Privacy

1. Data processed

• Server and access data such as IP address, date, time, requested URL, and technical browser information
• Order and payment data to the extent required for contract processing
• Contact data such as name, email address, and other voluntary details for inquiries, purchase requests, or waitlist sign-ups
• Data that may be transmitted to a third-party provider when embedded media is activated

2. Purposes and legal bases

Processing is carried out to provide and secure the website, process orders and purchase requests, communicate with customers, send transactional emails, manage waitlist registrations, and comply with legal obligations.

Legal bases include Art. 6(1)(b) GDPR for contract performance or pre-contractual measures, Art. 6(1)(c) GDPR for compliance with legal obligations, and Art. 6(1)(f) GDPR based on legitimate interests in a secure and functioning online presence. Where you actively confirm the waitlist or load an embedded YouTube video, processing is based on Art. 6(1)(a) GDPR.

3. Service providers

The website is self-hosted. Stripe is used for payment processing. Waitlist and purchase request data is stored in Supabase. Resend may be used to send transactional emails.

A YouTube video is embedded on the product page and is only loaded after active confirmation. Only then is a connection established to YouTube or Google.

Where required, appropriate data processing agreements are concluded with service providers. Processing outside the EU or EEA may take place where suitable safeguards such as standard contractual clauses exist.

4. Storage and rights

Personal data is stored only for as long as necessary for the respective purpose or as long as statutory retention periods apply. Contract and tax-related data is retained in accordance with mandatory statutory retention periods.

Waitlist data is stored until the purpose has been fulfilled or consent has been withdrawn. Purchase request data is generally stored only for as long as necessary to handle the request or comply with subsequent legal obligations.

• Access to stored personal data
• Rectification of inaccurate data
• Erasure or restriction of processing where legally permitted
• Objection to processing based on legitimate interests
• Complaint to the competent supervisory authority

5. Contact

Please send privacy-related requests to janhebein.design@gmail.com.