Privacy policy

DRAFT — to be reviewed before launch.

1. Who is responsible

Thomas Heran, [address], Bremerhaven, Germany — info@thomasheran.com.

2. Visiting this website

The site is hosted by Cloudflare, Inc. (Cloudflare Pages). To deliver the pages, Cloudflare processes technical data such as your IP address, browser and time of request in server logs (Art. 6 (1) (f) GDPR — secure and reliable operation). Cloudflare is certified under the EU–US Data Privacy Framework. We use no cookies, no analytics and no tracking. Fonts are served from our own server.

3. Email

If you write to us, we use your message and address only to answer you (Art. 6 (1) (b) or (f) GDPR). Email is hosted by Google Workspace (Google Ireland Ltd.).

4. Buying a print or booking a masterclass

Payments are handled by Stripe Payments Europe Ltd. (Dublin). Stripe receives your payment and contact details and the delivery address; we receive your name, email, delivery address and order. Prints are produced and shipped by our print partner [Prodigi / Gelato], which receives your name and delivery address for that purpose (Art. 6 (1) (b) GDPR). We keep order data as long as tax law requires (up to 10 years, § 147 AO).

If you subscribe, your email address is stored with MailerLite (UAB MailerLite, Lithuania) and used only to send the newsletter, based on your consent (Art. 6 (1) (a) GDPR). We use double opt-in. Every email has an unsubscribe link; you can withdraw consent at any time.

6. Instagram

We only link to Instagram. No data goes to Meta until you click the link.

7. Your rights

You have the right to access, correction, deletion, restriction, data portability and objection (Art. 15–21 GDPR), and to withdraw consent at any time. You can complain to a supervisory authority, e.g. Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen.