Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Tamara Krapp (MAK-ART), Hauptstr. 26, 51465 Bergisch Gladbach, Deutschland — phone: +49 2202 1860373, e-mail: [email protected]

We are not legally required to appoint a data protection officer, as the conditions of § 38 BDSG are not met. For any privacy-related question you can reach us directly using the contact details above.

2. General Information on Data Processing

We process personal data only to the extent necessary to provide a functional website, our content and services, and to fulfil your order. Personal data is any information relating to you as an identified or identifiable person.

Every processing operation relies on one of the following legal bases:

• Art. 6(1)(a) GDPR — your consent, for example for session recordings or back-in-stock notifications.
• Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures, for example order, payment and shipping.
• Art. 6(1)(c) GDPR — compliance with legal obligations, for example tax retention duties.
• Art. 6(1)(f) GDPR — our legitimate interests, for example security, abuse prevention and statistical analysis of website use.

3. Hosting and Server Log Files

We operate this website and the underlying shop system on a server we rent from active 1 GmbH, Kritenbarg 66, 22391 Hamburg, Deutschland. The server is located in a data centre in Frankfurt am Main, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

On every request the server automatically records data transmitted by your browser:

• IP address of the requesting device
• date and time of access
• name and URL of the file retrieved
• volume of data transferred
• notification of whether the retrieval succeeded
• the browser used, including version and operating system

This data is technically necessary to deliver the website, ensure its stability and security, and defend against attacks. The legal basis is Art. 6(1)(f) GDPR. We keep the log files only as long as necessary for these purposes.

4. Delivery via Cloudflare

We use the content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, represented in the European Union by Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C, 81671 München. Requests to our pages therefore pass through Cloudflare servers, which cache content and fend off attacks. We also store product images, files you upload and our invoice PDFs in Cloudflare’s R2 object storage.

To protect our contact form and free-download claims (the “Download for free” button on the product page) against automated submissions we also use Cloudflare Turnstile. Turnstile evaluates technical characteristics of your browser and your IP address to distinguish humans from machines; a click or image puzzle is generally not required.

Your IP address may be processed and transferred to the USA in the process. Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. The legal basis is our legitimate interest in the secure, stable and fast delivery of our content (Art. 6(1)(f) GDPR).

5. Orders and Contract Processing

When you place an order with us, we process the data required for the contract:

• first and last name
• billing and delivery address
• e-mail address
• payment data and order and payment history
• for personalised products, your customisation details and any uploaded image files

We use customisation details and uploaded images solely to make your product. They are not published and not used for advertising.

The legal basis is Art. 6(1)(b) GDPR. We store this data for the duration of the statutory retention and warranty periods and delete it thereafter, unless a statutory retention obligation requires otherwise.

6. Payment Processing via Stripe

We process payments through Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Irland. Depending on the payment method you choose, your name, billing address, e-mail address, order total and payment data are transmitted to Stripe.

We never receive your full card or bank details — you enter them directly with Stripe, where they are also processed. We only learn whether a payment was successful.

The legal basis is Art. 6(1)(b) GDPR. Stripe also processes part of the data as its own controller, for example for fraud prevention and to meet its own regulatory obligations; details are set out in Stripe’s privacy policy.

7. Fraud Prevention

To protect against fraud and payment defaults, we employ technical measures to detect and prevent suspicious transactions.

The purpose of this processing is to prevent fraud and payment abuse, and to protect our legitimate business interests.

• E-mail address
• Anonymised payment method fingerprint (a technical identifier that contains no personal data)

The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR.

We retain this data for a maximum of two years following the triggering payment transaction. Earlier deletion occurs if the security purpose no longer applies.

To exercise your rights to request access to and deletion of this data, please send an informal request to [email protected]

8. Shipping

To deliver your order we pass your name and delivery address to the shipping provider engaged. We currently ship with DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn and Hermes Germany GmbH, Essener Straße 89, 22419 Hamburg.

We do not pass on your e-mail address in the process. We send the shipping confirmation with the tracking number ourselves.

The legal basis is Art. 6(1)(b) GDPR.

9. Digital Products

If you buy a digital product (a download file) or register for a free download, we process the data required to provide it and to guard against misuse:

• e-mail address
• country from your billing or delivery address (to determine the place of supply for VAT purposes)
• your order reference or customer account
• the time of unlock and of the most recent download, plus a download counter used to limit abuse

This data is used to provide the download, to protect against abusive repeated use — via a time-limited access link and a limit on downloads per period — and as a tax record for the VAT treatment of digital content.

