Privacy policy

1. Controller

1. (1)The controller for data processing on this website is Donauprint GbR, Burgwaldring 1, 86697 Oberhausen / Kreut, Germany, represented by Julian Lutz and Lukas Schläfer. Email: info@donauprint.de, phone: +49 176 24270013.
2. (2)Donauprint Living is a brand of Donauprint GbR. We are not legally required to appoint a data protection officer; for any data protection question please contact the address above.

2. Your rights

You have the following rights regarding the personal data concerning you:

• Access to the data we process (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), unless a statutory retention obligation prevents it
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR). The competent authority is the Bavarian Data Protection Authority (BayLDA).

3. Hosting and server log files

1. (1)This website runs on a server we rent from IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The server is located within the European Union. IONOS processes data as our processor.
2. (2)Every request processes technically necessary access data: IP address, date and time, the address requested, the amount of data transferred, the status code, the referrer, and details of your browser and operating system.
3. (3)The legal basis is our legitimate interest in operating the website securely and without technical faults (Art. 6 (1) (f) GDPR). This data is not combined with other sources.

4. Storage on your device

Besides classic cookies we use your browser's local storage. Both fall under § 25 TDDG (German Telecommunications Digital Services Data Protection Act). The following entries are set:

• dpl_locale (cookie, 1 year) — remembers your language choice so you do not have to pick it again on every page.
• dpl.cart.v2 (local storage, no expiry) — your cart, so it survives a reload or a browser restart.
• dpl.wishlist.v1 (local storage, no expiry) — your wishlist.
• dpl.consent.v1 (local storage, no expiry) — your cookie decision, so we do not ask again on every visit.
• dpl.payment (session storage, until the tab is closed) — a temporary reference to a payment in progress. It contains no payment data.

5. Consent management

1. (1)On your first visit we ask whether, beyond the technically necessary entries, statistics, marketing or external content may be used. Declining is exactly as easy as accepting, and nothing is pre-selected.
2. (2)The legal basis for technically necessary entries is § 25 (2) no. 2 TDDG together with Art. 6 (1) (f) GDPR; for all others it is your consent under § 25 (1) TDDG and Art. 6 (1) (a) GDPR.
3. (3)You can change or withdraw your decision at any time via the Cookie settings link in the footer.

6. No analytics or marketing tools in use

1. (1)No analytics, tracking or marketing services are currently integrated into this website. There is no audience measurement, no profiling, and no third-party advertising services. The statistics, marketing and external content categories in the consent dialogue are prepared but currently unused.
2. (2)Should such services be introduced in future, they will only be loaded after prior consent and will be described here beforehand.

7. Order processing

1. (1)To process an order we use your first and last name, email address, delivery and where applicable billing address, optionally company and phone number, as well as the items ordered, the amounts, the chosen shipping and payment method, and any discount code.
2. (2)The legal basis is performance of the purchase contract (Art. 6 (1) (b) GDPR). Without this information we cannot fulfil an order.
3. (3)No customer account is required. The entire checkout runs as a guest order; no account and no password are created.
4. (4)The phone number is optional and is used solely if there is a question about your delivery.

8. Payment processing

1. (1)When paying by PayPal, the necessary data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. We only receive a reference for the transaction and whether the payment succeeded — no payment data.
2. (2)With payment in advance by bank transfer, no data is transmitted to a payment provider. You instruct the transfer at your own bank; we then only see the incoming payment on our business account together with the reference you provided.
3. (3)The legal basis is performance of the contract (Art. 6 (1) (b) GDPR). PayPal acts as a controller in its own right; its own privacy notice applies to its processing.
4. (4)Card payment is currently not offered. Should it be introduced, the provider used will be added here.

9. Shipping

1. (1)To deliver your order we pass your name and delivery address to the shipping provider we use (DHL). If you provided a phone number or email address for delivery notifications, these are passed on as well.
2. (2)The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).

10. Email and order tracking

1. (1)Transactional emails such as order confirmation, payment confirmation and shipping notification are sent from our own mailbox at our hosting provider IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. No additional email service provider is involved, and the data does not leave the European Union.
2. (2)Since no account is created, order tracking works with your order number and email address. Both must match. The link to the order confirmation is additionally signed cryptographically, so that a guessed order number cannot reveal anyone else's data.
3. (3)The legal basis is performance of the contract (Art. 6 (1) (b) GDPR).

11. Custom design enquiries and file uploads

1. (1)Through the form under Custom design we process your name, email address, optionally your phone number, your message, and any files you upload (for example STL, STEP, OBJ, 3MF, PDF or image files).
2. (2)We use this data solely to handle your enquiry and prepare a quotation. If an order results from it, the data is used for production within Donauprint GbR. It is not passed to any other third party.
3. (3)Uploaded files are stored outside the publicly accessible area under randomly generated names and cannot be retrieved via any web address.
4. (4)The legal basis is pre-contractual measures or performance of the contract (Art. 6 (1) (b) GDPR). The consent you give in the form additionally documents this purpose.

12. Newsletter

1. (1)For the newsletter we use the double opt-in procedure. After signing up you receive an email with a confirmation link. Your subscription only becomes effective when you click that link. Until then we send nothing to your address except that one confirmation email.
2. (2)We store your email address, the language you chose, and — as a record of consent — the time of sign-up, the time of confirmation and the IP address used at sign-up. The confirmation link is valid for seven days; only a hash of the confirmation token is stored.
3. (3)The legal basis is your consent (Art. 6 (1) (a) GDPR). You may withdraw it at any time with effect for the future, for example via the unsubscribe link at the end of every newsletter. After unsubscribing, the data is deleted unless it is still needed as evidence of the earlier consent.

13. Cart, wishlist and search

1. (1)Your cart and wishlist are stored exclusively in your browser and are not transmitted to us unless you place an order. If you clear your browser's site data, both are lost.
2. (2)When you use the product search, the search term is sent to our server to find matching products. Search terms are not stored permanently and are not linked to any individual.

14. Fonts

The fonts used are served from our own server. No connection is made to Google Fonts or any other external font provider, so your IP address is not transmitted to any third party for this purpose.

15. Security

1. (1)The website is delivered exclusively over encrypted HTTPS. Anything you enter is therefore protected against being read by third parties in transit.
2. (2)To protect against automated bulk requests we limit how often individual functions such as discount code checks, ordering, search and design enquiries may be used. For this the IP address is processed briefly and only in memory, and is not stored permanently. The legal basis is Art. 6 (1) (f) GDPR.

16. Retention periods

• Order and invoice data: ten years, due to commercial and tax retention obligations (§ 257 HGB, § 147 AO).
• Design enquiries and uploaded files: until the enquiry is concluded, and beyond that only where it resulted in an order.
• Newsletter data: until you withdraw your consent.
• Server log files: short-term, for fault and abuse analysis.
• Data stored locally in your browser: until you delete it yourself.

17. Transfers to third countries

Hosting, the database and email delivery all run on servers within the European Union. In normal operation, no personal data is transferred to third countries. The one exception is payment by PayPal, where data may also be processed outside the European Union under the European Commission's standard contractual clauses.

18. Changes to this policy

We update this privacy policy whenever the processing described here changes — for example if analytics tools or a customer account are introduced in future. The version published on this page is the one that applies.