Privacy policy

1. Data Processing for Order Fulfillment

8.1 Transmission of Image Files for Order Fulfillment via Upload Function

On our website, we offer customers the option to personalize products by submitting image files through an upload function. The submitted image is used as a template for personalizing the selected product.

Through the upload form on the website, customers can directly transmit one or more image files from their device's storage to us via automated and encrypted data transfer. We collect, store, and use the transmitted files solely for the creation of the personalized product as described in the respective service description on our website. If the submitted image files are further passed on to special service providers for the creation and handling of the order, you will be explicitly informed about this in the following paragraphs. No further disclosure will occur. If the transmitted files or digital images contain personal data (particularly identifiable individuals' images), all processing operations mentioned above are exclusively carried out for the purpose of processing your online order under Art. 6(1)(b) GDPR.

After the order is completed, the transmitted image files are automatically and completely deleted.

8.2 To the extent required for the contract's execution and for delivery and payment purposes, personal data collected by us are transferred to the commissioned shipping company and the commissioned credit institution under Art. 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or for digital products based on a corresponding contract, we process the contact data you provided when ordering (name, address, email address) to inform you personally about upcoming updates within the legally prescribed period in accordance with Art. 6(1)(c) GDPR on an appropriate communication channel (e.g., postal or email). Your contact data is used strictly for notifications about updates owed by us and is processed only to the extent necessary for this purpose.

For order processing, we also cooperate with the following service provider(s) who support us in executing concluded contracts. Some personal data are transmitted to these service providers in accordance with the following information.

8.3 To fulfill our contractual obligations to our customers, we cooperate with external shipping partners. We forward your name and delivery address, and if necessary for delivery, your phone number, solely for the purpose of delivering the goods under Art. 6(1)(b) GDPR to a selected shipping partner chosen by us.

8.4 DSers

For order processing, we use the following provider: Bowers Enterprises, LLC, 109 Cloister Drive, Peachtree City, GA 30269, USA.

Name, address, and, if applicable, other personal data are transmitted to the provider under Art. 6(1)(b) GDPR for the purpose of processing the online order. The disclosure of your data only takes place insofar as it is actually necessary for the order's execution. The provider is also used for accounting. The provider processes our incoming and outgoing invoices and may also process our company's banking transactions to automatically record invoices, match transactions, and generate financial accounting in a semi-automated process.

If personal data are also processed in this context, the processing takes place under Art. 6(1)(f) GDPR based on our legitimate interest in efficiently organizing and documenting our business transactions.

To transmit data to the United States, the provider relies on standard contract clauses of the European Commission, which are intended to ensure compliance with the European data protection level.

8.5 Use of Payment Service Providers

• Apple Pay

If you choose the payment method "Apple Pay" provided by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the payment is processed via the "Apple Pay" function of your device running iOS, watchOS, or macOS by charging a payment card stored with "Apple Pay." Apple Pay uses security features integrated into the hardware and software of your device to protect your transactions. To authorize a payment, you are required to enter a code previously defined by you and to verify it using the "Face ID" or "Touch ID" function of your device.

For payment processing, your information provided during the order process, along with order information, is transferred to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before transmitting the data to the payment service provider of the payment card stored in Apple Pay to perform the payment. Encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamically generated security code to the originating website for confirmation of the payment's success.

If personal data are processed during the described transmissions, the processing is exclusively for the purpose of payment processing under Art. 6(1)(b) GDPR.

Apple retains anonymized transaction data, including the approximate purchase amount, approximate date and time, and whether the transaction was successfully completed. Anonymization prevents personal identification. Apple uses the anonymized data for improving "Apple Pay" and other Apple products and services.

If you use Apple Pay on your iPhone or Apple Watch to complete a purchase made through Safari on your Mac, the Mac and the authorization device communicate through an encrypted channel on Apple servers. According to Apple, this processing is exclusively pursuant to Art. 6(1)(f) GDPR based on its legitimate interest in proper accounting, transaction verification, and the optimization and maintenance of the Apple Pay service. Apple also reserves the right to aggregate the processed transaction data with other information collected and stored by Google when you use other Google services.

