Privacy policy

Controller

What we process

When you order, we process your email address, your phone number, your delivery address, any note you leave us, and the items ordered together with the delivery date. We collect nothing beyond that, and you do not need an account to place an order.

Legal bases

• Art. 6(1)(b) GDPR — performance of the contract of sale.
• Art. 6(1)(c) GDPR — statutory retention obligations.
• Art. 6(1)(f) GDPR — server logs and preventing abuse.

Cookies

We set no analytics or advertising cookies and embed no third-party services in our pages. There is nothing to consent to, and so there is no cookie banner. Only three cookies are technically necessary:

• a session cookie that holds your basket and ends when you close your browser;
• a sign-in cookie set only when our staff log in to the admin area — never when you place an order.
• an encrypted cookie holding the delivery address you typed, set only while you are going through checkout so you do not have to enter it again if you correct something. It ends with the browser session and is deleted as soon as you place the order.

All three are strictly necessary to operate the shop within the meaning of § 25(2) no. 2 TDDDG.

Fonts and external content

We serve our typeface from our own server. Your browser loads nothing from a third-party server when you visit these pages.

Processors

• Hetzner Online GmbH, Nuremberg — runs our servers. The database and uploaded images live on that server.
• Amazon Web Services (Amazon SES), Frankfurt region — sends your order confirmation and other email about your order.
• Stripe Payments Europe, Ltd., Ireland — handles online payments, and only if you choose to pay that way. You are taken to a page hosted by Stripe, and your payment details never reach us.

Hosting and email both take place in Germany. No data is transferred to a third country outside the EU.

How long we keep it

We keep orders and invoices for eight years, as required by § 147(3) AO and § 257(4) HGB. Staff sign-ins end when they sign out.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Use the contact details above.

You may also complain to a supervisory authority; ours is: