Privacy Policy

Version 2026-10 · PETDUO 5R™ website and diagnostic services

1. Controller · 2. Visiting the website · 3. Ordering a diagnostic · 4. Online withdrawal · 5. Waitlist · 6. Free resource & newsletter · 7. Contacting us · 8. AI-assisted tools · 9. Service providers · 10. Transfers outside the EEA · 11. Retention · 12. Security & confidentiality · 13. Your rights · 14. Changes

1. Controller

The controller responsible for this website and for the PETDUO 5R™ diagnostic services is:

Gelfei, Anne Louise und Merlino, David Elie GbR, trading as Cause GbR
Raum 210 – ARTtraktiv Vol. 1
Beilsteiner Straße 121
12681 Berlin, Germany
Email: 5r@petduo.com
Telephone: +49 151 70839699

We have not appointed a data protection officer, as we are not required to do so. For any privacy question or request, write to 5r@petduo.com.

2. Visiting the Website

Hosting and server logs. This website and our order system are hosted by Namecheap, Inc. When you open a page, the server processes technical connection data: IP address, date and time of the request, requested page or file, referrer, browser and operating system, and status and error information. This is necessary to deliver the website and to keep it secure (Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website). Access logs archived in our hosting account are deleted automatically after 30 days. The hosting provider may keep its own server logs for a limited period for security purposes. Our hosting control panel also automatically generates statistics from these server logs (AWStats); this cannot be disabled on our hosting plan. We do not use these statistics for marketing or to identify visitors.

No cookies, analytics or tracking. This website does not set cookies and does not use analytics, advertising, tracking pixels or social-media plugins. Fonts are served from our own server; no third-party font service is contacted. If this changes, we will update this policy and ask for your consent where required before activating such technologies.

Availability check. When the diagnostics section loads, the page asks our server whether each diagnostic is currently available. This request contains no personal data beyond the technical connection data described above.

External pages. Payment (Stripe), the onboarding form and the waitlist (Tally) open on the websites of those providers. Their own privacy information also applies there; see section 9.

3. Ordering a Diagnostic

3.1 Order confirmation page and order record

When you select "Book", our order confirmation page asks you to accept the Terms and to request early performance of the service. When you continue to payment, we create an order record in our own database containing:

• the diagnostic ordered, a random internal order identifier, the order reference we assign to your case (format PTD-YYYY-NNN), and the date, time and status of the order;
• the date and time of your acceptance of the Terms and of your early-performance request, and the version of the exact wording you confirmed;
• the identifiers of the Stripe payment session and payment;
• after payment, the following data received from Stripe: your email address, the amount paid, the country of your billing details and the invoice number.

We do not store your card details, your name or your postal address in this record, and our order system does not store your IP address.

Purpose and legal basis: concluding and performing the contract, managing weekly capacity and matching your payment to your onboarding form (Art. 6(1)(b) GDPR); keeping evidence of your confirmations and of the order (Art. 6(1)(f) GDPR; our legitimate interest is being able to prove the content of the contract and of your early-performance request).

3.2 Payment (Stripe)

Payments are processed by Stripe. On the Stripe payment page you provide your email address, your payment details, your name and your billing address (street, postcode, city and country), either by entering them or through Apple Pay or Google Pay; a complete billing address is required for every order. Stripe creates the invoice and receipt for your payment, which are sent to you by email; your name and billing address appear on the invoice. Our order system stores only the following data received from Stripe: the payment status, your email address, the amount, the billing country and the invoice number. Your name and full billing address are not stored in our order system; they remain in our Stripe account. We never receive your full card details.

We use your billing address to issue correct invoices and to check the VAT treatment of your order, which depends on where you are resident. A billing address is only an initial indication of residence. For this check we may also look at information Stripe provides about your payment, such as the country in which your card was issued. If this information suggests that you live outside the EU, we may ask you by email to confirm your full residential address and that you purchased as a private individual, and we keep that confirmation with our invoicing records. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with German VAT and accounting obligations (Art. 6(1)(c) GDPR).

• Stripe processes payment data on our behalf as our processor, and also as an independent controller for its own purposes, such as fraud prevention and compliance with financial regulations.
• On the Stripe payment page you may choose to save your details with Link, Stripe's payment service. This is optional and is governed by Stripe's own terms and privacy policy.
• If you pay with Apple Pay or Google Pay, Apple or Google also process data under their own terms.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR); invoices and accounting records are kept to comply with German tax and commercial law (Art. 6(1)(c) GDPR). Privacy information: stripe.com/privacy.