Further information on data protection for Apple Pay can be found at the following internet address: https://support.apple.com/en-us/HT203027

• Google Pay

If you choose the payment method "Google Pay" provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), the payment is processed through the "Google Pay" application of your mobile device with at least Android 4.4 ("KitKat") and NFC capability by charging a payment card or a verified payment system (e.g., PayPal) stored with Google Pay. For payments made via Google Pay exceeding €25, your mobile device must be unlocked in advance using the respective verification method (e.g., facial recognition, password, fingerprint, or pattern).

For payment processing, the information you provide during the order process, along with order information, is transmitted to Google. Google then sends your payment information stored in Google Pay as a unique transaction number to the originating website to verify a completed payment. This transaction number does not contain any information about the actual payment data of your payment methods stored with Google Pay; it is created and transmitted as a unique numerical token. With all Google Pay transactions, Google only acts as an intermediary to process the payment between you and the originating website by charging the payment method stored in Google Pay.

If personal data are processed during these transmissions, the processing is exclusively for the purpose of payment processing under Art. 6(1)(b) GDPR.

Google reserves the right to collect, store, and analyze certain transaction-specific information for every transaction made via Google Pay. This information may include the date, time, and amount of the transaction, merchant location and description, a description of the purchased goods or services provided by the merchant, photos you attached to the transaction, and the name and email address of the sender and recipient (seller and buyer or sender and recipient), the payment method used, your description for the purpose of the transaction, and any associated offers.

According to Google, this processing is carried out exclusively under Art. 6(1)(f) GDPR based on Google's legitimate interest in proper accounting, transaction data verification, and the optimization and maintenance of the Google Pay service.

Google also reserves the right to merge the processed transaction data with other information collected and stored by Google when you use other Google services.

Google Pay's terms of use can be found here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=en

Further information on data protection for Google Pay can be found at the following internet address:

https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en

• Klarna

On this website, one or more online payment options from the following provider are available: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden.

For payment methods in which you pay in advance (e.g., credit card payment), your payment data (including name, address, bank and payment card information, currency, and transaction number), as well as information about your order, will be passed on to Klarna according to Art. 6(1)(b) GDPR. This data transfer takes place solely for the purpose of payment processing with Klarna and only to the extent required for this purpose.

For payment methods in which the provider is in advance (e.g., invoice or installment purchase, or direct debit), you will be asked to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, possibly data for an alternative payment method) in the order process.

To safeguard our legitimate interest in determining the payment capability of our customers, we will transfer this data to Klarna under Art. 6(1)(f) GDPR for the purpose of a credit check. Klarna will evaluate whether the selected payment option can be granted in view of payment and/or default risk based on the personal data you provide, as well as additional data (e.g., shopping cart, invoice amount, order history, payment experiences).

The credit report may contain probability values (so-called score values). If score values are included in the credit report, they are based on a scientifically recognized, mathematically-statistical procedure. Address data, among other things, is included in the calculation of score values.

You can object to the processing of your data at any time via a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual payment processing.

• Paypal

On this website, one or more online payment options from the following provider are available: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

For payment methods in which you pay in advance, your payment data provided during the order process (including name, address, bank and payment card information, currency, and transaction number), as well as information about the content of your order, will be transmitted to the provider according to Art. 6(1)(b) GDPR. This data transfer takes place solely for the purpose of payment processing with the provider and only to the extent required for this purpose.

For payment methods in which we pay in advance, you will also be asked to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, possibly data for an alternative payment method) in the order process.

To safeguard our legitimate interest in determining the payment capability of our customers, this data will be transmitted to the provider under Art. 6(1)(f) GDPR for the purpose of a credit check. The provider will evaluate whether the selected payment option can be granted in view of payment and/or default risk based on the personal data you provide, as well as additional data (e.g., shopping cart, invoice amount, order history, payment experiences).

The credit report may contain probability values (so-called score values). If score values are included in the credit report, they are based on a scientifically recognized, mathematically-statistical procedure. Address data, among other things, is included in the calculation of score values.

