Privacy Policy

1. Data controller

The controller responsible for processing personal data on this website is:

ZuM Creativo GbR
Zeynep Gusinali and Mareike Mann
Krühgarten 11
38228 Salzgitter
Germany
Email: zum.creativo@gmx.de

2. General information

We process personal data only where necessary to operate this website, process bookings, conduct our workshops, process payments or communicate with customers, or where another legal basis applies.

Depending on the purpose, processing is based in particular on Art. 6(1)(b) GDPR for pre-contractual measures and performance of a contract, Art. 6(1)(c) GDPR for compliance with legal obligations, or Art. 6(1)(f) GDPR for our legitimate interests in the secure and reliable operation of our services.

3. Hosting and technical operation

We use a technical service provider (ORISCO) for domain and hosting services. During technical operation, data such as IP addresses, access times, requested resources, browser and device information and technical log data may be processed.

This processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and technically functional operation of our website.

4. Workshop bookings

When you book a workshop, we process the information you provide. This may include your first and last name, email address, telephone number, selected workshop date, number of participants, the number of adults and children and any participant names provided.

The data is required to prepare and carry out your booking and to assign participants to the relevant workshop. The legal basis is Art. 6(1)(b) GDPR.

5. Database and booking system – Supabase

We use Supabase for technical website functions, including the storage and processing of workshop dates, bookings, customer data, participant data and payment status.

Processing takes place insofar as necessary for booking and contract performance on the basis of Art. 6(1)(b) GDPR and, where technical security is concerned, on the basis of Art. 6(1)(f) GDPR.

Where service providers process personal data on our behalf, the legally required data protection agreements are used. Where data is processed outside the European Economic Area, the legally required safeguards for international data transfers are taken into account.

6. Payments with PayPal

We use PayPal to process payments. The provider for customers in the European Economic Area is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.

When PayPal is used, data required for payment processing is transmitted to or processed by PayPal. This may include the payment amount, transaction identifiers and technical information. We do not receive complete credit card or bank account details from PayPal.

Processing connected with the payment method selected by you is carried out for contract performance on the basis of Art. 6(1)(b) GDPR. PayPal's own privacy policy also applies to processing carried out independently by PayPal.

PayPal Privacy Policy

7. Contacting us

If you contact us by email or another communication method, we process your contact details and the content of your message in order to respond to your enquiry.

If your enquiry relates to a booking or contract, processing is based on Art. 6(1)(b) GDPR. Other enquiries are generally processed on the basis of our legitimate interest in handling communications pursuant to Art. 6(1)(f) GDPR.

8. Storage period

Personal data is stored only for as long as necessary for the relevant purpose. Booking and payment data may be retained beyond this period where statutory commercial, tax or other retention obligations apply. Data is deleted once the purpose and applicable statutory retention periods have expired, unless another legal basis permits continued storage.

9. Cookies and similar technologies

Our website does not currently use our own analytics or marketing tracking services. Technically necessary storage or cookies may be used where required for individual website functions.

PayPal functions are loaded during the payment process. PayPal may use technically necessary cookies or similar technologies in this context. Further information is available in PayPal's privacy and cookie information.

10. Your data protection rights

Subject to the statutory requirements, you have rights including access, rectification, erasure, restriction of processing and data portability. You may also object to processing based on Art. 6(1)(f) GDPR.

You also have the right to lodge a complaint with a competent data protection supervisory authority.

11. Version

Last updated: September 2026