PINK PANZER

Privacy Policy / Datenschutzerklärung

Last updated: 6 October 2026

We take the protection of your personal data seriously. This Privacy Policy explains how we collect, use and protect personal data when you visit the Pink Panzer website, make a booking or use our co-making studio.

Pink Panzer is operated by Roxane Franc in cooperation with M.Y. Crafts.

1. Controller

The controller responsible for the processing of your personal data is:

Roxane Franc
Saint Julien Strasse 24
5020 Salzburg, Austria
E-mail: roxanefranc@icloud.com
Phone: +43 670 553 4047

Pink Panzer is a brand operated by Roxane Franc and is not a separate legal entity.

For questions regarding your personal data or to exercise your data protection rights, you can contact us using the details above.

2. What personal data we collect

Depending on how you interact with Pink Panzer, we may process:

first and last name
e-mail address
telephone number
billing and invoicing information
address
booking and appointment information
information relating to your use of the studio
communications you send to us
payment and transaction information
technical information required for the secure operation of our website and booking system, such as IP address, browser type and device information

We only collect information that is necessary for the relevant purpose.

3. How we use your personal data

We process your personal data for the following purposes:

Bookings and studio services

We use your data to:

process and manage bookings
manage co-making memberships, passes and sessions
provide access to the Pink Panzer studio
communicate with you about your booking or studio use
administer studio services
process payments and issue invoices

The legal basis for this processing is generally Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or to take steps at your request before entering into a contract.

Communication

We use your contact details to respond to enquiries, booking requests, questions and other communications.

The legal basis is generally Article 6(1)(b) GDPR where the communication relates to a requested service or contractual relationship, or Article 6(1)(f) GDPR where we have a legitimate interest in responding to and managing business communications.

Legal and accounting obligations

We process information necessary to fulfil our legal obligations, including accounting, tax, invoicing and record-keeping requirements.

The legal basis for this processing is Article 6(1)(c) GDPR.

Studio security

Where applicable, we may process personal data for the protection of people, equipment and property, including through security measures such as video surveillance.

The legal basis may be Article 6(1)(f) GDPR, based on our legitimate interest in protecting the studio, its equipment and the people using it, subject to applicable legal requirements.

4. Online booking system

Our Pink Panzer booking system is a web application operated by us and hosted using third-party infrastructure providers.

The application uses:

Vercel for application hosting and deployment.

Supabase for database and related backend infrastructure.

These providers may process technical and booking-related personal data on our behalf as necessary to provide the booking system and its infrastructure.

Supabase provides GDPR-related contractual and technical measures for customers using its services, including a Data Processing Addendum where applicable.

Vercel provides infrastructure for deploying and operating the booking application and states that it acts as a processor for customer data processed through customer applications.

We configure and use these services only to the extent necessary to operate the Pink Panzer booking system.

5. Payments

Payments for Pink Panzer services are processed by Stripe.

When you make a payment, Stripe may process information necessary to complete and secure the transaction, including payment and transaction information.

We do not store your complete payment card details on our own systems.

Stripe processes personal data in accordance with its applicable privacy documentation and data processing arrangements.

6. Analytics and marketing

We do not currently use separate third-party advertising or marketing tracking services on the Pink Panzer booking system.

We may use technical information generated by the website and booking system where this is necessary for the secure operation, maintenance and improvement of the service.

If we introduce additional analytics, advertising or marketing technologies in the future that require additional information or consent, this Privacy Policy and, where applicable, our cookie information will be updated accordingly.

7. Cookies and similar technologies

Our website and booking system may use technically necessary cookies or similar technologies required for functionality, security, authentication and maintaining your session.

We do not use non-essential advertising or marketing cookies unless the applicable legal requirements for their use have been met.

The technologies used may change as we develop the website and booking system.

8. Video surveillance

Parts of the studio may be monitored by video surveillance for security purposes, including the protection of people, property and equipment.

Video surveillance is not used to monitor the creative work or ordinary activities of makers for marketing purposes.

Where video surveillance is operated, appropriate information notices are provided at the relevant locations.

Recordings are retained only for as long as necessary for the stated security purposes and in accordance with applicable legal requirements.

Further information regarding the video surveillance can be obtained from us.

9. Who receives your personal data?

Where necessary, we may share personal data with service providers that support the operation of Pink Panzer.

Depending on the service concerned, these may include:

Vercel — hosting and deployment of the booking application
Supabase — database and backend infrastructure
Stripe — payment processing
IT and technical service providers
accounting and tax service providers
professional advisers
public authorities or courts where legally required

We do not sell your personal data.

Service providers receive access to personal data only to the extent necessary for the services they provide to us or where disclosure is required by law.

Where required, appropriate data processing agreements are maintained with processors.

10. Transfers outside the EU / EEA

Some of the service providers we use may process personal data outside the European Union or European Economic Area.

Where personal data is transferred to a third country, we ensure that an appropriate legal mechanism under applicable data protection law is in place, such as an adequacy decision or appropriate safeguards under Chapter V GDPR.

11. How long do we keep your data?

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or where we are legally required to retain it.

In particular:

booking and customer information is retained for as long as necessary to administer the customer relationship;
accounting and tax records are retained for the periods required under applicable Austrian law;
information required to establish, exercise or defend legal claims may be retained for the duration of the relevant limitation periods;
technical data is retained only for as long as reasonably necessary for the operation and security of our systems.

Once personal data is no longer required, it is deleted or anonymised where technically and legally possible.

12. Is providing personal data mandatory?

Certain personal data is necessary to make and administer a booking, enter into a contractual relationship with us and provide the requested services.

If you do not provide the information necessary for these purposes, we may not be able to process your booking or provide the requested service.

13. Your rights

Under the GDPR, you have the following rights, subject to the applicable legal requirements:

Right of access — you can request information about the personal data we process about you.
Right to rectification — you can request correction of inaccurate or incomplete data.
Right to erasure — you can request deletion of your personal data where the legal requirements are met.
Right to restriction of processing — you can request that processing be restricted in certain circumstances.
Right to data portability — you may request to receive certain personal data in a structured, commonly used and machine-readable format.
Right to object — you may object to certain processing based on legitimate interests.
Right to withdraw consent — where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the contact details above.

You also have the right to lodge a complaint with the competent data protection supervisory authority:

Österreichische Datenschutzbehörde (DSB)
Barichgasse 40–42
1030 Vienna, Austria
E-mail: dsb@dsb.gv.at

14. Automated decision-making

We do not use your personal data for automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.

15. Data security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.

However, no transmission or storage system can be guaranteed to be completely secure.