3.3 Onboarding form and track upload (Tally)

After payment you complete the onboarding form for your diagnostic, provided by Tally. The form collects: artist name, email address, track title, preferred diagnostic language, genre, BPM, production stage, artistic intention, what you are unsure about (optional), intended destination, your WAV file, and your confirmations regarding rights and privacy. The form also receives the identifier of your Stripe payment session, which we use only to match your submission to your paid order.

Each submission is sent to us as an email notification at 5r@petduo.com. Uploaded files are stored by Tally until we delete them.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Privacy information: tally.so/help/privacy-policy.

3.4 Producing and delivering the diagnostic

To produce your diagnostic we listen to and analyse your track, make internal notes and create the written diagnostic and, for a Video Diagnostic, a video walkthrough that may contain short excerpts of your track. We may keep temporary working copies of your track for this purpose.

Working copies, internal notes, written diagnostics and video walkthroughs are stored in our Google Workspace account (Google Drive). The written diagnostic is sent to you by email. The video walkthrough is provided through a private Google Drive link that is shared only with you.

For a Re-Diagnostic we use the records of the previous diagnostic of the same track to compare the versions and to check eligibility.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

3.5 Contract confirmation and service emails

We send you a contract confirmation by email, with the Terms and the withdrawal information attached, and we contact you by email about your order (for example, if information or a usable file is missing, or to remind you to complete the onboarding form). Legal basis: Art. 6(1)(b) and (c) GDPR (§ 312f BGB requires the contract confirmation).

Is providing the data required? To order a diagnostic, you must provide the data requested on the order confirmation page, on the Stripe payment page and in the onboarding form. Without it we cannot conclude or perform the contract. Fields marked optional can be left empty.

4. Online Withdrawal Function

If you use our online withdrawal function, we record: your name, the email address for the acknowledgement, the diagnostic, the order reference and order date you enter, the text of your withdrawal declaration, the date and time of receipt on our server, and whether and when the acknowledgement was sent. We send the acknowledgement of receipt to your email address from noreply@petduo.com (replies go to 5r@petduo.com) and a copy to 5r@petduo.com, and we use the data to process your withdrawal and refund.

Legal basis: compliance with our legal obligation to acknowledge receipt (§ 356a BGB; Art. 6(1)(c) GDPR), processing of the withdrawal (Art. 6(1)(b) GDPR) and keeping evidence of the declaration and its timing (Art. 6(1)(f) GDPR). If you withdraw by email, post or telephone, we process the data you give us for the same purposes.

5. Waitlist

If a diagnostic is fully booked, you can join its waitlist through a form provided by Tally. We collect your name, email address, optional artist name and the diagnostic you are waiting for, and we use them only to tell you when a place becomes available. There is no newsletter and no obligation to purchase.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form. You can withdraw it at any time by email to 5r@petduo.com; this does not affect processing carried out before the withdrawal. Waitlist entries are deleted after six months.

6. Free Resource & Newsletter (Kit)

When you request the free PDF through the form on our website, we and our email service provider Kit process your email address, your optional first name, whether you ticked the optional newsletter box, your confirmation and subscription status, and the date and time of subscription and confirmation where recorded. Kit may also process technical information generated during submission and confirmation. The page does not load Kit's scripts; your data is sent to Kit only when you submit the form.

• Sending the confirmation email and the free PDF: steps taken at your request (Art. 6(1)(b) GDPR). Not ticking the newsletter box does not prevent delivery of the PDF.
• Occasional PETDUO 5R™ emails: only if you tick the optional box and confirm by double opt-in (consent, Art. 6(1)(a) GDPR). You can unsubscribe at any time through the link in every email or by writing to 5r@petduo.com; this does not affect processing carried out before.

Kit, Inc. is based in the United States (see section 10). Privacy information: kit.com/privacy; Data Processing Addendum: kit.com/dpa.

7. Contacting Us

If you email us, we process your email address, the content of your message and any attachments to answer you. Our mailboxes at petduo.com are hosted by Namecheap (Private Email).

Our telephone number is provided by Telekom Deutschland GmbH under the fraenk brand and is answered by voicemail. If you leave a message, the recording and your telephone number are stored in the provider’s voicemail system. We check voicemail every business day and delete the recording once the message has been processed. The provider may also delete messages automatically under its own technical retention settings. If the message concerns an order or withdrawal, we record the relevant content in our order or withdrawal records, which are retained for the periods stated in section 11.

Legal basis: Art. 6(1)(b) GDPR where your message relates to an order or a possible order; otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).

8. AI-Assisted Tools

We may use AI-assisted tools only to organise or refine generic, de-identified observations. We do not enter any customer or case identifier, name, artist name, email address, audio file, track title, order data or other information that allows the material to be linked to a customer. AI-assisted output does not replace our professional assessment. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

9. Service Providers and Other Recipients

We use the following service providers. Where they process personal data on our behalf, they do so as processors under a data processing agreement (Art. 28 GDPR).

