Privacy Policy
Information on the processing of your data in the online shop
Last updated:
1. Controller
2. General & Hosting
We process your data exclusively on the basis of the GDPR. This page informs you about the type, scope and purpose of data collection in our online shop.
Server Log Files
When you visit our website, our hoster (provider) automatically collects data in server log files (IP address, browser, date/time, referrer). Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in secure operation). Storage period: 7 days. No merging with other data.
3. Order Processing (Shop)
When you place an order in our shop, we collect the following mandatory data for contract processing:
- Name, address, email, phone: For contract, invoice, shipping notification
- Order & payment data: Ordered items, amount, payment method
Legal basis: Art. 6 para. 1 lit. b GDPR (performance of a contract).
Disclosure: Only to shipping service providers and payment providers insofar as necessary for processing.
Invoicing obligation: Invoice data is retained in accordance with statutory periods (10 years under AO, 6 years under HGB).
4. Customer Account & Registration
You can create a voluntary customer account to view orders and order faster.
- Email, password (bcrypt-encrypted), name, address
Legal basis: Art. 6 para. 1 lit. b GDPR and Art. 6 para. 1 lit. a GDPR for voluntary information.
Deletion: Until account deletion by you + 30 days, unless retention obligations prevent it.
5. Payment Providers
For payment processing, we share your payment data with the following providers depending on the payment method selected:
| Provider | Purpose / Data |
|---|---|
| PayPal (Europe) S.à r.l. | Processing PayPal, credit card via PayPal, direct debit. Transfer of name, email, address, amount. PayPal Privacy Policy |
| Klarna Bank AB | Invoice, installment purchase, instant bank transfer. Verification of creditworthiness and identity. Klarna Privacy Policy |
| Stripe Payments Europe Ltd. | Credit card processing. Name, email, amount, credit card number is transmitted directly to Stripe. Stripe Privacy Policy |
Legal basis: Art. 6 para. 1 lit. b GDPR (contract) and Art. 6 para. 1 lit. f GDPR (legitimate interest in secure payment).
For payment in advance, no data is shared with payment providers.
We do not store complete credit card data ourselves. Data is entered directly with the payment provider via an encrypted connection.
6. Shipping Providers
For delivery, we share your name, delivery address and, if applicable, email/phone (for shipment tracking) with our shipping partner:
- DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn - DHL Privacy Policy
Legal basis: Art. 6 para. 1 lit. b GDPR.
7. Cookies & Technical Tools
We use only technically necessary cookies for shopping cart, login and checkout. No tracking, no Google Analytics, no advertising cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| PHPSESSID / session | Session, shopping cart, login | Session |
| cart / csrf_token | Shopping cart content, security | 30 days / Session |
Legal basis: Art. 6 para. 1 lit. f GDPR and §25 para. 2 no. 2 TTDSG (technically necessary).
8. Your Rights
- Access (Art. 15): What data we store
- Rectification (Art. 16): Correction of inaccurate data
- Erasure (Art. 17): Deletion, insofar as no retention obligation exists
- Restriction (Art. 18) & Objection (Art. 21)
- Data Portability (Art. 20)
Contact for your rights: kontakt@kunstmaler.online
Right to lodge a complaint with the competent data protection supervisory authority of your federal state.
9. Storage Period
| Data Type | Duration |
|---|---|
| Order & invoice data | 10 years (tax law) |
| Customer account | Until deletion + 30 days |
| Server logs | 7 days |
| Contact requests | 6 months after completion |
Security: SSL/TLS encryption (HTTPS), bcrypt password hashing, access restriction. Payment data is not stored with us.