[DRAFT -- prepared technically based on the services actually used, but does not replace a legal review. Before publication, add actual company/contact details and have it legally reviewed.]
1. Controller
[Name/Company]
[Address]
Email: uride.displaid@gmx.net
Phone: [Phone number, optional]
2. General Information on Data Processing
In principle, we process our users' personal data only to the extent necessary to provide our shop, our content, and our services. Legal bases include, in particular, Art. 6 (1) (a) (consent), (b) (performance of contract), and (f) (legitimate interest) of the GDPR.
3. Hosting and Server Log Files
Our shop is operated via Shopify, and our design configurator via the hosting provider Railway. Both providers automatically collect technical access data (e.g., IP address, date/time, accessed page, browser type) in server log files to ensure safe and stable operation. Legal basis: Art. 6 (1) (f) GDPR.
4. Cookies
Our shop uses cookies, some of which are technically necessary (e.g., shopping cart, checkout, login), and some of which require your consent (e.g., statistics/marketing via Shopify). Upon your first visit, we will ask for your consent via a cookie banner, as far as legally required (§ 25 TTDSG in conjunction with Art. 6 (1) (a) GDPR). [Add a concrete list of cookies/services once finalized.]
5. Registration and Customer Account
If Shopify customer accounts are actively used: When you create a customer account, we process the data provided (name, email, address, order history) for the fulfillment and processing of the contract (Art. 6 (1) (b) GDPR).
6. Order and Payment Processing
When an order is placed, we process the data required for this (name, billing and delivery address, email, payment data) for the performance of the contract (Art. 6 (1) (b) GDPR). Payment processing takes place via Shopify Payments or the payment service providers offered at checkout [add specific payment service providers].
7. Design Configurator: Processing of Your Vehicle Photos
To create your custom artwork, you upload your own photos of your vehicle. In doing so, we process the uploaded image files themselves as well as any license plates, locations, or other people/vehicles of third parties that may be visible in them. The legal basis is the performance of a contract (Art. 6 (1) (b) GDPR).
The photos are:
- stored with our storage provider Cloudflare (R2),
- transmitted to OpenAI (USA) for image generation in order to create your custom design,
- linked to your order/session in our database (hosted via Railway).
Important note regarding license plates: If your photo shows a license plate, this will—in accordance with your wishes—be reproduced faithfully on the final artwork you purchase. However, on publicly visible preview images (e.g., before purchase, in marketing, or on social media), the license plate will be obscured or removed.
8. Transfer to Third Countries (USA)
Image generation is carried out via OpenAI, a company based in the USA. Consequently, personal data (the photos you upload) may be transferred to a country outside the EU/EEA for which no adequacy decision by the EU Commission exists. We ensure an appropriate level of data protection through suitable guarantees, in particular by concluding EU Standard Contractual Clauses (SCCs) (Art. 46 GDPR) with the respective provider. [Before going live, check/confirm that a corresponding data processing agreement, including SCCs, has been concluded with OpenAI.]
9. Printing and Shipping
For the production and shipping of your product, we transmit the required data (name, delivery address, print file) to our printing and fulfillment partner Gelato, who produces on your behalf and ships directly to you. Legal basis: Art. 6 (1) (b) GDPR.
10. Newsletter
If the newsletter subscription is actively used: When you sign up, we use your email address to send you news and offers, based on your consent (Art. 6 (1) (a) GDPR). You can withdraw this consent at any time via the unsubscribe link in every email.
11. Contacting Us
When you contact us via email or contact form, we process the data you provide in order to handle your request (Art. 6 (1) (b) or (f) GDPR).
12. Overview of Data Processors Used
- Shopify -- Shop system, checkout, payment processing, order management
- Railway -- Hosting of the design configurator and database
- Cloudflare -- Storage of photos and generated images
- OpenAI -- AI-powered image generation from your photos
- Gelato -- Printing and shipping of your order
13. Storage Duration
We only store personal data for as long as it is necessary for the stated purposes or as required by statutory retention periods (e.g., 6-10 years for accounting data under commercial and tax law). For uploaded photos and generated design drafts, the following applies automatically:
- If no generation is started within a session after uploading photos, we delete the photos after a maximum of 30 minutes of inactivity.
- We delete unselected generated design variants no later than 90 minutes after their creation.
- We retain photos and designs from a session in which a generation has already occurred for as long as the session is still active or as long as later re-generation might be possible. [For sessions that never lead to an order, there is currently no automated deletion limit beyond the two mentioned periods—decide internally whether an additional automatic deletion period should be added or a manual review should be introduced before this paragraph is finalized.]
14. Your Rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing (Art. 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). To do so, please contact the address mentioned above or our competent supervisory authority [insert competent state data protection authority].
15. Changes to This Privacy Policy
We will update this privacy policy whenever the legal situation or the nature of the data we process changes. The version current at the time of your visit applies.