Note: some business details are still placeholders (marked in yellow). Fill them in under "company" in config.php before going live.

This is a translation for your convenience. Only the German version is legally binding.

Privacy policy

Last updated: October 2026

1. Controller

The controller responsible for data processing on this website under the General Data Protection Regulation (GDPR) is:

[Business name]
[Street and number]
[Postcode] [City]
Deutschland
Email: [Email address]

2. Overview

We only process personal data where this is necessary to run this website, design your products and handle your orders, or where you have given consent. The legal bases are in particular Art. 6(1)(b) GDPR (contract and pre-contractual steps), (c) (legal obligations, e.g. retention duties), (f) (legitimate interests, e.g. running the website securely) and (a) (consent).

3. Hosting and server log files

This website is hosted by: [Web host name and address]. When you visit the website, technically necessary data is processed (IP address, date and time, page requested, browser and operating system). This is needed to deliver the website and keep it secure (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest unless they are needed to investigate a security incident. We have a data processing agreement with the host (Art. 28 GDPR).

4. Customer account and guest orders

You can order as a guest without a customer account; we then only store the order data (see section 5). If you create a customer account, we store your email address, optionally your name, and your password (only as a secure hash, never in plain text). The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time by emailing us; statutory retention duties for orders remain unaffected.

Sign in with Google

If you sign in with Google, you are redirected to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google then sends us your name, email address and a Google ID. We only use this data for your customer account (Art. 6(1)(b) GDPR). Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. More information: policies.google.com/privacy.

5. Designs, uploaded images and orders

Texts and images you use in the designer are stored with your order so we can make your product. For the order we also process your name, delivery address, email address, optionally your phone number, the items ordered and the payment method (Art. 6(1)(b) GDPR). We keep invoice and order data for up to 10 years as required by commercial and tax law (Art. 6(1)(c) GDPR in conjunction with § 147 AO, § 257 HGB). Please only upload images you have the necessary rights to.

For shipping, we pass your name and delivery address to the shipping company.

6. Payment

Depending on the payment method you choose, we pass the data needed for payment (name, email address, order number, amount) to the payment provider (Art. 6(1)(b) GDPR). You enter your card details or PayPal login directly with the payment provider; we never receive them.

Payment providers may also transfer data to countries outside the EU and carry out their own fraud checks.

7. Cookies and local storage

We only use technically necessary cookies, which do not require consent (§ 25(2) TDDDG):

Designs saved with "Save design" are stored only in your browser's local storage and are not sent to us until you order. You can remove them at any time with the delete button or in your browser settings. We do not use any tracking or advertising cookies.

8. External content

For fonts and the 3D designer to work, your browser loads files from external servers. Your IP address is transferred to the provider concerned (Art. 6(1)(f) GDPR – legitimate interest in a consistent appearance and a working designer):

9. Recipients

Only the service providers named above (hosting, payment, shipping, Google sign-in if used) receive your data, and only as far as necessary. We never sell your data.

10. Storage period

We delete personal data as soon as it is no longer needed for its purpose, unless statutory retention periods apply (usually 6 or 10 years for commercial and tax records).

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Just write to us at [Email address].

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests, you can object to this processing at any time for reasons arising from your particular situation.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the authority responsible for us: [Data protection authority of your federal state].

12. Security

This website uses an encrypted connection (HTTPS). Passwords are only stored as a secure hash.