DE/EN
Legal

Privacy Policy

Last updated: September 2026

Protecting your data matters to us. This website is deliberately built lean: no advertising networks, no social media plugins, no external fonts. No cookies are set to operate the site.

Anonymous audience measurement only takes place if you expressly consent on your first visit. If you decline or make no choice, no audience measurement takes place. Your refusal itself is noted in your browser's local storage so that we do not ask again on every visit. Technically necessary server log files are created regardless of your choice (section 3). You can change your decision here at any time:

1. Controller

We are not required to appoint a data protection officer because the conditions of Section 38 of the German Federal Data Protection Act (BDSG) are not met; no data protection officer has therefore been appointed. For any data protection matter, please contact us at the e-mail address above.

2. Hosting

This website is hosted by STRATO AG, Otto-Ostrowski-Strasse 7, 10249 Berlin, Germany. When you access the site, STRATO processes the technically necessary connection data as our processor. A data processing agreement pursuant to Art. 28 GDPR is in place.

The servers are located in Germany; no transfer to a third country takes place. The legal basis is our legitimate interest in a secure and fast website, Art. 6 (1) (f) GDPR.

3. Server log files

Each time the site is accessed, data transmitted by your browser is recorded automatically:

  • the address requested, plus date and time of access
  • volume of data transferred and confirmation of successful retrieval
  • browser type and version, operating system used
  • truncated IP address and the previously visited page

This data is technically necessary to deliver the site, ensure its stability and detect attacks. The legal basis is Art. 6 (1) (f) GDPR. It is not combined with other data and is not evaluated for advertising purposes. Logs are deleted after no more than 30 days.

4. Fonts

The fonts used, Cormorant Garamond and Jost, are stored on and served from our own server. There is no connection to Google Fonts or any other external service. Your IP address is therefore not transmitted to any third party.

5. Contacting us

If you contact us by e-mail, telephone or via the form on this website, we process the details you provide — usually your name, contact details and your enquiry — solely in order to handle your request.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry serves the preparation or performance of a contract, otherwise Art. 6 (1) (f) GDPR based on our interest in responding to enquiries. Your details remain with us until you ask us to delete them or the purpose ceases to apply; mandatory statutory retention periods, in particular under commercial and tax law, remain unaffected.

Via the contact form we collect your name, phone number and email address, and optionally your company and message. The details are sent by email to our mailbox at STRATO AG and processed there; they are not stored in a website database and are not passed on to any further service provider. We automatically send a confirmation to the email address you provide, containing a summary of your enquiry and our direct contact details. The email address is therefore a mandatory field.

6. Trade area

Access to the trade area is reserved for commercial clients. For activation we process the company name, contact person, contact details and evidence of commercial status. The legal basis is Art. 6 (1) (b) GDPR. Access credentials are used solely for access control and are deleted once the business relationship ends, unless retention obligations apply.

For sign-in we store the email address, company name, contact person and password. The password is stored only as a non-reversible hash (bcrypt) and cannot be read by us. Signing in sets a strictly necessary session cookie (gd_haendler), permitted without consent under Section 25 (2) no. 2 TDDDG, which expires on sign-out or after two hours of inactivity at the latest.

To protect against attacks we log sign-ins, failed attempts and changes to accounts, recording the time, the action, the email address and a shortened IP address; the final segment of the IP address is not stored. After five failed attempts, sign-in is blocked for 15 minutes. The legal basis is our legitimate interest in the security of the protected area (Art. 6 (1) (f) GDPR). Logs are deleted after 90 days.

7. Local storage in your browser

The language version follows solely from the address you open (/, /en/); nothing is stored in your browser for this. The only item we store in your browser's local storage is your decision on audience measurement (section 8). It never leaves your device and is not transmitted to us. You can delete it at any time via your browser settings.

8. Consent and audience measurement

On your first visit we ask whether we may anonymously measure which pages are viewed. We store your answer in your browser’s local storage under the name gd_consent. We also record the time of your decision and the version of this notice. These entries never leave your device and contain only the value “granted” or “denied”, the timestamp and the text version.

No audience measurement is currently active: no measurement ID has been entered, so nothing is measured and no connection to Google is established even if you consent. Once measurement is activated, and if you consent, we will use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Acting as our processor under Art. 28 GDPR, Google processes truncated IP addresses, pages viewed, time on page, approximate location at city level, device and browser type, and the referring page. We have disabled advertising and personalisation signals; no linking to Google accounts takes place. The data is deleted after 14 months.

The legal basis is your consent under Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG. A transfer to the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework, so an adequacy decision under Art. 45 GDPR applies, supplemented by EU Standard Contractual Clauses.

Your consent is voluntary. You may withdraw it at any time with one click at the top of this page, without any disadvantage to you. As long as you do not consent, no Google script is loaded and no connection to Google is established.

9. Encryption

This website is delivered exclusively over an encrypted connection, indicated by https and the padlock symbol in your browser. Data you send us therefore cannot readily be read by third parties.

10. Your rights

You may withdraw consent to audience measurement at any time with one click at the top of this page. In addition, you have the right at any time to:

  • access the data stored about you, Art. 15 GDPR
  • rectification of inaccurate data, Art. 16 GDPR
  • erasure, Art. 17 GDPR, and restriction of processing, Art. 18 GDPR
  • data portability, Art. 20 GDPR
  • object to processing based on Art. 6 (1) (f) GDPR, Art. 21 GDPR
  • withdraw consent with effect for the future, Art. 7 (3) GDPR

A short message to info@georgina-diamond.com is sufficient.

11. Right to lodge a complaint

If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with a supervisory authority. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
datenschutz.hessen.de

12. Changes

We will amend this statement if our website or the legal situation changes. The version published here applies in each case. The date of the current version is shown above.