GDPR Compliance Statement

Last updated: August 2024

Handgemacht Atelier is committed to protecting and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP). This document outlines how we handle personal data in compliance with these regulations.

Data Controller

Handgemacht Atelier acts as the data controller for personal information collected through this website. Our contact details are:

Handgemacht Atelier
Bahnhofstrasse 42
8001 Zurich, Switzerland
[email protected]

Legal Basis for Processing

We process personal data on the following legal bases:

Consent: When you submit a contact form or enquiry, you consent to us processing your data to respond to your request.
Contract: When you commission a piece from us, we process data as necessary to fulfil our contractual obligations.
Legitimate Interest: We may process data for our legitimate business interests, such as improving our services, provided these interests do not override your rights.
Legal Obligation: We may process data to comply with legal requirements.

Your Rights Under GDPR

As a data subject, you have the following rights:

Right of Access

You have the right to obtain confirmation as to whether we process personal data concerning you and, if so, to request access to that data.

Right to Rectification

You have the right to request that we correct any inaccurate personal data and complete any incomplete data.

Right to Erasure

You have the right to request deletion of your personal data under certain circumstances, such as when the data is no longer necessary for the purpose for which it was collected.

Right to Restrict Processing

You have the right to request that we limit how we use your data in certain circumstances.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Data Transfers

Your personal data is primarily stored and processed in Switzerland. Switzerland has been recognised by the European Commission as providing an adequate level of data protection. If we transfer data to other countries, we ensure appropriate safeguards are in place.

Data Security

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

Encryption of data in transit
Regular security assessments
Access controls and authentication
Staff training on data protection

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly.

Exercising Your Rights

To exercise any of your rights, please contact us at the address provided above. We will respond to your request within one month. If your request is complex or we receive a large number of requests, we may extend this period by up to two months, informing you of such extension.

Complaints

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC).

Updates to This Statement

We may update this GDPR compliance statement from time to time. Any changes will be posted on this page with an updated date.