1. Controller
2. General notes on processing
We process personal data only to the extent necessary to provide a functional website and our products. Legal bases are notably Art. 6 (1) (a), (b), (c) and (f) GDPR.
3. Your rights
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16)
- Right to erasure (Art. 17)
- Right to restriction (Art. 18)
- Right to data portability (Art. 20)
- Right to object (Art. 21)
- Right to withdraw consent at any time
- Right to lodge a complaint with a supervisory authority
4. Hosting & server logs
Hosted by Hetzner Online GmbH (Germany). Cloudflare is used solely as a tunnel proxy for TLS termination. Server logs (truncated IP, user agent, referrer, timestamp) are kept for 7 days. Legal basis: Art. 6 (1) (f) GDPR.
5. Cookies (§ 25 TTDSG)
We use only strictly necessary cookies (cart, session, CSRF). No consent required under § 25 (2) TTDSG. Analytics via self-hosted Plausible — anonymous, cookieless.
6. Order processing
Order processing uses Medusa (commerce backend), Payload CMS and PostgreSQL — all on our own servers. Legal basis: Art. 6 (1) (b) GDPR.
7. Payment providers
Stripe Payments Europe Ltd. (Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), bank transfer.
8. Shipping
Name, shipping address (and optionally email for notifications) are transmitted to Deutsche Post DHL Group.
9. Transactional email
Sent via Zoho Corporation B.V. (EU data center).
10. Newsletter
Double opt-in. Email, timestamp and a SHA-256 hashed IP are stored as proof of consent. Withdrawal anytime via the link in each email. Legal basis: Art. 6 (1) (a) GDPR.
11. Third-country transfers
Stripe may process data in the USA — standard contractual clauses and EU-US DPF certification apply.
12. Retention periods
Order data: 10 years (German Tax Code § 147 AO). Logs: 7 days. Newsletter consent: until withdrawal + 3 years.
13. Encryption
TLS 1.3 with HSTS.
14. Updates
Last updated: 16 May 2026.