You can object to the processing of your data at any time via a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual payment processing.

 

9.Web Analytics Services

Google Tag Manager

This website uses the "Google Tag Manager," a service provided by the following company: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "Google").

The Google Tag Manager provides a technical foundation for bundling various web applications, including tracking and analysis services, and allows them to be calibrated, controlled, and linked through a unified user interface. The Google Tag Manager itself does not store information on user devices or read such information. However, when the Google Tag Manager is called up, your IP address is transmitted to Google and may be stored there. Additionally, transmission to Google LLC servers in the USA is possible.

This processing is only carried out if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. Without your consent, the use of the Google Tag Manager will not take place during your visit to the site. You can withdraw your consent at any time with future effect. To exercise your withdrawal, please deactivate this service using the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider to ensure the protection of data of our site visitors and to prohibit unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on the European Commission's adequacy decision, ensures compliance with European data protection standards.

 

10. Retargeting/Remarketing and Conversion Tracking

10.1 Facebook Pixel for Creating Custom Audiences with Extended Data Matching (with Cookie Consent Tool)

Within our online offering, we use the "Facebook Pixel" service in extended data matching mode, provided by the following company: Meta Platforms Ireland Limited, 4 Grand Canal Quare, Dublin 2, Ireland ("Facebook").

When a user clicks on one of our ads on Facebook, the URL of our linked page is extended with a parameter using the "Facebook Pixel." This URL parameter is then added to the user's browser via a cookie set by our linked page. Furthermore, this cookie captures specific customer data, such as email addresses collected on our website associated with the Facebook ad during events such as purchases, account logins, or registrations (extended data matching). The cookie is then read and allows the transmission of data, including specific customer data, to Facebook.

We use "Facebook Pixel" with extended data matching to make our Facebook ads ("Facebook Ads") more effective and ensure that they correspond to user interests or have specific features (e.g., interests in specific topics or products determined based on visited web pages) that we transmit to Facebook ("Custom Audiences").

Additionally, we analyze the effectiveness of our ads by tracking whether users were redirected to our website after clicking an ad (Conversion). Compared to the standard version of "Facebook Pixel," the extended data matching feature helps us better measure the effectiveness of our advertising campaigns by capturing more attributed conversions.

All data transmitted is stored and processed by Facebook, allowing it to be assigned to the respective user profile, and Facebook can use the data for its own advertising purposes in accordance with Facebook's data usage policies (https://www.facebook.com/about/privacy/). The data can enable Facebook and its partners to display ads on and off Facebook.

All the described processing, especially setting cookies to read information on the user's device, only takes place if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with future effect by deactivating this service using the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider to ensure the protection of data of our site visitors and to prohibit unauthorized disclosure to third parties.

The information generated by Facebook is typically transferred to a Facebook server and stored there. In this context, there may also be a transfer to servers of Meta Platforms Inc. in the USA.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on the European Commission's adequacy decision, ensures compliance with European data protection standards.

10.2 Google Ads Remarketing

This website uses retargeting technology provided by the following company: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

For this purpose, Google places a cookie in your end device's browser, which automatically enables interest-based advertising using a pseudonymous cookie ID and based on the pages you have visited. Further data processing only takes place if you have consented to Google linking your Internet and app browser history with your Google account and using information from your Google account to personalize ads that you view on the web. If you are logged into your Google account during your visit to our website in this case, Google uses your data together with Google Analytics data to create and define cross-device remarketing audience lists. Your personal data is temporarily linked to Google Analytics data to create target groups. In the context of using Google Ads Remarketing, personal data may also be transferred to Google LLC servers in the USA.

All the above-described processing activities, especially setting cookies to read information on the user's device, only take place if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. Without your consent, retargeting technology will not be used during your visit to the site.

You can permanently opt out of cookies set by Google Ads Conversion Tracking by downloading and installing the browser plugin available at the following link: https://www.google.com/settings/ads/plugin?hl=en

Please note that certain features of this website may be limited or unavailable if you disable the use of cookies.

