Privacy Policy

1. Controller

Ivan Aliev Court Objects Kennedyallee 88 60596 Frankfurt am Main Germany Email: contact@courtobjects.com

Court Objects is the trading name used by Ivan Aliev, a German sole proprietor.

2. Hosting and technical website delivery

Vercel Inc. hosts and delivers this website. When you access it, Vercel and our server functions may process technical connection and log data such as IP address, date and time, requested path, referrer, browser, device and operating-system information, and error or security information. The country derived from the connection is also used for automatic language selection.

This processing is necessary to deliver, secure and diagnose the website. The legal basis is Article 6(1)(f) GDPR; our legitimate interests are a secure, stable and usable website. Logs are retained according to operational, security and legal requirements and the hosting-account settings. Vercel may process data in the United States and other countries; its DPA provides the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. We do not use a separate error-monitoring service.

3. Consent and necessary browser storage

Necessary functions are available without optional consent. The localStorage key court-objects-cookie-consent stores Necessary, Analytics and Marketing choices, a timestamp and policy version until you delete browser data or replace your choice. The first-party cookies court-objects-locale and court-objects-locale-detected remember language selection for up to one year. Shopify may use necessary browser storage to retain the cart. The sessionStorage keys court-objects:shopify-checkout-session and court-objects:visit-started-at last for the current browser tab and support checkout return and the delayed assistant launcher. An admin-only authentication cookie lasts up to eight hours.

Necessary storage is used under § 25(2)(2) TDDDG and related personal-data processing under Article 6(1)(b) or (f) GDPR. Analytics and Marketing are off by default and require separate consent under § 25(1) TDDDG and Article 6(1)(a) GDPR. Accept all enables both; reject keeps both off; Save preferences applies the selected categories. COOKIE SETTINGS in the footer reopens the controls. Withdrawal applies for the future and does not affect earlier lawful processing. The policy and settings remain accessible without optional consent.

4. Google Analytics 4

With explicit Analytics consent, we use Google Analytics 4, measurement ID G-XB1EL8YP9W, supplied by Google Ireland Limited; Google LLC and other Google companies may also process data. Google receives event and device data, online identifiers, approximate location and technical connection data. An IP address is necessarily processed during transmission; Google states that IP addresses from EU users are used for coarse geolocation and discarded before logging.

No Google Analytics script or request is made before consent. We send one manual page_view for the current page and later client-side navigation. URLs contain only the path, not arbitrary query parameters. Validated UTM campaign values may be mapped to campaign fields; an external referrer is reduced to its origin. Attribution is held only in memory before consent and cleared on rejection or withdrawal. Form values, assistant conversations and sensitive URL parameters are not sent. Advertising storage, Google Signals, advertising personalisation and user-provided-data collection are disabled in our custom-site tag.

Google Analytics uses the cookies _ga and _ga_XB1EL8YP9W, normally for up to two years, subject to browser limits and renewed use. Event-level retention follows the period configured in the GA4 property; this is separate from browser-cookie lifetimes and from aggregate reporting. Processing is based on consent under § 25(1) TDDDG and Article 6(1)(a) GDPR. Withdrawal stops subsequent collection and removes accessible GA cookies. Google may process data outside the EEA, including in the United States, relying where applicable on the EU-US Data Privacy Framework and Standard Contractual Clauses.

5. Meta Pixel

With explicit Marketing consent, Meta Pixel ID 2467685383743528 is loaded for advertising measurement. The custom site may send PageView, AddToCart, InitiateCheckout and Lead events together with technical connection, browser, device, page and cookie identifiers. We do not send form content or assistant messages through the Pixel. No Pixel is loaded and no event is sent by our integration before Marketing consent.

The recipient is Meta Platforms Ireland Limited; Meta group companies may process data as described in their notice, including outside the EEA. Processing and terminal access are based on § 25(1) TDDDG and Article 6(1)(a) GDPR. Withdrawal through COOKIE SETTINGS immediately blocks further application events, sends Meta's runtime consent-revocation command and removes accessible first-party _fbp and _fbc cookies for the current host and verified parent-domain scope. It cannot delete inaccessible third-party or HttpOnly cookies and does not erase information already received by Meta. On a later page load with Marketing disabled, our website does not load the Pixel. Meta determines any further processing of data already received under its own responsibility and applicable transfer safeguards.

6. Shopify cart, checkout and orders

The product catalogue, availability, live price, cart and checkout are provided through Shopify. On this site, Shopify's Storefront/Buy Button technology processes product and cart interactions, line items, quantities, cart identifiers and technical connection data. When you continue to Shopify checkout, Shopify processes the contact, billing, delivery, order and payment-related information you enter. Payment data is handled by Shopify and the payment method shown in checkout; Court Objects does not create a separate payment page.

Processing for cart and checkout steps and order fulfilment is based on Article 6(1)(b) GDPR. Accounting, tax, fraud-prevention and legal records are processed under Article 6(1)(c) and, where applicable, Article 6(1)(f) GDPR. Contract and invoice records are retained for statutory periods; abandoned-cart and checkout data follow Shopify settings and applicable requirements.

