PRIVACY POLICY

In short

This website sets no cookies, embeds no third-party advertising or analytics services and makes no connection to external servers when you open it. Even the fonts are served from our own server rather than loaded from Google. That is why you see no consent banner here: there is nothing to consent to.

We only receive personal data if you write to us yourself.

Controller

GRAF CLASSICS, owner Leonard Graf

Seeweg 5, 8280 Kreuzlingen, Switzerland

Phone +41 79 371 15 71

Email info@grafclassics.com

Company ID CHE-177.289.356

For any privacy question, an email to the same address is enough.

If you only browse the site

Server logs. For technical reasons our hosting provider records every request, including your IP address, date and time, the address requested and your browser identification. These logs serve the operation and security of the website; we do not evaluate them on a personal basis and do not combine them with other data.

Visitor counting. We count how often each page is opened, which country the request comes from, the type of device and browser, and which site you came from. No IP address, no cookie and no identifier on your device are stored.

To tell returning visits from new ones, we derive two non-reversible check values from your IP address, your browser identification and a secret. The first includes the date and therefore changes daily; it answers how many different people visited on a given day. The second stays the same for as long as your IP address and browser do not change; it answers how many different people visited over a longer period, without counting anyone twice. Neither value can be used to work out who you are, and nothing is stored on or read from your device for this, which is why this counting needs no consent banner. The second value does, however, make it possible to relate visits to one another over a longer period; like all counting data it is deleted after 400 days. The legal basis is our legitimate interest in a functioning website (Art. 31(1) revFADP, Art. 6(1)(f) GDPR).

If you contact us

Contact form. We collect your name, email address and message, plus your phone number if you choose to give it. This information is used solely to answer your enquiry and is delivered to us by email. It is not stored in a database on the website.

Email, phone and WhatsApp. If you contact us directly, we process the information involved in order to deal with your request.

The legal basis is the performance of pre-contractual measures, or our legitimate interest in answering your enquiry.

Who receives data

We do not sell data and do not pass it on for advertising purposes. We use the following providers, which process data solely on our behalf and on our instructions:

Vercel Inc. (website hosting, USA): delivers the pages and keeps the server logs.

Supabase (database for visitor counting, located in Frankfurt am Main, Germany): stores the counts described above, which carry no personal reference.

Resend (email delivery, located in Ireland): delivers contact form messages to our mailbox.

Beyond this we pass on data only where we are legally obliged to, or where you expressly agree.

Transfers abroad

Server logs may be processed by Vercel Inc. in the USA. The counting database is in Germany and email delivery in Ireland, both within the European Economic Area. For processing in the USA we rely on our provider's contractual guarantees and on the Standard Contractual Clauses approved by the European Commission.

How long we keep data

Server logs are deleted automatically by our provider after a short period. We delete the counting data after 400 days; it carries no personal reference in any case. Enquiries are kept for as long as handling them requires, and beyond that for as long as statutory retention obligations apply.

Your rights

You have the right to information about the data we process, to correction of inaccurate details, to deletion, to restriction of processing, and to receive or transfer your data. Where we rely on a legitimate interest, you may object to the processing.

An email to info@grafclassics.com is enough. You also have the right to complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), and, for people in the European Economic Area, to the supervisory authority where you live.

Data security

The website is delivered exclusively over an encrypted connection (HTTPS). Please note that email may be transmitted unencrypted and that complete protection against access by third parties is not possible in that case.

Changes

We update this policy when the website or the legal situation changes. The version published here at any given time applies.