Binding version
This is a translation for your convenience. Only the German version (sofialuna.de/datenschutz) is legally binding.
1 · Controller
Sofia Luna Di Francesco, Sofia Luna Keramik, Notburgastraße 5, 80639 Munich, Germany Phone: +49 89 12625755+49 89 12625755 Email: keramik@sofialuna.dekeramik@sofialuna.de No data protection officer is appointed as there is no legal obligation to do so. This policy covers the website, bookings via eTermin, the newsletter and everything that happens in the studio. A paper copy is available in the studio.
2 · Hosting, encryption and server log files
The website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, on servers in Germany, under a data processing agreement (Art. 28 GDPR). Connections are TLS-encrypted. With every request the server automatically stores IP address, date and time, page requested, referrer, browser and operating system, to run the site securely and detect attacks (Art. 6(1)(f) GDPR). IONOS anonymises the IP address immediately after collection; log files are deleted after eight weeks at the latest. Fonts, images and scripts are served from our own server. No content from Google, Instagram or other third parties is loaded when you visit the website.
4 · Contact by form, email or phone
If you contact me, I process your details (name, contact details, message) to answer your enquiry. The form is sent as an email via our own server at IONOS. The server then sends a short confirmation of receipt to the email address you entered with topic, date and a copy of your message (without the copy if it contains a link). Legal basis: your consent via the tick box in the form (Art. 6(1)(a) GDPR); for bookings, purchases or commissions also Art. 6(1)(b) GDPR, otherwise my legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Withdrawal declarations via the online withdrawal function (sofialuna.de/en/widerruf) also run through our own server at IONOS; receipt is confirmed by email without undue delay, and declaration and confirmation are kept as proof (Art. 6(1)(b) and (c) GDPR). Enquiries are deleted once settled; correspondence leading to a contract is kept as long as commercial and tax law require (up to six years).
5 · Bookings, time cards and vouchers (eTermin)
Bookings, open studio places, waiting lists and the sale of time cards and vouchers run through eTermin (eTermin GmbH, Mättivor 3, 6430 Schwyz, Switzerland; data is stored in a data centre in Frankfurt am Main) under a data processing agreement (Art. 28 GDPR); Switzerland is covered by an EU adequacy decision. The booking window only loads when you click a booking or buy button. Processed: name, address (for the invoice), email, phone, optional notes, the booked date or service, redeemed codes, your answers to the tick boxes (e.g. newsletter, review request), payment status and method. Legal basis: Art. 6(1)(b) GDPR. Without name, email and address I cannot accept a booking. eTermin sets a language cookie and uses session storage for the booking process – both technically necessary. Only if you tick “remember my details on this device” does eTermin also store your contact details in a cookie on your device. eTermin sends confirmations, reminders and any cancellations by email and notifies our server at IONOS of bookings, cancellations and waiting-list entries, where codes, the waiting list (section 9) and the review request (section 10) are handled automatically. For the loyalty offer (terms section 10 (6)) our server counts how many loyalty time cards were bought with the same email address; only a checksum of the address is stored, not the address itself, and it is deleted at the end of 2026. If the permitted number is exceeded, I receive an email with the code and the order details. Legal basis: Art. 6(1)(b) GDPR (carrying out the offer conditions). On the “print a voucher” page our server can check a code with eTermin; only the code is transmitted (Art. 6(1)(f) GDPR). Booking data is deleted when no longer needed; what is required for invoices and accounting is kept under § 147 AO and § 257 HGB (receipts and invoices eight years, business letters six years).
6 · Invoices (Lexware Office)
For every paid booking eTermin automatically creates an invoice in Lexware Office (Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany) and emails it to you. Name, address, email, service, date and amount are transferred for this, under a data processing agreement (Art. 28 GDPR). Data is stored in Frankfurt am Main; for sending emails and support Lexware also uses service providers in the USA, safeguarded by the EU-US Data Privacy Framework or standard contractual clauses. Legal basis: Art. 6(1)(b) and (c) GDPR. Invoices are kept for eight years.
7 · Payment (Stripe, card and cash in the studio)
Online payments are processed by Stripe (Stripe Payments Europe, Limited, Dublin, Ireland). Stripe receives your payment data and technical device data for fraud prevention and sets its own technically necessary cookies when you pay; I never see full card details. Legal basis: Art. 6(1)(b) GDPR. Stripe acts partly as an independent controller (e.g. fraud prevention, legal obligations); data may be transferred to the USA, Stripe is certified under the EU-US Data Privacy Framework and standard contractual clauses also apply. In the studio you can also pay by card or cash. Card payments on site run through a SumUp card terminal (SumUp Limited, Dublin, Ireland); SumUp processes card data as an independent controller under its own privacy notice, and I never see full card details.
9 · Waiting list
If a class is full you can join the waiting list via eTermin. Our server at IONOS stores your first name, email, language and the class date and emails you a booking link as soon as a place opens up (Art. 6(1)(b) GDPR). The data is deleted once the class has started, you have booked or you ask to be removed.
10 · Review request
If you agree when booking a class, I send you a short email the day after your last class asking for a review on my Google business profile, using your first name, email, language and class dates; it is sent from our own server at IONOS. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the link in the email or by replying.
11 · Classes and the studio on site
Bookings by phone, email or in person, commissions and purchases in the studio: name, contact details, address where needed and the agreed service are processed to perform the contract (Art. 6(1)(b) GDPR); invoices are kept for the statutory periods. Minors: for young people from 14 attending alone I need written consent from their parents or guardians with an emergency contact; this is used only for that class and emergencies (Art. 6(1)(b) and (d) GDPR) and deleted no later than three months after the class. Health: information on pregnancy, allergies or illnesses is voluntary. If you tell me so that I can adapt the class, I use it only for that and only with your explicit consent (Art. 9(2)(a) GDPR), do not add it to the booking and delete notes at the end of the class. Please do not enter health information in the online booking notes. Photos and videos: recognisable people are only published with consent (Art. 6(1)(a) GDPR; for minors their parents’ consent), which can be withdrawn at any time. Photos of pieces you made yourself are likewise only published with your consent (form in the studio), which you can withdraw at any time with effect for the future.
12 · Instagram
I run the Instagram profile @sofialunakeramik. The website only links to it. For the profile I am jointly responsible with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (Art. 26 GDPR) insofar as Meta provides me with usage statistics (“Insights”); see facebook.com/legal/terms/page_controller_addendum and privacycenter.instagram.com. You can also exercise your rights directly with Meta. Legal basis: my legitimate interest in presenting the studio (Art. 6(1)(f) GDPR).
13 · News and opening hours
News and opening hours are kept in a Google Sheet; our server fetches and serves them itself, your IP address is not sent to Google.
14 · Recipients at a glance
IONOS (hosting, email), eTermin (bookings), Lexware Office (invoices), Stripe (payments), Brevo (newsletter) and, if you visit it, Instagram/Meta. Beyond that, data is only passed on where required by law (e.g. tax office). There is no automated decision-making or profiling.
15 · Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). You may also lodge a complaint with a supervisory authority (Art. 77 GDPR), e.g. the one responsible for me: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
16 · Right to object
Where data is processed on the basis of legitimate interests (Art. 6(1)(f) GDPR – e.g. log files, code checks, block list), you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR); I will then stop unless there are compelling legitimate grounds or the processing serves legal claims. You can object to the use of your data for the newsletter at any time without giving reasons (Art. 21(2) GDPR).