Back to home

Privacy Policy

Convenience translation. This English version is provided for understanding only. The German version is the only legally binding text and serves as the basis for all translations. In case of any discrepancy, the German wording prevails.

Privacy Policy

1. General information and principles of data processing

We are pleased that you are visiting our website. The protection of your privacy and of your personal data when using our website is an important concern for us.

According to Art. 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person. Processing within the meaning of Art. 4(2) GDPR always requires a legal basis or your consent.

2. Data controller

MX-Softnet Hard- Software Consulting
Owner Dirk Greineisen
Erich-M. Müller Str. 6
86655 Harburg, Germany

3. Server log files

When you use this website, we collect technically necessary data via server log files (IP address, date and time of request, retrieved file, referrer, browser type, operating system). The legal basis is Art. 6(1)(f) GDPR (legitimate interest).

4. Cookies

We use cookies. On your first visit, a cookie banner with two options appears:

  • Accept all: necessary + functional/statistics cookies are activated.
  • Necessary only: only technically necessary cookies are set.

Cookies in use: carving_session (session, necessary), cookie_consent (1 year, necessary), werk_like_* (1 year, only with consent).

5. Registration and user account

You can register as a carver or specialist dealer. We collect: first/last name, email address, password (bcrypt-encrypted), role. Optional profile data: artist name, address, phone, website, description, social media, awards, profile picture. The visibility of optional details can be controlled via your profile settings. Legal basis: Art. 6(1)(b) and (a) GDPR.

6. Contact form

You can contact us via a contact form. We collect name, email address, subject and message. Contact requests are automatically deleted after 90 days. Legal basis: Art. 6(1)(a) GDPR (consent).

7. Internal messaging system

Registered users can send messages to other users via an internal messaging system. The message text, sender, recipient and timestamp are stored. Legal basis: Art. 6(1)(b) GDPR.

8. Image uploads

Registered users can upload images. Permitted formats: JPG and PNG, max. 2 MB. All embedded metadata (EXIF, GPS, camera info) is automatically removed upon upload. Legal basis: Art. 6(1)(b) GDPR.

9. Q&A section

Registered users and visitors can post publicly visible questions. Unanswered questions are automatically deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR.

10. Emails sent by the platform

We only send emails for: account activation, password reset, message notifications. We do not send newsletters. Legal basis: Art. 6(1)(b) GDPR.

11. External services

OpenStreetMap (maps): Map tiles are loaded directly from the servers of the OpenStreetMap Foundation. Your IP address is transmitted in the process. Legal basis: Art. 6(1)(f) GDPR.

Nominatim (geocoding): The query is performed server-side — your IP address is not passed on. Only postcode and city are transmitted.

Local libraries: All JavaScript/CSS libraries (Bootstrap, jQuery, Leaflet, Lightbox, Summernote, Chart.js, SortableJS) and fonts (Playfair Display, Source Sans 3) are hosted locally on our server. No data is transferred to external CDN services or to Google.

12. Tracking and analytics

We use our own, self-hosted statistics system. No data is transmitted to third parties. Your IP address is not stored — instead, a non-traceable SHA-256 hash with a daily salt is generated. Bots and administrators are not recorded. Data is only collected with your consent ("Accept all"). Legal basis: Art. 6(1)(a) GDPR.

13. Sponsor links

On the "Sponsors" page, partner logos are displayed. When clicking on a sponsor logo, you are redirected with rel="noreferrer", so the referrer header is not transmitted. We keep an anonymous click counter (only sums, no IP, no user IDs). The counter is incremented only with cookie consent ("Accept all").

14. Social media links on profiles

Carvers and dealers can optionally add social media links to their profile (Facebook, Instagram, YouTube, TikTok). These are displayed as simple text links — no widgets, no iframes, no scripts from the providers are embedded. rel="noopener noreferrer" is set, so the referrer header is not transmitted.

15. Data security

  • Encrypted transmission via SSL/TLS
  • Passwords stored as bcrypt hashes
  • CSRF protection in all forms
  • Prepared statements (SQL injection protection)
  • Automatic EXIF removal from uploaded images
  • IP addresses stored only as anonymised hash values

16. Your rights (Art. 15-22, 77 GDPR)

  • Right of access (Art. 15): confirm whether we process your data and obtain information.
  • Right to rectification (Art. 16): request correction of inaccurate data.
  • Right to erasure (Art. 17): have your data erased.
  • Right to restriction of processing (Art. 18).
  • Right to data portability (Art. 20).
  • Right to object (Art. 21).
  • Right to lodge a complaint with a supervisory authority (Art. 77).
  • Right to withdraw consent (Art. 7(3)) at any time, with effect for the future.

To exercise these rights, please contact the data controller (section 2).

17. Changes to this privacy policy

We reserve the right to update this policy at any time as required.

