Privacy Policy

The short version

This site collects the minimum needed to sell and ship ceramics: your order details when you buy, your message when you write, and anonymous page statistics. There is no advertising, no third-party tracking, no profiling, and your data is never sold or shared for marketing.

Who is responsible

The data controller is Matiass Preiss, Iceland — reachable at matiass@matiasspreiss.com. Iceland is part of the EEA, so the GDPR applies to everything described here.

What is collected, and why

Orders. When you buy a piece, the studio stores your name, email address, delivery address, country, phone number for pickup orders, and what you bought. Legal basis: performance of the contract — this is what makes it possible to pack, ship, and stand behind your order. Order records are kept for as long as bookkeeping and warranty obligations require.

Payment. Payment happens on PayPal. The studio receives confirmation of payment and the details PayPal shares for the order, but never your card number. PayPal processes your data under its own privacy statement.

Messages. If you write through the contact form or by email, your name, email address, and message are kept to answer you and for as long as the conversation is relevant. Legal basis: legitimate interest in replying to you. Nothing is added to a mailing list without your explicit consent.

Order and contact emails. Transactional emails (order confirmation, shipping notice, replies) are delivered through Resend, an email service processing the message and your address on the studio’s behalf.

Analytics. The site counts page views with a random, anonymous per-session identifier that disappears when you close the browser tab. It stores the page path and coarse location context provided by the network (country, city, time zone, and a location rounded to roughly ten kilometres) — no IP address, no fingerprinting, no cross-site tracking — and it is switched off entirely if your browser sends Do Not Track. Legal basis: legitimate interest in knowing which pages are read and roughly where visitors come from. Details are in the cookie policy.

Newsletter. Joining the studio’s letters is double opt-in: entering an address sends one confirmation email, and nothing else is ever sent unless you click it. Legal basis: your consent, which you can withdraw at any time — every letter carries a one-click unsubscribe link, and unsubscribed addresses are added to a suppression list so they are not emailed again. The same applies to Collector Access membership emails, which you join by application and can leave with one click.

Interrupted checkouts. When you begin a checkout, the details you enter (your contact details and the pieces in your bag) are saved with the order so the purchase can be completed. If payment is not finished, the studio may send you a single reminder email with a link that restores your bag — one email, never more, with an opt-out link inside. Legal basis: legitimate interest in completing a purchase you initiated; your opt-out is honored permanently.

Hosting. The site runs on Cloudflare Pages. Like any host, Cloudflare processes technical request data (such as IP addresses) for security and delivery, acting as a processor under its own data processing terms.

Who receives data

Only the service providers needed to run the site, each bound by data-processing terms: Cloudflare (hosting, storage), PayPal (payment), Resend (transactional email), and the postal or courier service that carries your parcel (name and address — they cannot deliver without it). No data is sold, rented, or shared for advertising, ever.

Your rights

Under the GDPR you can ask at any time for access to the data held about you, correction, deletion, restriction of processing, a portable copy, or object to processing based on legitimate interest. Write to matiass@matiasspreiss.com and it will be handled personally, without forms or delay. You also have the right to complain to a supervisory authority — in Iceland, Persónuvernd (the Icelandic Data Protection Authority), or the authority in your own country.

What this site does not do

No advertising networks. No social media pixels. No third-party analytics. No profiling or automated decision-making. No newsletters without your explicit, confirmed consent. No data transfers beyond the processors named above.