Google's privacy policy can be viewed here: https://www.google.com/policies/privacy/

For data transfers to the USA, the provider relies on the standard contract clauses of the European Commission, which are intended to ensure compliance with European data protection standards.

10.3 Google Ads Conversion Tracking

This website uses the online advertising program "Google Ads" and, within Google Ads, the Conversion Tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use Google Ads to draw attention to our attractive offers on external websites using advertisements (so-called Google Adwords). In relation to the data of the advertising campaigns, we can determine how successful the individual advertising measures are. We thereby pursue the interest of displaying advertising to you that is of interest to you, making our website more interesting for you, and achieving a fair calculation of advertising costs.

The cookie for conversion tracking is set when a user clicks on an ad placed by Google. Cookies are small text files that are stored on your device. These cookies usually lose their validity after 30 days and do not serve the purpose of personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies, therefore, cannot be tracked via the websites of Google Ads customers. The information obtained using the conversion cookie is used to create conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information with which users can be personally identified. As part of the use of Google Ads, personal data may also be transferred to the servers of Google LLC in the USA.

Details on the processing initiated by Google Ads Conversion Tracking and Google's handling of data from websites can be found here: https://policies.google.com/technologies/partner-sites

All the above-described processing activities, especially setting cookies to read information on the user's device, only take place if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with future effect by deactivating this service using the "Cookie Consent Tool" provided on the website.

You can also permanently object to the setting of cookies by Google Ads Conversion Tracking by downloading and installing the browser plug-in available at the following link: https://www.google.com/settings/ads/plugin?hl=en

Please note that certain features of this website may be limited or unavailable if you disable the use of cookies.

For data transfers to the USA, the provider relies on the standard contract clauses of the European Commission, which are intended to ensure compliance with European data protection standards.

10.4 Pinterest-Tag Conversion Tracking

This website uses the conversion tracking technology provided by the following company: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

If you have reached our website through an ad on the provider's domain, the success of the ad can be tracked using cookies and/or similar technologies (tracking pixels, web beacons, pings, or HTTP requests).

For this purpose, certain device and browser information, including your IP address, may be read via the tracking technology to capture and evaluate user actions predefined by us (e.g., completed transactions, leads, searches on the website, product page views). This enables the creation of statistics about user behavior on our website after redirection from an ad, which serves us to optimize our offering.

All the above-described processing activities, especially setting cookies to read information on the user's device, only take place if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with future effect by deactivating this service using the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider to ensure the protection of data of our site visitors and to prohibit unauthorized disclosure to third parties.

10.5 Snap Pixel (Snapchat)

This website uses the conversion tracking technology provided by the following company: Snap Inc., 63 Market Street, Venice, CA 90291, USA.

If you have reached our website through an ad on the provider's domain, the success of the ad can be tracked using cookies and/or similar technologies (tracking pixels, web beacons, pings, or HTTP requests).

For this purpose, certain device and browser information, including your IP address, may be read via the tracking technology to capture and evaluate user actions predefined by us (e.g., completed transactions, leads, searches on the website, product page views). This enables the creation of statistics about user behavior on our website after redirection from an ad, which serves us to optimize our offering.

All the above-described processing activities, especially setting cookies to read information on the user's device, only take place if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with future effect by deactivating this service using the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider to ensure the protection of data of our site visitors and to prohibit unauthorized disclosure to third parties.

For the transfer of data to the USA, the provider relies on the standard contract clauses of the European Commission, which are intended to ensure compliance with European data protection standards.

10.6 Snap Pixel (Snapchat)

This website uses the conversion tracking technology provided by the following company: Snap Inc., 63 Market Street, Venice, CA 90291, USA.

If you have reached our website through an ad on the provider's domain, the success of the ad can be tracked using cookies and/or similar technologies (tracking pixels, web beacons, pings, or HTTP requests).

For this purpose, certain device and browser information, including your IP address, may be read via the tracking technology to capture and evaluate user actions predefined by us (e.g., completed transactions, leads, searches on the website, product page views). This enables the creation of statistics about user behavior on our website after redirection from an ad, which serves us to optimize our offering.

