Privacy

Controller

Atemis GmbH
Trippstadter Straße 110
67663 Kaiserslautern, Germany
Managing Director: Michael Pirro
requests@grailconcierge.com · +49 175 3228888

Visiting the website

When you open this site, our server records the usual technical access data (IP address, date and time, requested page, browser and operating system, referring page). This is necessary to deliver the site and keep it secure (Art. 6 (1) (f) GDPR). Access logs are deleted after 14 days.

This site sets no cookies and uses no analytics or tracking: fonts, scripts and styles are served from our own server. Visitor numbers are derived from our own server log with anonymised IP addresses. The only external component is the spam check on the request form, described below.

Spam protection on the request form

The request form uses Cloudflare Turnstile (Cloudflare, Inc.) to tell people from automated bots. When you use the form, your browser loads a small script from Cloudflare, which processes your IP address and technical browser characteristics to make that decision. Turnstile does not set advertising cookies and does not track you across websites. Legal basis is our legitimate interest in protecting the form from abuse (Art. 6 (1) (f) GDPR). Cloudflare's privacy policy: cloudflare.com/privacypolicy. If you prefer not to use it, write to us by e-mail instead.

Requests via form, e-mail or WhatsApp

When you send a request, we process the details you provide (name, e-mail address, phone number, delivery country, product wishes, budget range and any notes) to answer you and, if you engage us, to carry out the engagement (Art. 6 (1) (b) GDPR). Form submissions are transmitted over an encrypted connection to our mailbox; they are not stored in a separate database. To prevent abuse, the form handler temporarily records a hashed form of your IP address for one hour.

If you contact us via WhatsApp, WhatsApp Ireland Ltd. processes your data under its own terms. Please use e-mail if you prefer not to use WhatsApp.

Engagements

Where an engagement is concluded, we additionally process delivery address, payment details and shipment data, and share what is strictly necessary with our carriers (DHL, UPS or a specialised courier) and insurers to deliver and insure your consignment. Commercial and tax law require us to retain invoices and related correspondence for up to ten years (Art. 6 (1) (c) GDPR).

Retention

Request data that does not lead to an engagement is deleted no later than twelve months after our last contact, unless you ask us to delete it earlier.

Your rights

• Access to the personal data we hold about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17) and restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interest (Art. 21)
• Complaint to a supervisory authority, for us, the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (Mainz, Germany)

To exercise any of these rights, write to requests@grailconcierge.com.

Changes

This notice is dated 28.08.2026 and will be updated if our processing changes.