Status: April 2026

Notifications for interested visitors

Type of processing: email address, category selection (works, courses, events, accessories, general), country selection, language, pseudonymous IP hash (SHA-256) as consent proof.

Legal basis: Art. 6 (1) (a) GDPR (consent). Consent is given actively by ticking a checkbox and confirming a link sent to the provided email address (Double-Opt-In).

Purpose: information about new works, courses, events, accessory offers and platform news.

Settings changes: If you are already an active subscriber and want to change your categories or countries, the new values are stored briefly as a "pending change" with a one-time token and a validity of 48 hours. You will receive an email with two options ("Apply new settings" or "Keep old settings"). After your confirmation or after the 48 hours expire, the intermediate values are automatically removed. This additional processing only serves to verify the change of consent and has no other purpose.

Storage duration: until unsubscription. After unsubscribing, the record is kept in "unsubscribed" status to fulfill legal duties (consent proof, re-import protection). Alternatively, you can trigger full deletion (Art. 17 GDPR – right to erasure) yourself at any time: the unsubscribe page offers a "Delete data completely" button.

Right to withdraw (Art. 7 (3) GDPR): Withdrawal of your consent is possible at any time through three channels:

  • One-click unsubscribe link in every notification email
  • Footer link "Unsubscribe from notifications" on every page (email input, personal unsubscribe link sent by email)
  • Informal email to the address listed in the imprint

Recipients: no sharing with third parties. SMTP delivery runs through IONOS, covered by the existing data processing agreement.

Moderation and logging

Type of processing: To ensure the lawful and secure operation of the platform, moderation actions are logged. When an administrator or an authorised moderator hides, approves or deletes a piece of content (e.g. work, course, event) or an account, the following are recorded: the acting user (name), the action taken and the affected object, an optional reason, and the timestamp. No IP address is stored in this process.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the traceability of moderation decisions, abuse prevention and the fulfilment of due-diligence duties as a service provider).

Recipients: The log data is accessible exclusively to the administrator and is not shared with third parties.

Storage duration: Log entries are automatically deleted after 12 months.

Google Search Console

Purpose: We use Google Search Console to monitor and technically optimise how our website is found in Google Search (e.g. search terms, impressions, indexing errors).

Important: There is no tracking script and no cookie on our website for this. Only Google's own aggregated search statistics, which cannot be traced back to individual visitors, are evaluated; our site only hosts a static verification file.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in findability and technical optimisation).

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing in the USA is possible and safeguarded by the standard contractual clauses or the EU-US Data Privacy Framework.

Event contributions ("Carver on Tour")

Type of processing: Logged-in carvers can contribute photos to events. The photo, a short caption, the contributor's public name with profile link and the timestamp are published.

Legal basis: Art. 6 (1) (b) GDPR (use of the platform) and Art. 6 (1) (f) (legitimate interest in community visibility). The contributor is responsible for any persons depicted.

Storage duration: Contributions are automatically deleted after 7 days including the image file; before that they can be deleted at any time by the contributor or by us.

Safeguards: EXIF metadata (including GPS) is automatically removed on upload. Every contribution has a reporting function.

Commission requests / searches

Type of processing: Visitors can post a request (a desired work or a commission/event) without an account; matching carvers submit offers. Processed are the email address, description, budget/timeframe, target postcode/town and the coordinates derived from it, a pseudonymous IP hash (SHA-256) and the timestamp.

Legal basis: Art. 6 (1) (b) GDPR (initiation/performance of a commission) together with Art. 6 (1) (a) (consent via double opt-in for forwarding the request to carvers).

Contact details: Both sides remain anonymous until the award; the searcher's email address is only transmitted to the chosen carver upon awarding the commission — solely to carry it out.

Storage duration: unconfirmed requests after 7 days, open/expired ones after 30 days, awarded ones 30 days after completion — each deleted automatically. The request can be closed by the searcher at any time via the code link.

Use of artificial intelligence (AI)

Editorial content: Some editorial texts on this website — such as blog and glossary articles — and their translations into other languages are produced with the support of AI-based tools. Such content is reviewed, approved and editorially signed off by a human before publication.

No automated decision-making: No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place. This website does not use an AI chatbot.

No AI processing of your data: Our users' personal data is not transmitted to AI services for automated analysis and is not used to train AI models.

Images: The photos of works uploaded by our users are real photographs of genuine woodwork and are not AI-generated images.

App installation and local cache

Purpose: Our website can be added to the home screen of your phone or computer as an app. To do this, the browser registers a service worker that caches presentation files locally so the app starts faster and can show an information page when there is no connection.

What is stored: Only public files that are identical for every visitor — stylesheet, scripts, icons and the offline information page. Page content is not cached, in particular no profile, message or request data. No identifiers that would allow recognition are created.

