Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Tamara Krapp (MAK-ART), Hauptstr. 26, 51465 Bergisch Gladbach, Deutschland — e-mail: shop@mak-art.shop

We are not legally required to appoint a data protection officer, as the conditions of § 38 BDSG are not met. For any privacy-related question you can reach us directly using the contact details above.

2. General Information on Data Processing

We process personal data only to the extent necessary to provide a functional website, our content and services, and to fulfil your order. Personal data is any information relating to you as an identified or identifiable person.

Every processing operation relies on one of the following legal bases:

• Art. 6(1)(a) GDPR — your consent, for example for session recordings or back-in-stock notifications.
• Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures, for example order, payment and shipping.
• Art. 6(1)(c) GDPR — compliance with legal obligations, for example tax retention duties.
• Art. 6(1)(f) GDPR — our legitimate interests, for example security, abuse prevention and statistical analysis of website use.

3. Hosting and Server Log Files

We operate this website and the underlying shop system on a server we rent from active 1 GmbH, Kritenbarg 66, 22391 Hamburg, Deutschland. The server is located in a data centre in Frankfurt am Main, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

On every request the server automatically records data transmitted by your browser:

• IP address of the requesting device
• date and time of access
• name and URL of the file retrieved
• volume of data transferred
• notification of whether the retrieval succeeded
• the browser used, including version and operating system

This data is technically necessary to deliver the website, ensure its stability and security, and defend against attacks. The legal basis is Art. 6(1)(f) GDPR. We keep the log files only as long as necessary for these purposes.

4. Delivery via Cloudflare

We use the content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, represented in the European Union by Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C, 81671 München. Requests to our pages therefore pass through Cloudflare servers, which cache content and fend off attacks. We also store product images, files you upload and our invoice PDFs in Cloudflare’s R2 object storage.

To protect our contact form, our withdrawal function and free-download claims (the “Download for free” button on the product page) against automated submissions we also use Cloudflare Turnstile. Turnstile evaluates technical characteristics of your browser and your IP address to distinguish humans from machines; a click or image puzzle is generally not required.

Your IP address may be processed and transferred to the USA in the process. Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. The legal basis is our legitimate interest in the secure, stable and fast delivery of our content (Art. 6(1)(f) GDPR).

5. Orders and Contract Processing

When you place an order with us, we process the data required for the contract:

• first and last name
• billing and delivery address
• e-mail address
• payment data and order and payment history
• for personalised products, your customisation details and any uploaded image files

We use customisation details and uploaded images solely to make your product. They are not published and not used for advertising.

The legal basis is Art. 6(1)(b) GDPR. We store this data for the duration of the statutory retention and warranty periods and delete it thereafter, unless a statutory retention obligation requires otherwise.

6. Payment Processing

We process payments through Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Irland. Depending on the payment method you choose, your name, billing address, e-mail address, order total and payment data are transmitted to Stripe. If you choose PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxemburg, is additionally responsible as an independent controller; for Amazon Pay, Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg. If you use Link, Stripe’s service for saving your payment details, Stripe’s privacy notice applies to it in addition.

We never receive your full card or bank details — you enter them directly with Stripe, where they are also processed. We only learn whether a payment was successful.

The legal basis is Art. 6(1)(b) GDPR. Stripe and, depending on the payment method chosen, PayPal and Amazon Pay also process part of the data as independent controllers, for example for fraud prevention and to meet their own regulatory obligations; details are set out in their privacy policies. A transfer to Stripe, Inc. in the USA is possible in the process; according to its own information, Stripe, Inc. is certified under the EU-US Data Privacy Framework, so the transfer relies on the European Commission’s adequacy decision pursuant to Art. 45 GDPR.

7. Fraud Prevention

To protect against fraud and payment defaults, we employ technical measures to detect and prevent suspicious transactions.

The purpose of this processing is to prevent fraud and payment abuse, and to protect our legitimate business interests.

• E-mail address
• an identifier of the payment method created by Stripe (fingerprint) that contains no card number but recognises the same card again

The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR.

We retain this data for a maximum of two years following the triggering payment transaction. Earlier deletion occurs if the security purpose no longer applies. We keep records of a payment dispute (order reference, e-mail address, payment method identifier) for as long as the related order data and delete them afterwards.

