Skip to content
Seitenstart – to the home page

Privacy policy

Draft – to be reviewed by a chamber of commerce or lawyer before publication. This is a translation; the German version is legally binding.

1. Controller

Lukas-Domenik Sonnenfeld, Seitenstart, Anschrift siehe Impressum, Germany · Email: sunfieldshops@gmail.com

2. Hosting (Cloudflare)

This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit, Cloudflare processes technically necessary data (IP address, time, page requested, browser details) to deliver the pages and secure operations (Art. 6(1)(f) GDPR). A data processing agreement is in place with Cloudflare; the transfer to the USA is based on the adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses. We do not store any log data ourselves; Cloudflare stores it only as long as necessary for operation and security.

3. No cookies, no statistics

This website sets no cookies, uses no statistics or advertising services and loads no fonts or scripts from third-party servers. The order page stores nothing in your browser.

4. Ordering and paying with PayPal

When you click “Order with obligation to pay – PayPal”, a payment link of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, opens. Only then is data transferred to PayPal; nothing is loaded from PayPal before that. PayPal processes your payment data under its own responsibility; PayPal’s privacy policy applies. From PayPal we receive your name, email address, amount and time of payment. The legal basis is Art. 6(1)(b) GDPR (contract).

5. Online payment via Stripe

If you choose “Order with obligation to pay – card, Apple Pay, Google Pay, Klarna, SEPA & more” at checkout, you will be redirected to Stripe’s payment page. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Data is transferred to Stripe only once you click this button; before that, this website does not load any content from Stripe. Stripe processes the data you enter there (name, optionally company name, email address, billing address, payment details such as card number or IBAN), the amount and the product purchased, as well as technical data about your device (for example your IP address), in order to process the payment, prevent fraud and comply with legal obligations.

We do not receive card numbers or other complete payment details. From Stripe we receive your name, company name if provided, email address, billing address, amount, product and payment status in order to send you the download link and issue the invoice. The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations under Section 147 of the German Fiscal Code (AO) and Section 14b of the German VAT Act (UStG)). Stripe itself is responsible for fraud prevention and for complying with its own regulatory obligations.

Stripe may transfer data to affiliated companies, in particular to Stripe, Inc. in the USA. According to Stripe, such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses. If you pay with Klarna, Apple Pay, Google Pay or by SEPA Direct Debit, the respective providers additionally process data in accordance with their own privacy notices. On its payment page, Stripe uses cookies and similar technologies that are necessary for secure payment and fraud prevention; this website itself still does not set any cookies. Stripe’s privacy policy: stripe.com/privacy.

6. Order email and delivery

With the prepared order email we receive the order number, product, price, time, language, your country, your consent to the expiry of the right of withdrawal and – if provided – your email address for the download. We use these details to match payment and download and to send the link (Art. 6(1)(b) GDPR); we also need your country to check our VAT obligations. We keep order and invoice data for up to 10 years due to statutory obligations (Art. 6(1)(c) GDPR, § 147 AO). The emails are processed by our email provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (Gmail bzw. Google Apps Script). Soweit Daten in die USA übermittelt werden, geschieht das auf Grundlage des EU-US Data Privacy Framework bzw. von Standardvertragsklauseln.

7. Withdrawal via the online function

If you use “Withdraw from a contract”, your name, order details and email address are sent to us via Cloudflare Workers KV (Cloudflare, Inc., see section 2, as processor) and stored there so that we can process your withdrawal and confirm its receipt (Art. 6(1)(c) GDPR in conjunction with § 356a BGB). We keep the details as long as claims under the contract are possible and for up to 10 years due to statutory obligations (§ 147 AO).

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example die für den jeweiligen Wohnort zuständige Datenschutz-Aufsichtsbehörde (Übersicht: https://www.bfdi.bund.de).

As of 4 November 2026