The legal basis is Art. 6(1)(b) GDPR for providing the purchased or registered content, and Art. 6(1)(f) GDPR for the protection against misuse.

The download entitlement is limited to 24 months from unlock and expires automatically thereafter. Tax-relevant data such as country and amount is retained like invoice data for the statutory period of ten years (§ 147 AO, § 257 HGB).

We additionally protect the claiming of a free download with Cloudflare Turnstile — see the Cloudflare delivery section for details.

10. Invoices

For every order we automatically generate an invoice in PDF format. It contains your name, your billing address, the items ordered and the invoice amount.

We store the invoice PDFs in a non-public area of our object storage. Access is possible only via time-limited, signed links.

Invoices are subject to the statutory retention period of ten years (§ 147 AO, § 257 HGB). The legal basis is Art. 6(1)(c) GDPR. A deletion request can therefore only extend to this data once that period has elapsed.

11. E-mail Delivery via Resend

We send transactional e-mails — order confirmation, shipping notification, invoice, review invitation, back-in-stock notification, cart reminder and replies to contact enquiries — through Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.

In the process your e-mail address and the content of the respective message are transferred to the USA. Resend is certified under the EU-US Data Privacy Framework; the transfer therefore relies on the European Commission’s adequacy decision pursuant to Art. 45 GDPR. We have agreed standard contractual clauses in addition.

The legal basis is Art. 6(1)(b) GDPR for contract-related messages and Art. 6(1)(f) GDPR for answering your enquiries.

12. Customer Account

You can create a customer account. We then store your e-mail address, an encrypted password, your name and address details and your order history so that you can view orders and reuse addresses.

A customer account is optional — you can equally order with us as a guest.

The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time. Order and invoice data remain unaffected to the extent statutory retention periods apply.

13. Sign in with Google

Alternatively you can sign in with your Google account. This is optional; an equivalent registration by e-mail and password is available to you.

If you choose this option, you are redirected to Google and sign in there. We receive your e-mail address, your name and an identifier for your Google account from Google — but not your password.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. A transfer to Google LLC in the USA may occur; Google is certified under the EU-US Data Privacy Framework.

The legal basis is your consent, given by choosing this sign-in method (Art. 6(1)(a) GDPR), together with Art. 6(1)(b) GDPR for the subsequent operation of your customer account.

14. Wishlist

Without signing in, we store your wishlist solely in your browser’s local storage. This data does not leave your device and is not visible to us.

When you sign in, we migrate a wishlist previously stored locally into your customer account so that it is available on all your devices. It is then held on our server, linked to your account.

The legal basis is Art. 6(1)(f) GDPR — our and your interest in a convenient save-for-later feature. You can remove entries at any time.

15. Product Reviews

Some time after shipping we invite you by e-mail to review the product you bought. The link contains a signed, time-limited token. This ensures that only actual buyers can leave a review — invented reviews are ruled out this way.

We publish the review itself, the star rating, the date and the name you provide; you may use a pseudonym here. Your e-mail address is not published. We check every review before publication.

You may optionally upload photos with your review. Photos of rejected reviews are deleted automatically. Uploaded images for which no review was submitted are deleted after seven days at the latest.

The legal basis for sending the invitation is Art. 6(1)(f) GDPR, and for publication your consent, given when you submit the review (Art. 6(1)(a) GDPR). You can request deletion of your review at any time.

16. Back-in-Stock Notification

If an item is sold out, you can ask to be notified by e-mail as soon as it is back in stock.

We use a double opt-in procedure for this: after you sign up, you receive a confirmation e-mail; the sign-up only becomes effective once you confirm.

We delete unconfirmed sign-ups after seven days. We delete confirmed sign-ups immediately after the notification has been sent, and in any case no later than six months after sign-up.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

17. Cart Reminder

If you leave your cart without completing the order, we send you a reminder exactly once, after 24 hours.

This only happens if you have expressly agreed to it beforehand. The reminder contains no discount, no deadline and no countdown — it is not meant to pressure you, only to remind you of a cart you may have forgotten.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future.

