Privacy Policy — Shopatch

This site (shopatch.com) is operated by Werner Mathias Bundschuh, an Individual Entrepreneur registered in Georgia (IE Reg. No. B25175473 — see Legal Notice). This page describes what personal data is processed, why, and your rights.

This policy is written to comply with both the EU General Data Protection Regulation (GDPR) and the Georgian Personal Data Protection Law — both frameworks are functionally equivalent for the data processed by this site.

What data is collected

This site is deliberately minimal in its data collection. Here is the complete list:

Server access logs (Cloudflare)

When you visit shopatch.com, Cloudflare (the hosting provider) records standard HTTP access logs: your IP address (anonymized after 24h by Cloudflare's default settings), your browser User-Agent, the URL you visited, the HTTP referer, and a timestamp.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — security, abuse-prevention, and operational reliability.
Retention: Cloudflare retains anonymized logs for up to 7 days, then aggregates them.
Processor: Cloudflare, Inc. (USA), under Standard Contractual Clauses + their DPA. See Cloudflare's privacy policy.

Anonymous traffic analytics (Cloudflare Web Analytics)

This site uses Cloudflare Web Analytics — a cookie-free, privacy-respecting analytics tool. It tracks aggregated page views, visit duration, referrer, browser/OS and country (no precise location). It sets no cookies, uses no fingerprinting, performs no individual user tracking, and sells no data.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).
Processor: Cloudflare, Inc.

Contact form submissions

If you use the contact form, the data you submit (name, email, topic, message) is received by a Cloudflare Worker on my own infrastructure, saved in a Cloudflare D1 database (EU region), and a notification email is delivered to my Proton Mail inbox ([email protected]) via Scaleway Transactional Email (France, EU).

Collected: your name, email address, topic, message content, a timestamp, and your IP address / country (used for spam prevention).

To block spam, the form uses Cloudflare Turnstile — a cookie-free CAPTCHA alternative that analyses technical signals and does not track you across sites.

Legal basis: Consent (Art. 6(1)(a) GDPR) — implied by your choice to submit the form; spam prevention on the basis of legitimate interest (Art. 6(1)(f) GDPR).
Retention: Your message stays in my inbox and in the database until no longer needed, typically up to 6 months.
Processors: Cloudflare, Inc. (form handling, database storage, spam protection), Scaleway SAS (email delivery, EU), and Proton AG (email inbox).

Appointment booking (Proton Calendar)

If you book a call via the "Book a call" feature, the data you provide (name, email address, chosen time slot, and any note) is processed via a Proton Calendar booking page to arrange and confirm the appointment. Video calls may take place via Proton Meet.

Legal basis: Contract / pre-contractual steps (Art. 6(1)(b) GDPR) or consent (Art. 6(1)(a)).
Retention: until the appointment has taken place, at most 6 months.
Processor: Proton AG (Switzerland), which holds a Data Protection Adequacy decision under EU law.

What is NOT used on this site

No Google Analytics
No Google Fonts CDN (fonts are self-hosted)
No Facebook Pixel / Meta tracking
No third-party-cookie video embeds
No chat widgets (Intercom, Hubspot, etc.)
No marketing-automation pixels
No cookies that require consent

Because no consent-requiring cookies are set, no cookie banner is needed under EU/Georgian law.

Your rights (under GDPR / Georgian PDPL)

You have the right to: access a copy of your data, rectification of inaccurate data, erasure ("right to be forgotten"), restriction of processing, portability, objection to processing based on legitimate interest, withdrawal of consent, and to lodge a complaint with your local data protection authority.

To exercise any of these rights, email [email protected]. I will respond within 30 days.

Supervisory authority for this site: Georgian Personal Data Protection Service. EU visitors may also lodge complaints with their national data protection authority.

EU representative (Art. 27 GDPR)

As a controller established outside the EU that offers services to data subjects in the Union, a representative within the EU has been designated pursuant to Art. 27 GDPR. We have appointed Prighter Group with its local partners as our privacy representative and your point of contact for the European Union (EU). To exercise your data subject rights or contact us on any matter related to the processing of your personal data, please visit app.prighter.com/portal/shopatch (reference: ID-19065088599).

Data processors used

Processor	Purpose	DPA / Policy
Cloudflare, Inc.	Hosting, CDN, DNS, Web Analytics, contact-form handling (Worker + D1), spam protection (Turnstile)	Privacy · DPA
Scaleway SAS	Contact-form email delivery (EU)	Privacy
Proton AG	Email inbox ([email protected]) + online appointment booking (Proton Calendar), Switzerland	Privacy

International data transfers

Cloudflare, Inc. is based outside the EU/EEA (USA); where data is transferred there it is protected by Standard Contractual Clauses (SCCs) and/or adequacy decisions where applicable, and the contact-form data is additionally stored in a Cloudflare D1 database in the EU region. Scaleway (contact-form email) processes data within the EU (France). Proton AG (email inbox and appointment booking) is based in Switzerland, which holds a Data Protection Adequacy decision under EU law.

Changes to this policy

I will update this policy if site practices change. Material changes will be announced on the home page, and the "Last updated" date above will be revised.

Contact

For privacy questions or to exercise your rights: [email protected].