Skip to content
Layerfuchs

Privacy policy

Version 5 · as of 9 Oct 2026

1. Controller

Birthelmer Digital
Owner: Sebastian Birthelmer
Lichtenfelser Straße 39a
96103 Hallstadt
Germany

Email: birthelmer.business@gmail.com
Phone: +49 176 31673319

No data protection officer has been appointed, as there is no legal obligation to do so.

2. Hosting and server logs

This shop runs on a server owned and operated by the controller in Germany. No external hosting provider is involved.

When you visit the site, the server processes technically necessary data: IP address, date and time, requested address, browser identifier. This is required to deliver the site and protect it against attacks (Art. 6(1)(f) GDPR, legitimate interest in secure operation).

Fonts, scripts and images are loaded exclusively from our own server. No third party content is embedded.

3. Data processed and purposes

  • Order processing: name, email, billing address, optionally company and VAT ID, order data and the consents given at checkout (Art. 6(1)(b) GDPR). Invoice data is stored due to statutory retention obligations (Art. 6(1)(c) GDPR). Addresses and VAT IDs are stored encrypted.
  • Guest orders: to access a guest order later, we send a one time code to your email address.
  • Customer account: email, password (stored only as an Argon2id hash), optionally name, wishlist (Art. 6(1)(b) GDPR).
  • Reviews and community photos: reviews and photos you submit are published in the shop after moderation. Photo metadata (e.g. location) is removed before publication (Art. 6(1)(a) GDPR).
  • Downloads: time, file, order and IP address to prevent abuse (Art. 6(1)(f) GDPR). IP addresses are removed automatically after 30 days.
  • Security: protection against abuse through rate limits, temporary IP blocks and a self hosted CAPTCHA without third parties (Art. 6(1)(f) GDPR).
  • Newsletter: email address after double opt in confirmation (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email.
  • Release notifications: email address for notices about new releases (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email.
  • Support: the content of your request and your contact details (Art. 6(1)(b) and (f) GDPR).

Providing order and billing data is necessary to conclude the contract. Without it, a purchase is not possible.

4. Payment processing

Payments are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). To pay, you are redirected to a page operated by Stripe. Stripe receives your email address, the order amount, the order number and the payment details you enter there (Art. 6(1)(b) GDPR). Card and account details are not stored on our server.

Stripe may also transfer data to the USA; this is based on the EU US Data Privacy Framework or standard contractual clauses. More information: https://stripe.com/privacy

5. Email delivery

System emails (e.g. order confirmation, invoice, one time codes, password reset) are sent via an email server. Your email address and the content of the message are processed for this purpose (Art. 6(1)(b) GDPR).

6. Cookies and local storage

Necessary (no consent required, Section 25(2) TDDDG):

  • Login/session: up to 30 days
  • Cart: 60 days
  • Access to guest orders: 24 hours
  • Language setting: 1 year
  • Your cookie choice: in your browser's local storage

Analytics (only with your consent, Art. 6(1)(a) GDPR, Section 25(1) TDDDG): we use a self hosted Matomo instance for audience measurement. The data stays on our server and is not shared with third parties. Matomo is only loaded after you have consented. You can withdraw your consent at any time via "Cookie settings"; the Matomo cookies are then deleted.

7. Recipients

Your data is only passed on where necessary for processing: to Stripe (payment), to the email service (delivery) and to tax advisers and tax authorities where required by law. Your data is not sold.

8. Retention

  • Invoices and accounting records: 8 years, business correspondence: 6 years (Section 147 AO, Section 257 HGB)
  • Customer account: until you delete it. Orders are then kept in anonymised form for statutory retention.
  • IP addresses in download and session logs: 30 days
  • Carts without an account: 60 days
  • Newsletter and release notifications: until you unsubscribe
  • Support requests: up to 3 years after closure

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future.

Data export and account deletion are available directly in your customer account. For anything else, an email to the address above is sufficient.

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de

10. Automated decision making

No automated decision making, including profiling, takes place.

Last updated: October 2026