Privacy

01Controller

The controller within the meaning of the GDPR is:

Rümeysa Biricik
Kapitän-Lehmann-Ring 28
28309 Bremen
Deutschland
E-Mail: contact@farbenwellen.de

02Server log files

When you access this website, information is automatically stored in server log files that your browser transmits: IP address, date and time of the request, requested URL, amount of data transferred, HTTP status code, referrer URL, browser type and operating system. This data is not merged with other sources.

Legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technically error-free presentation, security and stability of the website. Log files are deleted after 7 days at the latest, unless required to investigate a specific security incident.

03Hosting

This website is hosted on a server operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany (server location Helsinki/EU). Hetzner processes data arising from operating the website on our behalf. A data processing agreement (Art. 28 GDPR) is in place with Hetzner.

Legal basis is Art. 6(1)(f) GDPR (interest in secure, reliable operation of the website).

04Customer account and sign-in

You can create a customer account. We process the data you provide (name, email address and a password of your choice, which is stored only in encrypted form). The account is used to process your orders and to view your order history.

Legal basis is Art. 6(1)(b) GDPR (contract / pre-contractual measures). You can have your account deleted at any time; statutory retention periods remain unaffected.

05Order processing

To process your order we process the necessary data (name, billing and delivery address, email address, order and payment information). We pass the required address data to the commissioned shipping company for delivery.

Legal basis is Art. 6(1)(b) GDPR; additionally Art. 6(1)(c) GDPR for retaining invoices (legal obligation).

06Payment processing via Stripe

Payments are processed via the payment provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). You enter your card details exclusively on Stripe's secure payment page; they never reach our shop. Data transmitted to Stripe includes name, email address, billing/delivery address, payment amount and payment method. Stripe acts as an independent controller in this respect.

A transfer to Stripe, LLC in the USA may occur. This is safeguarded by the EU-U.S. Data Privacy Framework and additionally by EU Standard Contractual Clauses (Art. 46 GDPR). Legal basis is Art. 6(1)(b) GDPR. More information: stripe.com/privacy.

07Region-based price display (Geo-IP)

When you access the shop we process your IP address to determine your approximate geographic region and show you the prices and delivery terms intended for your region (shipping costs are included in the displayed price). No merging with other sources and no profiling takes place; the IP address is only processed briefly for this purpose.

Legal basis is Art. 6(1)(f) GDPR (legitimate interest in a region-appropriate presentation). You may object to this processing pursuant to Art. 21 GDPR.

08Contact form

If you contact us via the contact form, we process the data you provide (name, email address, message) to handle your enquiry. It is stored in our database and sent to the shop operator by email.

Legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). The data is deleted once your enquiry has been dealt with and no retention obligations apply.

09Cookies and local storage

We use only technically necessary storage: a session cookie for sign-in and your browser's local storage (localStorage) for the shopping cart and wishlist. These are required for the shop functionality you request and are therefore exempt from consent under § 25(2) TDDDG.

We use no analytics, tracking or marketing cookies and load no external fonts or services for such purposes. A cookie banner is therefore not required.

10Retention and deletion

We store personal data only as long as necessary for the respective purpose or as required by law. We retain accounting documents and invoices for eight years pursuant to § 257(4) HGB and § 147(3) AO, and commercial books and annual financial statements for ten years. During this period processing is limited to storage (Art. 6(1)(c) GDPR).

11Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR).

An email to contact@farbenwellen.de is sufficient to exercise these rights. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR):

12Automated decision-making

Automated decision-making including profiling pursuant to Art. 22 GDPR does not take place.

13SSL/TLS encryption

For security reasons this website uses SSL/TLS encryption. You can recognise an encrypted, secure connection by the https:// prefix at the start of your browser's address bar.