Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

Antiquariat Norbert Haas
Proprietor: Norbert Haas
An den Kastanien 30
D-47551 Bedburg-Hau, Germany
Telephone: +49 (0) 160 966 104 64
Email: info@antiquariat-norbert-haas.de

2. Server log data

When you visit this website, the web server processes technically necessary data (IP address, date and time, page requested, browser identifier) in order to deliver the website and to ensure the security of operation (Art. 6 (1) (f) GDPR). Log data is deleted after a short period and is not combined with other data sources.

3. Cookies

This website uses only technically necessary cookies. No tracking, analytics or advertising cookies are used. In detail:

• session - holds your enquiry folder and, if you are signed in, your session. Without your consent this cookie lasts only for the current browser session and is deleted when you close the browser. If you accept the cookie notice, the same cookie is reissued with a 30-day lifetime so that your enquiry folder is preserved. No additional cookie is set. Legal basis: Art. 6 (1) (f) GDPR for the session variant, Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG for the 30-day variant.
• cookie_consent - records for one year that you have acknowledged the cookie notice, so that it is not shown again on every visit. Legal basis: Art. 6 (1) (c) GDPR together with the record-keeping duty in Art. 7 (1) GDPR.
• lang - remembers your language preference. Legal basis: Art. 6 (1) (f) GDPR, Section 25 (2) no. 2 TDDDG.

All three cookies are HttpOnly, so they cannot be read by scripts in the browser, and they are sent only to this server.

4. Enquiries and orders

When you submit a purchase enquiry or place an order, we process the data required for this purpose (name, address, email address, telephone number where provided, items requested) in order to carry out pre-contractual measures and to perform the contract (Art. 6 (1) (b) GDPR), and to comply with retention obligations under commercial and tax law (Art. 6 (1) (c) GDPR). Data is passed on only to the shipping company entrusted with the delivery.

5. Customer account

A customer account is created only at your request (Art. 6 (1) (b) GDPR). You can delete your account at any time in the account settings, where you can also download a copy of the data stored about you.

There are two ways to get an account: through the sign-up form, or, where we offer it, through a switch during checkout. In the second case we first create the account without a password and email you a link so that you can set one yourself. You can also have a single-use sign-in link sent to your email address instead of entering a password. For these links and for password resets we store only a check value derived from the link we sent, never the link itself; each link can be used once and expires after a short time (sign-in link 15 minutes, password link one hour). The legal basis is Art. 6 (1) (b) GDPR.

6. Contact by email or telephone

When you contact us, we process the information you provide in order to handle your request (Art. 6 (1) (b) and (f) GDPR).

7. Newsletter

If you subscribe to our newsletter, we store your email address and use it to send you information about new arrivals and fair dates. The legal basis is your consent (Art. 6 (1) (a) GDPR).

Subscription uses the double opt-in procedure: after you enter your address we first send you a confirmation email containing a link. You are subscribed only once you follow that link. As evidence of consent we store the time of confirmation and the IP address used; the legal basis for keeping that record is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR. The confirmation link expires if you do not use it, and an unconfirmed subscription is deleted after a short period.

You may withdraw your consent at any time with effect for the future. The easiest way is the unsubscribe link we send you on request, but an email to info@antiquariat-norbert-haas.de is just as good. Your email address will then be removed from the mailing list. Your address is not passed on to third parties.

8. No third-party services

Fonts, images and all other content of this website are served locally from our own server. No third-party content is loaded and no analytics or advertising services are embedded.

9. Storage period

We store personal data only for as long as is necessary for the purposes stated above or as required by statutory retention periods (in particular under German commercial and tax law: six or eight years).

We routinely delete order data once its retention period has expired. In addition, you can delete expired orders yourself at any time in your customer account. For as long as a retention obligation applies, we restrict processing to that obligation instead of deleting the data (Art. 18 GDPR).

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). You may revoke any consent given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Data Protection Commissioner of North Rhine-Westphalia (LDI NRW).