Privacy Policy

1. Privacy at a glance

General information

This privacy policy provides a brief overview of what happens to your personal data when you visit this website. Personal data means any information that can be used to identify you personally. Detailed information about the processing of your data can be found in this privacy policy.

Data collection on this website

Who is responsible for data collection on this website?

The processing of personal data on this website is carried out by the operator of this website. You can find the relevant contact details in the section "Responsible party" of this privacy policy.

How do we collect your data?

Some data is collected because you provide it to us voluntarily. This may happen, for example, when you contact us, place an order, or submit other information through our website.

Other data is collected automatically by our IT systems or processed only after you have given your consent when you visit our website. This includes mainly technical information such as your browser type, operating system, or the time the page was accessed. This data is collected automatically as soon as you visit our website.

How do we use your data?

Some data is processed to ensure the technical operation and proper functioning of our website. Other data may be used to analyse how visitors use our website and to understand user behaviour. If contracts are concluded or prepared through our website, we also process the information you provide to handle enquiries, process orders, and carry out related business activities.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction or deletion of your data. If the processing of your data is based on your consent, you may withdraw that consent at any time with effect for the future. Under certain circumstances, you also have the right to request restriction of the processing of your personal data. In addition, you have the right to lodge a complaint with the competent data protection authority.

If you have questions regarding data protection or the processing of your personal data, you can contact us at any time.

Analytics tools and third-party services

When you visit this website, your use of the website may be statistically analysed. For this purpose, we may use analytics tools provided by third parties.

Further information about the analytics tools and third-party services used on this website can be found in the following sections of this privacy policy.

2. Hosting

The content of our website is hosted by the following provider:

Shopify

The provider is Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter "Shopify").

Shopify provides the technical platform used to create and operate our online shop. When you visit our website, Shopify processes information such as your IP address and details about your device and browser. Shopify may also process technical usage data, visitor statistics, and information about how our shop is used. If you place an order through our website, Shopify processes the data required to complete the purchase, including your name, email address, delivery and billing address, payment information, and other order-related details (such as your phone number if provided).

For analytical purposes, Shopify may use cookies or similar technologies.

Further information can be found in Shopify's privacy policy: https://www.shopify.de/legal/datenschutz .

The use of Shopify is based on Art. 6(1)(f) GDPR. We have a legitimate interest in providing our online shop in a secure, reliable, and technically functional manner. Where consent is requested, processing is additionally based on Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as this concerns the storage of cookies or access to information on the user's device. Consent can be withdrawn at any time.

Data processing agreement

We have entered into a data processing agreement (DPA) with Shopify. This agreement ensures that personal data of our website visitors is processed only according to our instructions and in compliance with applicable data protection regulations.

3. General information and mandatory disclosures

Data protection

We take the protection of your personal data seriously. We treat your personal data confidentially and process it in accordance with applicable data protection laws and this privacy policy.

When you use this website, personal data is processed. Personal data means information that can be used to identify you directly or indirectly. This privacy policy explains what data we collect, why we use it, and the legal basis for such processing.

Please note that data transmission over the internet, for example when communicating by email, may involve security risks. Complete protection of data against access by third parties cannot be guaranteed.

Responsible party

The party responsible for the processing of personal data on this website is:

Sirio Magnabosco
Adalbertstr. 9
10999 Berlin
Germany
Email: hello@spaceistheplace.art

The responsible party is the person or organisation that determines the purposes and means of processing personal data.

Storage period

Unless a specific storage period is stated elsewhere in this privacy policy, we store personal data only for as long as necessary for the purpose for which it is processed. If you request deletion of your data or withdraw your consent, your data will be deleted unless we have legal obligations or other legally permitted reasons that require continued storage. This may include, for example, tax or commercial retention obligations.

Legal basis for data processing

Where you have given consent to the processing of your personal data, processing is based on Art. 6(1)(a) GDPR. Where special categories of personal data are processed, Art. 9(2)(a) GDPR may also apply.

If you have expressly consented to the transfer of personal data to third countries, processing is additionally based on Art. 49(1)(a) GDPR. The storage of cookies or access to information on your device is based, where required, on § 25(1) TDDDG.

If processing your data is necessary for the performance of a contract or for taking steps before entering into a contract, processing is based on Art. 6(1)(b) GDPR. If processing is required to comply with a legal obligation, the legal basis is Art. 6(1)(c) GDPR. Data may also be processed based on our legitimate interests pursuant to Art. 6(1)(f) GDPR.

The specific legal basis applicable to individual processing activities is explained in the relevant sections of this privacy policy.

Recipients of personal data

As part of our business activities, we work with various external service providers. This may require us to share personal data with these providers.

We only share personal data when this is necessary to fulfil a contract, when we are legally required to do so, when we have a legitimate interest in doing so, or when another legal basis permits the transfer.

