Data handling in brief

Summary

Every page of Kintsugi Workshop Kyoto can be read without an account. We set no cookies and run no analytics, advertising or tracking scripts. What does reach us is the connection data any web server sees when it delivers a page, described below.

Nothing is booked on this site. When you choose a class, you book it on Viator or GetYourGuide, and their privacy rules apply there.

Who stands behind it

Kintsugi Workshop Kyoto
[email protected]

We are under no legal duty to appoint a data protection officer and have not appointed one. For any question about your data write to [email protected].

What our server records

Every time your browser asks for a page or a file, our web server records the requesting IP address, the date and time, the address requested, the referring page and the identification text your browser and operating system send.

We need these records to deliver the site, keep it stable, spot attacks and misuse, and count how often each page is read. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a site that works and stays secure. Raw records are deleted after 90 days at the latest; counts without IP addresses are kept longer. A hosting company runs the server and handles this data for us, strictly on our instructions.

The service between you and us

This domain's pages and email run through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which serves the site fast, filters attacks and forwards email to our mailbox. To do so Cloudflare processes your IP address and technical connection data.

The legal basis is Article 6(1)(f) GDPR, our interest in a fast, protected site. Cloudflare is certified under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses apply as well. Cloudflare describes its handling at cloudflare.com/privacypolicy.

Class photographs

Photos of classes load straight from the image servers of GetYourGuide (GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany) and, for Viator listings, from the image servers Viator uses. To show a photo your browser contacts those servers and sends your IP address, which we cannot influence.

The legal basis is Article 6(1)(f) GDPR: we want to show each class with its provider's up-to-date photos.

At the moment of booking

Each booking link goes directly to Viator or GetYourGuide and carries our partner number, which lets the platform credit us with the booking.

On Viator or GetYourGuide the platform sets its own cookies and handles your data under its own privacy policy. We receive only commission reports with totals, with no names, contact details or payment data.

Clips

Videos use YouTube's privacy-enhanced mode and stay a still image until you press play, so your browser does not contact YouTube before that. After you press play, the video streams from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies.

You consent by pressing play: Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google's policy is at policies.google.com/privacy.

Small files on your device

Your browser holds a few small notes so that the site follows your choices. They stay on your device, and we cannot read any of them:

• the checklist boxes you tick, which stay ticked when you return (local storage, until you clear it);
• the currency you choose in the menu, which every page then keeps (local storage, until you clear it);
• for a chat you open: its reference number, an access key, your email address and a copy of the exchange, so you can continue later (local storage, until you clear it);
• a flag that the chat bubble was already shown, so it does not return (session storage, deleted when the tab closes);
• a flag that the leaving-offer was already shown, so it does not return (session storage, deleted when the tab closes).

These notes are strictly necessary for functions you use yourself (Section 25(2) No. 2 TDDDG). You can remove them whenever you like in your browser settings.

Talking with us in chat

Opening a chat means giving us your name, your email address and your messages. The chat service also notes the country your connection comes from, a scrambled form of your IP address (a salted hash that cannot be turned back into the address), and the page and language you wrote from.

Chats are stored with Cloudflare (named above), and every message you write is passed on to our account with the messaging service Telegram, which processes it outside the European Union; our replies come back the same route. Details: telegram.org/privacy. We use your email address only for our answer.

The legal basis is Article 6(1)(b) GDPR, because you ask and we answer, and Article 6(1)(f) GDPR for the scrambled IP address, kept only to prevent abuse and spam. A conversation is erased automatically 180 days after its last message.

Email contact

When you email us, we use what you send only to answer you. The legal basis is Article 6(1)(f) GDPR, and Article 6(1)(b) GDPR if the message concerns a contract. We delete the exchange once it is closed, unless the law requires us to keep it.

Font and map use

Our typefaces come from our own server, so no font service learns that you visited. The maps are images on our server, drawn from OpenStreetMap data; viewing or enlarging them contacts no map service. A "Google Maps" link reaches Google only when you press it.

Sources we point to

Our guides cite museums, tourism offices and other official sources and link to them. Those sites receive nothing from you until you click, and after that their own privacy rules apply.

Data rights

You may ask what data we hold about you (Article 15 GDPR), request correction (Article 16) or erasure (Article 17), restriction of processing (Article 18) and a portable copy (Article 20). Where we rely on legitimate interest you can object at any time (Article 21), and consent can be withdrawn for the future. Simply write to [email protected].

You can also complain to a data protection supervisory authority, above all in the EU country where you live or work or where the alleged infringement took place (Article 77 GDPR).

We take no automated decisions about you and make no profiles. You do not have to give us data, but without technical connection data a page cannot reach your screen.