Privacy policy
Draft – to be reviewed before publication.
This is a translation provided for convenience. Only the German version is legally binding: Deutsche Fassung.
1. Controller
Lukas-Domenik Sonnenfeld
Anschrift siehe Impressum
Germany
Email: sunfieldshops@gmail.com
2. Principles
This website sets no cookies, uses no analytics or advertising tools and loads no third-party fonts or scripts. There is no customer account.
3. Hosting
The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit it, Cloudflare processes technically necessary data (IP address, time, page requested, browser information) in server logs in order to deliver the site and protect it against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure delivery). We have a data processing agreement with Cloudflare; transfers to the USA are based on den Angemessenheitsbeschluss der EU-Kommission zum EU-US Data Privacy Framework (Art. 45 DSGVO) sowie EU-Standardvertragsklauseln.
4. Ordering by email
When you order, you send us an email containing the product, price, your country, whether you are ordering as a private individual or a business, and your declaration of consent. We process your email address, your name (if given) and the order details in order to perform the contract and send you the download link (Art. 6(1)(b) GDPR). We process your country and customer type for invoicing and to determine the applicable tax rules (Art. 6(1)(c) GDPR). We keep invoices and accounting records for the periods required by law (Art. 6(1)(c) GDPR, including § 147 AO and § 257 HGB – German tax and commercial codes); otherwise we delete the data when it is no longer needed. Our email provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (Gmail bzw. Google Apps Script). Soweit Daten in die USA übermittelt werden, geschieht das auf Grundlage des EU-US Data Privacy Framework bzw. von Standardvertragsklauseln.
5. Payment with PayPal
No PayPal script is embedded on the order pages. Only when you click “Pay with PayPal” are you redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal then processes your payment data as an independent controller; see PayPal’s privacy statement. PayPal provides us with your name, email address, the amount and the payment reference. Legal basis: Art. 6(1)(b) GDPR.
6. Online payment via Stripe
If you choose “Order with obligation to pay – card, Apple Pay, Google Pay, Klarna, SEPA & more” at checkout, you will be redirected to Stripe’s payment page via the payment link after sending the order email. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Data is transferred to Stripe only once you click this button; before that, this website does not load any content from Stripe. Stripe processes the data you enter there (name, optionally company name, email address, billing address, payment details such as card number or IBAN), the amount and the product purchased, as well as technical data about your device (for example your IP address), in order to process the payment, prevent fraud and comply with legal obligations.
We do not receive card numbers or other complete payment details. From Stripe we receive your name, company name if provided, email address, billing address, amount, product and payment status in order to send you the download link and issue the invoice. The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations under Section 147 of the German Fiscal Code (AO) and Section 14b of the German VAT Act (UStG)). Stripe itself is responsible for fraud prevention and for complying with its own regulatory obligations.
Stripe may transfer data to affiliated companies, in particular to Stripe, Inc. in the USA. According to Stripe, such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses. If you pay with Klarna, Apple Pay, Google Pay or by SEPA Direct Debit, the respective providers additionally process data in accordance with their own privacy notices. On its payment page, Stripe uses cookies and similar technologies that are necessary for secure payment and fraud prevention; this website itself still does not set any cookies. Stripe’s privacy policy: stripe.com/privacy.
7. Withdrawal using the online function
If you use “Withdraw from contract”, your name, order details and email address are transmitted to us via Cloudflare Workers KV (Cloudflare, Inc., see above) so that we can process your withdrawal and confirm receipt (Art. 6(1)(c) GDPR in conjunction with § 356a BGB – German Civil Code). We keep this information as evidence for as long as claims under the contract are possible and then delete it.
8. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You may lodge a complaint with a data protection supervisory authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information.
Last updated: November 2026
This is a translation provided for convenience. Only the German version is legally binding: Deutsche Fassung.