When we use data processors, personal data is processed on the basis of an appropriate data processing agreement in accordance with the GDPR. Where joint controllership applies, an agreement governing joint responsibility is established.

Some of the service providers we use may process personal data outside the European Union or the European Economic Area. In such cases, we ensure that appropriate safeguards are in place in accordance with GDPR requirements, for example through European Commission adequacy decisions or Standard Contractual Clauses.

Withdrawal of your consent to data processing

Many processing activities are only possible with your consent. You may withdraw any consent you have already given at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)

Where the processing of your personal data is based on Art. 6(1)(e) or (f) GDPR, you have the right to object to such processing at any time for reasons arising from your particular situation. This also applies to profiling based on these provisions. The relevant legal basis for each processing activity can be found in the respective sections of this privacy policy.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing is required for the establishment, exercise, or defence of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object to such processing at any time. This also applies to profiling related to such direct marketing. After you object, your personal data will no longer be used for direct marketing purposes.

Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a data protection supervisory authority. You may submit a complaint, in particular, to the authority in the country of your habitual residence, place of work, or the location of the alleged infringement. Other administrative or judicial remedies remain unaffected.

Right to data portability

You have the right to receive personal data that we process automatically based on your consent or for the performance of a contract in a structured, commonly used, and machine-readable format. Where technically feasible, you may also request that this data be transferred directly to another controller.

Access, correction, and deletion

Within the scope of applicable law, you have the right at any time to obtain free information about your stored personal data, its origin, recipients, and the purpose of processing. You also have the right to request correction or deletion of your data where applicable.

If you have questions about the processing of your personal data, you can contact us at any time.

Right to restriction of processing

Under certain circumstances, you have the right to request restriction of the processing of your personal data. You may contact us at any time for this purpose. This right applies in particular in the following cases:

• If you dispute the accuracy of your personal data stored by us, you may request restriction of processing while we verify the accuracy of the data.
• If the processing of your personal data is unlawful, you may request restriction of processing instead of deletion.
• If we no longer need your personal data, but you require it for the establishment, exercise, or defence of legal claims, you may request restriction of processing instead of deletion.
• If you have objected to processing pursuant to Art. 21(1) GDPR, you may request restriction of processing while we assess whether our legitimate grounds override your interests.

Where processing has been restricted, such data may only be processed, apart from storage, with your consent or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another person or for reasons of important public interest of the European Union or a Member State.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or messages you send to us, this website uses SSL/TLS encryption. You can recognise an encrypted connection when the browser address changes from “http://” to “https://” and a lock symbol appears in your browser.

When SSL/TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Encrypted payment transactions on this website

If you are required to provide payment information after entering into a paid contract, this information is processed exclusively for the purpose of handling the payment.

Payments made using common payment methods are processed through encrypted SSL/TLS connections. You can recognise an encrypted connection by the “https://” address and the lock symbol displayed in your browser.

When communication is encrypted, payment information transmitted to us is protected against access by third parties.

4. Data collection on this website

Cookies

Our website uses cookies. Cookies are small text files stored on your device that do not cause any damage. Some cookies are stored only for the duration of your visit (session cookies), while others remain stored on your device until you delete them or your browser removes them automatically.

Cookies may be set by us (first-party cookies) or by third-party providers (third-party cookies). Third-party cookies may enable the integration of external services, such as payment functions.

Cookies may perform different functions. Some cookies are technically necessary to enable certain website functions, such as the shopping cart. Other cookies are used to analyse website usage or for marketing purposes.

Technically necessary cookies are stored on the basis of Art. 6(1)(f) GDPR unless another legal basis is stated. Our legitimate interest is to provide a technically functional and optimised website. Where we request your consent for cookies or similar technologies, processing is carried out on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time.

You can configure your browser to notify you about the use of cookies, allow cookies only in individual cases, or generally disable cookies. You can also enable automatic deletion of cookies when closing your browser. If cookies are disabled, the functionality of this website may be limited.

Further information about cookies and services used on this website can be found in the relevant sections of this privacy policy.

Consent management with Complianz

Our website uses Complianz to obtain your consent for the use of certain cookies and similar technologies and to document your choices in compliance with data protection requirements. The provider is Complianz B.V., Kalmarweg 14-5, 9723 JG Groningen, Netherlands (hereinafter “Complianz”).

Complianz helps us fulfil the legal requirements regarding obtaining and managing consent for cookies and similar technologies. Complianz stores a cookie in your browser to save your cookie preferences and avoid asking for your consent again unnecessarily.

The stored consent information remains saved until you request its deletion, remove the relevant cookie yourself, or the purpose for storing the information no longer applies. Mandatory legal retention obligations remain unaffected.

