three years (sections 195 and 199 BGB).

Uploads linked to unsubmitted enquiries become eligible for deletion after 24 hours and are removed in the next daily maintenance run. Daily statistics totals are deleted in the daily run once they are 90 days old. Linked source information and its consent record are removed from the enquiry in the daily run once they are 90 days old; the enquiry itself is unaffected. Existing daily backups are removed on a rolling basis after about seven days. Deleted data may therefore remain in access-restricted backups until the next backup rotation.

Internally, only people authorised to handle enquiries and provide technical support have access. Where necessary, hosting providers, communication providers when contact actually occurs, and, in individual cases, legally authorised authorities or advisers bound by professional confidentiality may receive data. This does not include publishing your enquiry or references. No transfer to a third country is planned for the self-hosted website and its database. External communication and platform services you use are separate from this.

10. Your rights

Subject to the applicable legal requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with future effect (Article 7(3)). This does not affect processing before withdrawal.

You may also lodge a complaint with a data protection supervisory authority (Article 77 GDPR), particularly in your place of habitual residence, place of work or the place of the alleged infringement. The German Data Protection Conference lists the federal and state supervisory authorities. You do not have to contact us first to lodge a complaint.

This policy relates to the audited operation at buddy.dorfspy.de. Changes to features, providers or processing purposes require a corresponding update.