• Namecheap, Inc. (USA) — website hosting, our order database, our online withdrawal function and our email (Private Email). Privacy information: namecheap.com/legal/general/privacy-policy.
• Stripe — payment processing, invoices and receipts; processor and, for its own purposes, independent controller (section 3.2). Privacy information: stripe.com/privacy.
• Tally BV (Belgium) — onboarding forms, track upload and waitlist. According to Tally, form data is hosted with Google Cloud in Belgium and uploaded files are stored with Cloudflare in the EU; email notifications of submissions are sent through SendGrid in the USA. Privacy information: tally.so/help/privacy-policy.
• Kit, Inc. (USA) — free resource and newsletter (section 6).
• Google Ireland Limited (Ireland) — Google Workspace (Google Drive) for storing working files, diagnostics and video walkthroughs and for the private video link (section 3.4). Privacy information: policies.google.com/privacy.
• Telekom Deutschland GmbH (Germany), operating the fraenk brand — telephone and voicemail (section 7).
• Our tax advisor and the tax authorities — invoices and accounting records, where required by law.

We do not sell your data and we do not use it for advertising profiles.

10. Transfers Outside the EEA

Some providers process personal data in the United States:

• Namecheap — the servers for this website, our order database and our email are located in the United States. Namecheap's Data Processing Addendum provides for the European Commission's Standard Contractual Clauses (controller to processor) for these transfers.
• Tally — email notifications of submissions are sent through SendGrid (USA).
• Google — data stored in Google Workspace may be processed in the United States or other countries where Google operates. Google's Cloud Data Processing Addendum provides for the Standard Contractual Clauses, and Google LLC is certified under the EU–U.S. Data Privacy Framework.
• Kit — subscription data is processed in the United States. Kit's Data Processing Addendum identifies the EU–U.S. Data Privacy Framework where applicable and, where required, the Standard Contractual Clauses.
• Stripe — may transfer data to the United States on the basis of the safeguards described in its privacy policy.

Where no adequacy decision applies, transfers are based on appropriate safeguards under Chapter V GDPR, in particular the Standard Contractual Clauses. You can request a copy of the relevant safeguards from us. These safeguards cannot rule out every risk, in particular access by public authorities in the recipient country.

11. Retention

We keep personal data only as long as necessary for the purposes above, and then delete it unless the law requires us to keep it.

• Email address in our order record — deleted 90 days after delivery of the diagnostic.
• Rest of the order record (order reference, service, times, your confirmations and their wording version, payment identifiers, billing country, invoice number) — kept as evidence of the contract until the end of the third calendar year after the order.
• Onboarding form submissions and uploaded WAV files (Tally) — deleted within 90 days after delivery of the diagnostic. Tally removes deleted data from its backups within a further 90 days.
• Temporary working copies and working files — deleted within 90 days after delivery.
• Video walkthrough — the private link remains available for 90 days after delivery; the video may then be deleted. Please download and keep your copy within this period.
• Written diagnostics, internal case records and service correspondence — up to three years, to handle a Re-Diagnostic and to establish or defend legal claims.
• Online withdrawal declarations — until the end of the third calendar year after receipt.
• Invoices and accounting records — for the periods required by German tax and commercial law. These records are kept separately (with Stripe and in our accounting) and are not affected by the 90-day deletion of operational data.
• Waitlist — six months, or earlier if you withdraw your consent.
• Free resource and newsletter — as long as needed to deliver the PDF and administer your subscription; newsletter data until you unsubscribe. A short suppression record may be kept so that your opt-out is respected.
• Voicemail — the recording is deleted from the mailbox once your message has been processed. Where we record its content in our order or withdrawal records, those records are kept for the periods stated above.

Some data may have to be kept longer where the law requires it. In that case we restrict its use to that purpose.

12. Security & Confidentiality

Data is transmitted to this website over encrypted HTTPS connections. Access to orders, submissions, audio files, diagnostics and correspondence is restricted to Anne Louise Gelfei and David Elie Merlino. We use reasonable technical and organisational measures to protect personal data; no system can guarantee absolute security.

Your track is never published, shared with labels or used for promotion without your separate written permission. Feedback is never published as a testimonial without separate written permission.

13. Your Rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• rectification of inaccurate or incomplete data (Art. 16);
• erasure (Art. 17), subject to legal retention obligations;
• restriction of processing (Art. 18);
• data portability (Art. 20);
• object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).

To exercise these rights, write to 5r@petduo.com. We normally respond within one month.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin, Germany
datenschutz-berlin.de

14. Changes to This Policy

We update this policy when our services or the providers we use change. The version shown at the top of this page applies.