Privacy policy

The data controller is the company named in the imprint. Contact us there for any privacy question or request.

Order data (name, delivery and billing address, email, order contents): to perform the contract, Art. 6(1)(b) GDPR.

Payment data: processed by our payment provider; we never store full card numbers. Legal basis: contract performance and our legal obligation to keep accounting records, Art. 6(1)(b) and (c) GDPR.

Server logs (IP address, user agent, timestamp) and strictly necessary cookies: to operate the site securely and reliably, Art. 6(1)(f) GDPR.

Optional analytics: only with your consent, Art. 6(1)(a) GDPR, which you may withdraw at any time via the cookie settings.

We use processors for hosting, payments and email delivery under Article 28 agreements. Where data leaves the EEA, transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Order and invoice records are kept for the statutory accounting period (usually 10 years in the EU, 6 years in the UK). Analytics data is kept for 14 months. Everything else is deleted when it is no longer needed.

You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interests. You also have the right to lodge a complaint with your local supervisory authority. Write to the contact address in the imprint — we answer within one month.