To exercise your rights to request access to and deletion of this data, please send an informal request to shop@mak-art.shop

8. Shipping

To deliver your order we pass your name and delivery address to the shipping provider engaged. We currently ship with Deutsche Post AG (Charles-de-Gaulle-Straße 20, 53113 Bonn, Warensendung) and, depending on the shipment, with DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn) and/or Hermes (Hermes Germany GmbH, Essener Straße 89, 22419 Hamburg).

We do not pass on your e-mail address in the process. We send the shipping confirmation with the tracking number ourselves.

The legal basis is Art. 6(1)(b) GDPR.

9. Digital Products

If you buy a digital product (a download file) or register for a free download, we process the data required to provide it and to guard against misuse:

• e-mail address
• country from your billing or delivery address (to determine the place of supply for VAT purposes)
• your order reference or customer account
• the time of unlock and of the most recent download, plus a download counter used to limit abuse

This data is used to provide the download, to protect against abusive repeated use — via a time-limited access link and a limit on downloads per period — and as a tax record for the VAT treatment of digital content.

The legal basis is Art. 6(1)(b) GDPR for providing the purchased or registered content, and Art. 6(1)(f) GDPR for the protection against misuse.

The download entitlement is limited to 24 months from unlock and expires automatically thereafter. Tax-relevant data such as country and amount is retained like invoice data for the statutory period of ten years (§ 147 AO, § 257 HGB).

We additionally protect the claiming of a free download with Cloudflare Turnstile — see the Cloudflare delivery section for details.

10. Invoices

For every order we automatically generate an invoice in PDF format. It contains your name, your company where applicable, your billing address, the items ordered and the invoice amount.

We store the invoice PDFs in a non-public area of our object storage. Access is possible only via time-limited, signed links.

Invoices are subject to the statutory retention period of ten years (§ 147 AO, § 257 HGB). The legal basis is Art. 6(1)(c) GDPR. A deletion request can therefore only extend to this data once that period has elapsed.

11. E-mail Delivery via Resend

We send transactional e-mails — order confirmation, shipping notification, invoice, review invitation, back-in-stock notification, cart reminder, newsletter, confirmations of withdrawal declarations and replies to contact enquiries — through Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.

In the process your e-mail address and the content of the respective message are transferred to the USA. According to its own information, Resend is certified under the EU-US Data Privacy Framework; the transfer therefore relies on the European Commission’s adequacy decision pursuant to Art. 45 GDPR. We have agreed standard contractual clauses in addition.

Our mailbox shop@mak-art.shop is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Deutschland; we have a data processing agreement with the provider pursuant to Art. 28 GDPR.

The legal basis is Art. 6(1)(b) GDPR for contract-related messages and Art. 6(1)(f) GDPR for answering your enquiries.

12. Customer Account

You can create a customer account. We then store your e-mail address, an encrypted password, your name and address details and your order history so that you can view orders and reuse addresses.

A customer account is optional — you can equally order with us as a guest.

The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time. Order and invoice data remain unaffected to the extent statutory retention periods apply.

13. Sign in with Google

Alternatively you can sign in with your Google account. This is optional; an equivalent registration by e-mail and password is available to you.

If you choose this option, you are redirected to Google and sign in there. We receive your e-mail address, your name and an identifier for your Google account from Google — but not your password.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. A transfer to Google LLC in the USA may occur; Google is certified under the EU-US Data Privacy Framework.

The legal basis is your consent, given by choosing this sign-in method (Art. 6(1)(a) GDPR), together with Art. 6(1)(b) GDPR for the subsequent operation of your customer account.

14. Wishlist

Without signing in, we store your wishlist solely in your browser’s local storage. This data does not leave your device and is not visible to us.

When you sign in, we migrate a wishlist previously stored locally into your customer account so that it is available on all your devices. It is then held on our server, linked to your account. If you share your wishlist, anyone with the link can see the products on it, but not your name or e-mail address.

The legal basis is Art. 6(1)(f) GDPR — our and your interest in a convenient save-for-later feature. You can remove entries at any time.

15. Product Reviews

Some time after shipping we invite you by e-mail to review the product you bought. The link contains a signed, time-limited token. This ensures that only actual buyers can leave a review — invented reviews are ruled out this way.

We publish the review itself, the star rating, the date and the name you provide; you may use a pseudonym here. Your e-mail address is not published. We check every review before publication.

You may optionally upload photos with your review. Photos of rejected reviews are deleted automatically. Uploaded images for which no review was submitted are deleted after seven days at the latest.

