1. Controller
The controller under the GDPR is:
Kristian Lust / SBMiniatures
Amselweg 14
21529 Kröppelshagen
Germany
Email: kontakt@sbminiatures.com
2. Hosting and server logs
This website is hosted by Domainfactory GmbH, c/o WeWork, Neuturmstrasse 5, 80331 Munich, Germany. The hosting provider processes technically necessary connection data such as IP address, date and time, requested URL, HTTP status, referrer and browser/device information. Processing is based on Art. 6(1)(f) GDPR for secure and stable operation. Where DomainFactory acts as our processor, processing is governed by an Art. 28 GDPR agreement. See the DomainFactory privacy information.
3. Consent management, necessary cookies and local storage
We use Complianz to manage your choices regarding cookies, scripts and similar technologies that require consent. Technically necessary browser storage is used to remember your consent choices and the applicable cookie-policy version. These data are used for consent management, not for advertising profiles. Necessary storage is based on section 25(2)(2) TDDDG; GDPR processing necessary for legal compliance is based on Art. 6(1)(c), and otherwise on Art. 6(1)(f) GDPR. You can change your choices at any time via “Cookie settings”.
WooCommerce uses technically necessary storage for cart, checkout, login and session functions. The SBMiniatures wishlist stores only product IDs locally under sbm_wishlist and is not used for advertising or tracking.
4. Audience measurement with Jetpack Stats
We use Jetpack Stats, provided by Automattic Inc., United States, to evaluate visits and technical use in aggregate. Data may include IP address, WordPress.com user ID/username where applicable, user agent, visited and referring URLs, timestamp, browser language, country code, page views, outbound clicks and technical performance data.
Jetpack Stats is assigned to the “Statistics” category and is intended to load only after your consent. Processing based on consent relies on Art. 6(1)(a) GDPR and, where information is stored on or read from your device, section 25(1) TDDDG. You may withdraw consent at any time via “Cookie settings”. Our Jetpack configuration also honours browser “Do Not Track” preferences. According to Automattic, statistics logs containing IP addresses and, where available, WordPress.com usernames are retained for 28 days. Processing in the United States may occur. See the Jetpack Stats information and Automattic Privacy Policy.
5. Payment processing with Stripe and PayPal
We use Stripe Payments Europe, Limited, Ireland, and affiliated Stripe companies for card payments and, where offered, express payment methods. Stripe may process connection, device, browser and interaction data for payment security and fraud prevention and receives the payment and order data required for the payment method you select.
The checkout may also offer or embed services from PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, such as PayPal payment methods or PayPal-related checkout content. Depending on the function and your selection, connection, device, order and payment data may be transferred to PayPal.
Processing necessary to perform a payment you select is based on Art. 6(1)(b) GDPR. Security and fraud-prevention measures may be based on Art. 6(1)(f) GDPR. Where Stripe or PayPal stores or reads non-essential information on your device, these functions are controlled through consent under section 25(1) TDDDG and Art. 6(1)(a) GDPR. See the privacy statements of Stripe and PayPal.
6. Orders and customer accounts
We process customer, billing, delivery, order and payment-status data to take steps before entering into and to perform contracts (Art. 6(1)(b) GDPR). If you create a customer account, the data required to maintain it, saved addresses and order history are processed on the same basis. Statutory accounting and tax records are retained under Art. 6(1)(c) GDPR for the applicable period.
7. Shipping
For fulfilment we transfer required recipient data to shipping providers. We use Packlink (Auctane, S.L.U.) as a shipping platform for many shipments and primarily DPD/UPS within Germany and the EU and DHL for international shipments. The legal basis is Art. 6(1)(b) GDPR. International delivery may require processing in third countries where necessary to perform the contract.
8. Contact
Contact-form and email data is processed to respond to requests. Contract-related enquiries are processed under Art. 6(1)(b) GDPR; other enquiries under Art. 6(1)(f) GDPR based on our legitimate interest in handling communications appropriately.
9. Electronic withdrawal
Electronic withdrawal submissions include your name, email address, contract/order identifier, optional item information and the date/time of receipt. They are stored privately in WordPress and sent by email for handling and the statutory acknowledgement. Processing is based on Art. 6(1)(c) and (b) GDPR.
10. Reviews and comments
If reviews or comments are enabled and you submit content, we process the information entered and technically necessary metadata for publication, moderation and abuse prevention. Processing is based on Art. 6(1)(f) GDPR.
11. Recipients, processors and international transfers
Hosting, shop, consent-management, analytics, payment, shipping, email and security providers receive only the data required for their respective role. Where they act as processors, applicable processing is governed by Art. 28 GDPR agreements. Automattic, Stripe, PayPal or international carriers may process data outside the European Economic Area. Such transfers are made in accordance with Articles 44 et seq. GDPR using an applicable adequacy decision, appropriate safeguards such as EU Standard Contractual Clauses, or a statutory derogation where applicable.
12. Retention
We retain personal data only for as long as necessary for the relevant purpose, statutory retention duties or the establishment, exercise or defence of legal claims. Data is deleted or anonymised when the relevant purpose and retention period end.
13. Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, data portability and objection under Articles 15–21 GDPR and the right to withdraw consent for the future. You may contact kontakt@sbminiatures.com.
14. Supervisory authority
You may lodge a complaint with a data protection supervisory authority. The competent authority for businesses based in Schleswig-Holstein is the Independent Centre for Privacy Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, www.datenschutzzentrum.de.