Complianz is used to fulfil legal obligations regarding the collection and documentation of consent. The legal basis is Art. 6(1)(c) GDPR.

Contact by email

If you contact us by email, we process the personal data you provide, in particular your name, email address, and the content of your request, in order to handle your enquiry.

We do not share this information with third parties without your consent unless there is a legal obligation or another legal basis permitting such disclosure.

Processing is based on Art. 6(1)(b) GDPR if your enquiry relates to the performance of a contract or pre-contractual measures. In all other cases, processing is based on our legitimate interest in efficiently handling enquiries pursuant to Art. 6(1)(f) GDPR or, where consent is required, on Art. 6(1)(a) GDPR.

The data you provide will be deleted once the purpose of processing no longer applies and no legal retention obligations prevent deletion.

5. Analytics tools and advertising

Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics allows us to analyse how visitors use our website and to better understand how users interact with our pages. This may include information such as visited pages, time spent on the website, devices used, browser information, and the general source of visitors.

Google Analytics uses technologies such as cookies or similar methods to collect and analyse information about the use of our website.

Google Analytics is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time with effect for the future.

The transfer of data to the United States is based on the Standard Contractual Clauses approved by the European Commission and, where applicable, the EU-US Data Privacy Framework.

Further information about Google's privacy practices can be found here: https://business.safety.google/adscontrollerterms/sccs/ .

IP anonymisation

IP anonymisation is enabled in Google Analytics. This means that your IP address is shortened within the European Union or the European Economic Area before further processing. Only in exceptional cases may the full IP address be transmitted to a Google server in the United States and shortened there.

Google processes this information on our behalf in order to evaluate website usage, create reports on website activity, and provide further services related to website usage. According to Google, the IP address transmitted by your browser as part of Google Analytics is not combined with other Google data.

Browser add-on for disabling Google Analytics

You can prevent the collection and processing of your data by Google Analytics by installing Google's browser add-on for disabling Google Analytics:

https://tools.google.com/dlpage/gaoptout?hl=en

Further information about data protection in connection with Google Analytics can be found here:

https://support.google.com/analytics/answer/6004245

Data processing agreement

We have entered into a data processing agreement with Google. This ensures that Google processes personal data only according to our instructions and in compliance with the GDPR.

Google Analytics e-commerce measurement

This website uses Google Analytics e-commerce measurement. This allows us to analyse information relating to orders and purchasing behaviour, such as which products are viewed or purchased and how visitors interact with our online shop.

The analysis of this information helps us better understand the use of our shop and improve our products and services.

Meta Pixel

This website uses the Meta Pixel to analyse visitor actions and measure the effectiveness of our marketing activities on Meta platforms. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The Meta Pixel allows us to understand how visitors interact with our website, for example after arriving through an advertisement on Facebook or Instagram. The information collected helps us measure advertising performance and improve the relevance of our campaigns.

The information collected may include visited pages, actions performed on the website, technical information about the device used, and, where applicable, order and transaction data.

We do not use the collected data to personally identify individual visitors. However, Meta may link this information to an existing Facebook, Instagram, or other Meta account and process it for its own purposes in accordance with Meta's privacy policy.

The Meta Pixel is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time with effect for the future.

Where personal data is collected through the Meta Pixel and transmitted to Meta, we and Meta Platforms Ireland Limited are jointly responsible for this processing pursuant to Art. 26 GDPR. This joint responsibility is limited to the collection and transmission of data to Meta. Any subsequent processing by Meta is carried out under Meta's own responsibility.

Further information about data processing by Meta and your rights can be found in Meta's privacy information:

https://de-de.facebook.com/about/privacy/

The transfer of data to third countries, particularly the United States, takes place based on Standard Contractual Clauses approved by the European Commission or, where applicable, the EU-US Data Privacy Framework.

You can manage the use of your data for personalised advertising by Meta through your Meta account settings:

https://www.facebook.com/adpreferences/

Meta Conversion API

This website uses the Meta Conversion API. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The Meta Conversion API allows us to transmit certain events and interactions from our website to Meta through a server-side connection. This helps us measure, analyse, and optimise the performance of our advertising activities on Facebook and Instagram.

The data processed may include information such as visited pages, times of actions, technical information about the device used, IP address, browser information, and, in the case of purchases, product details, shopping cart value, and currency.

The Meta Conversion API is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time with effect for the future.

Where personal data is transmitted to Meta through the Meta Conversion API, we and Meta Platforms Ireland Limited are jointly responsible for the collection and transmission of this data pursuant to Art. 26 GDPR. Any subsequent processing by Meta is carried out independently according to Meta's privacy practices.

Further information about Meta's processing of personal data can be found here: https://de-de.facebook.com/about/privacy/ .

The transfer of data to third countries takes place based on Standard Contractual Clauses approved by the European Commission or the EU-US Data Privacy Framework where applicable.