Legal basis: Section 25 (2) no. 2 TDDDG (technically necessary for the service you expressly requested) in conjunction with Art. 6 (1) (f) GDPR.

Deletion: The cache is stored on your device only. You can remove it by deleting the app from your home screen or by clearing the site data in your browser settings.

Push notifications

Purpose: Registered members can choose, per device, to be notified when someone sends them a message or a matching commission request comes in.

Legal basis: Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG — your consent only. Nothing is stored and nothing is sent unless you switch it on and confirm in your browser.

What is stored: The delivery address (endpoint) issued by your browser, the two associated encryption keys, your language and a rough device label (e.g. "Chrome on Android") so you can identify the right device in your profile. No IP address, no full browser identification string.

Recipients: Delivery necessarily runs through the push service of your browser vendor — depending on the device Google (Android, Chrome), Apple (iPhone, iPad, Safari) or Mozilla (Firefox). That service learns that a message is going to your device and may process it in a third country (in particular the USA). It cannot read the content: title and text are encrypted on our server with your device's keys (procedure per RFC 8291) and are only decrypted again on your device.

Content of the notifications: Deliberately minimal — for example "New message" and the sender's name. Subject and message text are not included, because a notification is also visible on a locked screen.

Withdrawal and deletion: You can switch notifications off again at any time using the same switch; that device's subscription is deleted immediately. Withdrawing the permission in your browser settings has the same effect. Deleting your account removes all device subscriptions. Subscriptions that permanently cannot be delivered to are deleted automatically.

“Stay signed in”

Purpose: If you tick “Stay signed in” when logging in, you do not have to enter your password on every visit on that device. Without it, the session ends after a short period of inactivity and at the latest when the browser is closed.

Legal basis: Section 25 (2) no. 2 TDDDG — technically necessary for a service you expressly requested by ticking the box; additionally Art. 6 (1) (b) GDPR (performance of the user relationship). Without the tick, nothing is set and nothing is stored.

What is stored: A cookie containing two random values, plus a record on our side with your user ID, the first of those values, a checksum of the second, the expiry date and a rough device label (e.g. "Chrome on Android"). No password, no IP address. The second value is held by us only as a checksum — our database alone cannot be used to sign in. It is renewed on every use.

Retention: 60 days from last use; after that the login expires and the record is deleted automatically.

Withdrawal: Clicking “Log out” immediately deletes the cookie and the record for that device. Clearing the site data in your browser has the same effect. Deleting your account removes all records.

Note: Please do not tick the box on a shared or borrowed device — your account would remain open for the next person.

Featuring works on social media

Purpose: We feature carvers' works and photos on our own channels on Instagram, Facebook and LinkedIn, crediting the name or artist name and, if provided in the profile, the Instagram profile.

Legal basis: Exclusively your consent (Art. 6 (1) (a) GDPR). You give it in your profile for all works or individually per work; it is switched off by default. Without consent we do not show your work.

Proof: We store when you agreed to or withdrew which version of the consent text, and which posts we published on which channel and when. Your IP address is only stored as an irreversible hash.

Withdrawal: You can withdraw your consent at any time in your profile or on the individual work. We will then delete posts featuring your work that have already been published; the lawfulness of processing up to the withdrawal remains unaffected (Art. 7 (3) GDPR). The same applies if you delete your account.

Providers: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (Instagram, Facebook) and LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Processing in the USA by these providers is possible and safeguarded by the EU-US Data Privacy Framework or standard contractual clauses. The providers' privacy notices apply to processing on their platforms.

Storage period: We keep the consent and post logs for as long as posts are published and, beyond that, as proof of consent until the end of the statutory limitation period of three years.

Personal planning support for requests

Type of processing: If you tick “personal support with planning” on a request (e.g. a carver for an event), your request is additionally sent by email to the operator and the moderators of Carvingkunst after confirmation — including your email address, so that we can contact you personally. Further coordination takes place by email or phone.

Legal basis: Art. 6 (1) (a) GDPR (consent by ticking the box) and Art. 6 (1) (b) GDPR (pre-contractual support at your request).

Note: The support is free of charge. Carvingkunst does not become a contracting party; you agree the commission directly with the carver.

Storage duration and withdrawal: The request itself is deleted automatically as described above. Emails exchanged for the planning are deleted once the planning is completed or you object. You can withdraw your consent at any time by emailing us.

Featuring works on Reddit

With a separate, additional consent we also feature works in our Reddit community r/artofcarving, crediting your name or artist name with a link to your Carvingkunst profile. Legal basis is your consent (Art. 6 (1) (a) GDPR); it requires the social media consent and is switched off by default. You can withdraw it at any time in your profile or dashboard; we then delete published posts. Provider: Reddit, Inc., San Francisco, USA (processing in the USA, safeguarded by standard contractual clauses or the EU-US Data Privacy Framework). Proof and retention as described above.