Your details.
Handled clearly.

Josef Rauscher is responsible for shipping inquiries and studio content. The Bonsai Kreativ association is responsible for workshop registrations. Contact details and further legal information can be found in the Legal notice .

For a shipping inquiry, we process the selected products, first and last name, email address, optional phone number, delivery country, postal code and state or region where applicable, city, an optional message and the time of the inquiry.

Following a successful security check, the website stores the inquiry, product details and contact information in the protected customer management system. This also includes the chosen reply language, processing status, internal notes and sent replies, including quoted shipping costs. Message content and contact details are not written to application logs. Hostinger Mail delivers the internal notification and an acknowledgement; personal replies are sent from the administration area after review.

We process a specific purchase inquiry and take steps towards a contract at your request under Article 6(1)(b) GDPR. Without the information marked as required, we cannot reliably identify your inquiry, assess shipping or reply to you. You may leave optional fields blank.

For agreed purchases and custom orders, Josef Rauscher processes billing and delivery addresses, ordered items, prices, the flat-rate shipping charge and payment status. International shipping additionally involves the goods and consignment information required for customs clearance. Processing serves the performance of the contract and statutory documentation obligations (Article 6(1)(b) and (c) GDPR). Invoices and any customs documents are stored securely and generally retained for seven years from the end of the relevant calendar year; longer statutory retention periods remain applicable where required. Necessary information is shared with recipients, shipping providers, customs representatives and competent authorities for fulfilment.

To recover an interrupted contact inquiry, shipping inquiry or workshop registration safely, the open browser tab stores a random submission identifier and verification code in session storage. This entry contains no contact details or form text. Only a hash of the verification code is stored in the database. This allows the same tab to retrieve the corresponding receipt again; the entry is removed when you explicitly start a new submission.

Automatic confirmations and internal notifications are stored in a protected delivery queue with their recipient, subject, content and delivery status. Interrupted or failed delivery attempts can therefore be checked separately.

Inquiries and messages are retained for as long as necessary for processing, communication, legal obligations or the establishment and defence of claims. They must be deleted when their purpose no longer applies and no retention grounds remain. A non-binding inquiry does not trigger payment or reserve products. The inquiry form does not collect card details or online banking credentials.

The shipping inquiry, contact and workshop registration forms use Cloudflare Turnstile to detect automated entries and abuse. When the service loads, Cloudflare receives connection and browser information, including the IP address and technical details about the browser and device. Cloudflare evaluates these signals to distinguish human from automated access.

Our purpose is to protect the forms and the systems behind them. Where processing is necessary for this purpose and is not overridden by the interests of the person concerned, we rely on Article 6(1)(f) GDPR. Storing or accessing information on your device is also subject to section 165(3) of the Austrian Telecommunications Act 2021: without consent, this is permitted only for statutory exceptions, in particular operations strictly necessary for the service you expressly request.

The generated Turnstile token is verified on the server and is neither stored in our site database nor logged. Information about Cloudflare’s own processing, including improvements to its detection systems, recipients and international data transfers, is available in its privacy policy and data processing agreement. You can also contact us directly by email or phone without using the form.

For workshop registration, we store selected dates, name, address, phone number, email, an optional message, booking and payment status, and internal processing notes. These details are needed to organise the workshop, manage places, communicate and handle billing. We also store the time and version of the accepted participation terms, the registration confirmation and its delivery status.

After successful storage, the association confirms participation on the success page and sends the automatic registration confirmation via Hostinger Mail from office@bonsaikreativ.site to the specified email address. The message contains the selected dates, participation fee and participation terms. A personal payment request follows later; registration does not initiate a payment.

The legal bases are steps towards and performance of the participation contract under Article 6(1)(b) GDPR and applicable statutory retention obligations under Article 6(1)(c) GDPR. Registration data is needed to organise and administer participation; billing records are retained to the extent required by law. Acknowledging this privacy information does not constitute consent to advertising.

For a general contact inquiry, we process the subject, email address, message and time, and optionally your name, phone number and any reference you provide. Following a successful Turnstile check, the site saves these details with an inquiry number and delivery status in a protected contact inbox, separate from customer records. The message is then forwarded via Hostinger Mail to office@bonsaikreativ.site, so that your inquiry is preserved if delivery fails. Your email address appears in the message for a personal reply. Only the authorised owner can access the stored contact inbox. Message content and contact details are not written to application logs.

We process contract-related inquiries under Article 6(1)(b) GDPR. For other matters, our legitimate interest under Article 6(1)(f) GDPR is to respond to the communication you requested and maintain a record of its handling. The purposes and limits described above for inquiries also apply to retention.

For delivery, Hostinger Mail processes sender, recipient, subject, content and delivery information. Further details are available in the Hostinger privacy policy.

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Statutory retention obligations may prevent immediate deletion.

You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of prior processing. You may also lodge a complaint with the Austrian Data Protection Authority or another competent supervisory authority. The inquiry and booking process does not involve automated decision-making with legal or similarly significant effects under Article 22 GDPR.

Please use the contact details in the legal notice and, for shipping inquiries, include the inquiry number where possible.

