Privacy policy.

General information

The following notes give you an overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. The sections below set this out in detail.

Who is responsible?

Data processing on this website is carried out by the website operator. You will find the contact details in the section “Information on the controller” and in the imprint.

How do we collect your data?

Partly because you tell us — for instance in a form on this website. Beyond that, our web server automatically records technical data whenever a page is requested, such as browser, operating system and the time of the request.

What do we use your data for?

To deliver the website reliably and to handle your enquiry or appointment booking. We do not build user profiles, we do not track you across other websites, and we do not pass your data on for advertising purposes.

What rights do you have?

You have the right at any time to free information about the origin, recipients and purpose of your stored data, to rectification and erasure, to restriction of processing, to data portability, to object to processing, and to lodge a complaint with a supervisory authority. You may withdraw consent you have given at any time. Details follow below; you are welcome to contact us about any of this.

Strato

We host the content of this website with Strato AG, Otto-Ostrowski-Strasse 7, 10249 Berlin, Germany (“Strato”). When you visit our website, Strato records various log files including your IP address. The servers are located in Germany. For details see the Strato privacy policy.

Strato is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the reliable provision of this website.

We have concluded a data processing agreement (DPA) with Strato. It ensures that Strato processes our visitors' personal data only on our instructions and in compliance with the GDPR.

Data protection

We take the protection of your personal data seriously and treat it confidentially, in accordance with statutory provisions and this privacy policy. Please note that data transmission over the internet — for example when communicating by email — can have security gaps. Complete protection against access by third parties is not possible.

Information on the controller

The controller for data processing on this website is:

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Storage period

Unless a more specific storage period is stated in this policy, your personal data remains with us until the purpose of processing no longer applies. If you make a legitimate request for erasure or withdraw your consent, your data will be deleted unless we have other legally permissible grounds for storing it — such as retention periods under tax or commercial law. In that case we delete the data once those grounds cease to apply.

Legal bases for processing

Where you have consented to processing, we process your data on the basis of Art. 6(1)(a) GDPR. Where you have consented to information being stored on your device or accessed from it, processing is additionally based on Section 25(1) TDDDG. Consent may be withdrawn at any time. Where your data is required to perform a contract or to take pre-contractual steps, we process it on the basis of Art. 6(1)(b) GDPR. Where it is required to fulfil a legal obligation, on the basis of Art. 6(1)(c) GDPR. Otherwise, processing may be based on our legitimate interest under Art. 6(1)(f) GDPR. The basis that applies in each case is stated in the relevant section.

Recipients of personal data

We pass personal data on to external parties only where this is necessary to perform a contract, where we are legally obliged to do so, where we have a legitimate interest under Art. 6(1)(f) GDPR, or where another legal basis permits it. Where we use processors, we do so only on the basis of a valid data processing agreement. The parties involved are named in the sections on hosting, appointment booking and web analytics.

Withdrawal of your consent

Many processing operations are only possible with your express consent. You may withdraw consent already given at any time. The lawfulness of processing carried out before withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right at any time to object, on grounds relating to your particular situation, to the processing of your personal data; this also applies to profiling based on those provisions. The respective legal basis is set out in this privacy policy. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims (objection under Art. 21(1) GDPR).

If your personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such purposes; this also applies to profiling insofar as it is connected with such direct marketing. If you object, your personal data will no longer be used for direct marketing (objection under Art. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority competent for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany. This right exists without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request direct transfer to another controller, this will only be done where technically feasible.

Information, rectification and erasure

Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of processing, and where applicable a right to rectification or erasure. You are welcome to contact us about this at any time.

Right to restriction of processing

You have the right to request the restriction of processing of your personal data. This right applies in the following cases:

• If you contest the accuracy of the data we hold about you, we usually need time to verify it. For the duration of that check you may request restriction.
• If the processing was or is unlawful, you may request restriction instead of erasure.
• If we no longer need your data but you need it to establish, exercise or defend legal claims, you may request restriction instead of erasure.
• If you have objected under Art. 21(1) GDPR, your interests and ours must be weighed against each other. For as long as it is not clear whose interests prevail, you may request restriction.

If you have restricted processing, the data may — apart from being stored — only be processed with your consent, to establish, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest.

SSL/TLS encryption

For security reasons and to protect confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser address bar starting with “https://” and showing a padlock symbol. When encryption is active, the data you send us cannot be read by third parties.

Objection to advertising emails

We hereby object to the use of contact data published under our statutory imprint obligation for sending advertising and information material that has not been expressly requested. We expressly reserve the right to take legal action in the event of unsolicited advertising, for example by spam email.

Cookies

This website sets only technically necessary cookies. There are no advertising, marketing or recognition cookies, and none of the cookies used comes from a third party.

• wire — session cookie of the ProcessWire content management system. It keeps your session together and protects forms against cross-site request forgery. It is deleted when you close your browser.
• ea_session and csrf_cookie — session and security cookies of the appointment system. They are only created if you open the appointment system at “/termine-app/” directly, for example via the reschedule or cancel link in your confirmation email. Lifetime: seven days and two hours respectively.

