Privacy Policy

Personal data (usually referred to just as “data” below) will only be processed by us to the extent necessary and for the purpose of providing a functional and user-friendly website, including its contents, and the services offered there.

This privacy policy explains which data we process when you visit www.essential-grid.com, for what purpose, on which legal basis and for how long. Terms such as “personal data” and “processing” are used as defined in Art. 4 of Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”).

The Slider Revolution and Essential Grid plugins will not collect any personal data in order to send them to us (please check third parties though, such as YouTube or Vimeo). On this website both plugins run on our own server and load no third-party trackers; the only third parties your browser meets here are named in sections 3, 5 and 8.

Information About Us
Your Rights
Hosting, Server Log Files and Cloudflare
Cookies
Customer Account, Purchases and Support
Contact by E-Mail
Newsletter
Embedded Videos
Links to Other Websites
Data Retention and Deletion
Facebook and Instagram Data in Essential Grid
Changes to This Policy

1. Information About Us

Controller for the purposes of the General Data Protection Regulation (GDPR):

Name: ThemePunch OHG
Address: c/o Startplatz, Im Mediapark 5, 50670 Köln, Germany
Represented by: Krisztian Horvath, Moritz Praetorius, Dirk Gavor
Register: Handelsregister, Amtsgericht Koeln, A 32058
Telephone: +49 221 16836020 (No Support!)
Email: [email protected]

Contact for data protection: [email protected]

2. Your Rights

Under the GDPR you have the right to:

access your data (Art. 15 GDPR)
have incorrect data corrected (Art. 16 GDPR)
have your data deleted (Art. 17 GDPR)
restrict the processing (Art. 18 GDPR)
receive your data in a portable format (Art. 20 GDPR)
object to processing based on our legitimate interests (Art. 21 GDPR)
withdraw a consent at any time with effect for the future (Art. 7 Para. 3 GDPR)

To use these rights, write to [email protected]. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), for example the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, https://www.ldi.nrw.de.

3. Hosting, Server Log Files and Cloudflare

This website is hosted by DomainFactory GmbH, c/o WeWork, Neuturmstrasse 5, 80331 München, Germany, on a server in Germany. DomainFactory processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

Each time you open a page, the server records in its log files: your IP address, the date and time, the page or file requested, the HTTP status, the amount of data sent, the referring page (referrer) and your browser’s user agent. We need this data to deliver the website, to keep it secure and to find errors. The logs are kept only for a short time and then deleted; data needed to clear up a security incident is kept until the incident is resolved.

Legal basis: our legitimate interest in a secure and working website (Art. 6 Para. 1 lit. f GDPR).

Cloudflare

To secure our website and to make it load faster, all requests go through the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (content delivery network, cache and protection against attacks). Cloudflare receives the same request data as our server, including your IP address, and processes it on our behalf under its data processing addendum. Cloudflare may also process the data in the USA; Cloudflare is certified under the EU-US Data Privacy Framework, and its addendum includes the EU’s Standard Contractual Clauses.

Legal basis: our legitimate interest in a secure and fast website (Art. 6 Para. 1 lit. f GDPR).

4. Cookies

This website sets no cookies for analytics, advertising or tracking, and loads no analytics or advertising service. Opening a page sets no cookie of ours. We set cookies only where a function needs them:

Demo shop: the shop under /demo-shop/ and the shop templates show Essential Grid’s WooCommerce templates. Once you add a product to the cart, WooCommerce sets its session and cart cookies (wp_woocommerce_session_*, woocommerce_items_in_cart, woocommerce_cart_hash) so that the cart works. If you dismiss the shop notice, WooCommerce remembers this in a store_notice cookie. No order can be placed in the demo shop.
Login: if you log in to this website (only our team does), WordPress sets its login cookies.
Cloudflare may set a strictly necessary security cookie (such as __cf_bm) to tell visitors from bots.

These cookies are strictly necessary for a function you use, so they need no consent (§ 25 Para. 2 No. 2 TDDDG), and we show no consent banner for them. Legal basis for the data they carry: Art. 6 Para. 1 lit. b and f GDPR. You can delete cookies or block them in your browser at any time; the demo shop’s cart then does not work. The video players of two example pages are the one exception; section 8 explains them.

5. Customer Account, Purchases and Support

Your customer account, your licenses, purchases and support tickets are handled at account.essential-grid.com (also reached through support.essential-grid.com), our own customer service. It runs on Cloudflare (see section 3). To provide it we process the data you give us there, such as your name and e-mail address, your licenses and the domains they are activated on, and the content of your tickets. Legal basis: the performance of our contract with you (Art. 6 Para. 1 lit. b GDPR). The account site sets the cookies it needs for your login and session; what else it uses is explained in the notice shown there.

The prices on this website come from Paddle’s public price list; our server asks for them, so your browser does not connect to Paddle when you view a page.

Paddle (Check-Out & Payments)

When you buy a license, the check-out opens on our account site and is run by Paddle.com Market Ltd., Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom (“Paddle”), our Merchant of Record. Paddle sells the license to you, so Paddle is the controller for the payment and processes the data you enter in its check-out (such as your e-mail address, country, billing and payment details) and your IP address to process the payment, to prevent fraud and to meet its tax obligations. Paddle tells us which license you bought so that we can provide it. The United Kingdom has an adequacy decision of the European Commission.

