Privacy policy
Draft – to be reviewed by a chamber of commerce or lawyer before publication.
This is a translation for your convenience. The German version is legally binding.
1. Controller
Lukas-Domenik Sonnenfeld, Anschrift siehe Impressum, Germany, email: sunfieldshops@gmail.com
2. Hosting
This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit, Cloudflare processes technically necessary data (IP address, time, page requested, browser details) in server logs in order to deliver and secure the site (Art. 6(1)(f) GDPR). A data processing agreement is in place with Cloudflare; the transfer to the USA is based on the EU-US Data Privacy Framework or standard contractual clauses. Log retention period: Wir selbst speichern keine Protokolldaten; Cloudflare speichert sie nur so lange, wie es für Betrieb und Sicherheit nötig ist, und löscht sie danach..
3. No cookies, no analytics
We use no cookies and no analytics or advertising tools, and load no third-party fonts or scripts. Nothing is stored on your device.
4. Ordering and payment via PayPal
Only when you click “Order with obligation to pay – PayPal” does PayPal open (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg). No connection to PayPal is made before that. PayPal processes your payment and contact data as an independent controller; privacy notice: https://www.paypal.com/de/legalhub/privacy-full. From PayPal we receive your name, email address, amount, time and transaction number in order to perform the contract and send the download link (Art. 6(1)(b) GDPR). The country you select on the order page helps us check our VAT obligations.
5. Online payment via Stripe
If you choose “Order with obligation to pay – card, Apple Pay, Google Pay, Klarna, SEPA & more” at checkout, you will be redirected to Stripe’s payment page. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Data is transferred to Stripe only once you click this button; before that, this website does not load any content from Stripe. Stripe processes the data you enter there (name, optionally company name, email address, billing address, payment details such as card number or IBAN), the amount and the product purchased, as well as technical data about your device (for example your IP address), in order to process the payment, prevent fraud and comply with legal obligations.
We do not receive card numbers or other complete payment details. From Stripe we receive your name, company name if provided, email address, billing address, amount, product and payment status in order to send you the download link and issue the invoice. The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations under Section 147 of the German Fiscal Code (AO) and Section 14b of the German VAT Act (UStG)). Stripe itself is responsible for fraud prevention and for complying with its own regulatory obligations.
Stripe may transfer data to affiliated companies, in particular to Stripe, Inc. in the USA. According to Stripe, such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses. If you pay with Klarna, Apple Pay, Google Pay or by SEPA Direct Debit, the respective providers additionally process data in accordance with their own privacy notices. On its payment page, Stripe uses cookies and similar technologies that are necessary for secure payment and fraud prevention; this website itself still does not set any cookies. Stripe’s privacy policy: stripe.com/privacy.
6. Delivery by email
We send the order confirmation and download link to the email address you gave PayPal or Stripe via our email provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (Gmail bzw. Google Apps Script). Soweit Daten in die USA übermittelt werden, geschieht das auf Grundlage des EU-US Data Privacy Framework bzw. von Standardvertragsklauseln (data processor). The download is provided via einen persönlichen, befristeten Download-Link oder als E-Mail-Anhang.
7. Withdrawal via the online function
If you use “Withdraw from a contract”, your name, order details and email address are sent to us via Cloudflare Workers KV (Cloudflare, Inc., see above) so that we can process and confirm your withdrawal (Art. 6(1)(c) GDPR in conjunction with § 356a BGB).
8. Email contact
If you write to us, we process your details to reply (Art. 6(1)(b) or (f) GDPR).
9. Retention
We keep order and invoice data for the statutory periods (up to 10 years, § 147 AO, § 14b UStG); other enquiries are deleted once they have been dealt with.
10. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a supervisory authority, e.g. https://www.bfdi.bund.de (list of German data protection authorities; e.g. the one responsible for your place of residence).
As of 4 November 2026