These cookies are strictly necessary for the operation of the website and for the functions you have requested. They are stored without consent on the basis of Section 25(2) no. 2 TDDDG; the associated data processing is based on Art. 6(1)(f) GDPR. You can configure your browser to inform you about cookies or to reject them generally. If you reject them, forms and appointment booking will no longer work.

None of these three cookies require consent. That is why this website has neither a cookie banner nor any consent management: there would be nothing for such a switch to switch.

Server log files

The provider of this website automatically collects and stores information in server log files which your browser transmits automatically:

• browser type and version
• operating system used
• referrer URL
• host name of the accessing computer
• time of the server request
• IP address

This data is not merged with other data sources. It is collected on the basis of Art. 6(1)(f) GDPR: we have a legitimate interest in the technically correct presentation and the security of this website.

Enquiry and order form

The form on the Order page lets you make a non-binding enquiry about bespoke work, an alteration or leather samples. We process the details you enter yourself: category, a description of your project, where applicable your size and measurements, first name, email address, optionally a phone number, the chosen language, and up to three reference images.

Your enquiry is delivered by email to our mailbox only; a copy is sent to the address you provided as an acknowledgement of receipt. We do not build a customer database on the website. Uploaded reference images are deleted from the web server immediately after sending and then exist only as an email attachment.

Processing is based on Art. 6(1)(b) GDPR where your enquiry relates to the initiation or performance of a contract. In all other cases it is based on our legitimate interest in handling enquiries addressed to us (Art. 6(1)(f) GDPR). The data remains with us until you ask us to delete it or the purpose ceases to apply — for example once your enquiry has been dealt with. Mandatory statutory retention periods remain unaffected.

Enquiries by email or telephone

If you contact us by email or telephone, your enquiry including all personal data arising from it will be stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent.

Processing is based on Art. 6(1)(b) GDPR where your enquiry relates to the initiation or performance of a contract, and otherwise on Art. 6(1)(f) GDPR. The data remains with us until you ask us to delete it or the purpose ceases to apply. Mandatory statutory retention periods remain unaffected.

Job applications by email

You apply for advertised positions by email to bewerbung@tysk.berlin. There is no application form on this website. We process the data you send us — usually contact details, CV, references and a covering letter — solely to carry out the application procedure.

The legal basis is Section 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR: the processing is necessary for the decision on entering into an employment relationship. If you voluntarily send us special categories of personal data within the meaning of Art. 9(1) GDPR — such as information about a disability — processing is additionally based on Art. 9(2)(b) GDPR and Section 26(3) BDSG.

If no employment relationship comes about, we delete your application documents no later than six months after the procedure has ended. This period allows us to examine and defend against any claims under the German General Equal Treatment Act; the basis for this is our legitimate interest under Art. 6(1)(f) GDPR. If you would like us to keep your documents beyond that for future positions, we need your express consent, which you may withdraw at any time.

Booking via this website

We use Easy!Appointments, an open-source appointment system, for scheduling. It runs on the same server as this website, under the same address in the “/termine-app/” directory. It is not an external booking service; your data leaves our server only in the cases described below.

When you book, we process the details you enter in the form: first name, email address, optionally a phone number, optionally a short description of your project, the chosen language, and the appointment type you selected with its date and time. We store this data in the appointment system's database so that we can carry out the appointment and so that you can reschedule or cancel it yourself.

After booking you receive a confirmation by email containing personal links to reschedule and to cancel. We receive a notification in our own mailbox.

Processing is based on Art. 6(1)(b) GDPR, as it is necessary to carry out the appointment you requested. We store appointment data for as long as is necessary for carrying out and following up the appointment and for complying with statutory retention periods.

Synchronisation with our appointment calendar

To prevent an appointment from being booked twice, the appointment system synchronises appointments with our own appointment calendar in both directions. That calendar is held on a Nextcloud installation operated for us by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. We have concluded a data processing agreement with Hetzner under Art. 28 GDPR.

When an appointment is booked, rescheduled or cancelled, the appointment system transmits to that calendar: the name of the appointment type, date, time and duration, the location, the details you entered about your project, and the names and email addresses of the people involved — ours and yours. In the other direction, the appointment system reads from the calendar only which periods are already occupied.

The transfer is necessary to carry out the appointment you requested and is based on Art. 6(1)(b) GDPR. No data is transferred to a country outside the European Union. For details see the Hetzner privacy policy.

If you would prefer to avoid this transfer, please arrange your appointment directly by email or by telephone. Booking via this website is voluntary.

For completeness, because these questions come up regularly:

• No external fonts. All fonts are hosted on our own server. No connection is made to Google Fonts or any other font service.
• No embedded map. The location map on the Studio page is a graphic on our server, not an embedded mapping service. You only leave this website when you click the route-planning link.
• No social media embeds. References to social networks are plain links. No content, tracking pixels or buttons are loaded from them; a connection is only made when you click the link.
• No newsletter, no advertising networks, no third-party tracking. We do not send a newsletter and do not embed any advertising, remarketing or tracking services.