Privacy policy

This translation is provided for convenience. The German version is legally binding.

1. Controller

Michael Plumbohm
Cookie Prints Co.
Auf der Höhe 10
75181 Pforzheim
Deutschland
Email: cookieprintsco@icloud.com

2. Principles

We only process personal data as far as necessary to run the shop and fulfil your order. We use no tracking, analytics or advertising services and embed no third-party content (fonts, videos, maps, social plugins). All fonts, images, videos and 3D previews are served from our own server.

3. Hosting and server logs

The website runs on our own server (Coolify). Technically necessary data (IP address, time, URL, user agent) is briefly processed in log files to ensure secure operation and prevent abuse. Legal basis: Art. 6(1)(f) GDPR. Logs are deleted after 14 days at the latest.

4. Cookies and local storage

We only use strictly necessary storage (§ 25(2) TDDDG):

• cp_session (cookie, only after login): keeps you signed in, 30 days.
• NEXT_LOCALE (cookie): remembers your language.
• cp_cart_v1 and cp_theme (localStorage): cart contents and light/dark setting. This data stays in your browser until you order.

No consent is required, so there is no cookie banner.

5. Orders and customer account

To process your order we process name, address, email, optional phone, order contents and personalisation (Art. 6(1)(b) GDPR). If you create an account, we store your password as an Argon2 hash. Statutory retention obligations (up to 10 years) remain unaffected.

6. Uploaded photos and preview

Photos you upload for personalised products are stored on our server, used solely to make your product and deleted no later than 90 days after shipping; uploads without an order are deleted after 7 days. The 3D preview is computed on our own server: we process a reduced grayscale version of your cropped photo and your chosen options in an isolated process without internet access; the resulting 3D model is only cached briefly in memory. At checkout we generate the print file for your product from it. No data is transferred to third parties.

7. Payment providers

If you choose PayPal, you are redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; order number and amount are transmitted. The same applies to Stripe Payments Europe Ltd., Dublin, if offered. Legal basis: Art. 6(1)(b) GDPR. Bank transfer involves no third parties.

8. Email

We send order confirmations, shipping notifications and messages about your order via our mail server (Apple iCloud Mail, Apple Distribution International Ltd., Cork, Ireland), Art. 6(1)(b) GDPR. You only receive marketing emails if you have explicitly subscribed to the newsletter (section 9).

9. Newsletter

Purpose: Our newsletter occasionally informs you about new products, designs and offers. We only send it with your explicit consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG). Subscribing is voluntary; the checkbox at registration, in your account or at checkout is never pre-ticked.

Double opt-in: After signing up you receive an email with a confirmation link. You are only added to the list once you click it. Without confirmation you won't receive any newsletters.

Logging: To be able to prove your consent we store your email address, chosen language, time and IP address of the sign-up, where you signed up (e.g. footer, account, checkout), time and IP address of the confirmation and, if applicable, time and channel of the unsubscription (Art. 6(1)(c) and (f) GDPR). We keep a send log (recipient, time, delivery status). We do not track opens or clicks (no tracking pixels).

Withdraw any time: You can unsubscribe at any time with effect for the future – via the unsubscribe link in every newsletter (one click, no login), your email program's unsubscribe function, your customer account, the "Unsubscribe from newsletter" page (link in the footer) or by emailing us. The lawfulness of processing before withdrawal remains unaffected.

Retention: We keep your newsletter data until you unsubscribe. After unsubscribing we send no more newsletters; only the address marked as "unsubscribed" and the consent log are kept as proof (up to 3 years, statutory limitation period). Unconfirmed sign-ups are deleted on request at any time.

10. Shipping

For delivery we pass name and address to the carrier used (usually DHL / Deutsche Post AG, Bonn; possibly Hermes, DPD, GLS or UPS), Art. 6(1)(b) GDPR. We share the tracking number with you by email and on your order page.

11. External links

Links to Etsy and Instagram are plain links; no data is transferred before you click.

12. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection Baden-Württemberg.