Privacy

Email: roy@filamenting.com

I am the controller under the GDPR for everything on this site. Write to me about anything on this page.

The site runs on Cloudflare (Cloudflare, Inc., USA). To deliver pages and pictures and to block attacks, Cloudflare processes your IP address, the page you asked for, the time and your browser type. Legal basis: my legitimate interest in a working and secure site (Art. 6 (1) (f) GDPR).

I count page views with PostHog (PostHog, Inc., USA) to see which products people look at. It stores nothing in your browser: no cookies, no local storage, and no profile that follows you between visits. PostHog receives your IP address, the page address and your browser type. Legal basis: my legitimate interest in knowing how the shop is used (Art. 6 (1) (f) GDPR). You can object at any time by writing to me.

The shop sets one cookie, fl_cart, which remembers what is in your cart. It is needed for the shop to work, so it needs no consent (§ 25 (2) TDDDG). There are no advertising or tracking cookies.

I store your name, email address, delivery address and what you ordered, so I can make and send your order and answer questions about it. Legal basis: performance of the contract (Art. 6 (1) (b) GDPR). The data sits in a database hosted by Neon (Neon, Inc.) in Frankfurt, Germany.

Payment is handled by Stripe (Stripe Payments Europe, Ltd., Ireland). You enter your payment details on Stripe’s page. I never see or store your card number. Stripe’s own privacy policy is at stripe.com/privacy.

Your name and delivery address go to the parcel carrier that delivers the order.

Order emails are sent through Resend (Resend, Inc., USA), which receives your email address and the content of the email.

I keep order and invoice data for as long as German tax and commercial law requires, which is up to ten years (Art. 6 (1) (c) GDPR). After that it is deleted.

If you use the contact form or send an email, I store your name, email address and message so I can reply. Legal basis: steps before a contract or my legitimate interest in answering you (Art. 6 (1) (b) and (f) GDPR). Replies are sent through Resend. To stop spam, the form counts messages per sender using a scrambled (hashed) form of the IP address, which is deleted after a short time. I delete messages once the matter is settled, unless they belong to an order.

Cloudflare, PostHog and Resend are US companies, so data can be processed in the USA. These transfers rely on the EU-US Data Privacy Framework or on the EU standard contractual clauses.

You can ask me what data I hold about you, have it corrected or deleted, have its use restricted, receive it in a portable format, and object to processing that rests on my legitimate interest (Art. 15 to 21 GDPR). An email is enough.

You can also complain to a data protection authority. The one responsible for me is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, ldi.nrw.de.

You are not required to give me any data, but without a name, an address and an email I cannot send you an order. I make no automated decisions about you.