Privacy policy

This translation is provided for convenience. The German version is legally binding.

1. Controller

Michael Plumbohm
Cookie Prints Co.
Auf der Höhe 10
75181 Pforzheim
Deutschland
Email: info@cookieprints.org

2. Principles

We only process personal data as far as necessary to run the shop and fulfil your order. We use no advertising services and no third-party analytics. Cookieless reach measurement with self-hosted Umami is described in section 13. Fonts, images and 3D previews are served from our own server. We load a Google script only on the order confirmation page for the voluntary customer reviews (section 12); YouTube or Vimeo videos only after you click "Play video" (section 11).

3. Hosting and server logs

The website runs on our own server (Coolify). Technically necessary data (IP address, time, URL, user agent) is briefly processed in log files to ensure secure operation and prevent abuse. Legal basis: Art. 6(1)(f) GDPR. Logs are deleted after 14 days at the latest.

4. Cookies and local storage

We only use strictly necessary storage (§ 25(2) TDDDG):

• cp_session (cookie, only after login): keeps you signed in, 30 days.
• NEXT_LOCALE (cookie): remembers your language.
• cp_cart_v1 and cp_theme (localStorage): cart contents and light/dark setting. This data stays in your browser until you order.

Reach measurement (section 13) does not use cookies. No consent is required, so there is no cookie banner.

5. Orders and customer account

To process your order we process name, address, email, optional phone, order contents and personalisation (Art. 6(1)(b) GDPR). If you create an account, we store your password as an Argon2 hash. Statutory retention obligations (up to 10 years) remain unaffected.

6. Uploaded photos and preview

Photos you upload for personalised products are stored on our server, used solely to make your product and deleted no later than 90 days after shipping; uploads without an order are deleted after 7 days. The 3D preview is computed on our own server: we process a reduced grayscale version of your cropped photo and your chosen options in an isolated process without internet access; the resulting 3D model is only cached briefly in memory. At checkout we generate the print file for your product from it. No data is transferred to third parties.

7. Payment providers

If you choose PayPal, you are redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; order number and amount are transmitted. The same applies to Stripe Payments Europe Ltd., Dublin, if offered. Legal basis: Art. 6(1)(b) GDPR.

8. Email

We send order confirmations, shipping notifications, messages about your order and – if subscribed – the newsletter from addresses of our domain cookieprints.org (e.g. info@cookieprints.org); emails sent to these addresses are received there as well. The mailboxes of this domain are hosted by Apple iCloud Mail (Apple Distribution International Ltd., Cork, Ireland), which processes the emails on our behalf, Art. 6(1)(b) GDPR (newsletter: Art. 6(1)(a)). You only receive marketing emails if you have explicitly subscribed to the newsletter (section 9), and a review request only if you ticked the box for it at checkout (section 15).

9. Newsletter

Purpose: Our newsletter occasionally informs you about new products, designs and offers. We only send it with your explicit consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG). Subscribing is voluntary; the checkbox at registration, in your account or at checkout is never pre-ticked.

Double opt-in: After signing up you receive an email with a confirmation link. You are only added to the list once you click it. Without confirmation you won't receive any newsletters.

Logging: To be able to prove your consent we store your email address, chosen language, time and IP address of the sign-up, where you signed up (e.g. footer, account, checkout), time and IP address of the confirmation and, if applicable, time and channel of the unsubscription (Art. 6(1)(c) and (f) GDPR). We keep a send log (recipient, time, delivery status). We do not track opens or clicks (no tracking pixels).

Withdraw any time: You can unsubscribe at any time with effect for the future – via the unsubscribe link in every newsletter (one click, no login), your email program's unsubscribe function, your customer account, the "Unsubscribe from newsletter" page (link in the footer) or by emailing us. The lawfulness of processing before withdrawal remains unaffected.

Retention: We keep your newsletter data until you unsubscribe. After unsubscribing we send no more newsletters; only the address marked as "unsubscribed" and the consent log are kept as proof (up to 3 years, statutory limitation period). Unconfirmed sign-ups are deleted on request at any time.

10. Shipping

For delivery we pass name and address to the carrier used (usually DHL / Deutsche Post AG, Bonn; possibly Hermes, DPD, GLS or UPS), Art. 6(1)(b) GDPR. We share the tracking number with you by email and on your order page.

11. External links

Links to Etsy and Instagram are plain links; no data is transferred before you click.

Embedded videos (YouTube, Vimeo): Some stories contain videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Vimeo (Vimeo.com, Inc., New York, USA). Until you click "Play video", no connection to these providers is made and no cookies are set by them – only a preview image from our own server is shown. The player is loaded only after your click; your IP address and the page visited, among other data, are then transmitted to the provider. We use YouTube's privacy-enhanced mode (youtube-nocookie.com) and Vimeo's "Do Not Track" mode. The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data may be transferred to the USA; both providers are certified under the EU-US Data Privacy Framework. More information: policies.google.com/privacy and vimeo.com/privacy.

12. Google Customer Reviews

On the order confirmation page you can voluntarily take part in Google Customer Reviews (seller ratings). Only on this page do we load the opt-in module of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We do not use a cookie banner for this; you give consent in the module's dialog. If you agree, we transmit the order number, email address, delivery country and estimated delivery date to Google. Google then sends you a review request. Participation is voluntary and does not affect your order. The legal basis is your consent (Art. 6(1)(a) GDPR). More information: policies.google.com/privacy

13. Reach measurement

For reach measurement we use Umami, self-hosted on our own server. It sets no cookies, does not store IP addresses and does not pass data on to third parties. We record pages visited, referrer including a link's campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term; other URL parameters are removed before sending), device type and the events "added to cart", "checkout started", "order completed", "photo uploaded", "crop applied", "voucher error", "payment error" and clicks on links to Etsy (with product and page section) – without names, email addresses, voucher codes or order numbers. The admin area is excluded. The legal basis is our legitimate interest in an anonymous evaluation of how the shop is used (Art. 6(1)(f) GDPR). You can object by enabling "Do Not Track" in your browser; the visit is then not recorded. Your right to object under Art. 21 GDPR (section 14) remains unaffected.

14. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection Baden-Württemberg.

15. Product reviews

Review request by email: Only if you tick the (not pre-ticked) box at checkout do we send you a single email with a personal review link about 7–10 days after shipping. For this we store the time and wording of your consent and the time the email was sent with your order. The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG). You can withdraw it at any time without giving reasons – via the unsubscribe link in the email or by messaging us; you will then receive no further review requests (including for other orders with the same email address).

Your review: We only publish real buyer reviews – no invented star ratings. Via the link you can review the products you bought (stars, text, display name). We store it on our server linked to your order, check it before publication (only for spam and legal violations – critical reviews are published too) and show it with display name, date, stars and text on the product page and possibly the home page; it is included in the structured data for Google Search. Your email address and order data are not published. The legal basis is your consent by submitting (Art. 6(1)(a) GDPR) and our legitimate interest in credible product information (Art. 6(1)(f) GDPR). You can request erasure or anonymisation of your review at any time (see section 14).

Reviews from Etsy: Reviews that buyers have posted publicly in our Etsy shop are taken over unchanged with the name or initials, date and stars shown there and labelled "Review from Etsy" (legitimate interest, Art. 6(1)(f) GDPR). If you deleted a review there or do not want it taken over, write to us and we will remove it.

We use no cookies and no third-party services for reviews (for Google Customer Reviews see section 12).