Privacy policy
This is a translation for your convenience. The German version is legally binding.
1. Controller
Lukas-Domenik Sonnenfeld, Anschrift siehe Impressum, Germany, email: sunfieldshops@gmail.com
2. In short
This shop sets no cookies, uses no analytics or advertising services and loads no fonts or scripts from third-party servers. We only process data when you place an order, withdraw from a contract or write to us.
3. Hosting
The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit, Cloudflare processes technically necessary data (IP address, date and time, requested file, browser identifier, referrer) in server logs in order to deliver the pages and prevent misuse (Art. 6(1)(f) GDPR). The transfer to the USA is based on the EU-US Data Privacy Framework or EU standard contractual clauses. Cloudflare’s information: https://www.cloudflare.com/privacypolicy/
4. Orders
On the order page you may enter an email address for the download link and you select your country. Both stay in your browser until you send the prepared order email yourself with your email program. We process your order data (name, email address, country, product, price, time, consent to early download) to perform the contract (Art. 6(1)(b) GDPR) and retain it to meet tax and commercial law obligations (Art. 6(1)(c) GDPR, § 147 AO, § 257 HGB). We also need your country to check our VAT obligations.
5. Payment with PayPal
Payments are processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The PayPal button is a plain link: only when you click “Order with obligation to pay – PayPal” does PayPal open and receive data such as your IP address, browser identifier, referrer and the order details; before that, this shop loads nothing from PayPal (two-click solution). You enter your payment details directly with PayPal; PayPal provides us with your name, email address, amount and transaction number. The legal basis is Art. 6(1)(b) GDPR. PayPal may carry out credit and fraud checks to process the payment. PayPal’s privacy statement: https://www.paypal.com/de/legalhub/paypal/privacy-full
6. Online payment via Stripe
If you choose “Order with obligation to pay – card, Apple Pay, Google Pay, Klarna, SEPA & more” at checkout, you will be redirected to Stripe’s payment page. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Data is transferred to Stripe only once you click this button; before that, this website does not load any content from Stripe. Stripe processes the data you enter there (name, optionally company name, email address, billing address, payment details such as card number or IBAN), the amount and the product purchased, as well as technical data about your device (for example your IP address), in order to process the payment, prevent fraud and comply with legal obligations.
We do not receive card numbers or other complete payment details. From Stripe we receive your name, company name if provided, email address, billing address, amount, product and payment status in order to send you the download link and issue the invoice. The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations under Section 147 of the German Fiscal Code (AO) and Section 14b of the German VAT Act (UStG)). Stripe itself is responsible for fraud prevention and for complying with its own regulatory obligations.
Stripe may transfer data to affiliated companies, in particular to Stripe, Inc. in the USA. According to Stripe, such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses. If you pay with Klarna, Apple Pay, Google Pay or by SEPA Direct Debit, the respective providers additionally process data in accordance with their own privacy notices. On its payment page, Stripe uses cookies and similar technologies that are necessary for secure payment and fraud prevention; this website itself still does not set any cookies. Stripe’s privacy policy: stripe.com/privacy.
7. Withdrawal via the online function
If you use “Withdraw from a contract”, your name, order details and email address are sent to us via Cloudflare Workers KV (Cloudflare, Inc., see above) and stored at Cloudflare so that we can process your withdrawal and confirm its receipt (Art. 6(1)(c) GDPR in conjunction with § 356a BGB). We delete the details once they are no longer needed for processing and statutory evidence obligations.
8. Delivery and email
We send the download link by email. We use emails you send us only to deal with your request.
9. Retention
We keep order and invoice data for as long as statutory retention obligations require; we delete all other data as soon as it is no longer needed.
10. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(f) GDPR, as well as the right to lodge a complaint with a data protection supervisory authority.