Privacy Policy.

When the website is accessed, technically necessary access data is processed in order to deliver the website, ensure stability, and detect attacks or malfunctions.

• IP address
• date and time of the request
• requested URL and volume of data transmitted
• referrer, browser, operating system, and device data

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure, stable, and technically error-free operation of the website. The storage period for technical log data depends on security, operational, and provider requirements.

Technical performance data is processed to measure loading and response times. The analysis is used to observe the technical performance of the website.

Performance measurement is not used for advertising, profiling, or cross-site marketing tracking. The legal basis is Art. 6(1)(f) GDPR.

The shopping cart may be stored in the browser on the device used.

The data remains stored in the browser of the device used until it is removed by the browser, by the user, or by cart logic. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in providing functional cart and reservation behavior.

When contact is made by email or telephone, the information provided is processed insofar as this is necessary to respond to the request. This may include name, contact details, the content of the message, and technical communication data.

The legal basis is Art. 6(1)(b) GDPR if the request is related to a contract or pre-contractual measures. In all other cases, the legal basis is Art. 6(1)(f) GDPR.

For AUREIR Journal signups, AUREIR processes data required to register, confirm, and manage the subscription. The Journal is sent irregularly and provides information about new editions, availability, exhibitions, and events.

Processed data includes email address, selected language, signup source, an optional reference to an object of interest, and information required to confirm the signup and manage unsubscribe requests.

Signup uses a double opt-in process. After entry, a confirmation email is sent. The subscription is marked as confirmed only after confirmation.

Unsubscription is possible through the unsubscribe link. The unsubscription is stored so that no further Journal emails are sent.

Unconfirmed signups are deleted after seven days. Confirmed and unsubscribed records are retained for subscription management and suppression until deletion is requested or a legal reason for further storage exists.

The legal basis for Journal signup is Art. 6(1)(a) GDPR. Technical administration and proof of signup are additionally based on Art. 6(1)(f) GDPR.

For the preparation and processing of orders, personal data may be processed. This includes contact data, cart data, selected variants, and payment-related information.

Stripe Checkout may be used for payment processing. Payment takes place on a payment page provided by Stripe.

In particular, the following data may be processed:

• name and contact details
• email address
• payment data at Stripe
• cart and product data

Stripe processes payment data according to its own privacy and processing terms. The legal basis for transmitting data required for payment is Art. 6(1)(b) GDPR.

For limited AUREIR objects, availability may be checked and a temporary reservation may be used.

Processing serves availability management during the purchase process. The legal basis is Art. 6(1)(b) GDPR where processing is required for pre-contractual steps or contract performance, and otherwise Art. 6(1)(f) GDPR.

When the electronic withdrawal form is used, AUREIR processes the data required to identify and handle the withdrawal request.

The data is used to send an internal notification to AUREIR and a confirmation of receipt to the email address provided. Email delivery is handled through Resend. The data is retained as far as necessary to handle the withdrawal request and comply with legal obligations. The legal basis is Art. 6(1)(b) GDPR.

The following service providers are used to provide the website and process individual functions.

Where processing takes place outside the European Union, this is done on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR.

The website uses fonts that are delivered locally via the same domain. When the website is accessed, no connection is made to external font providers.

• Cart data in the browser remains stored until it is removed by the browser, by the user, or by cart logic.
• Unconfirmed Journal signups are deleted after seven days.
• Confirmed and unsubscribed Journal records are retained for subscription management and suppression until deletion is requested or a legal reason for further storage exists.
• Data from the withdrawal form is retained as far as necessary to handle the request and comply with legal obligations.
• Reservation data is processed for the duration of the temporary reservation; expired or cancelled reservations may be released.

Under the GDPR, data subjects have the following rights in particular:

• right of access under Art. 15 GDPR
• right to rectification under Art. 16 GDPR
• right to erasure under Art. 17 GDPR
• right to restriction of processing under Art. 18 GDPR
• right to data portability under Art. 20 GDPR
• right to object under Art. 21 GDPR
• right to withdraw consent granted under Art. 7(3) GDPR

To exercise these rights, an informal notice to contact@aureir.com is sufficient.

Data subjects have the right to lodge a complaint with a data protection supervisory authority regarding the processing of personal data. In particular, the Saxon Data Protection and Transparency Commissioner, Devrientstraße 5, 01067 Dresden, is competent.