Legal basis: the performance of the contract (Art. 6 Para. 1 lit. b GDPR).

6. Contact by E-Mail

If you write to us, we process your message and the data it contains, such as your name and e-mail address, to answer you. Legal basis: the performance of a contract or of steps before one (Art. 6 Para. 1 lit. b GDPR), otherwise our legitimate interest in answering your question (Art. 6 Para. 1 lit. f GDPR).

7. Newsletter

We send our newsletter through Mailchimp, a service of The Rocket Science Group LLC d/b/a Mailchimp, 405 N Angier Ave NE, Atlanta, GA 30308, USA, part of Intuit Inc. Mailchimp processes the data in the USA. The transfer rests on the EU-US Data Privacy Framework, under which Intuit is certified, and on the EU’s Standard Contractual Clauses.

If you sign up, Mailchimp stores your e-mail address, your name if you give it, and the IP address and time of your sign-up. The mails contain a tracking pixel, and their links run through Mailchimp, so that we can see whether a mail was opened and which links were clicked. We use this to see which mails are read.

Legal basis: your consent (Art. 6 Para. 1 lit. a GDPR). You can withdraw it at any time with the unsubscribe link in every mail or by writing to us. What happened before stays lawful. After you unsubscribe, Mailchimp keeps your address only as unsubscribed, so that you get no further mails from us.

8. Embedded Videos

Our video tutorials and some example grids show videos from YouTube and Vimeo. The tutorials load their player only when you click play. On two example pages (the Hoover and McKinley templates) the YouTube and Vimeo players load together with the page, because the templates are shown as they work; there your browser connects to the video provider as soon as the page opens, the provider receives at least your IP address, the page you are on and your browser’s data, and may store data in your browser. Legal basis: our legitimate interest in presenting our product (Art. 6 Para. 1 lit. f GDPR). If you do not want this, do not open those two example pages, or block the providers’ hosts in your browser.

YouTube

YouTube is a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We embed YouTube videos in its privacy-enhanced mode (youtube-nocookie.com), in which YouTube sets no cookies before you play a video. Data may be processed in the USA; Google LLC is certified under the EU-US Data Privacy Framework.

Vimeo

Vimeo is a service of Vimeo, LLC, 555 West 18th Street, New York, NY 10011, USA. Data may be processed in the USA; Vimeo is certified under the EU-US Data Privacy Framework.

9. Links to Other Websites

This website links to our other sites (www.themepunch.com, www.sliderrevolution.com, anywhere.sliderrevolution.com) and to other providers. A link transfers no data until you click it; the linked site then receives your request and is responsible for its own processing, as set out in its own privacy policy.

10. Data Retention and Deletion

We delete your data as soon as it is no longer needed for the purpose we collected it for, or when you withdraw your consent. Data we must keep by law, such as business letters and accounting records under German commercial and tax law (§ 257 HGB, § 147 AO), we keep for the legal period (up to ten years) and use only for that purpose. How long the services named above keep data is set out in their privacy policies.

11. Facebook and Instagram Data in Essential Grid

Facebook

Slider Revolution and Essential Grid use Facebook’s login functionality to fetch data from your Facebook pages to your WordPress site if you want them to. Both connect through the same Meta app, “Slider Revolution Posts”. The access token is sent straight back to your WordPress site and kept only there, in the settings of your slider or grid. Our servers pass your site’s requests on and keep an identical request’s answer for up to 15 minutes to stay within Meta’s rate limits; they store no account data and no token. To delete the gathered Facebook data:

On your WordPress site: in Essential Grid, delete the grid that shows your Facebook page; in Slider Revolution, disconnect the account in the slider or delete the slider. This removes the access token from your site; the fetched posts are removed or expire within days.
On Facebook: remove the app “Slider Revolution Posts”, for example under Settings & privacy → Settings → Business integrations (or Apps and websites).

After these steps, once those cached copies have expired, no Facebook data of yours remains with Slider Revolution, Essential Grid or ThemePunch.

Instagram

Slider Revolution and Essential Grid use Instagram’s API to fetch data from your Instagram account to your WordPress site if you want them to. Both connect through the same Meta app, “Slider Revolution Posts”. The access token is sent straight back to your WordPress site and kept only there, in the settings of your slider or grid. Our servers pass your site’s requests on and keep an identical request’s answer for up to 15 minutes to stay within Meta’s rate limits; they store no account data and no token. To delete the gathered Instagram data:

On your WordPress site: in Essential Grid, delete the grid that shows your Instagram account; in Slider Revolution, disconnect the account in the slider or delete the slider. This removes the access token from your site; the fetched posts are removed or expire within days. A copy of the token that Essential Grid keeps to renew it expires after 30 days, and removing the app on Instagram revokes it at once.
On Instagram: remove the app “Slider Revolution Posts”, for example under Settings and activity → Website permissions → Apps and websites.

After these steps, once those cached copies and that copy of the token have expired, no Instagram data of yours remains with Slider Revolution, Essential Grid or ThemePunch.

12. Changes to This Policy

We update this privacy policy when our website or the law changes. The version on this page applies.

Table of Contents