IV. Provision of the Website & Creation of Logfiles

1. Data Collection and Logfiles Whenever you visit our website purely for informational purposes, meaning if you do not register or transmit any information to us, our system automatically collects personal data and information that your computer system sends to our server. To display our website and ensure its stability and security, we collect the following technically necessary data:

• Browser software information
• Language and version
• Operating system and user interface
• User’s IP address
• Date and time of access
• Content of the request (specific page)
• Access status/HTTP status code
• Websites from which the user’s system accessed our website.

This data is stored in the logfiles of our system, but it is not linked to other personal data of the user.

2. Legal Basis for Data Processing The legal basis for the temporary storage of data is Article 6(1)(f) of the GDPR.

3. Purpose of Data Processing The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session. The storage in logfiles occurs to ensure the functionality of the website. Additionally, the data helps us optimize the website and ensure the security of our information technology systems. The data is not evaluated for marketing purposes. Our legitimate interest in data processing is also based on Article 6(1)(f) of the GDPR.

4. Duration of Storage The data is deleted as soon as its purpose has been fulfilled and its storage is no longer required. When data is collected for website provision, this happens after the end of the respective session. Data stored in logfiles will be deleted at the latest after seven days. Longer storage is possible, but in such cases, the IP addresses of the users will either be deleted or anonymized so that they can no longer be assigned to an individual.

5. Right to Object and Removal An objection to the collection and processing of personal data is only possible for voluntarily provided data based on consent. It is not possible to object to the collection of data that is necessary for the operation of the website and stored in logfiles.

6. Access Data and Hosting You can visit our website without providing personal information. However, when you visit a page, access data such as the file name, IP address, date and time of retrieval, amount of data transmitted, and the requesting provider are automatically stored in the server logfiles. These access data are solely used to ensure the smooth operation of the site and to improve our offerings. This serves our legitimate interests in the correct display of our services as per Article 6(1)(f) of the GDPR. All access data will be deleted no later than seven days after your visit. For hosting and displaying the website, we collaborate with service providers who handle these tasks on our behalf. Unless otherwise stated in this privacy policy, all access data and data from forms on this website are processed on the servers of our service providers. Our service provider for hosting is Netzreform Neue Medien GmbH, which provides the technical infrastructure. If you have any questions about our service providers and the basis of our collaboration with them, please refer to the contact details provided in this privacy policy.

7. Data Processing for Contract Execution and Contacting

7.1 Data Processing for Contract Execution For the purpose of contract fulfillment as per Article 6(1)(b) of the GDPR, we collect personal data that you voluntarily provide when making an order. Mandatory fields are clearly marked, as we require this data to fulfill the contract and cannot process the order without it. The required data can be found in the respective input forms. Further information on data processing, especially regarding the transfer of data to our service providers for order processing, payments, and shipping, is provided in the following sections of this privacy policy. After the contract has been processed, your data will be restricted and, according to Article 6(1)(c) of the GDPR, deleted after the expiration of the statutory retention periods unless you have expressly consented to further use in accordance with Article 6(1)(a) of the GDPR or we reserve further use that is legally permissible and which we will inform you about in this statement.

8. Inventory Management System for Order and Contract Processing We use inventory management systems from external service providers who work for us as part of an order processing agreement. If you have questions about our service providers and the basis of our collaboration with them, please refer to the contact details described in this privacy policy.

9. Customer Account If you have given your consent according to Article 6(1)(a) of the GDPR by choosing to create a customer account, we will use your data to open and manage your customer account as well as to store your data for future orders on our website. You can delete your customer account at any time, either by sending a message to the contact options provided in this privacy policy or via a corresponding function in your customer account. After the deletion of your customer account, your data will be deleted unless you have expressly consented to further use in accordance with Article 6(1)(a) of the GDPR or we reserve further use that is legally permissible and which we will inform you about in this statement.

V. Use of Cookies

1. Description and Scope of Data Processing
   Our website uses cookies, which are text files stored by your internet browser on your device (e.g., PC, laptop, tablet, smartphone). When a user visits a website, a cookie may be stored on their operating system, allowing for the unique identification of the browser when visiting the site again. Cookies do not harm your device, do not contain viruses, Trojans, or malware. They store information related to the device, but do not directly identify you personally.
   We use cookies to make our website more user-friendly. Some parts of our website require that the browser can be identified even after navigating between pages. The data stored and transmitted in cookies includes:
   (1) Session ID
   (2) Acceptance of the cookie notice
   Additionally, cookies from Google Analytics are used to analyze browsing behavior. More information can be found in Section IX 1.a).

2. Legal Basis for Data Processing
   The legal basis for the processing of personal data is Article 6(1)(f) of the General Data Protection Regulation (GDPR).

