Website privacy policy
Last updated: This document is also available in German.
This privacy policy explains which personal data we process when you visit this website (gallery-sort.com) and what rights you have. The mobile app is covered separately in the app privacy policy.
Controller
Laschinger Lukas Karl Konstantin, Schackmann Luca Markus GbR
Buchbergerstraße 10c, 82538 Geretsried, Germany
Represented by Lukas Laschinger and Luca Schackmann
Email: info@gallery-sort.com
See also our legal notice.
Overview
- The website is hosted by Cloudflare. Visiting it requires processing technical connection data.
- We measure how the website is used with PostHog (EU instance). Without your consent this is limited to anonymous page view counts; nothing is stored on your device. With your consent we also collect detailed usage data, using cookies and similar storage.
- You can change or withdraw your choice at any time via “Cookie settings” in the footer.
- The website uses no third-party fonts, advertising, social media plugins or embedded third-party content.
Hosting with Cloudflare
The website is delivered through Cloudflare (Cloudflare, Inc., USA; Workers and Static Assets). When you open a page, your browser transmits connection data that Cloudflare processes in order to deliver the page and protect it against misuse: in particular your IP address, the requested address (URL), browser and device information in the request headers, and the time of the request. The same applies to requests that your browser sends to our analytics path (see below).
Legal basis: our legitimate interest in a secure, fast and reliable website (Art. 6(1)(f) GDPR). Cloudflare acts as our processor. Where data is processed outside the EU/EEA, this is done on the basis of the safeguards described in Cloudflare’s terms; see its privacy policy anddata processing addendum.
Website analytics with PostHog
To understand how the website is used and to find errors and obstacles, we use PostHog (PostHog Inc., USA) with its EU cloud (data is stored in the EU). PostHog acts as our processor. Your browser does not contact PostHog directly: requests go to our own domain under /ingest/ and are forwarded to PostHog by our Cloudflare Worker. The forwarding removes cookies and authorization headers and passes on your IP address, which PostHog needs to derive an approximate location and to count visitors in the anonymous mode.
Which data is processed depends on your choice.
Without your consent: anonymous counting
As long as you have not consented, or if you declined, only page views and the end of a page view are counted. No cookie and no persistent identifier is stored on your device, and no person profile is created. Visitors are counted through a visitor hash that PostHog calculates on its servers from technical request data (such as IP address and user agent). Along with the page view, general technical information is transmitted, such as the page address, referrer, browser, operating system, device type and screen size. Autocapture, session recordings, heatmaps, surveys, error and performance tracking are switched off. If PostHog data from an earlier consent is still stored on your device, it is deleted.
Legal basis: our legitimate interest in anonymous reach measurement (Art. 6(1)(f) GDPR).
If your browser sends a “Do Not Track” or Global Privacy Control signal, we treat this as “anonymous”: no banner is shown, and only the anonymous counting described above takes place. You can still consent voluntarily via “Cookie settings” in the footer.
With your consent: full analysis
If you accept in the cookie banner (or later via “Cookie settings”), PostHog stores an identifier in a cookie and in the local storage of your browser (the names start with ph_; the cookie is valid for up to 365 days). This lets us recognise returning visits. In addition, we collect:
- page views, clicks on links and buttons (autocapture), repeated and unresponsive clicks;
- heatmaps of clicks and scrolling;
- session recordings of how you use the page. All input fields are masked; elements marked as sensitive are hidden or masked;
- performance data (such as loading times and web vitals) and JavaScript errors;
- answers to surveys, if we display any.
We do not link this data with other websites and we do not intentionally create named person profiles.
Legal basis: your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG for storing and reading information on your device).
More on PostHog
Data transfers to third countries, as far as they occur (PostHog Inc. is based in the USA), are covered by the safeguards agreed in our data processing agreement with PostHog. More information: PostHog’sprivacy notice anddata storage documentation. We keep analytics data only as long as it is needed for the purposes described above.
Your choice and cookies
We use the consent tool Klaro. It stores your decision in the first-party cookie gallerysort_klaro for up to 180 days so that we do not ask you again on every visit. This cookie is technically necessary to respect your decision (Art. 6(1)(c) and (f) GDPR, Section 25(2) No. 2 TDDDG) and is not used to follow you across websites.
You can change or withdraw your consent at any time with “Cookie settings” in the footer. The change applies to future visits; when you switch, the PostHog data stored on your device is deleted and the page reloads. Withdrawal does not affect the lawfulness of the processing carried out before. Data already received by PostHog is not deleted by the switch itself; contact us if you want it deleted.
If you use the light/dark toggle in the page header, your choice is saved in the local storage of your browser (keytheme) so that it is applied on your next visit. This is not transmitted to us.
Fonts
All fonts are served from our own domain. No data is sent to font providers such as Google Fonts.
Contact and app stores
If you write to us by email, we process your email address and your message to answer your request (Art. 6(1)(b) or (f) GDPR). Please do not send photos unless it is necessary for your request. The links to the Apple App Store and Google Play lead to the websites of those providers; their own privacy policies apply once you follow a link.
Your rights
You have the following rights under the GDPR with regard to your personal data:
- access (Art. 15), rectification (Art. 16) and erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- to withdraw consent at any time with effect for the future (Art. 7(3)), see “Your choice and cookies”;
- to object to processing based on legitimate interests at any time, on grounds relating to your particular situation (Art. 21).
To exercise your rights, write to info@gallery-sort.com. Please note that anonymously counted visits cannot be assigned to you, so they cannot be identified for access or deletion requests.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany,www.lda.bayern.de.
Providing data is not required by law or contract. Without it you can still use this website. There is no automated decision-making, including profiling, that produces legal effects concerning you.
Changes
We will update this policy when the website or the legal requirements change. The current version is always available on this page.