Privacy Policy

Preamble

With this Privacy Policy, we inform you about the types of personal data (hereinafter referred to as “data”) we process, for what purposes, and to what extent. This Privacy Policy applies to all processing of personal data carried out by us, in particular within our online offering, our online shop, and our external online presences, such as social media platforms.

This Privacy Policy applies to users worldwide. Where required by applicable law (e.g., the GDPR), specific rights and safeguards are provided.

The terms used are gender-neutral.

Last updated: August 5, 2025

​

Controller

Christopher Gribbohm
Ratsmühlendamm 22
22335 Hamburg
Germany

Email: TheWoodysGallery@googlemail.com

​

Overview of Processing Activities

The following overview summarizes the types of data processed, the purposes of processing, and the categories of data subjects concerned.

​

Types of Data Processed

• Master data

• Payment data

• Contact data

• Contract data

• Content data

• Usage data

• Meta, communication and procedural data

• Log data

​

Categories of Data Subjects

• Customers / recipients of services

• Prospective customers

• Communication partners

• Users of the online offering

• Business and contractual partners

​

Purposes of Processing

• Fulfilment of contractual obligations

• Communication

• Security measures

• Direct marketing

• Reach measurement and web analytics

• Provision and optimization of the online offering

• Business processes and administration

​

Legal Bases for Processing

Where the General Data Protection Regulation (GDPR) applies, we process personal data on the following legal bases:

• Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures)

• Art. 6(1)(c) GDPR (compliance with legal obligations)

• Art. 6(1)(f) GDPR (legitimate interests)

• Art. 6(1)(a) GDPR (consent)

If you are located outside the European Union, processing may additionally be based on comparable legal provisions applicable in your jurisdiction.

​

Security Measures

We implement appropriate technical and organizational measures in accordance with the state of the art to protect personal data against loss, misuse, and unauthorized access. These measures ensure the confidentiality, integrity, and availability of data and include procedures for exercising data subject rights and responding to security incidents.

​

Disclosure of Personal Data

Personal data is disclosed to third parties only if this is necessary for the performance of a contract, for the use of external services, or due to legal obligations.

Where required, we conclude data processing agreements with service providers in accordance with applicable data protection laws.

​

International Data Transfers

If we use service providers that process personal data outside the European Union (EU) or the European Economic Area (EEA), this is carried out in compliance with applicable legal requirements. This may include reliance on:

• Adequacy decisions of the European Commission

• Standard Contractual Clauses (SCCs)

• Other legally recognized safeguards

Despite such safeguards, data transfers to third countries may involve residual risks that cannot be completely excluded.

​

Rights of Data Subjects

Where the GDPR applies, you have the following rights:

• Right of access (Art. 15 GDPR)

• Right to rectification (Art. 16 GDPR)

• Right to erasure (Art. 17 GDPR)

• Right to restriction of processing (Art. 18 GDPR)

• Right to data portability (Art. 20 GDPR)

• Right to object, in particular to direct marketing (Art. 21 GDPR)

• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

If you are located outside the EU, you may have similar rights under applicable local data protection laws.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is:

Hamburg Commissioner for Data Protection and Freedom of Information (Germany).

​

Commercial Services & Online Shop

We process personal data of our customers for order processing, payment handling, and communication. Processing is carried out for the performance of a contract and in accordance with legal obligations.

​

Shipping & Fulfillment

The production and shipment of ordered products are carried out by our contracted print partner:

WhiteWall Media GmbH
Europaallee 59
50226 Frechen
Germany

For this purpose, we transmit the necessary data (in particular name and delivery address) exclusively for manufacturing and delivery.

​

Payment Processing

We use payment service providers to process payments. Depending on the selected payment method, processing is carried out by:

• PayPal

• Klarna

• Credit card providers

• Apple Pay

• Google Pay

Payment processing is handled via the payment services provided by Wix.

​

Provision of the Online Offering & Hosting

Our website and online shop are hosted and operated via Wix.com Ltd., Nemal St. 40, 6350671 Tel Aviv, Israel.

Wix provides hosting, technical infrastructure, and shop functionality. In this context, IP addresses, log files, and technical usage data are processed.

​

Cookies & Consent Management

We use cookies to provide functionality and analyze our online offering. Non-essential cookies are only used after obtaining prior consent where required by law.

To manage user consent, we use the Consentik GDPR Cookie Banner (via Wix). Consent status, timestamps, and a pseudonymous identifier are stored. Consent can be withdrawn at any time via the cookie settings.

​

Web Analytics – Google Analytics

We use Google Analytics (Google Ireland Limited) to analyze the use of our online offering. Google Analytics is only activated after prior consent via the cookie banner. IP addresses are pseudonymized (IP masking).

Consent can be withdrawn at any time via the cookie settings.

​

Contact

If you contact us by email or other communication channels, the transmitted data will be processed exclusively for handling your request. Data will not be shared with third parties unless required for processing your request or by law.

​

Newsletter

Newsletters are sent only with prior consent. Consent can be withdrawn at any time. Distribution takes place directly via our email program without the use of an external newsletter service provider.

​

Social Media

We maintain online presences on social networks (e.g., Instagram). In this context, personal data may be processed outside the EU. Further information can be found in the respective providers’ privacy policies.

​

Plug-ins & Embedded Content

Our online offering may integrate third-party content (e.g., Google Fonts). For technical reasons, the user’s IP address must be processed in order to provide such content.

​

Data Retention & Deletion

Personal data is deleted as soon as the purpose of processing no longer applies and no statutory retention obligations exist. Statutory retention periods (e.g., tax and commercial law) remain unaffected.

Created on the basis of the Privacy Policy Generator by Dr. Thomas Schwenke, individually adapted.