The legal basis for sending the invitation is Art. 6(1)(f) GDPR, and for publication your consent, given when you submit the review (Art. 6(1)(a) GDPR). You can request deletion of your review at any time.

We send you the review invitation as a customer without separate consent on the basis of Section 7(3) of the German Unfair Competition Act (UWG) and Art. 6(1)(f) GDPR; our legitimate interest is receiving genuine feedback on purchased products. You can object to the use of your e-mail address for review requests at any time without incurring any costs other than the transmission costs at basic rates – via the link “Keine Bewertungsanfragen mehr” (no more review requests) in every review request, by replying to the request or by sending us an informal message. We then keep your address permanently on a block list so that your objection is also respected for later orders.

16. Back-in-Stock Notification

If an item is sold out, you can ask to be notified by e-mail as soon as it is back in stock.

We use a double opt-in procedure for this: after you sign up, you receive a confirmation e-mail; the sign-up only becomes effective once you confirm.

We delete unconfirmed sign-ups after seven days. We delete confirmed sign-ups immediately after the notification has been sent, and in any case no later than six months after sign-up.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

17. Cart Reminder

If you leave your cart without completing the order, we send you a reminder exactly once, after 24 hours.

This only happens if you have expressly agreed to it beforehand. The reminder contains no discount, no deadline and no countdown — it is not meant to pressure you, only to remind you of a cart you may have forgotten.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future.

18. Newsletter

For our newsletter we use a double opt-in procedure: after you sign up, you receive an e-mail with a confirmation link. Your sign-up only becomes active once you click it.

As proof of consent we store your e-mail address, the time of sign-up and confirmation, and the IP address used at the time. We delete unconfirmed sign-ups after seven days and all others no later than six months after sign-up.

After you confirm, you receive a one-time welcome discount code; for this we store the code together with your sign-up.

The legal basis is your consent, Art. 6(1)(a) GDPR.

You can withdraw your consent at any time via the unsubscribe link in every newsletter e-mail; we then delete your sign-up together with the proof of consent. The lawfulness of processing carried out before the withdrawal remains unaffected.

We use Resend for delivery (see the e-mail delivery section). Your data is not passed on to any other third parties.

19. Contact Form

When you write to us via the contact form, we process your name, your e-mail address and the content of your message in order to answer the enquiry. We forward your message to our mailbox via Resend (see the section E-mail Delivery via Resend).

To guard against automated submissions we use a form field invisible to you (a honeypot) and Cloudflare Turnstile; details are in the Cloudflare section.

The legal basis is Art. 6(1)(b) GDPR where your enquiry serves to initiate or perform a contract, otherwise Art. 6(1)(f) GDPR. We delete the enquiry once it has been dealt with conclusively and no retention obligations apply.

20. Withdrawal Function

If you declare a withdrawal through our withdrawal function, we process the order number, e-mail address, the items concerned and the time of receipt in order to handle the withdrawal and confirm receipt to you (Art. 6(1)(c) GDPR in conjunction with § 356a BGB). In addition, we store the IP address from which you declare the withdrawal together with the time of the declaration, so that we can prove timely receipt and defend the function against misuse (Art. 6(1)(f) GDPR; our legitimate interest is this proof). We store this information for the duration of the statutory retention obligations. The form is also protected by Cloudflare Turnstile; details are in the Cloudflare section.

21. Product Search

For the product search we use the search software MeiliSearch. Your search terms are processed to show you relevant results.

We run MeiliSearch ourselves on our server in Germany; search queries are not transmitted to third parties. The legal basis is Art. 6(1)(f) GDPR.

22. Reach Measurement with Umami

We use the analytics software Umami in a self-operated installation. It runs on a server of active 1 GmbH, Kritenbarg 66, 22391 Hamburg, in a data centre in Frankfurt am Main, Germany; we have a data processing agreement with the hosting provider pursuant to Art. 28 GDPR. Transfer to our analytics server runs through Cloudflare (see the section Delivery via Cloudflare). Umami works without cookies, without cross-device recognition and without building profiles across websites. IP addresses are not stored.

We record the page viewed (address and page title), the referring page without its parameters, campaign tags from the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), browser, operating system, device type, screen size and browser language, the approximate region of origin, and technical page-load measurements (Web Vitals: LCP, INP, CLS, FCP, TTFB). We remove all other parameters in the address before sending. In addition we record interaction events — for example clicks on buttons and links, search terms, and cart and checkout actions; when an order is completed, only the order total and currency.