3. Purpose of Data Processing
   The use of cookies aims to make the website easier for users to navigate. Some functions of our website would not be available without cookies, as the browser must be recognized after switching pages. We need cookies for the following purposes:

• Providing a shopping cart feature
• Preventing/recognizing abuse of the website
• Providing a customer account
• Displaying the cookie notice banner
• Managing the wishlist

The data collected through technically necessary cookies is not used to create user profiles. Our legitimate interest in processing personal data is in line with Article 6(1)(f) of the GDPR. Cookies are stored on the user's computer and transmitted to our site. Therefore, you as a user have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. Stored cookies can be deleted at any time, including automatically. If cookies are disabled for our website, some features may not be fully functional.

4. Use of the Acris Professional Plug-In

The Acris Professional Plug-In is used on our website to provide certain functions and improve the user experience for our visitors. In connection with the use of this plug-in, personal data may be collected and processed. We take the protection of your data seriously and aim to transparently explain how your information is handled.

• Data Collection and Purposes:
  The Acris Professional Plug-In may collect certain information about your interactions with our website, such as your IP address, browser type, operating system, and pages visited. This data is used to optimize the performance of the plug-in, fix errors, and improve user-friendliness.

• Responsibility:
  We are responsible for the processing of your data related to the Acris Professional Plug-In as the operator of this website. We always act in compliance with applicable data protection laws and use your data solely for the above-mentioned purposes.

• Data Security:
  We take appropriate technical and organizational measures to protect your data from unauthorized access, loss, or theft. We use industry-standard security measures and continuously update them to address current threats.

• Disclosure to Third Parties:
  Your data will not be shared with third parties unless required to fulfill legal obligations or unless you have expressly consented.

• Your Rights:
  You have the right to request information about the data we store, correct it, delete it, or restrict its processing. You can also object to the processing of your data and have the right to data portability. Please contact us using the contact details below for such requests.

• Contact:
  If you have any questions or concerns regarding the use of your data through the Acris Professional Plug-In or would like to exercise your data protection rights, you can reach us at info@littlevangogh.de. This privacy policy may be updated from time to time to reflect changes in our data protection practices or legal requirements. Please review this statement regularly to stay informed about updates.

VI. Contact Form and Email Contact

1. Description and Scope of Data Processing

Our website offers several forms for electronic contact. When a user utilizes these forms, the data entered in the input mask is transmitted to us and stored. The collected data varies depending on the form type:

• Contact Form: Name, phone number, email, message
• Rental Inquiry: Name, phone number, email, message
• Order Art Catalog: Callback request, name, address, postal code, phone number, fax, email
• Order Stretched Canvas: Callback request, name, address, postal code, phone number, fax, email
• Virtual Rental Plan: Series selection, desired exchange interval, callback request, company name, name, address, postal code, phone number, fax, email
• Order Information Material: Callback request/send written information/appointment request, company, contact person, address, postal code, city, phone number, how you found us, email
• Artist Application Form: Artist name, first name, last name, email, address, postal code, city, phone number, mobile, artistic background, description of works, image upload with title/technique/height/width/price

In addition to the entered data, the following information is also stored at the time of form submission:

• IP address
• Date and time of form submission

The use of cookies aims to make the website more user-friendly. Some functions of our website are not available without cookies, as the browser needs to be recognized after a page change. We require cookies for the following applications:

2. Legal Basis for Data Processing

The legal basis for data processing exists when the user has given consent in accordance with Article 6(1)(a) of the General Data Protection Regulation (GDPR). In the case of data processing during email communication, the legal basis is Article 6(1)(f) of the GDPR. If email contact is aimed at the conclusion of a contract, Article 6(1)(b) of the GDPR also serves as the legal basis for processing.

3. Purpose of Data Processing

The processing of personal data from the input masks serves only to process the contact request. In the case of email contact, the legitimate interest in data processing lies here as well. Other personal data processed during the submission process serve to prevent misuse of the contact form and to ensure the security of our IT systems.

4. Duration of Storage

The processing of personal data provided in the input mask takes place exclusively to handle the contact request. In the case of email contact, there is also a legitimate interest in processing the data. The personal data processed during the submission process serve to prevent misuse of the contact form and to ensure the security of our IT systems.

5. Right to Object and Erasure

The user can withdraw their consent to the processing of personal data at any time. If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. If the objection relates to optional personal data that is not marked as mandatory fields in the contact forms, the conversation may still continue. To revoke the processing of personal data submitted via contact form or email, simply send an informal email to info@littlevangogh.de. All personal data stored during the contact process will be deleted in this case.