For customers in the EEA, Shopify International Limited in Ireland is the principal Shopify entity. Data may be processed by Shopify Inc. in Canada, group companies and subprocessors in other countries. Shopify describes reliance on the EU adequacy decision for Canada, Binding Corporate Rules and Standard Contractual Clauses where applicable. The official Google & YouTube Shopify app is connected to the same GA4 property. Depending on the settings used in Shopify, it may transmit ecommerce events to Google. Tracking on Shopify-hosted checkout is governed separately by the settings and privacy choices applicable there, rather than by the custom-site Analytics tag described above.

7. Contact and legacy pre-order forms

The contact form processes name, email address and message. The still-accessible pre-order/contact route may also process a phone or WhatsApp number, country, preferred contact method, optional note, quantity, product and locale. We use these details only to answer the enquiry or take requested pre-contractual steps. Required fields must be provided so that we can respond; without them we cannot handle the request.

The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual communication and otherwise Article 6(1)(f) GDPR, based on our legitimate interest in answering enquiries. Form data is sent by email and is not stored in a separate contact-form database. We retain correspondence until the enquiry is complete and thereafter only as needed for contractual, evidentiary or statutory duties.

8. Email delivery through Resend

Plus Five Five, Inc. (Resend), United States, processes sender and recipient addresses, message content, delivery status and technical delivery data as our email-delivery processor for contact, pre-order and review notifications. The legal bases follow the underlying communication described above and Article 6(1)(f) GDPR for reliable delivery.

Resend's DPA provides Standard Contractual Clauses and describes participation in the EU-US Data Privacy Framework. Delivery metadata is retained according to operational needs, contractual settings and legal requirements. Where open or click measurement is enabled in the email-service domain settings, Resend may additionally process the time, link, IP address and device information associated with an opening or click for delivery analysis.

9. WhatsApp links

WhatsApp is provided as an external link only; no WhatsApp SDK is embedded and Court Objects sends no data to WhatsApp merely because you view this website. Clicking the link opens WhatsApp with a prefilled text. You decide whether to send it. WhatsApp then processes your account, phone, message, device and connection data under its own terms. The recipient is WhatsApp Ireland Limited; international processing and safeguards are described in its privacy information. Communication you initiate is processed under Article 6(1)(b) GDPR or, for general enquiries, Article 6(1)(f) GDPR.

10. Reviews

The review form collects your name, optional city or country, review text, locale and explicit publication consent. Submissions are stored in a database with status and timestamps for moderation; Resend sends an internal notification. Pending and rejected reviews are not public. If approved, the review, name and location are published as consented. You may withdraw publication consent by contacting us; this does not affect earlier lawful processing.

Moderation and publication are based on Article 6(1)(a) GDPR; security and abuse prevention are based on Article 6(1)(f) GDPR. Required review fields are necessary to submit a review. Records are kept while moderation is pending or the review remains published, and afterwards only for removal requests, defence of claims or legal duties. Database and backup copies are processed by our infrastructure providers and removed according to the applicable operational backup and deletion cycles.

11. Ask Court Objects assistant

The assistant sends your message, selected locale and up to six recent conversation messages through our server to the OpenAI Responses API when the provider is configured. OpenAI Ireland Limited/OpenAI, L.L.C. acts as a service provider. Messages are used only to generate the reply and operate and protect the service. Do not enter payment data, passwords, health information or other sensitive information.

The browser keeps the conversation only in current React memory; the website does not persist it in localStorage or a database. Our server sends store:false, which disables application-state storage for the response request but does not mean Zero Data Retention and does not eliminate provider abuse-monitoring logs. OpenAI states that API data is not used to train models by default and that abuse-monitoring logs may be kept for up to 30 days, unless a different approved account control applies or longer retention is legally or operationally required. A short-lived in-memory rate limit processes the requesting IP address for abuse prevention. The legal basis for answering your request is Article 6(1)(b) GDPR and for rate limiting Article 6(1)(f) GDPR. OpenAI may process data internationally under its applicable contractual safeguards. The assistant makes no legally significant automated decisions.

12. Retention and recipients

Unless a more specific period is stated above, we retain personal data only while necessary for the relevant purpose and then erase or restrict it, subject to statutory accounting and retention duties, limitation periods, security needs and the defence of legal claims. Recipients are limited to the providers named above, database and hosting providers, professional advisers and public authorities where legally required. We do not sell personal data.

13. Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, data portability and objection. Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation; direct marketing may be objected to at any time. You may withdraw consent at any time for the future. Withdrawal does not affect the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, workplace or the alleged infringement. For Court Objects in Hesse, the competent authority is the Hessian Commissioner for Data Protection and Freedom of Information.

14. Provision of data and automated decisions

Technical data and necessary browser storage are required to deliver requested website functions. Checkout and required form fields are needed to process the requested purchase or enquiry; without them, the relevant service cannot be provided. Optional Analytics and Marketing consent is not required. We do not use personal data on this site for solely automated decisions that produce legal or similarly significant effects.

15. Privacy contact

For privacy questions or to exercise your rights, contact contact@courtobjects.com.