Privacy policy

This translation is provided for convenience; the German version is legally binding. See Datenschutzerklärung.

1. Controller

The controller responsible for processing personal data on this website is:

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Hosting and server log files

The shop runs on a server rented by the controller in the European Union. Each time the website is accessed, the web server automatically stores the following data in log files: IP address, date and time of access, requested URL, browser identification (user agent) and HTTP status code.

This processing serves the security and stability of operation, in particular defending against attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the secure operation of the website. The log files are deleted after 14 days.

The hosting provider processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

3. Cookies

We set only one technically necessary cookie, named cart. It contains a random identifier of your cart so that the cart is kept while you browse, and it is deleted after 30 days. Storing it is based on § 25 (2) no. 2 TDDDG; further processing is based on Art. 6 (1) (b) GDPR (performing your order) or Art. 6 (1) (f) GDPR (a working cart).

We use no analytics or tracking tools and embed no third-party content. Fonts and scripts are served from our own server.

4. Orders

When you place an order, we process your name, email address, delivery address and the items ordered in order to perform the contract (Art. 6 (1) (b) GDPR). We keep this data for the statutory retention periods (§ 147 AO, § 257 HGB: up to 10 years; Art. 6 (1) (c) GDPR) and delete it afterwards.

To deliver your order, we pass your name and delivery address to the shipping carrier we have engaged (Art. 6 (1) (b) GDPR).

5. Payment processing by Stripe

For payment you are redirected to Stripe’s payment page. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland. Stripe processes your payment data (e.g. name, email address, billing and delivery address, payment method details, amount) as an independent controller for payment processing. The legal basis for transferring data to Stripe is Art. 6 (1) (b) GDPR.

Stripe may transfer data to Stripe, Inc. in the USA. Such transfers are based on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. More information is available in Stripe’s privacy policy at stripe.com/privacy.

6. Withdrawal via the withdrawal function

If you declare a withdrawal using the withdrawal function, we store your name, email address, order number, message and the time of receipt in order to process the withdrawal and confirm its receipt (Art. 6 (1) (c) GDPR). The data is kept for the statutory retention periods.

7. Your rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)

To exercise these rights, contact . You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

8. No automated decision-making

No automated decision-making, including profiling, takes place.