VII. Order Process

1. Description and Scope of Data Processing

On our website, you can place orders. When a user takes advantage of this option, the data entered in the input form is transmitted to us and stored. This data includes:

• Salutation, first name, last name, company, email, street, house number, address supplement, postal code, city, country, phone, fax
• Optional when entering a different delivery address: Salutation, first name, last name, company, email, street, house number, address supplement, postal code, city, country, phone, fax

As part of the ordering process, we also collect your chosen shipping method and payment method.

Depending on the chosen payment method, your data is transmitted to payment service providers for the purpose of processing the payment. More detailed information can be found under section IX.

2. During the Ordering Process

You have the option to create a customer account, allowing us to store your data for future purchases. When creating a customer account, the data you provide will be stored revocably.

2. Legal Basis for Data Processing

The processing of the data is necessary for the completion of the contract, so Article 6(1)(b) of the GDPR serves as the legal basis for data processing. For voluntary data entries, consent is given, and therefore, Article 6(1)(a) of the GDPR serves as the legal basis.

3. Purpose of Data Processing

The processing of personal data during the ordering process serves the following purposes:

• Identification as a customer
• To process your order
• To contact you in case of questions, discrepancies, or other information regarding your order
• For invoicing
• For warranty and liability issues, and to enforce any claims against you
• To manage our customer data.

4. Duration of Storage

Data will be deleted once it is no longer necessary for the purpose for which it was collected. For personal data from the ordering process, this is the case once the respective contract has been fulfilled, and there are no legal retention obligations preventing deletion.

5. Right to Object and Erasure

The user has the right to withdraw consent for the processing of their personal data at any time. In such a case, the contract cannot be fulfilled. To revoke the processing of personal data submitted during the ordering process, simply send an informal email to info@littlevangogh.de. All personal data stored during the ordering process will be deleted in this case.

6. Data Processing for Shipping Fulfillment

For the fulfillment of the contract according to Article 6(1)(b) of the GDPR, we pass your data to the shipping service provider entrusted with the delivery, as far as necessary for the delivery of ordered goods.

Data Transfer to Shipping Providers for Delivery Notification
If you have given your explicit consent during or after your order, we will pass your email address to the chosen shipping service provider to enable them to contact you regarding delivery notification or scheduling before delivery. You can revoke this consent at any time by contacting us at the contact address described in this privacy policy or directly with the shipping service provider at the following addresses. Upon revocation, we will delete your data provided for this purpose, unless you have expressly consented to further use of your data or we reserve the right to further use of your data as permitted by law, about which we inform you in this statement.

• DHL Paket GmbH
  Sträßchensweg 10, 53113 Bonn, Germany
• Hermes Europe GmbH
  Essener Straße 89, D-22419 Hamburg, Germany

VIII. Newsletter

1. Description and Scope of Data Processing

On our website, you have the option to subscribe to a free newsletter. To subscribe to the newsletter offered on the website, we require your email address and additional information that allows us to verify that you are the owner of the provided email address and that you agree to receive the newsletter. To ensure lawful consent for newsletter delivery, we use the so-called double-opt-in procedure. In this process, the potential recipient is first added to the distribution list. Then, the user receives a confirmation email, which allows them to verify the subscription legally. Only after confirmation is the email address actively included in the distribution list. This data is used exclusively for the delivery of the requested information and offers. We use Mailchimp as the newsletter software. Your data is transmitted to Mailchimp GmbH, and Mailchimp is prohibited from selling your data or using it for purposes other than sending newsletters.

2. Mailchimp

This website uses Mailchimp for sending newsletters. The service is provided by Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA. Mailchimp facilitates the sending and analysis of newsletters. When you subscribe to the newsletter (e.g., by providing your email address), this data is stored on Mailchimp’s servers in the USA. Mailchimp enables us to analyze our newsletter campaigns. When opening an email sent via Mailchimp, a file (web beacon) included in the email connects to Mailchimp’s servers in the USA. This allows us to determine if a newsletter message has been opened and which links were possibly clicked. Additionally, technical information such as the time of retrieval, IP address, browser type, and operating system is collected. This information cannot be attributed to individual recipients and is used solely for statistical analysis of newsletter campaigns. The results help us tailor future newsletters more closely to the recipients’ interests. If you do not wish for Mailchimp to analyze your data, you can unsubscribe from the newsletter. Each newsletter message contains a corresponding link to unsubscribe. The processing of your data is based on your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by unsubscribing from the newsletter. The legality of data processing that occurred prior to the withdrawal remains unaffected. The data you provided for the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter, at which point it will be deleted from the distribution list. Other data stored by us remains unaffected. The transmission of your data to the USA is based on the standard contractual clauses of the EU Commission. Further details can be found in Mailchimp’s privacy policy.

