Privacy policy

Information on the processing of personal data under Art. 13 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Italian Data Protection Code (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018).

1. Controller (titolare del trattamento)

2. Data processed, purposes and legal bases

a) Contact (email / request). If you contact us by email, we process your name, your email address and the content of your message to handle your request. Through the contact form we also collect your first and last name, phone number and the service you are interested in; the request is stored in our database for processing and sent to us by email. Reference images you choose to upload are stored on our server with protected access and used only to handle your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in communication).

b) Server log files. When you visit the website, the hosting provider automatically collects technical access data (IP address, date and time, page requested, browser and device information) to deliver the website and keep it secure and stable. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

c) Google Analytics. This website uses Google Analytics (measurement ID G-3GHF3VCKF0), a web analytics service of Google Ireland Ltd. It uses cookies and processes usage data (including a shortened IP address, pages visited, device and browser) to evaluate the use of the website statistically. Legal basis: Art. 6(1)(a) GDPR (consent). Google Analytics is only loaded once you agree in the cookie banner. You can change or withdraw your choice at any time using the “Cookie settings” link in the footer.

Google Tag Manager. Together with Google Analytics and with the same consent we load Google Tag Manager (container GTM-KKJZKPFD) of Google Ireland Ltd. The Tag Manager itself sets no cookies; it manages the Google services embedded on this website, which only work within your consent. Legal basis: Art. 6(1)(a) GDPR (consent). Without your consent it is not loaded.

Microsoft Clarity. With your consent we use Microsoft Clarity (project ID z48m2qvrig), a service of Microsoft Ireland Operations Ltd. Clarity records how the website is used (clicks, scrolling, mouse movements, pages visited, device and browser) and creates anonymised heat maps and session recordings so that we can improve the website. Entries in form fields are masked and not recorded. Cookies used: _clck, _clsk, CLID (up to 13 months). Legal basis: Art. 6(1)(a) GDPR (consent). Clarity is only loaded once you tick it or accept all in the cookie banner. Withdrawal at any time via “Cookie settings” in the footer. More: Microsoft privacy statement.

d) Our own statistics (without cookies). To improve our website we measure on our own server how it is used: pages visited, clicks on links and buttons (for example WhatsApp, call, request), start, submission and errors of forms (never the content you enter), scroll depth, reading time, sections viewed, language, device type, referring website and campaign parameters (UTM). From the IP address we immediately derive the approximate country, region, town and internet provider using a local database (DB-IP, licence CC BY 4.0); no data is passed to third parties. The IP address is not stored; it is only turned into an identifier valid for one day, formed with a random value that changes daily and is then deleted. No cookies are set and nothing is stored on your device. Results are only evaluated in aggregated form. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimising audience measurement).

Own statistics with visitor ID (only with your consent). If you select “Own statistics with visitor ID” in the cookie notice, we store the cookie hz_vid with a random number in your browser (duration 13 months). This shows us how a visit continues across several pages and days. The cookie contains no IP address and no name, is read only by us and is not combined with other data (such as requests or your customer account). Legal basis: your consent (Art. 6(1)(a) GDPR, Art. 122 Italian Privacy Code). You can withdraw your consent at any time via “Cookie settings” at the bottom of every page; the cookie is then deleted.

e) Google Maps (click to load). On some pages a Google Maps map can be loaded with a click. Only with this click is data (including your IP address) transmitted to Google. Before that, no connection to Google Maps is made. Legal basis: Art. 6(1)(a) GDPR (consent by actively loading the map).

f) Newsletter (double opt-in). If you sign up for our newsletter, we process your email address, your mobile number if you wish, the language you chose and, as proof of consent, the time of sign-up and confirmation as well as a shortened hash value of your IP address valid for one day only. Sign-up uses the double opt-in procedure: after sending the form you receive an email with a confirmation link; we only add you to the mailing list once you click it. If you do not confirm, we delete the sign-up after 30 days at the latest. We only use your mobile number to tell you about appointments that have become available at short notice, by WhatsApp or text message. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future, using the unsubscribe link at the end of every newsletter email or simply by email to info@herzstickl.com. Emails are sent via our own mail server; no external newsletter service is involved, so no data is passed on to third parties.

g) Customer account. If you create an account, we process your name, e-mail address, phone number if you provide it, chosen language and an encrypted password (stored only as a hash). You confirm your registration via a link sent by e-mail (double opt-in); unconfirmed accounts are deleted after 7 days. To prevent misuse we limit login attempts and briefly store a hash of your IP address for this. In your account you can see your requests and gift vouchers. You can delete your account yourself at any time; vouchers remain valid but are no longer linked to the account. For logging in we set a technically necessary session cookie. Legal basis: Art. 6(1)(b) GDPR (contract of use).

h) Gift vouchers. When you order a voucher we process your name, e-mail address, phone number (for pickup), amount, design including the names and texts you enter, payment status and redemptions. The voucher PDF is stored with access protection on our server. Payment is handled by SumUp (SumUp Payments Limited) once online payment is enabled; we never receive your card details. Legal basis: Art. 6(1)(b) GDPR (contract) and (c) (tax retention obligations).

i) Artist applications. If you apply via “Your place at Herzstickl”, we process your details (name, contact details, Instagram, styles, experience, message) and your portfolio images to review your application and contact you. The images are stored with access protection outside the public area. If no collaboration follows, we delete the application after 12 months at the latest, or immediately on request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and (a) (consent).

j) Instagram (click to load). On our artists’ pages an Instagram profile can be loaded in a window with a click. Only with this click is data (including your IP address) transmitted to Meta Platforms Ireland Ltd., which may set cookies. Before that there is no connection to Instagram. Legal basis: Art. 6(1)(a) GDPR (consent by actively loading).

3. Recipients and processors

• Hosting: Hostfactory (server34.hostfactory.ch), Switzerland. An adequacy decision of the EU Commission exists for Switzerland.
• Web analytics: Google Ireland Ltd. / Google LLC.

4. Transfers to third countries

In connection with Google Analytics and Microsoft Clarity, data may be transferred to Google LLC and Microsoft Corporation in the USA, on the basis of the EU standard contractual clauses or the EU-US Data Privacy Framework.

5. Storage period

Email requests are stored until they have been dealt with and within the statutory retention periods. Server logs are kept only for a short time. Analytics data according to the settings of Google Analytics. Data of our own statistics is deleted after 13 months; after that only aggregated daily totals without any identifier remain.

We store newsletter data until you withdraw your consent. After you unsubscribe, we delete your mobile number immediately; we keep your email address and the time of unsubscribing as proof that no more newsletters may be sent to this address. The legal basis for this is our legitimate interest in being able to provide proof (Art. 6(1)(f) GDPR in conjunction with Art. 7(1) GDPR). Unconfirmed sign-ups are deleted automatically after 30 days.

6. Your rights

Under Art. 15 to 22 GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3)). To exercise them, an email to info@herzstickl.com is enough.

7. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in Italy the Garante per la protezione dei dati personali (garanteprivacy.it).

8. Cookies

This website uses technically necessary elements and, as part of Google Analytics, analytics cookies. Only with your consent we also set the cookie hz_vid (own statistics with visitor ID, 13 months). Your choice in the cookie notice is kept in your browser’s local storage (hz_consent_ga, hz_consent_cl, hz_consent_stats). With your consent Microsoft Clarity sets _clck, _clsk and CLID. You can manage, block or delete cookies in your browser.

Last updated: October 2026 · Legal notice