Privacy

PRIVACY NOTICE The controller is CURLYHEAD Media GmbH (Focus Rings), Doblhoffgasse 7 Top 6A, 1010 Vienna, Austria. Privacy enquiries: b.see@focusrings.at. Website operation When you access the website, we process technically necessary connection data, including IP address, time, requested URL, browser information and error data. This enables delivery, abuse prevention and troubleshooting. The legal basis is our legitimate interest in secure operation (Article 6(1)(f) GDPR). We do not use advertising trackers. Fonts and 3D assets are served with the website. Anonymous statistics To see which pages and tools are used, we count page views and a few actions (free downloads, cart additions, checkout starts, shares and print requests). For each day we store only the page path, the domain of the referring website and the country derived from the connection, as totals. We set no cookie and store no IP address, browser details or identifier, so a count cannot be linked to you or to another visit. Obvious bots are not counted. The legal basis is our legitimate interest in improving the website (Article 6(1)(f) GDPR). Cart, orders and files Configurations and your cart are stored locally in your browser. A necessary, protected session cookie associates your orders with your browser and enables downloads; it expires within 90 days. Separate necessary access cookies are used for the private beta and administration. These stores support the functions you request and are not used for advertising. You may delete browser data; access to an order can be restored using its order number and the email address provided. For quotations, contracts and delivery, we process names, email addresses, billing addresses, company and VAT details where applicable, configurations, order items, prices, tax information, consents and payment references (Article 6(1)(b) GDPR). We cannot process a purchase without the required details. Our shop does not receive full card numbers or security codes; these are entered directly with Stripe. For invoicing and tax obligations, we process invoice details, tax location information and, where applicable, VAT validation evidence (Article 6(1)(c) GDPR). The country derived from your connection may be compared with your billing address. Printed parts notifications If you ask to be notified when printed parts can be ordered, we store your email address, your country, the part, any details you add, the time and the wording of your consent. We send one confirmation email; only after you confirm do we keep the request, and we use it solely to email you once when batch orders open and to answer your request. Unconfirmed requests are deleted after seven days. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by email; we then delete your request. Confirmed requests are deleted once we have informed you, or at the latest after 24 months. Contact and withdrawal Messages, withdrawal declarations and fit correction requests are stored to handle them and document receipt. This includes contact details, the declaration, order reference, timestamps and handling notes. The legal bases are contract performance, legal obligations and our legitimate interest in resolving enquiries (Article 6(1)(b), (c) and (f) GDPR). Please send only information needed for your enquiry. Service providers and recipients Vercel provides hosting and file storage; Neon provides PostgreSQL databases. Encrypted database recovery snapshots are stored as private GitHub Actions artifacts for seven days; the decryption key is held separately. Frankfurt is the selected region for application data and files, and Ireland is the selected region for email delivery through Resend. Resend (Plus Five Five, Inc.) processes recipients, message contents, attachments and delivery status for our transactional emails. Open and click tracking are disabled. sevdesk processes customer and document data needed for invoicing and bookkeeping. Stripe Payments Europe Limited and affiliated companies process payment and fraud prevention data; depending on the purpose, Stripe acts as a processor or an independent controller. For EU businesses, VAT IDs are checked through the European Commission's VIES system. Our tax advisers and legally entitled authorities receive data where necessary. We use the providers' data processing agreements. Despite the selected EU regions, support, security and payment processes, and subprocessors, may involve processing outside the EEA. Providers specify safeguards for these transfers, including EU Standard Contractual Clauses or an applicable adequacy decision. You may request information about these safeguards using our contact address. Provider information: https://vercel.com/legal/dpa, https://neon.com/dpa, https://resend.com/legal/dpa, https://stripe.com/privacy and https://sevdesk.de/datenschutz/. Retention Invoices and tax records are generally retained for seven years from the end of the relevant calendar year, or longer where required by special legal duties or ongoing proceedings. Evidence of contracts, consent and supply is retained as long as needed to fulfil and demonstrate legal or contractual claims. Other contact and operational data is deleted or anonymised when no longer needed, unless a retention obligation or necessary protection of claims requires otherwise. Data needed for ongoing download rights remains assigned to that purpose. Your rights Subject to the legal conditions, you may request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Any consent given for data processing may be withdrawn for the future. Contact us at the address above. You may also complain to a data protection authority, particularly the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, https://www.dsb.gv.at. Our shop does not make its own automated decisions producing legal or similarly significant effects under Article 22 GDPR; Stripe's payment checks are governed by its privacy information.