After unsubscribing from the newsletter distribution list, your email address may be stored in a blacklist to prevent future mailings. The data in the blacklist is used solely for this purpose and is not merged with other data. This is in both our and your interest to comply with legal requirements for newsletter distribution (legitimate interest under Art. 6(1)(f) GDPR). The storage in the blacklist is not time-limited. You can object to the storage if your interests outweigh our legitimate interest. Further information can be found in Mailchimp’s privacy policy.

3. Contractual Processing Agreements

To use the mentioned services, we have concluded a processing agreement (AVV) with Mailchimp. This contract is a legal requirement under data protection law, ensuring that the service provider processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

4. Postal Advertising and Your Right to Object

Additionally, we may use your first and last name as well as your postal address for our own advertising purposes, such as sending interesting offers and information about our products by postal mail. This use serves our legitimate interests, particularly our interest in addressing our customers for marketing purposes under Article 6(1)(f) of the GDPR. If you do not want your data to be stored and used for these purposes, you can object at any time by contacting us via the contact information provided in this privacy policy. The execution of the advertising mailings is carried out by a service provider as part of a processing agreement, to whom we forward your data for this purpose.

5. Legal Basis for Data Processing

The processing of data is based on the user’s consent pursuant to Article 6(1)(a) of the GDPR.

6. Purpose of Data Processing

The collection of the user’s email address serves the purpose of delivering the newsletter. The collection of other personal data during the newsletter registration serves to prevent misuse of the services or the email address used.

7. Duration of Storage

The collection of the user’s email address is done to deliver the newsletter. The collection of other personal data during the newsletter registration aims to prevent misuse of the services or the email address used.

9. Right to Object and Erasure

The user's email address is collected to deliver the newsletter. The collection of additional personal data during newsletter registration is intended to prevent misuse of the services or the email address used.

X. Tools / Other Data Protection-Relevant Technologies

8. YouTube (Embedded Videos)

To display YouTube videos on our website, we use the embedding feature of YouTube. YouTube is owned by Google LLC, based in Mountain View, California, USA. The embedding is done in what is called "Enhanced Privacy Mode," which, according to the provider, only processes personal data when the user starts playing the video. Once playback begins, YouTube collects information to generate video statistics, improve user experience, and prevent abuse. If the user is logged into their Google account, this data will be linked to their account. To avoid this, users should log out of their Google account before playing embedded YouTube videos. YouTube uses cookies to process the collected data. Even if the user is not logged in, data is stored and analyzed by Google as user profiles. The legal basis for this is Article 6(1) lit. f GDPR, based on Google’s legitimate interests in personalizing content, market research, and/or personalized advertising. Users have the right to object to the creation of such user profiles, which must be directed to YouTube. Google LLC is certified under the EU-US Privacy Shield Agreement, ensuring compliance with EU data protection standards. More information about YouTube’s privacy practices can be found in the provider's privacy policy.

1. Use of Google Services for Web Analytics and Advertising

We use various Google technologies to collect data on your use of our website for analysis and advertising purposes. The collected information is typically transferred to and stored on Google servers in the USA. Although the USA does not provide an adequate level of data protection according to the standards of the European Commission, we base our cooperation on the standard contractual clauses issued by the European Commission. Your IP address is anonymized before being stored on Google’s servers through IP anonymization. Data processing is carried out under processing agreements according to the GDPR. More information on data processing by Google can be found in Google’s privacy notices.

2. Google Tag Manager

We use Google Tag Manager to integrate various tracking and analytics tools, as well as other technologies on our website. The Google Tag Manager itself does not create user profiles, store cookies, or conduct independent analyses. It solely manages and deploys the tools embedded through it. However, the Google Tag Manager collects your IP address, which may be transferred to Google’s parent company in the USA. The use of Google Tag Manager is based on legitimate interests under the GDPR. If necessary, processing is based on your consent according to applicable data protection laws.

3. Google Analytics

For website analysis, we use Google Analytics, which automatically collects data such as IP address, time of visit, and device information. This data is used to create user profiles, which may involve the use of cookies. Data processing is carried out based on a processing agreement with Google.

4. Google Ads

For advertising purposes, we use Google Ads, which enables interest-based advertising. Among other things, the Google Remarketing cookie is used to display relevant ads. Data processing occurs only with your consent and in compliance with relevant data protection laws.

5. Google Conversion Tracking

With Google Conversion Tracking, we can evaluate certain user actions to create conversion statistics. Processing occurs based on your consent.

6. Google reCAPTCHA

We use Google reCAPTCHA to protect data entry on our website from automated programs. The storage and analysis of data occur based on legitimate interests under the GDPR and may also be based on your consent.

7. Browser Plugin

To prevent the collection and processing of your data by Google, you can download and install Google’s browser plugin. More information can be found in Google’s privacy policy.

Data Processing Agreement

We have entered into a processing agreement with Google and fully comply with the strict requirements set by the German data protection authorities when using Google Analytics.