Privacy Policy

Controller

[Controller within the meaning of Art. 4(7) GDPR]

Processing during checkout

To fulfil your order we process your name, billing and shipping address and email address. The legal basis is Art. 6(1)(b) GDPR.

If you put your address on the list, we store it together with the time of signup and a one-time confirmation token. Legal basis: your consent under Art. 6(1)(a) GDPR and § 7(2) no. 2 UWG.

We use double opt-in: the address stays marked unconfirmed until you click the link in the confirmation mail, and nothing is sent to an unconfirmed address. We do not store your IP address or browser for this — the timestamp and the confirmation are all we need, and anything beyond that would be collecting without a purpose.

The data sits in a Cloudflare D1 database in the EU (Western Europe). Withdraw your consent at any time via the unsubscribe link in every mail or by writing to the address in the imprint; we then delete the entry.

Recipients

Stripe Payments Europe Ltd. — payment processing

[Fulfilment partner] — production and shipping

Vercel Inc. — hosting

Cloudflare, Inc. — DNS, protection, inventory and file storage

Transfers to third countries

[Where data is transferred outside the EEA: state the legal basis and safeguards under Art. 44 et seq. GDPR.]

Your rights