~/locale

~/reshape/legal/privacy

Privacy policy

How we process data when you visit our website, use your account or enquire about a project.

Working draft — complete the marked details before public launch.

Controller: [FULL LEGAL PROVIDER NAME], trading as Reshape Media, [COMPLETE BUSINESS ADDRESS]. Send privacy enquiries to info@reshape-media.com.

[ADD THE DATA PROTECTION OFFICER AND CONTACT DETAILS IF ONE HAS BEEN APPOINTED; OTHERWISE REMOVE THIS NOTE].

Your browser transmits information including your IP address, time, requested address, browser/operating-system details and possibly a referring page. These data may be processed in server logs for delivery, troubleshooting and prevention of abuse. The basis is Article 6(1)(f) GDPR and our legitimate interest in reliable, secure operation.

[ADD THIS WEBSITE’S HOSTING PROVIDER AND ADDRESS, ACTUAL SERVER LOCATION AND LOG RETENTION PERIOD]. Our hosting infrastructure is subject to an EU-only server-location requirement, predominantly Germany.

An account processes your username, email address, protected credentials, creation date, session data and optional profile details, avatar and billing address. Signed-in language and appearance choices are linked to your account. Automatically assigned default avatars are supplied locally without contacting an external avatar service.

We use these details to provide the requested account and prepare or perform services under Article 6(1)(b) GDPR. Abuse prevention and security logs rely on Article 6(1)(f). Mandatory fields are needed for the relevant function.

Development, web-design and administration requests contain account contact details, the project brief, technical requirements, budget, timescale and additional messages. A hosting email enquiry contains the information you send us. Do not put passwords or particularly sensitive information in free-text fields.

We process requests to take pre-contractual steps under Article 6(1)(b) GDPR. General or business-related correspondence may rely on Article 6(1)(f), reflecting our interest in responding appropriately. Automated effort estimates support planning; project acceptance or rejection is not based solely on an automated decision.

Reshape Media may provide hosting itself or refer you to a separate provider. The role, contracting party, location and necessary data sharing are identified before an order is placed. A separate provider processes data under its own privacy information. Where processing takes place on instructions, the necessary Article 28 GDPR agreement is concluded.

Access is limited to authorised people and necessary service providers, such as infrastructure, email and, where used, billing providers. [ADD ACTUAL PROVIDERS/RECIPIENTS AND ROLES]. EU server locations do not automatically eliminate international transfers associated with additional external services.

Essential cookies secure sign-in and sessions. Your explicitly selected language and colour preferences are stored locally; the corresponding preference cookies currently last up to one year. Appearance may also remain in local browser storage until deleted. Signed-in users additionally have account preferences.

Strictly necessary device access is governed by section 25(2) TDDDG. Access outside that exception requires prior consent under section 25(1); a statement in this policy does not replace that consent. Any subsequent personal-data processing needs the relevant GDPR basis.

[BEFORE LAUNCH, VERIFY AND DOCUMENT THE ACTUAL STORAGE/COOKIE INVENTORY, DURATIONS, CONSENT MECHANISM AND EXTERNAL EMBEDS].

Google reCAPTCHA is intended for or integrated into access forms. It can transmit IP addresses, browser data and interactions to Google. The European provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. See also Google’s privacy information.

[BEFORE LAUNCH, SPECIFY THE ACTIVE RECAPTCHA VERSION/FORMS, DATA, RETENTION, LEGAL BASIS, REQUIRED CONSENT BEFORE LOADING, AND ANY INTERNATIONAL TRANSFER WITH VALID SAFEGUARDS. DO NOT MERELY CLAIM CONSENT IN THIS POLICY].

[ADD OTHER ACTUAL EXTERNAL RESOURCES, ANALYTICS, NEWSLETTER OR PAYMENT SERVICES IF USED; DO NOT MAKE UNVERIFIED ABSENCE CLAIMS].

Authorised accounts can access assigned files, available versions and system notifications. Account, permission and necessary technical data support delivery under Article 6(1)(b) or (f) GDPR. Personal-data exports are generated privately; confidential export links normally expire after three days.

Transactional messages support your account or a requested service. Promotional newsletters require an appropriate legal basis and an effective unsubscribe route. An email preference screen does not automatically enrol you in a newsletter. [ADD SENDING PROVIDER, SUBSCRIPTION/EVIDENCE PROCESS AND RETENTION IF ACTIVATED].

We keep personal data for as long as needed for the relevant purpose, then erase or anonymise it unless statutory retention or legitimate legal-defence requirements apply. Billing and business records follow the applicable statutory periods.

[ESTABLISH AND ADD ACTUAL RETENTION FOR UNACCEPTED ENQUIRIES, ACCOUNTS, SECURITY LOGS, DOWNLOAD/NOTIFICATION DATA AND BACKUPS]. Account erasure does not automatically erase records subject to a statutory retention duty.

Subject to the legal conditions, you can request access, rectification, erasure, restriction and portability. You may withdraw consent for future processing. You may object on grounds relating to your particular situation to processing based on legitimate interests, and may object to direct marketing at any time.

Contact info@reshape-media.com. Account tools also support export and erasure requests. You may complain to a supervisory authority, particularly where you usually live or work or where an alleged infringement occurred. [ADD THE RELEVANT SUPERVISORY AUTHORITY ONCE THE BUSINESS LOCATION IS CONFIRMED].

Dated 22 October 2026. This working draft covers known functions. Complete the marked business, provider, consent and retention details against the actual operation before public launch.