Privacy Policy

2.1 Personal Data We Collect

• Account Data: Email address, name, password (encrypted)
• Purchase Data: Name, email address, order details, payment method
• Technical Data: IP address (stored temporarily for security/fraud prevention, deleted after max. 14 days), browser type, device information
• Usage Data: Pages visited, time spent, interactions (via analytics)

2.2 How We Use Your Data

• Order Processing: To fulfill your orders and send digital artworks via email
• Customer Account: To manage your account and order history
• Communication: To send order confirmations, invoices, and customer support
• Analytics: To improve our website and services (only with your consent)
• Legal Compliance: To comply with tax and accounting requirements

2.3 Legal Basis (GDPR Article 6)

• Contract Performance: Processing orders and delivering digital artworks
• Legitimate Interest: Website security and fraud prevention
• Consent: Analytics cookies and marketing communications
• Legal Obligation: Tax records and invoice retention

3.1 Cookie Categories

3.2 Google Analytics

If you consent to analytics cookies, we use Google Analytics to understand how visitors interact with our website. This data is anonymized and does not identify you personally. You can opt-out at any time via the cookie settings.

3.3 Local Browser Storage (No Tracking)

To display the gallery, your browser stores a small amount of purely technical data on your device: for the duration of the open browser tab, the scroll position and the list of images already loaded (sessionStorage — deleted automatically when the tab is closed), and, permanently, display settings you have chosen yourself, such as grid size and content filter (localStorage — remains in your browser until you delete it there). In addition, your browser caches retrieved image files according to standard browser caching rules. This storage is strictly necessary to provide the service you have expressly requested and therefore does not require consent (Sec. 25 (2) No. 2 of the German TDDDG). No third party gains access; no data is transmitted to us or to third parties. You can delete the stored data at any time via your browser settings.

3.4 Recipient Code in Business Correspondence

Links in our contact messages to business addresses may contain an anonymous recipient code, which allows us to see which of the companies we contacted responded to our message. Only this code is stored — no person and no contact address. The legal basis is our legitimate interest in measuring the effectiveness of our business correspondence (Art. 6(1)(f) GDPR); you may object to this use at any time and without any formal requirements (Art. 21 GDPR).

Deutsche Fassung: „Links in unseren Kontaktaufnahmen an Geschäftsadressen können ein anonymes Empfänger-Kürzel enthalten, mit dem wir nachvollziehen, welches angeschriebene Unternehmen auf unsere Nachricht reagiert hat; gespeichert wird dabei ausschließlich dieses Kürzel, keine Person und keine Kontaktadresse. Rechtsgrundlage ist unser berechtigtes Interesse an der Erfolgsmessung unserer Geschäftskorrespondenz (Art. 6 Abs. 1 lit. f DSGVO); Sie können der Verwendung jederzeit formlos widersprechen (Art. 21 DSGVO).“

3.5 Cookie-Free Visit Counting

We count page views without cookies and without storing your IP address. For each view we record the path called up, the referring page, a coarse browser category (browser family and device type, for example „Firefox / Desktop“ — never the full browser identification), the country supplied by our hosting provider, the time, whether the visit came from a logged-in customer session (yes/no, without any customer ID), and, where applicable, the channel or recipient code described in section 3.4. This does not allow us to identify you or to recognise you across visits. The legal basis is our legitimate interest in understanding the reach and use of our website (Art. 6(1)(f) GDPR); you may object at any time (Art. 21 GDPR).

Deutsche Fassung: Wir zählen Seitenaufrufe ohne Cookies und ohne Speicherung Ihrer IP-Adresse. Erfasst werden je Aufruf: der aufgerufene Pfad, die Herkunftsseite, eine grobe Browser-Kategorie (Browserfamilie und Gerätetyp, etwa „Firefox / Desktop“ — nie die vollständige Browser-Kennung), das von unserem Hoster gemeldete Land, die Zeit, ob der Aufruf aus einer angemeldeten Kundensitzung kam (Ja/Nein, ohne Kundennummer) sowie gegebenenfalls das in Abschnitt 3.4 beschriebene Kanal- oder Empfänger-Kürzel. Eine Identifizierung Ihrer Person oder eine Wiedererkennung über mehrere Besuche hinweg ist damit nicht möglich. Rechtsgrundlage ist unser berechtigtes Interesse an der Kenntnis von Reichweite und Nutzung unserer Website (Art. 6 Abs. 1 lit. f DSGVO); Sie können jederzeit widersprechen (Art. 21 DSGVO).