Meta Custom Audiences

We use Meta Custom Audiences where applicable to create target groups for our advertising activities on Meta platforms and to display our advertising more effectively.

For this purpose, information about interactions with our website or the use of our services may be processed and transmitted to Meta. Meta may use this information to create target groups or similar audiences (Lookalike Audiences).

Meta Custom Audiences is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time with effect for the future.

Meta may also process transmitted data for its own purposes in accordance with Meta's privacy policy. Further information can be found here: https://de-de.facebook.com/about/privacy/ .

The transfer of personal data to third countries takes place based on appropriate safeguards pursuant to the GDPR, in particular Standard Contractual Clauses approved by the European Commission or the EU-US Data Privacy Framework where applicable.

Pinterest Tag

This website uses the Pinterest Tag to analyse user actions and measure the effectiveness of advertising activities on Pinterest. The provider is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

The Pinterest Tag allows us to record and analyse certain actions performed on our website. The information collected may be used to improve the display of relevant advertising on Pinterest and within the Pinterest advertising network.

The information processed may include, among other things, the Pinterest Tag ID, technical information, the referrer URL, and event data such as product views or purchases.

The Pinterest Tag uses technologies such as cookies or similar methods to record and recognise user actions.

The Pinterest Tag is used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may withdraw your consent at any time.

Further information about Pinterest's privacy practices can be found here: https://policy.pinterest.com/en/privacy-policy .

Product reviews via Judge.me

We use the review service Judge.me to display and manage customer reviews of our products. The provider of this service is Judge.me Ltd, Company number 12157706, c/o Buckworths, 1-3 Worship Street, London EC2A 2AB, United Kingdom.

When you submit a product review, Judge.me processes the information you provide as well as technical data required to manage and display the review. This may include your name, email address, review content, and information related to your order.

The processing of data in connection with product reviews is based on your consent pursuant to Art. 6(1)(a) GDPR, provided that you voluntarily submit a review. You may withdraw your consent at any time with effect for the future.

Further information about Judge.me's privacy practices can be found here: https://judge.me/privacy .

6. Newsletter

Newsletter via Shopify

If you subscribe to our newsletter, we use your email address to send you information about new products, restored works, and updates from our archive.

The newsletter is sent using Shopify. The provider is Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

The processing of your data is based on your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time, for example by using the unsubscribe link included in every newsletter.

After unsubscribing, your data will be deleted unless legal retention obligations or other legitimate reasons require continued storage.

7. E-commerce and payment providers

Processing of customer and contract data

We process customer and contract-related personal data where this is necessary for establishing, carrying out, or modifying contractual relationships. This includes in particular data required to process orders and provide our services.

The processing is based on Art. 6(1)(b) GDPR.

After completion of an order or termination of the business relationship, personal data is deleted once no legal retention obligations or other legally permitted reasons prevent deletion.

Data transfer for orders and shipping

When you place an order through our website, we share the personal data required for processing the order with the relevant service providers. These include payment service providers as well as companies responsible for producing and delivering the ordered products.

Only data necessary for the respective purpose is transferred. Processing takes place for the fulfilment of the contract pursuant to Art. 6(1)(b) GDPR.

Payment processing via Shopify Payments

For payment processing in our online shop, we use Shopify Payments, a payment service provided by Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

When you make a payment through Shopify Payments, Shopify processes the payment and transaction data you provide insofar as this is necessary to process the payment. This may include payment information, transaction details, order information, and technical data.

The processing of this data is carried out for the fulfilment of the contract concluded with you pursuant to Art. 6(1)(b) GDPR.

Further information about Shopify's privacy practices can be found here: https://www.shopify.com/legal/privacy .

Payment processing via PayPal

For certain payment options, we use the payment service PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

When you make a payment through PayPal, the data required for payment processing is transmitted to PayPal. This includes, in particular, payment information, order details, and personal data required to process and secure the payment.

The processing of this data takes place for the fulfilment of the contract concluded with you pursuant to Art. 6(1)(b) GDPR.

Further information about PayPal's privacy practices can be found here: https://www.paypal.com/de/webapps/mpp/ua/privacy-full .

Order processing via production and shipping partner

For the production and shipping of our products, we work with an external production and fulfilment partner. When you place an order, the personal data required for production and delivery is transmitted to this service provider.

This includes, in particular, your name, delivery address, order details, and, where required for shipping purposes, your email address or telephone number.

The transfer of this information takes place exclusively for the purpose of producing and delivering your order.

The processing of this data is necessary for the fulfilment of the contract concluded with you pursuant to Art. 6(1)(b) GDPR.

We work with the following production and shipping partner:

Prodigi (UK) Ltd
Unit 20, Caker Stream Road
Alton, Hampshire, GU34 2QA
United Kingdom