Privacy Policy

Last updated: September 2026

1. Overview

This overview provides a simple summary of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified. Detailed information can be found in the sections below.

2. Controller

The controller responsible for processing data on this website under the General Data Protection Regulation (GDPR) is:

Paul Burmester
Bierkellerweg 20
77876 Kappelrodeck
Germany
E-Mail: paul.burmester@icloud.com

Given the size and nature of the business, no data protection officer is required to be appointed.

3. Server Log Files

When you visit this website, your browser automatically transmits information that we store in server log files. These are: browser type and version, operating system used, referrer URL, hostname of the accessing device, and the time of the server request. This data is not merged with other data sources. The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest in the secure and technically error-free operation of the website).

4. Categories of Personal Data We Process

Depending on how you interact with this website, we may collect or process:

• Contact details: name, billing address, shipping address, phone number and e-mail address.
• Order and payment details: the items you purchase, transaction details, and confirmation that payment has been made (card and payment account numbers themselves are entered directly into our payment providers' systems and are not stored on our own servers — see Section 7).
• Communications: information you include when contacting us, e.g. a support request or a withdrawal declaration.
• Technical data: IP address, device and browser information (see Section 3).

5. Purposes and Legal Bases of Processing

• Contract performance (processing your order, arranging shipping, handling returns and withdrawals) — Art. 6(1)(b) GDPR.
• Compliance with legal obligations (e.g. retaining invoices under German tax and commercial law) — Art. 6(1)(c) GDPR.
• Legitimate interests (secure operation of the website, fraud prevention, asserting or defending legal claims) — Art. 6(1)(f) GDPR.
• Consent (e.g. if you sign up for marketing e-mails) — Art. 6(1)(a) GDPR. We only send marketing e-mails if you have actively opted in, and you can withdraw your consent at any time with future effect, free of charge, for example via the unsubscribe link in every such e-mail.

We do not use your data for automated decision-making or profiling that produces legal effects concerning you.

6. Cookies and Similar Technologies

This website uses the Shopify Buy Button to display products and enable purchases (see Section 7). Operating the shopping cart requires a technically necessary session cookie / local storage entry set by Shopify so that the items you select remain in your cart. This is strictly necessary for the shop to function and does not require your consent under Art. 6(1)(f) GDPR and § 25(2) No. 2 TTDSG.

We do not currently use cookies for analytics, tracking or advertising purposes. Should this change in the future, we will implement a consent banner allowing you to accept or decline such cookies before they are set, and we will update this policy accordingly.

7. Recipients of Your Data / Service Providers

We share personal data with the following categories of recipients, strictly to the extent necessary to fulfil your order:

• Shopify Inc. (151 O'Connor Street, Ground Floor, Ottawa, ON K2P 2L8, Canada) — provides the e-commerce infrastructure (Buy Button, checkout, order processing) and, where selected, payment processing. See Shopify's own privacy policy for details of its processing.
• WhiteWall — prints and ships our Fine Art Prints directly to you; receives your name and shipping address for this purpose.
• Printful — prints and ships postcards and other merchandise directly to you; receives your name and shipping address for this purpose.
• Payment providers (e.g. PayPal (Europe) S.à r.l. et Cie, S.C.A., and the card payment processors integrated via Shopify) — process your payment directly; we do not see or store full card numbers.

We do not sell your personal data, and we do not use any third-party form provider for the contract withdrawal form on our website — see Section 9.

8. International Data Transfers

Some of the recipients listed in Section 7 are located outside the European Economic Area (for example in Canada or the United States). Where we transfer personal data outside the EEA, we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses or a valid adequacy decision for the destination country.

9. Contract Withdrawal Form

When you use the contract withdrawal form on our website (revoke.html), the personal data you enter (name, e-mail address, order number, postal address, and an optional reason) is processed directly on our own web server and forwarded to us by e-mail for the sole purpose of handling your withdrawal. This is carried out by us directly, in accordance with Art. 6(1)(b) GDPR and § 356a of the German Civil Code (BGB). We do not transmit or store this data with any third-party form service provider.

10. Storage Duration

We retain personal data only for as long as necessary for the purposes described above, or as required by statutory retention obligations (for example, German commercial and tax law generally requires invoices and related business records to be kept for six to ten years). Data collected via the contract withdrawal form is retained only for as long as needed to process the withdrawal and any related statutory obligations.

11. Children

This website is not directed at children, and we do not knowingly collect personal data from persons under the age of 16 without the consent of a parent or legal guardian. If you believe a child has provided us with personal data without such consent, please contact us using the details in Section 2 so that we can delete it.

12. Your Rights

Under the GDPR, you have the right to:

• request access to the personal data we hold about you (Art. 15 GDPR);
• request correction of inaccurate data (Art. 16 GDPR);
• request erasure of your data (Art. 17 GDPR);
• request restriction of processing (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR); and
• withdraw any consent you have given, at any time and with future effect (Art. 7(3) GDPR).

To exercise any of these rights, please contact us using the details in Section 2.

13. Right to Lodge a Complaint

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI)
Königstraße 10a
70173 Stuttgart, Germany
Phone: +49 711 615541-0
Website: www.baden-wuerttemberg.datenschutz.de

You may also contact the supervisory authority in your own EU member state.

14. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or in applicable law. The current version is always available on this page.

15. Contact

For any questions about this privacy policy or to exercise your rights, please contact us at paul.burmester@icloud.com or at Bierkellerweg 20, 77876 Kappelrodeck, Germany.

← Home