vowandbespoke (www.vowandbespoke.com) is committed to safeguarding the personal data of our clients and site visitors. This Privacy Policy outlines how we collect, process, store, and protect your information when you engage with our customized wedding concept services or communicate with our platform, in full compliance with the EU General Data Protection Regulation (GDPR / DSGVO) and applicable German data protection laws.

1. Data Controller

The Data Controller responsible for data processing on this website under Article 4(7) of the GDPR is:

  • Brand / Operating Entity: vowandbespoke (www.vowandbespoke.com)
  • Website: www.vowandbespoke.com
  • Official Address: Tirolerstr. 1, 83435 Bad Reichenhall, Germany
  • Contact Email: internal@vowandbespoke.com
  • Contact Telephone: +49 86519650080

2. Information We Collect & Legal Basis for Processing

We process personal data strictly in accordance with statutory regulations. The categories of personal data collected and the legal bases for processing include:

A. Communication & Consultation Inquiries

  • Data Categories: Full name, email address, telephone number, event details, and consultation notes provided during initial project inquiries.
  • Legal Basis: Art. 6(1)(b) GDPR (processing necessary for the performance of a contract or prior to entering into a contract).

B. Contract Execution & Billing

  • Data Categories: Billing address, contract details, quotation records, and transaction history.
  • Legal Basis: Art. 6(1)(b) GDPR (contractual performance) and Art. 6(1)(c) GDPR (compliance with statutory legal obligations under German commercial and tax regulations).

3. Payment Processing via Stripe

To execute payment transactions securely (including deposit bookings and final balance settlements), we utilize the payment processing services of Stripe.

When you make a payment via our platform, your transaction-related data (such as payment amount, currency, billing details, and IP address) is transmitted directly to Stripe for verification, fraud mitigation, and settlement processing.

  • Payment Processor: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
  • Processing Purpose: Secure authorization, transaction processing, and prevention of fraudulent activities.
  • Legal Basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate business interest in secure financial management).

Note: Card details are collected and encrypted directly by Stripe. vowandbespoke does not store complete credit card or debit card numbers on its servers.

4. Data Retention Periods

Personal data is stored only for as long as necessary to fulfill the purpose for which it was collected, or as mandated by European Union and German statutory retention requirements.

  • General Consultation Records: Correspondence and preliminary project quotes not resulting in an executed contract are deleted within 6 months from the last communication.
  • Contractual & Financial Records: Under German commercial and fiscal law (Handelsgesetzbuch § 257 and Abgabenordnung § 147), contract documents, invoices, payment records, and business correspondence are retained for 6 to 10 years following the end of the calendar year in which the transaction occurred.
  • Log Files & Operational Data: Technical connection data is retained strictly for up to 7 days to ensure stability and system integrity, after which it is deleted or anonymized.

Upon the expiration of applicable statutory retention periods, stored data is securely destroyed or permanently anonymized.

5. Your Rights Under GDPR

As a data subject within the European Union, you hold the following rights regarding your personal information under the GDPR:

  • Right of Access (Art. 15 GDPR): You have the right to request confirmation as to whether your personal data is being processed and to receive a copy of such data.
  • Right to Rectification (Art. 16 GDPR): You may request the correction of inaccurate or incomplete personal information.
  • Right to Erasure / “Right to be Forgotten” (Art. 17 GDPR): You may request the deletion of your personal data, provided processing is no longer required and no statutory retention duties apply.
  • Right to Restriction of Processing (Art. 18 GDPR): You may request restricted processing under specific legal conditions.
  • Right to Data Portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to Object (Art. 21 GDPR): You may object to the processing of your personal data based on legitimate interests (Art. 6(1)(f) GDPR) at any time.

To exercise any of these rights, please contact us at internal@vowandbespoke.com.

6. Supervisory Authority & Right to Lodge a Complaint

If you believe that our processing of your personal data infringes applicable data protection laws, you have the right to lodge a complaint with a competent supervisory authority pursuant to Art. 77 GDPR.

For vowandbespoke, the local competent supervisory body is:

  • Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
  • Promenade 18, 91522 Ansbach, Germany
  • Website: https://www.lda.bayern.de

7. Data Storage & System Security

We implement appropriate technical and organizational measures (TOMs) to protect personal data against unauthorized access, loss, alteration, or disclosure. System security protocols are regularly audited to ensure robust operational resilience in alignment with current industry standards.