Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is:
Heiko Halfpaap
Auf dem Märchen 27
54646 Bettingen
Germany
Phone: +49 6527 1533
Email: support@designerspiele.com

2. General information

Personal data is information that can identify you directly or indirectly. We process personal data only where necessary to provide the website, respond to enquiries, fulfil orders or act on your consent.

3. Hosting and server logs

This website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you access the website, technically necessary information may be processed to deliver pages and keep the service secure. This can include your IP address, date and time, requested file, referrer URL, browser, operating system and volume of data transferred.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of the website. Where hosting or infrastructure providers process data on our behalf, they act as processors. A data processing agreement under Article 28 GDPR is in place with STRATO.

4. Contact and support

If you contact us by email, we process the information you send, particularly your email address, name, message and any order information. Processing is based on Article 6(1)(b) GDPR where the request concerns an order or pre-contractual enquiry, and otherwise on Article 6(1)(f) GDPR.

5. Cart, orders and digital products

Designerspiele supplies digital PDF downloads. Cart and order functions may process technical information and information entered during checkout, including name, email address, billing data, order information, payment status and order time.

Processing is necessary to perform the contract under Article 6(1)(b) GDPR and to meet legal obligations, particularly tax and commercial record-keeping duties, under Article 6(1)(c) GDPR.

6. Payment processing

We use Stripe Checkout to process payments. Depending on the service and contractual relationship, the provider is particularly Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, together with other Stripe group companies.

Information necessary for payment may be sent to Stripe, including email address, order total, currency, order number, payment status, chosen payment method and technical transaction data. We do not store full card details; Stripe processes them directly.

Processing is necessary to perform the contract under Article 6(1)(b) GDPR. Stripe may also process data for fraud prevention, security and legal compliance. See Stripe’s Privacy Policy.

Where required, data processing agreements under Article 28 GDPR are in place. Because Stripe operates internationally, personal data may be processed outside the EU or EEA, particularly in the United States. Stripe states that it uses safeguards including standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.

7. Cookies, local storage and consent

This website may use technically necessary cookies or local-storage entries to remember your cart, cookie choices or analytics consent. Non-essential analytics functions are activated only after consent.

Access to or storage of information on your device for technically necessary functions is based on Section 25(2) TDDDG. Non-essential access or storage occurs only with consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw consent at any time for the future.

8. Cloudflare Turnstile

We use Cloudflare Turnstile to protect the download search from automated requests and abuse. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile may process technical signals such as IP address, user agent, TLS fingerprint, site key and page origin to distinguish human visitors from automated access.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting the download function, customer data and technical infrastructure. Where Turnstile stores or reads information on your device, this is based on Section 25(2) TDDDG insofar as it is strictly necessary for the security check.

Cloudflare may transfer data to the United States and states that it uses safeguards including the EU–US Data Privacy Framework and standard contractual clauses. See the Cloudflare Turnstile Privacy Policy.

9. Google Analytics

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps us understand how visitors use the website, including pages and products viewed, traffic sources, devices and cart or checkout events.

Google Analytics is loaded only after you expressly consent to analytics. Processing is based on Article 6(1)(a) GDPR. We use Google Analytics without advertising personalisation and use Consent Mode so analytics storage is enabled only after consent.

Personal data may be transferred to Google LLC in the United States. Google states that it uses safeguards including standard contractual clauses and, where applicable, the EU–US Data Privacy Framework. See Google’s Privacy Policy.

10. Locally hosted fonts

Fonts used on this website are loaded locally from our server. Loading them does not connect your browser to Google Fonts or another external font provider.

11. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction, data portability and objection. You may withdraw consent at any time for the future.

Where processing is based on legitimate interests under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation under Article 21 GDPR.

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

You may lodge a complaint with a data protection supervisory authority if you believe processing infringes data protection law. In particular, the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate is competent unless another authority has jurisdiction.

12. Retention

We keep personal data only for as long as necessary for the relevant purpose or required by law. Contractual and tax-relevant data is retained for the applicable statutory periods.