The legal basis is our legitimate interest in statistical analysis to improve our offering (Art. 6(1)(f) GDPR). Umami stores no information on your device and sets no cookies; it only reads technical details that arise anyway when the page is displayed (e.g. screen size, language, load times). No consent under Section 25(1) TDDDG is required for this: the Umami tracker only reads the entry umami.disabled in your browser’s local storage in order to respect an objection to the measurement that you have set yourself. This access is strictly necessary to provide this service you have explicitly requested (Section 25(2) No. 2 TDDDG).

23. Session Recording and Heatmaps (with consent only)

If you consented to session recording (via “Accept all” in the cookie banner or in the cookie settings), Umami additionally records your session: the addresses you visit, mouse movements, clicks, scrolling and page changes. From this we create heatmaps to identify weak spots in the shop.

Entries in form fields are masked and not recorded. Areas showing personal details — for example in checkout, your customer account, the order confirmation, downloads and the review form — are fully hidden in the recording. We remove access keys from links in our e-mails from the address before recording starts. The data is processed at active 1 GmbH, Hamburg, on our behalf; like all page requests, the transfer there runs through Cloudflare (see the section Delivery via Cloudflare). It is not passed to any other third parties.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

You can withdraw your consent anytime with effect for the future: open “Cookie settings” in the footer and switch off “Session recording & heatmaps”. The page reloads and recording stops immediately.

24. Cookies and Local Storage

We use only technically necessary cookies and local storage in your browser:

• Cart identifier (cart_id, 1 year) — so your cart persists across pages.
• Sign-in to your account (your browser’s local storage, medusa_auth_token, until you sign out) — so you stay signed in to your account.
• Cookie choice (cookie_consent_v3, 6 months) — so we don't ask you again on every visit.
• Bot defence (__cf_bm) — set by our CDN Cloudflare, 30 minutes.
• Stripe cookies during checkout — for payment processing and fraud prevention.
• Download access (your browser’s session storage, mak-art:downloads-token, until you close the tab) — so your downloads stay available after a reload without the access link sitting in the address bar.
• Notices (local or session storage: newsletter-subscribed, newsletter-shown, mak-art:language-hint-dismissed) — so we don’t show you the newsletter or language notice again.

Without signing in, we store your wishlist in your browser’s local storage. Our reach measurement sets no cookies.

Technically necessary cookies require no consent under § 25(2) TDDDG. Everything beyond that — notably session recording — happens only with your consent. You can enable or disable individual categories granularly and change your choice anytime:

Open cookie settings

25. Retention Periods

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods:

• Order and invoice data: ten years (§ 147 AO, § 257 HGB).
• Customer account: until you delete it.
• Uploaded image files for personalised products: for the duration of the statutory retention and warranty periods, after which they are deleted. Images for which no order is placed are deleted after seven days.
• Back-in-stock sign-ups: seven days if unconfirmed; otherwise until the notification is sent, at most six months.
• Download entitlements for digital products: 24 months from unlock, after which the access link expires automatically.
• Newsletter sign-ups: seven days if unconfirmed; confirmed sign-ups including the proof of consent for at most six months from sign-up, or until you withdraw earlier.
• Contact enquiries: until conclusively dealt with, unless a retention obligation applies.
• Reach measurement statistics: 24 months, after which the raw data is deleted.
• Session recordings and heatmap data: 30 days.

26. Your Rights

As a data subject you have the following rights:

• access to the personal data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

If you have a customer account, you can also request access and data portability under “My data” and erase the account under “Delete account”. Alternatively, and for orders placed without an account, you can still exercise your rights by sending an informal message to shop@mak-art.shop

27. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of our legitimate interests under Art. 6(1)(f) GDPR. If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims (Art. 21 GDPR).

28. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf

29. No Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. In particular, there is no automated credit check and no personalised pricing — all visitors see the same prices.

30. Data Security

This website uses TLS encryption throughout. You can recognise it by the “https://” in your browser’s address bar. Transmitted data cannot be read by third parties as a result.

We embed fonts exclusively from our own server. No connection is made to Google Fonts or any other external font service.

31. Changes to This Privacy Policy

We adapt this policy when the legal situation or our offering changes — for example when new features are added. The current version applies to each of your visits.