All the above-described processing activities, especially setting cookies to read information on the user's device, only take place if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with future effect by deactivating this service using the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider to ensure the protection of data of our site visitors and to prohibit unauthorized disclosure to third parties.

For the transfer of data to the USA, the provider relies on the standard contract clauses of the European Commission, which are intended to ensure compliance with European data protection standards.

10.7 TikTok Pixel

This website uses the conversion tracking technology provided by the following company: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

If you have reached our website through an ad on the provider's domain, the success of the ad can be tracked using cookies and/or similar technologies (tracking pixels, web beacons, pings, or HTTP requests).

For this purpose, certain device and browser information, including your IP address, may be read via the tracking technology to capture and evaluate user actions predefined by us (e.g., completed transactions, leads, searches on the website, product page views). This enables the creation of statistics about user behavior on our website after redirection from an ad, which serves us to optimize our offering.

All the above-described processing activities, especially setting cookies to read information on the user's device, only take place if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with future effect by deactivating this service using the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider to ensure the protection of data of our site visitors and to prohibit unauthorized disclosure to third parties.

For the transfer of data to the USA, the provider relies on the standard contract clauses of the European Commission, which are intended to ensure compliance with European data protection standards.

 

11) Data Subject Rights

11.1 The applicable data protection law grants you, as the data subject, the following rights concerning the processing of your personal data (information and intervention rights). The legal basis for exercising these rights is referred to in each case:

• Right to Information pursuant to Article 15 GDPR: You have the right to request information about whether personal data concerning you is being processed by the controller, and if so, what data and for what purposes.
• Right to Rectification pursuant to Article 16 GDPR: You have the right to have inaccurate personal data corrected and to have incomplete personal data completed.
• Right to Erasure pursuant to Article 17 GDPR: You have the right to request the deletion of your personal data if the legal conditions for doing so are met. This is also known as the "right to be forgotten."
• Right to Restriction of Processing pursuant to Article 18 GDPR: You have the right to restrict the processing of your personal data if certain conditions are met. This means that your data may only be processed under limited circumstances.
• Right to Notification pursuant to Article 19 GDPR: If you have exercised your right to rectification, erasure, or restriction of processing, the controller is obliged to inform all recipients to whom your personal data has been disclosed about this rectification, erasure, or restriction.
• Right to Data Portability pursuant to Article 20 GDPR: You have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format and have the right to transmit this data to another controller.
• Right to Withdraw Consent pursuant to Article 7(3) GDPR: If you have given consent to the processing of your personal data, you have the right to withdraw this consent at any time.
• Right to Lodge a Complaint pursuant to Article 77 GDPR: You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates data protection laws.

11.2 RIGHT TO OBJECT

If we process your personal data based on our legitimate interests within the framework of a balance of interests, you have the right to object to such processing at any time due to reasons arising from your particular situation.

If you exercise your right to object, we will stop processing the data concerned. However, we reserve the right to continue processing if we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves to establish, exercise, or defend legal claims.

If we process your personal data for direct marketing purposes, you have the right to object to the processing of your personal data for such marketing at any time. You can exercise this objection as described above.

If you exercise your right to object, we will stop processing the data concerned for direct marketing purposes.

12) Duration of Personal Data Storage

The duration of the storage of personal data is determined based on the respective legal basis, the purpose of processing, and, if applicable, additional legal retention periods (e.g., commercial and tax retention periods).

For personal data processed on the basis of explicit consent in accordance with Article 6(1)(a) GDPR, the data will be stored until you withdraw your consent.

If there are legal retention periods for data processed within the framework of contractual or similar obligations based on Article 6(1)(b) GDPR, this data will be routinely deleted after the retention periods expire, provided it is no longer necessary for the performance or initiation of a contract and/or if we no longer have a legitimate interest in continued storage.

For personal data processed based on Article 6(1)(f) GDPR, this data is stored until you exercise your right to object under Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

For personal data processed for direct marketing purposes based on Article 6(1)(f) GDPR, this data is stored until you exercise your right to object under Article 21(2) GDPR.

Unless otherwise stated in the specific processing situations described in this statement, stored personal data will be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.