rythem-works
Bag(0)

Menu

Privacy

Last updated: 2026-11-14

This page explains which personal data this shop processes, why, and what your rights are. The short version: no tracking, no analytics, no advertising, no cookies. I only process what the shop needs to work and what you send me yourself.

The controller under the GDPR is:

[Your full name]
[Street and number]
[Postcode] [City]
Germany
Email: [Contact email]

I am not required to appoint a data protection officer.

The shop is a static website hosted by Cloudflare (Cloudflare, Inc., San Francisco, USA) on Cloudflare Pages. Record photos and audio samples are delivered from Cloudflare R2, the same provider. To deliver a page, Cloudflare necessarily processes your IP address, the page requested, date and time, and your browser's user agent, and keeps short-lived logs for security (for example to stop attacks).

  • Legal basis: Art. 6(1)(f) GDPR. My legitimate interest is delivering the site securely and reliably.
  • Cloudflare processes this data on my behalf under a data processing agreement.

The fonts are served from the shop itself: your browser does not contact Google or any other font service.

Each record is a single copy, so the page checks whether it is still available. Your browser asks the shop's database for this, hosted by Supabase (Supabase, Inc., servers in Frankfurt, Germany). The request contains your IP address, as any request on the internet does, but no other personal data. Nothing is stored about you.

  • Legal basis: Art. 6(1)(f) GDPR (showing correct availability and preventing double sales).

Your bag and the country you chose for shipping are saved in your own browser (local storage), not on my servers. They stay on your device until you remove them or clear your browser data. This storage is strictly necessary for the bag you asked for, so it needs no consent (§ 25(2) no. 2 TDDDG). It is not a cookie and is not used for tracking.

If a record is reserved and you ask to be told when it is back, I store your email address and the record in the shop's database (Supabase). If the record becomes available again, you get one email, sent through Resend (Resend, Inc., USA), and your address is deleted. If the record is sold or leaves the shop, your address is deleted without an email.

  • Legal basis: Art. 6(1)(b) GDPR, because you ask for this message.

When you make an offer on a record for trade, the form sends me: the records you offer and their condition, your pitch, what you tell me about yourself, your Discogs, Instagram and/or Facebook profile, your email address and whether you would like to meet in person. The data passes through a function on Supabase and reaches me as an email sent through Resend. It is not stored in a database. The offer and our conversation are kept in my mailbox, with my email provider, for as long as we talk and the trade needs; offers that do not lead to a trade are deleted after 6 months.

To decide whether to trade with you, I look at the public profiles you gave me. To check that the profiles are yours, you send me a short phrase from them: that message is processed by Discogs, Instagram (Meta) or Facebook (Meta) under their own privacy policies.

When you search for a record in the "Which record" field, your search text is sent through the shop's function to the Discogs API (Discogs, Inc., USA); Discogs does not receive your IP address from this search. The small cover images in the results are loaded directly from Discogs' servers, so Discogs receives your IP address when they appear.

  • Legal basis: Art. 6(1)(b) GDPR (steps you ask for before a possible contract) and Art. 6(1)(f) GDPR (knowing who I trade with).

If you sign up for the newsletter, your email address is stored by Buttondown (Buttondown, LLC, USA), which sends the newsletter on my behalf. You first get an email asking you to confirm (double opt-in); only then are you subscribed. Buttondown records the time of your sign-up and confirmation as proof of your consent. Open and click tracking is switched off.

You can unsubscribe at any time with the link in every email, or by writing to me. Your address is then removed from the list.

  • Legal basis: your consent, Art. 6(1)(a) GDPR. Withdrawing it does not affect what happened before.

When you buy a record, I process your name, shipping address, email address, the records you ordered and the payment status, to fulfil the contract.

  • Payment is handled by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) on Stripe's own checkout page. I never see your card or bank details. Stripe is responsible for the payment data it processes; see Stripe's privacy policy.
  • Your name and address are given to the shipping company that delivers your parcel: Deutsche Post / DHL.
  • Order emails are sent through Resend.
  • Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (tax and commercial law). Order records are kept for as long as tax and commercial law require, usually 8 to 10 years, and are then deleted.

If you write to me by email, on Discogs, Instagram or Facebook, I use what you send to answer you. Those platforms process the messages under their own privacy policies.

  • Legal basis: Art. 6(1)(b) GDPR if it is about an order or a trade, otherwise Art. 6(1)(f) GDPR (answering you).

Some of the providers above are based in the USA (Cloudflare, Resend, Buttondown, Discogs, Meta). Where personal data reaches them, it is protected by the EU–U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified, otherwise by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

You have the right to:

  • access the data I hold about you (Art. 15 GDPR)
  • have it corrected (Art. 16) or deleted (Art. 17)
  • restrict its processing (Art. 18)
  • receive it in a portable format (Art. 20)
  • withdraw a consent at any time, with effect for the future (Art. 7(3))
  • object at any time to processing based on Art. 6(1)(f) GDPR, for reasons arising from your particular situation (Art. 21)

To use any of these rights, write to [Contact email].

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR), for example the one where you live or the one responsible for me: Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Only what a form marks as required, and only if you want what that form does (a reminder, a trade offer, an order). There is no automated decision-making or profiling.

I update this page when the shop changes, for example when a new service is added. The date at the top shows the current version.

1

View

Reserved

Someone is checking out this record. If they don’t buy it, it’s back within 30 minutes. Leave your email and we’ll tell you.

One email, only for this record. Then we delete your address.