What I do with your email
Short, because there is very little to say. I am one person selling my own watches and I have no use for your data beyond answering you.
What I hold
Whatever you put in an enquiry — name, email, country, phone if you gave it, and what you wrote. If you buy something, the delivery address and the invoice, which I keep for seven years because tax law says so.
What I do with it
Answer you, and if it comes to it, ship a watch and keep a record of the sale. Nothing else. No mailing list exists, so you cannot be added to one.
Who else sees it
Every company involved, because you should know before you load a page or write to me, not after.
When you look at the site. Vercel hosts it: every page you open passes through its servers, which see your IP address and what your browser says about itself, as any web server does. Vercel also counts visits for me — more on that below. The photographs are served by Contentful, so your browser fetches them from its network and it sees your IP address too.
When you write to me. The form hands your enquiry to Resend, which sends it as an email to my mailbox at Namecheap. That mailbox forwards to my Gmail, where I read it and answer you. So Vercel, Resend, Namecheap and Google each handle what you wrote: your name, email address, country, phone number if you gave one, and the message.
When you buy. DHL gets a name and address. Your bank, or PayPal if you choose it, sees the payment.
Vercel, Resend, Namecheap and Google are American companies, so some of this is processed in the United States. That is the entire list — no advertising, no CRM, nothing sold or shared, ever.
Counting visits
Vercel, the company that hosts this site, counts page views for me: which page, when, where the visitor came from, the country and rough region, and the kind of device and browser. No cookie is set and nothing is stored in your browser. To count, Vercel briefly uses your IP address and browser details to make a scrambled value that tells one visitor from the next, and throws it away after 24 hours. I never see an IP address, and nothing in the numbers can be tied to you or to an enquiry you send. I look at them to see which watches get read, and that is all. I can see thirty days back.
You can object, and it takes one click. The choice is remembered in this browser — the one thing stored there for this, and only if you ask.
Your visits are counted.How long
Enquiries that go nowhere: deleted after a year. Notify-me addresses: deleted the moment that watch sells, or when you click the link to remove yourself. Invoices: seven years, then gone.
Cookies
None. Two things can be kept in your browser’s own storage, and neither leaves it: that you dismissed the notice about cookies, and — only if you use the switch above — that you do not want your visits counted.
Your rights
I process enquiries and orders on Art. 6(1)(b) GDPR — performing a contract you asked for — and keep invoices on Art. 6(1)(c), because tax law requires it. Serving the site and counting visits to it rest on Art. 6(1)(f): my interest in having a site that works and in knowing which pages are read. You can object to the counting at any time, with the switch above. Under the GDPR you can ask what I hold, ask for a copy, ask me to correct it, or ask me to delete it — and I will, within the month, except for invoices I am obliged to keep. Write to oleg@vintage-watch.es. There is no form and no department; it is the same address as everything else. If you think I have got this wrong you can also complain to a data protection authority; mine is the Berlin commissioner for data protection.