After your voluntary consent, we use Google Analytics 4 for statistics on selected public overview pages. Before consent and when you decline, the Google service is not loaded and no statistics are sent to Google. Forms, confirmations, the cart and administration, as well as URLs with query parameters or fragments, are excluded. We send fixed page URLs, page titles and language; no form contents, email addresses or individual user accounts. Google Signals, advertising personalisation and automatic enhanced measurement are switched off. Fonts are served by this website; our Facebook and Instagram icons are ordinary links. The social networks are only contacted when you open these links.

Google processes random browser identifiers, technical browser and connection data and approximate location information. Google receives your IP address when the connection is made; according to Google, it is not logged or stored in Google Analytics. Our statistics cookies “bk_stats_ga” and “bk_stats_ga_NSTYB907D8” apply only to bonsaikreativ.com and are session cookies. Browser session restoration can extend their lifetime.

The statistics help us understand how our website is used. The legal basis is your consent under Article 6(1)(a) GDPR and Section 165(3) TKG 2021. You can use the website without consenting and switch statistics off at any time via “Cookie settings” in the footer. Withdrawal stops future measurement and removes our statistics cookies; it does not automatically delete data already received by Google. The Analytics property is configured to retain event data for two months and user data for 14 months. New user activity resets the retention period for user data. These periods do not apply to aggregated standard reports.

The provider is Google; for users in the European Economic Area, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is responsible. Google may also process data in the USA. Details about processing, recipients and transfer safeguards are available in the Google Analytics privacy information, the Google data processing terms and the information about international data transfers.

When you select products, the cart stores only product identifiers and quantities in your browser tab’s session storage under “bonsai-kreativ-cart-v1”. The entry is removed when the cart is emptied. An empty cart is not stored for a simple page visit. Any selection remaining from the previous persistent storage is migrated once and removed from that storage.

Session storage keeps your requested selection when you navigate or reload. It normally ends with the tab session; your browser’s recovery feature may restore the session. The submission identifier for form confirmations described above is also kept only in session storage.

These functions serve the cart selection or form submission you expressly requested. The exception under section 165(3) of the Austrian Telecommunications Act 2021 applies to strictly necessary access, which does not require cookie consent. Where personal data is involved, the legal bases described for the respective process apply.

In the knowledge and workshop archives, your browser remembers the posts already loaded and your reading position in the respective history entry, so you can continue reading from the same point when you go back.

You can open information about the necessary storage functions at any time via “Cookie settings” in the footer. When you confirm your selection there, the “bk_consent” cookie stores your decision, the version of the settings and a random consent ID for a maximum of 180 days. It applies only to this website and is not used for advertising or usage analytics. Cookie settings are served locally by our website.

Cloudflare may use the “cf_clearance” and “__cf_bm” cookies for security checks and the detection of automated access. OpenAI Sites may also set the platform cookies “__Host-chatgpt_sites_session” and “__Host-appgarden-visitor”. These platform cookies are managed by the hosting provider. Further provider information is available in the “Operation & administration” section.

The website runs on OpenAI Sites using Cloudflare infrastructure. Requests involve processing the connection data needed for delivery and security, including IP address, requested address, time and technical request information. The purpose is reliable and secure operation; the legal basis is Article 6(1)(f) GDPR. The form, administration and document data described here is held in protected data or file storage within this infrastructure.

Access to the protected administration area is restricted to authorised people. Platform sign-in provides a user identifier or email address and, where applicable, a name. The additional editorial access uses a protected password verification value and session records. The “__Host-bk-editorial” cookie lasts no more than eight hours; unlocking is required again after 30 minutes of inactivity. Signing out ends the session. Security events may include time, event type and IP address; entries older than seven days are cleared the next time security administration is opened.

Selected navigation favourites and settings in the administration area are saved in local browser storage without automatic expiry; list filters remain in session storage. They support your selected way of using the interface and can be removed through your browser’s storage settings. The legal basis for access security is Article 6(1)(f) GDPR; the necessary session cookie supports expressly requested protected access under section 165(3) of the Austrian Telecommunications Act 2021.

Further provider information is available from OpenAI, Cloudflare and Hostinger. These services may also process data outside the EEA. Such transfers must meet the requirements of Articles 44 et seq. GDPR, in particular an applicable adequacy decision or appropriate safeguards such as EU standard contractual clauses. Please contact our privacy contact for details of the recipients and transfer grounds used in a specific case.

Our articles, artist profiles and workshop reports may include the names of authors and contributors and photographs showing identifiable people. Their purpose is to share work and knowledge and document our activities. Published content is accessible to the audience authorised to visit the website.

Where publication is based on consent, Article 6(1)(a) GDPR applies; consent may be withdrawn for the future. Publication based on legitimate interests under Article 6(1)(f) GDPR requires a balancing assessment that considers the people shown or named. Workshop registration alone does not constitute consent to the publication of photographs. Please use our privacy contact for questions about a specific photograph or mention of a name.

Articles and related editorial records are retained for as long as needed for publication, editing and the necessary evidence of rights. Personal content must be removed when these purposes and other legal retention grounds no longer apply. The data subject rights described above also apply here.