Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the GDPR is Alexander Dross, Jahnstr. 17, 88069 Tettnang, Germany. E-mail: mail@dross.net (via our contact form). For data-protection matters (access, deletion, objection) you can also reach us at datenschutz[at]dross.net.

2. General Information and Legal Bases

We process personal data only where a statutory basis permits it or you have given consent, and in line with data minimisation. Depending on the case, the legal basis is your consent (Art. 6(1)(a) GDPR), the performance of a contract or pre-contractual steps (Art. 6(1)(b)), compliance with a legal obligation (Art. 6(1)(c)), or our legitimate interests (Art. 6(1)(f)).

3. Your Rights

You have the following rights regarding your personal data:

• Access to the data we store about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17) and restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interests (Art. 21)
• Withdrawal of consent at any time, with effect for the future (Art. 7(3))

You also have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR). The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI Baden-Württemberg).

4. Server Log Files and Hosting

On every access to our server, access data is stored in log files: the page accessed, date and time, the amount of data transferred, browser type and operating system, the referrer URL and the IP address. This processing is necessary for the secure and stable operation of the website (Art. 6(1)(f) GDPR).

Our website is operated on the infrastructure of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), which also provides the content delivery network and the caching layer. When you visit the site, Cloudflare processes the access data described above (in particular the IP address) on our behalf under a data processing agreement. Transfers to the USA are safeguarded by the EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. Cloudflare's privacy policy: cloudflare.com/privacypolicy.

5. Cookies and Local Storage

This website uses no tracking cookies and no analytics. We only use storage that is technically necessary to provide functions you request — for example the shopping cart (browser localStorage), spam protection, the hosted payment page and offline caching (service worker). Such strictly necessary access does not require consent (§ 25(2) TDDDG), so no cookie banner is shown.

6. Contact Form and Spam Protection

If you contact us via the form or by e-mail, the details you provide are processed to handle your enquiry (Art. 6(1)(b) or (f) GDPR) and deleted once they are no longer required, unless statutory retention periods apply. To protect the forms against spam we use Cloudflare Turnstile instead of Google reCAPTCHA (provider: Cloudflare, Inc.); its privacy policy is available at cloudflare.com/privacypolicy.

7. Shop Orders and Payment (Stripe)

When you place an order, we process the data required to perform the contract (name, billing and delivery address, e-mail, phone, order details) on the basis of Art. 6(1)(b) GDPR. Payment is handled by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland); the payment data you enter is transmitted to and processed by Stripe as payment service provider, and we do not store full card details.

Invoices and order records are kept for the statutory retention periods under commercial and tax law (§ 257 HGB, § 147 AO — generally 6 to 10 years); the legal basis is Art. 6(1)(c) GDPR. Stripe's privacy policy: stripe.com/privacy.

8. Shipping (Sendcloud, DHL / Deutsche Post)

To ship physical orders we pass the delivery data required to create the label and deliver the parcel (name, delivery address, e-mail and phone number) to our shipping service provider Sendcloud B.V. (Stationsplein 32, 5211 AP 's-Hertogenbosch, Netherlands) and to the delivering carrier DHL / Deutsche Post (Deutsche Post AG / DHL Group, Germany), which also sends you the tracking status. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

9. Newsletter

You can subscribe to our newsletter with your e-mail address (name and topics optional). We use the double opt-in procedure: after signing up you receive a confirmation e-mail and are only added to the list once you confirm. The legal basis is your consent (Art. 6(1)(a) GDPR). We log the sign-up and confirmation (time and IP address) to demonstrate consent (Art. 6(1)(f)). You can unsubscribe and withdraw your consent at any time via the link in every newsletter or by e-mail.

10. E-mail Dispatch

Transactional and newsletter e-mails (order and contact confirmations, newsletter double opt-in) are dispatched via the SMTP server of our hosting provider netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany), which processes the sender and recipient data on our behalf. Inbound e-mail to our domains is routed via the e-mail routing of Cloudflare, Inc. The legal basis is the performance of the contract or your consent for the newsletter, and our legitimate interest in reliable communication (Art. 6(1)(b), (a) and (f) GDPR). Payment- and order-related e-mails may additionally be sent by Stripe (see the payment section).

11. Fonts and Absence of Tracking Services

All fonts are self-hosted (no Google Fonts). We do not use Google Analytics, Google marketing services, Facebook social plugins or any other external tracking or analytics services.

12. Processors at a Glance

The following processors act on our behalf under data processing agreements (Art. 28 GDPR):

• Cloudflare, Inc. (USA) — hosting, CDN, caching, e-mail routing and Turnstile spam protection (SCC / EU-US DPF)
• Stripe Payments Europe, Ltd. (Ireland) — payment processing and invoicing
• Sendcloud B.V. (Netherlands) — shipping-label creation
• DHL / Deutsche Post (Germany) — parcel delivery and tracking
• netcup GmbH (Germany) — SMTP e-mail dispatch

13. Storage Duration

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods (in particular under tax and commercial law). Once the purpose ceases and no retention obligation applies, the data is deleted.

14. Changes to this Privacy Policy

We reserve the right to amend this privacy policy to reflect changes in the legal situation or in our services. The current version always applies.