Privacy notice

1. Controller and contact

The controller responsible for processing personal data is:

Represented by the partners Gökce Dalkiran and Derya Ayirtman.

Email: hello@pitandpixel.com

Pit & Pixel is a brand and an offer of this partnership. For privacy questions or to exercise your rights, please use the email or postal address above.

2. Website visits and hosting

Vercel Inc. hosts the static pages and the project enquiry endpoint. Connections involve technical data: IP address, request date and time, requested URL, browser and operating-system information, referring page (referrer) if supplied, and response and security data.

This data is needed to deliver the website, address faults and prevent abuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, reliable operation of our public website.

Our application code does not log form content, maintain a customer database or create IP-based customer profiles. This does not mean that hosting generates no logs or security data. See Vercel’s privacy notice for further information.

3. Project enquiries, drafts and clipboard

The project enquiry form collects project type, garage or business name, market (United Kingdom or Germany), contact name and contact email. We need these required fields to identify and handle your enquiry. Your website and free-text requirements are optional. The chosen language, a technical request identifier and anti-spam validation data are also processed.

Drafts and previews remain in page memory. Your brief is submitted only when you explicitly choose “Send enquiry” after reviewing it. Resetting, leaving or reloading clears the page data; it does not delete enquiries already sent to email or provider systems.

Only choosing “Copy brief” writes the text to your device clipboard. That copy may remain after resetting the page and may be accessible to other apps. Copying does not send an enquiry.

You can alternatively email hello@pitandpixel.com. We then process your sender and contact details, message content and technical data associated with the communication. Please do not submit sensitive information or personal data about your customers or vehicle owners, either in the form or by email.

4. Communication purposes and legal bases

We use enquiries to assess and respond to the requested website project, prepare an offer and communicate with you about it. An enquiry does not automatically enrol you in a newsletter, place an order or book a garage appointment.

• Art. 6(1)(b) GDPR applies to pre-contractual steps you request where you are an individual who may personally become the contracting party.
• Art. 6(1)(f) GDPR applies to contact people acting for businesses and general business correspondence. Our legitimate interest is handling business enquiries and maintaining the relevant business relationship.
• Art. 6(1)(c) GDPR applies where statutory retention or other legal duties require processing.

Handling your enquiry does not require blanket consent to marketing or to all processing of personal data.

5. Email delivery and recipients

After you explicitly send, the enquiry first reaches the Vercel endpoint on the same website origin. The endpoint passes the data server-side to Resend (Plus Five Five, Inc.) for email delivery to Pit & Pixel. The enquiry includes your brief and contact details; your email address lets us reply.

Project enquiries are delivered to hello@pitandpixel.com, hosted using Private Email from Namecheap, Inc. We also receive direct emails and send replies through this mailbox. Message contents, sender and recipient details, and technical delivery data are processed and stored there.

Earlier correspondence may remain in the operator’s previous Gmail mailbox until the retention purposes described below no longer apply. New form enquiries are no longer delivered to that Gmail mailbox. Correspondence is accessible only to people authorised to handle it and to the providers involved in supplying their services.

Further information: Resend’s privacy policy and Google’s privacy policy.

Information about the business mailbox: Namecheap’s privacy policy.

6. How long data is kept

Unsent drafts exist only in page memory, as described above. We keep email correspondence while it is needed to handle your enquiry or the business relationship. We retain it further where statutory duties or the establishment, exercise or defence of legal claims require this. When those purposes and duties no longer apply, the data is deleted.

Technical hosting and security data is retained only for its operational and security purposes and under the applicable provider arrangements.

Resend’s published privacy information states a 30-day retention period for email and log data on standard Free, Pro and Scale plans. This is a provider policy and does not mean that correspondence in our Gmail or Namecheap mailboxes is deleted after 30 days.

7. International processing and safeguards

Vercel and Resend have US operations. Resend states that message content and logs are stored in the United States. Its “eu-west-1” region controls sending and routing, not storage location; it does not mean EU-only data storage. Google also processes data internationally. Data may therefore be processed outside the EU, EEA and United Kingdom, where different data protection rules apply.

The published data processing addenda of Vercel and Resend provide standard contractual clause arrangements as safeguards for international transfers. Google’s data transfer information explains its use of adequacy decisions and standard contractual clauses.

Namecheap operates its Private Email servers in the United States. Its published data processing addendum includes standard contractual clause arrangements for international transfers.

You can request information about the relevant safeguards and, where applicable, a copy by emailing hello@pitandpixel.com.

8. Cookies, local data and external content

This website uses no analytics or advertising pixels and no social trackers. It does not embed third-party fonts, maps or videos. We use system fonts; portfolio photographs are served locally with the website.

The application code sets no cookies and uses neither localStorage nor sessionStorage. The language choice is in the URL, and form inputs remain in page memory until explicit submission. Necessary hosting-provider security functionality may process technical data and may use essential security cookies where needed.

Because we use no optional tracking or optional storage on your device, we currently show no consent banner. If such functionality is added, we will reassess the requirements and obtain consent before using it where required.

9. Fictional garage concepts

Northline Auto, Form 01 and Maple Yard are fictional demonstrations. Their sample forms do not send enquiries to a garage, create a customer record or book real appointments. Please enter invented details only. Inputs stay in page memory and are cleared on reset, leaving or reloading. Visits to the demo pages still generate the normal hosting data described in section 2.

10. Your rights and complaints

Subject to the applicable statutory conditions, you have rights of access, correction, deletion, restriction of processing and data portability.

Objection: Where processing is based on legitimate interests under Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. Where processing relies on your consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing before it was withdrawn.

For these requests, contact hello@pitandpixel.com or use the postal address above. You may also complain to a competent data protection supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information). UK visitors may also contact the Information Commissioner’s Office (ICO).

11. Automated decisions and AI

This website does not make automated decisions producing legal or similarly significant effects under Art. 22 GDPR. No AI chat or phone agent is currently deployed on the website.

12. Security and changes

We use HTTPS for the website and limit access to personal data to authorised people. Even with protective measures, absolute security during transmission and storage cannot be guaranteed.

This notice is dated 16 September 2026. We update it when the actual services or data flows change.