18. Newsletter

For our newsletter we use a double opt-in procedure: after you sign up, you receive an e-mail with a confirmation link. Your sign-up only becomes active once you click it.

As proof of consent we store your e-mail address, the time of sign-up and confirmation, and the IP address used at the time.

The legal basis is your consent, Art. 6(1)(a) GDPR.

You can withdraw your consent at any time via the unsubscribe link in every newsletter e-mail. The lawfulness of processing carried out before the withdrawal remains unaffected.

Your data is not passed on to third parties.

19. Contact Form

When you write to us via the contact form, we process your name, your e-mail address and the content of your message in order to answer the enquiry.

To guard against automated submissions we use a form field invisible to you (a honeypot) and Cloudflare Turnstile; details are in the Cloudflare section.

The legal basis is Art. 6(1)(b) GDPR where your enquiry serves to initiate or perform a contract, otherwise Art. 6(1)(f) GDPR. We delete the enquiry once it has been dealt with conclusively and no retention obligations apply.

20. Product Search

For the product search we use the search software MeiliSearch. Your search terms are processed to show you relevant results.

We run MeiliSearch ourselves on our server in Germany; search queries are not transmitted to third parties. The legal basis is Art. 6(1)(f) GDPR.

21. Reach Measurement with Umami

We use the analytics software Umami, which we run ourselves on our server in Germany. Umami works without cookies, without cross-device recognition and without building profiles across websites. IP addresses are not stored.

We record page views, the approximate region of origin, the device type and the referring page, as well as anonymous interaction events — for example clicks on buttons, search queries and cart and checkout actions.

The legal basis is our legitimate interest in statistical analysis to improve our offering (Art. 6(1)(f) GDPR). As no information is accessed on your device in the process, consent under § 25 TDDDG is not required.

22. Session Recording and Heatmaps (with consent only)

If you chose “Accept all” in the cookie banner, Umami additionally records your session: mouse movements, clicks, scrolling and page changes. From this we create heatmaps to identify weak spots in the shop.

Entries in form fields are masked and not recorded. Checkout, customer account, order confirmation and the review form are entirely excluded from recording. The data is processed solely on our server in Germany and not passed to third parties.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

You can withdraw your consent anytime with effect for the future: open “Cookie settings” in the footer and switch off “Session recording & heatmaps”. The page reloads and recording stops immediately.

23. Cookies and Local Storage

We use only technically necessary cookies and local storage in your browser:

• Cart identifier (cart_id) — so your cart persists across pages.
• Language choice (locale) — so the site appears in your chosen language.
• Login session — so you stay signed in to your account.
• Cookie choice (cookie_consent_v3) — so we don't ask you again on every visit.
• Stripe cookies during checkout — for payment processing and fraud prevention.

Without signing in, we store your wishlist in your browser’s local storage. Our reach measurement sets no cookies.

Technically necessary cookies require no consent under § 25(2) TDDDG. Everything beyond that — notably session recording — happens only with your consent. You can enable or disable individual categories granularly and change your choice anytime:

Open cookie settings

24. Retention Periods

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods:

• Order and invoice data: ten years (§ 147 AO, § 257 HGB).
• Customer account: until you delete it.
• Uploaded image files for personalised products: for the duration of the statutory retention and warranty periods, after which they are deleted.
• Back-in-stock sign-ups: seven days if unconfirmed; otherwise until the notification is sent, at most six months.
• Download entitlements for digital products: 24 months from unlock, after which the access link expires automatically.
• Newsletter sign-ups: until you withdraw via the unsubscribe link.
• Contact enquiries: until conclusively dealt with, unless a retention obligation applies.

25. Your Rights

As a data subject you have the following rights:

• access to the personal data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

An informal message is enough to exercise these rights, sent to [email protected]

26. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of our legitimate interests under Art. 6(1)(f) GDPR. If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims (Art. 21 GDPR).

27. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf

28. No Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. In particular, there is no automated credit check and no personalised pricing — all visitors see the same prices.

29. Data Security

This website uses TLS encryption throughout. You can recognise it by the “https://” in your browser’s address bar. Transmitted data cannot be read by third parties as a result.

We embed fonts exclusively from our own server. No connection is made to Google Fonts or any other external font service.

30. Changes to This Privacy Policy

We adapt this policy when the legal situation or our offering changes — for example when new features are added. The current version applies to each of your visits.