Privacy policy

1) Information on the collection of personal data and contact details of the controller

1.1 Below we inform you about how we handle your personal data. Personal data is all data with which you can be personally identified.

1.2 The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is Uladzimir Siauko, Meistersingerstr. 64, 45307 Essen, Germany, email: siauko.commerce@gmail.com. The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Contacting us

When you contact us (e.g. by email, phone or WhatsApp), we process the details you provide. This data is stored and used exclusively for the purpose of answering your request or for contacting you and the associated technical administration. The legal basis for processing the data is our legitimate interest in answering your request in accordance with Art. 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR. Your data will be deleted once your request has been fully processed, i.e. when it can be inferred from the circumstances that the matter has been conclusively resolved and provided there are no statutory retention obligations.

3) Data processing for order handling

Insofar as necessary for the performance of the contract for delivery and payment purposes, the personal data we collect is passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) (b) GDPR.

To process your order, we also work with the service providers named in sections 6 to 11, who support us in whole or in part in performing concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information. Your name, delivery address and email address are required to conclude the contract; without them we cannot process your order.

4) Rights of the data subject

4.1 Applicable data protection law grants you comprehensive data subject rights (rights to information and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:

• right of access under Art. 15 GDPR;
• right to rectification under Art. 16 GDPR;
• right to erasure under Art. 17 GDPR;
• right to restriction of processing under Art. 18 GDPR;
• right to notification under Art. 19 GDPR;
• right to data portability under Art. 20 GDPR;
• right to withdraw consent given under Art. 7 (3) GDPR;
• right to lodge a complaint under Art. 77 GDPR.

4.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST AFTER WEIGHING UP INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

5) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and – where relevant – additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

When personal data is processed on the basis of express consent in accordance with Art. 6 (1) (a) GDPR, the data concerned is stored until you withdraw your consent.

If there are statutory retention periods for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6 (1) (b) GDPR, this data is routinely deleted after the retention periods have expired, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in continuing to store it.

When personal data is processed on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

When personal data is processed for direct marketing purposes on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (2) GDPR.

Unless otherwise stated in the other information in this policy about specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

6) Hosting

Our online shop is hosted by netcup GmbH, Emmy-Noether-Str. 10, 76131 Karlsruhe, Germany, on servers in Germany. When the pages are accessed, technically necessary data (e.g. IP address, date and time, page accessed, browser) is processed in order to deliver the website and ensure its security. The legal basis is our legitimate interest in secure and stable operation in accordance with Art. 6 (1) (f) GDPR. A data processing agreement in accordance with Art. 28 GDPR has been concluded with the provider.

We store uploaded photos and designs in non-public storage on the same server.

To prevent abuse (limits on photo uploads and AI designs) and to count how often products are viewed, we process your IP address only in shortened form or as an irreversible hash; we delete these values after two days at the latest. The legal basis is our legitimate interest in secure operation and in showing popular products in accordance with Art. 6 (1) (f) GDPR.

7) Uploading photos for personalised products

To make personalised products, you upload photos and provide details such as texts, names or a phone number for engraving. We process this data exclusively to create a design for you before ordering if you wish, to make your product and, where applicable, to send you a design for approval. The legal basis is the performance of the contract or the implementation of pre-contractual measures at your request in accordance with Art. 6 (1) (b) GDPR. If other people are shown in the photos, you confirm that you have their consent, and for children the consent of those with parental responsibility.

For AI designs we use the application programming interface (API) of the AI service OpenAI. The provider is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Your photos and details are only transmitted to OpenAI if you choose "Create design" on the product page or if we make the design with AI support after your order. The purpose is to create a design from your photos; the legal basis is Art. 6 (1) (b) GDPR. OpenAI processes the data on our behalf; a data processing agreement in accordance with Art. 28 GDPR has been concluded with OpenAI. The contracting party for customers in the European Economic Area is OpenAI Ireland Limited. If it transfers data to affiliates or sub-processors outside the European Economic Area, such as OpenAI, L.L.C. in the USA, this is based on EU standard contractual clauses (Art. 46 (2) (c) GDPR) or an adequacy decision of the European Commission (Art. 45 GDPR). OpenAI does not use data transmitted via the API to train its models; OpenAI may store it for up to 30 days to detect abuse, unless longer storage is required by law, and deletes it afterwards. We delete the photos and designs stored with us in accordance with the periods stated below. The designs are generated automatically and labelled as AI designs; you decide yourself which design you use. No automated decision-making within the meaning of Art. 22 GDPR takes place.

The photos are stored in non-public storage and used only by us for production. Photos that are uploaded but not added to the cart are deleted after 48 hours; photos in carts that do not become an order after 30 days. We delete the photos and designs after the order has been completed, at the latest 90 days after delivery, unless statutory retention obligations prevent this. Photos that you publish with a review are excluded (see section 15).

8) Payment processing

For payment by prepayment (bank transfer), we process the payment data transmitted to us by our bank.

