This privacy policy provides information about the type, scope and purpose of the processing of personal data when visiting and using this online shop. The legal basis is the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Controller
CineSigns
Owner: Thorsten Marks
Hauptstrasse 86
63743 Aschaffenburg
Germany
Email: info@cinesigns.com
Legal Basis
We process personal data on the basis of Art. 6 (1) GDPR:
- lit. a: consent
- lit. b: performance of a contract or pre-contractual measures
- lit. c: compliance with legal obligations
- lit. f: legitimate interests
Hosting
This website is hosted by Host Europe GmbH, Hansestrasse 111, 51149 Cologne, Germany. Servers are located in the European Union (Strasbourg, France). The hosting provider processes connection data on our behalf (Art. 28 GDPR).
Server Log Files
When this website is accessed, data is automatically stored in server log files: IP address, date and time of access, requested URL, referer URL, browser and operating system. The legal basis is Art. 6 (1) lit. f GDPR (legitimate interest in stability and security). The data is deleted or anonymised after a maximum of 14 days.
SSL/TLS Encryption
This website uses SSL/TLS encryption. You can recognise an encrypted connection by the lock icon in your browser and the „https://“ prefix.
Cookies
We use only technically necessary cookies that are required for the operation of the shop and the cart functionality (e.g. session and cart cookies from WordPress and WooCommerce). No consent is required for these (§ 25 (2) no. 2 TDDDG). These cookies are deleted at the latest at the end of the browser session.
Order Processing and Customer Account
For the processing of orders, we process name, address, email address, phone number where applicable, and order and payment data. Processing is carried out for the performance of the contract (Art. 6 (1) lit. b GDPR) and to comply with commercial and tax law retention obligations (Art. 6 (1) lit. c GDPR).
Optionally, you can create a customer account to view orders and save addresses. You can have your account deleted at any time; statutory retention periods remain unaffected.
Payment Service Provider (Stripe)
For the processing of payments, we use Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The payment data entered during the payment process (e.g. credit card data, account data) is transmitted directly to Stripe; we do not have access to complete payment data. The legal basis is Art. 6 (1) lit. b GDPR (performance of contract). Transfers to the USA are based on the EU-US Data Privacy Framework. More information: stripe.com/privacy.
Shipping Service Provider (DHL)
For shipping ordered goods, we transmit the name and delivery address to Deutsche Post DHL Group, Stinghauser Strasse 10, 53113 Bonn, Germany. For international shipments, the email address or phone number for shipment tracking is also transmitted, where provided. The legal basis is Art. 6 (1) lit. b GDPR. DHL privacy notices: dhl.de/privacy.
Contact by Email
If you contact us by email, your details will be stored for the purpose of processing your enquiry and for follow-up questions. The legal basis is Art. 6 (1) lit. b GDPR for contract-related enquiries, otherwise Art. 6 (1) lit. f GDPR.
Retention Period
Personal data is only stored for as long as necessary for the stated purposes. Order and invoice data is subject to commercial and tax law retention obligations of up to 10 years (§ 147 AO, § 257 HGB). After expiry, the data is deleted.
Your Rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Consent given can be withdrawn at any time with effect for the future.
To exercise these rights, an informal notification to the contact details above is sufficient.
Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.