Privacy Policy

The data controller is the business identified on our business information page. Registration details and postal address are published there.

For anything privacy-related, write to nilsachenbach@online.de.

Business information

Order data — email address, the sets purchased, price, tax data, country, payment provider references, and a VAT number if you supply one. Purpose: performing the contract and delivering your files. Legal basis: contract.

Tax and accounting data — the same transaction records, retained for statutory bookkeeping. Legal basis: legal obligation.

Withdrawal acknowledgement record — order ID, email, timestamp, the wording accepted and the document versions in force. Purpose: evidence that immediate supply was requested. Legal basis: legal obligation and contract.

Fulfilment and download logs — when payment was confirmed, when the confirmation email was sent, when a download link was created and used. Purpose: proof of delivery, support, fraud prevention and security. Legal basis: legitimate interest and contract.

Support correspondence — your message and our reply. Legal basis: legitimate interest.

We do not store card numbers. Payment credentials are handled entirely by our payment provider.

Cross-border digital sales require us to determine your country for VAT purposes. Our payment and tax provider supplies that determination and the supporting evidence; we store the result and the audit reference rather than duplicating more personal information than necessary.

We use a small number of service providers. Each processes data only on our instructions, under a data processing agreement.

• —Payment provider — Payment processing, tax determination, receipts. Data: Email, billing country, VAT ID where given, payment credentials, transaction data.
• —Hosting and application platform — Serving the website and storing order records. Data: Order records, technical logs.
• —Email delivery — Order confirmation and download delivery. Data: Email address, order details.

Where a processor transfers data outside the EEA, the transfer relies on an adequacy decision or on standard contractual clauses. The specific mechanism for each provider is confirmed on legal review before launch.

Retention is set per purpose, not in one blanket rule. Where the law requires us to retain accounting records, we cannot delete them on request — we will restrict processing instead and explain what remains.

• —Order, payment and tax records — Statutory accounting retention period (Legal obligation).
• —Download tokens — 30 days from issue (Contract performance).
• —Fulfilment and download logs — 12 months (Legitimate interest).
• —Support correspondence — 24 months (Legitimate interest).
• —Abandoned checkout data — 30 days (Legitimate interest).
• —Marketing preferences — Until withdrawn (Consent).

The site runs on essential functionality only: your selection is kept in your browser's local storage, and our payment provider sets what it needs to process a payment securely. Analytics: none. Advertising or behavioural tracking: none.

Because nothing non-essential is loaded, there is no consent banner. If we ever add analytics or anything non-essential, we will ask first, load nothing before you agree, offer equally easy Accept and Reject controls, and let you change your mind later.

Buying a set does not subscribe you to anything. Your email is used to process the order, send the receipt, deliver your files and handle necessary service messages. If we ever start a newsletter it will be a separate, voluntary choice and never a condition of purchase.

You can request access, correction, deletion, restriction, portability, or object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time.

Write to nilsachenbach@online.de. You also have the right to lodge a complaint with your local data protection supervisory authority.

All characters shown on this site are AI-generated and are not intended to depict any specific real individual. Our normal workflow does not use photographs of real people as references, and every set is reviewed by a person before publication to avoid obvious resemblance to identifiable individuals.