For payment by card, PayPal, Klarna, Apple Pay, Google Pay or another payment method offered via Stripe, processing is carried out by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. The data required for the payment (e.g. name, amount, payment details) is transmitted to Stripe. The legal basis is Art. 6 (1) (b) GDPR. A transfer to the USA is possible; Stripe is certified under the EU-US Data Privacy Framework. For payment with PayPal or Klarna, Stripe passes the necessary data on to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, or to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden; they also process the data under their own responsibility in accordance with their privacy notices.

9) Shipping

For delivery, we transmit your name and delivery address to DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany). The legal basis is Art. 6 (1) (b) GDPR. We only pass on your email address and phone number to DHL if you have agreed to this in the checkout (Art. 6 (1) (a) GDPR), so that DHL can inform you about the delivery. You can withdraw your consent at any time with effect for the future, e.g. by emailing us.

10) Sending emails

We send order confirmations, designs for approval and shipping information by email. For this we use the email server of netcup GmbH (see section 6) as a processor. The legal basis is Art. 6 (1) (b) GDPR.

11) Contact via WhatsApp

If you have given your consent when ordering or later on the page of your design, we agree on the design of your personalised product with you via WhatsApp; you then receive designs and reminders there instead of by email. The phone number you enter for this on the page of your design is stored with your order, together with the text and time of your consent. The legal basis is your consent in accordance with Art. 6 (1) (a) GDPR, which you can withdraw at any time with effect for the future, e.g. by email; we will then use email. The provider of WhatsApp is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Your phone number and the content of the messages are processed; a transfer to Meta Platforms, Inc. in the USA is possible. Meta is certified under the EU-US Data Privacy Framework.

12) Customer account

You can voluntarily create a customer account with us. We process your name, your email address, optionally your phone number and addresses, and an encrypted password so that you can view your orders and save addresses. The legal basis is Art. 6 (1) (b) GDPR. You can have your customer account deleted at any time, e.g. by email to siauko.commerce@gmail.com; data that we must retain for tax or commercial law reasons will be blocked until the retention periods expire.

13) Cookies

We only use technically necessary cookies, e.g. for the cart, signing in to the customer account, the country selection and the language selection. On the checkout page, the payment service Stripe (see section 8) sets its own cookies that enable secure payment and prevent fraud; they only serve the payment you have chosen. When you upload photos or create an AI design, we set the cookie "_lenori_vid" with a random identifier (stored for 30 days) to prevent abuse through mass uploads or designs. The legal basis is § 25 (2) No. 2 TDDDG in conjunction with Art. 6 (1) (b) and (f) GDPR. We do not use analytics or advertising cookies.

14) Newsletter

If you subscribe to our newsletter when registering, in the checkout, in your customer account or via the sign-up form at the bottom of every page, we send you offers and personal vouchers, news, reminders about items in your shopping cart and requests to review your orders by email. To make the emails relevant to you, we take into account your language, your previous orders (product categories, date of your last order) and the contents of a shopping cart you have not ordered. No automated decision within the meaning of Art. 22 GDPR takes place. The legal basis is your consent in accordance with Art. 6 (1) (a) GDPR.

The subscription only takes effect once you click the link in our confirmation email (double opt-in). As proof of your consent, we store the text shown, the time, place and language of the subscription and the time of confirmation (Art. 7 (1) GDPR). We do not measure whether you open an email or click a link. Links in our emails only contain an identifier of the email campaign, not of you; if you order after following such a link, we store this identifier with the shopping cart and the order in order to evaluate the success of our campaigns in aggregate (Art. 6 (1) (f) GDPR).

You can unsubscribe at any time via the unsubscribe link, in your customer account or by emailing us. After that, we no longer use your email address for the newsletter. We keep the proof of consent and the log of emails sent (recipient, campaign, time) for up to three years to defend against claims (Art. 6 (1) (f) GDPR); we delete unconfirmed subscriptions after 30 days and unused vouchers 30 days after they expire.

15) Reviews

Customers with a customer account can review products they have bought from us. We publish the review with your first name and the first letter of your last name, the date and the product reviewed; photos only if you have expressly agreed to their publication when uploading them, and only after we have checked them. The legal basis is your consent in accordance with Art. 6 (1) (a) GDPR. Reviews and photos remain published until you ask us to delete them, e.g. by email; this also applies to photos, notwithstanding the periods in section 7.

If you agreed in the checkout, we send you an email after dispatch asking for a review and, if you have not reviewed, a reminder after 14 days. The legal basis is your consent in accordance with Art. 6 (1) (a) GDPR, which you can withdraw at any time by emailing us or via the link in the email.

16) Online withdrawal

If you declare your withdrawal via the "Withdraw from contract" button, we process the details you provide (name, email address, order number and your message) to handle the withdrawal and to confirm receipt to you by email. The legal basis is Art. 6 (1) (c) GDPR in conjunction with § 356a BGB. We keep the data with the order records and delete it once the statutory retention periods have expired.

17) Accounting and retention

We store invoices and invoice corrections (name, address, items ordered, amounts, payment method) for eight years from the end of the year in which they were issued, to meet our tax obligations; the legal basis is Art. 6 (1) (c) GDPR in conjunction with § 147 AO and § 14b UStG. For our accounting we use cloud-based accounting software from a provider based in Germany as a processor (Art. 28 GDPR), and we pass the records to our tax adviser, who processes them under their own responsibility and professional secrecy.