Privacy policy
Controller
The controller for personal data processed via this website is Tatiana Garcia Velasco (Deco by Tatys). Postal address: see the Legal notice (Impressum). Contact: tatoog0130@gmail.com, the website contact form, or Instagram @decobytatys.
Contact form
When you submit the contact form, we process your name, email address, message, and any optional inquiry details (for example workshop preferences or product interest) solely to respond to your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) and/or Art. 6(1)(f) GDPR (legitimate interest in answering inquiries).
Storage and email
Submissions are stored in our database and forwarded by email to the business owner via Resend (email delivery). Contact fields are encrypted at rest in the database. We keep messages only as long as needed to handle your inquiry, then delete or anonymize them unless a longer retention is required by law.
Processors and tools
We use service providers that process data on our behalf as needed to run the site: Vercel (website hosting and edge delivery), Neon (PostgreSQL database), and Resend (transactional email). Vercel BotID helps block automated spam on the contact form and may process technical request data for that purpose. These providers act as processors under Art. 28 GDPR where applicable.
Hosting and technical data
When you visit the site, technical data such as IP address, browser type, and access times may be processed by our hosting providers as needed to deliver, secure, and debug the service. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, reliable website).
Cookies, BotID, and analytics
Strictly necessary (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR): the NEXT_LOCALE cookie remembers your chosen language for the session; Vercel BotID checks requests to the contact form for automated spam and may read technical browser data and set security cookies to do so. Your answer to the cookie banner is kept in your browser's local storage. Only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR) do we load Vercel Analytics and Vercel Speed Insights, which record page views and load times in aggregate and without cookies. We do not use advertising or marketing cookies. You can withdraw your consent at any time with "Cookie settings" in the footer.
Security
We use HTTPS for data in transit. Contact form personal data is encrypted at rest. Access to production systems is limited to operators who need it to run the service.
Your rights
You may request access, rectification, erasure, restriction of processing, or data portability where applicable, and object to processing based on legitimate interests. You may lodge a complaint with a supervisory authority — for Berlin-based controllers this is typically the Berliner Beauftragte für Datenschutz und Informationsfreiheit (https://www.datenschutz-berlin.de/). To exercise your rights, contact us at tatoog0130@gmail.com or via the contact form.
No sale of data
We do not sell your personal data and do not share it with third parties except as needed to operate the site (hosting, database, email delivery, spam protection) or when required by law.