Privacy policy

Version: 29.10.2026 (added the cookie for the language of the shop; previously 11.10.2026: customer account, express checkout, shipping, invoice and calendar file; corrected: Stripe.js for express checkout, browser storage) 1. Data protection at a glance General information The following information provides a simple overview of what happens to your personal data when you visit this online shop. Personal data is any data with which you can be personally identified. For detailed information on data protection, please refer to our privacy policy set out below this text. This privacy policy applies to our online shop. Our website www.motoworldtours.com has its own privacy policy. Data collection in this shop Who is responsible for data collection in this shop? Data processing in this shop is carried out by the shop operator. You can find the operator's contact details in the section "Information about the controller" in this privacy policy. How do we collect your data? On the one hand, your data is collected when you provide it to us. This may be, for example, data that you enter when placing an order or in your customer account, or that Apple Pay or Google Pay transmits to us during express checkout. Other data is collected automatically by our IT systems when you visit the shop. This is mainly technical data (e.g. internet browser, operating system or time of the page request). This data is collected automatically as soon as you enter the shop. What do we use your data for? Part of the data is collected to ensure that the shop is provided without errors. We use the data you provide when placing an order to process your order. If you create a customer account, we show you your orders, invoices and the shipping status there. What rights do you have regarding your data? You have the right at any time to receive information free of charge about the origin, recipient and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. For this purpose, and for any further questions on the subject of data protection, you can contact us at any time at the address given in the section "Information about the controller". Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. For details, please refer to the privacy policy under "Right to restriction of processing". No analytics or advertising services This shop does not use any analytics or advertising services. Your browsing behaviour is not analysed, no user profiles are created, and no cookies are set for analytics or advertising purposes. Only cookies and browser storage that are technically necessary for the functions you request are used (see section 4 and – for online payment – section 5). 2. Hosting, database and network services Operation by elvio GbR This shop runs on the elviOS platform. The shop software is provided by elvio GbR, Wasserkamp 39, 38442 Wolfsburg, Germany, which operates it on our behalf. elvio GbR processes your data only to the extent necessary to fulfil its service obligations and follows our instructions with regard to this data. For this purpose it uses the service providers named below. Hosting with Amazon Web Services The shop's servers are operated by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg ("AWS"), in the data centre in Frankfurt am Main (region eu-central-1). All requests to the shop are processed there. This may include, in particular, IP addresses, order data, contact data, names, contract data and other data generated via the shop. Product images are provided via Amazon CloudFront, a delivery service of AWS. When the images are loaded, AWS receives your IP address. The server's error logs are kept at AWS in Frankfurt am Main for 14 days. In individual cases they may contain an order ID or an email address, for example if an order confirmation could not be delivered. Access logs recording every page request with an IP address are currently not kept on our servers. AWS is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 (1) (b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6 (1) (f) GDPR). Database and file storage at Appwrite Orders, invoices (as PDF) and the shop's settings are stored in the Appwrite Cloud database of Appwrite Code Ltd., Israel ("Appwrite"), in its Frankfurt am Main region. Appwrite delivers data via the network of Fastly, Inc., USA. Your browser only contacts Appwrite directly in one case: our logo on the payment page and in the order confirmation email is loaded from Appwrite's file storage. Appwrite and Fastly receive your IP address in the process – for the email only if your email program loads images. The legal basis is Art. 6 (1) (b) GDPR and, insofar as the display of the logo is concerned, Art. 6 (1) (f) GDPR. Cloudflare The shop is accessible via the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare"). Every request from your browser to the shop passes through Cloudflare's servers before it reaches our servers. Cloudflare processes your IP address and the technical details of the request (e.g. browser identification, time, address requested). Because the encrypted connection ends at Cloudflare and is forwarded from there, encrypted again, to our servers, the contents of the requests – such as your order data – also pass through Cloudflare's servers. The purpose is the reliable delivery of the shop and its protection against attacks and overload. To fend off automated access, Cloudflare may set technically necessary cookies. The legal basis is Art. 6 (1) (f) GDPR. We have a legitimate interest in the secure and stable operation of the shop. Further information can be found in Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/ Conclusion of a data processing agreement To ensure processing in compliance with data protection law, we have concluded a data processing agreement with elvio GbR. elvio GbR in turn has concluded data processing agreements with the service providers it uses (AWS, Appwrite, Cloudflare and the email service Resend, see section 5). 3. General information and mandatory information Data protection The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. When you use this shop, various personal data are collected. Personal data is data with which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens. Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible. Information about the controller The controller responsible for data processing in this shop is: Marc Collins Wachtelberg 10e 15378 Rüdersdorf Germany Phone: +49 33434 / 80 73 44 Email: info@MotoWorldTours.com The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.). Withdrawal of your consent to data processing Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. An informal email to us is sufficient for this. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal. Right to object to data collection in special cases and to direct advertising (Art. 21 GDPR) IF THE DATA PROCESSING IS BASED ON ART. 6 (1) (E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21 (1) GDPR). IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT ADVERTISING (OBJECTION PURSUANT TO ART. 21 (2) GDPR). Right to lodge a complaint with the competent supervisory authority In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged violation. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies. Right to data portability You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible. SSL or TLS encryption For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties. The service providers commissioned by us through whose servers the connection runs (see section 2) are excluded from this. Information, deletion and correction Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to correction or deletion of this data. For this purpose, and for any further questions on the subject of personal data, you can contact us at any time at the address given in the section "Information about the controller". Right to restriction of processing You have the right to request the restriction of the processing of your personal data. For this purpose, you can contact us at any time at the address given in the section "Information about the controller". The right to restriction of processing exists in the following cases: If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data. If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of deletion. If we no longer need your personal data, but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of its deletion. If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data. If you have restricted the processing of your personal data, this data – apart from its storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a member state. Objection to advertising emails The use of contact data published within the framework of the imprint obligation for sending advertising and information material that has not been expressly requested is hereby objected to. The operators of the pages expressly reserve the right to take legal action in the event of unsolicited advertising information being sent, for example by spam emails. No automated decision-making We do not carry out automated decision-making within the meaning of Art. 22 GDPR. Stripe checks online payments automatically to prevent fraud and may reject a payment in the process (see section 5). If your payment is rejected, please contact us. 4. Data collection in this shop Cookies and storage in the browser Cookies are small text files that your browser stores on your device; your browser's local storage ("Local Storage") and session storage ("Session Storage") work in a similar way. This shop only uses cookies and browser storage that are technically necessary to provide the functions you have expressly requested. We do not set cookies for analytics or advertising purposes. In detail: Shop access (cookie "shop_laden_zugang") Only as long as the shop is protected by a password before its launch: after you enter the password, your browser remembers the unlocking in this cookie. It contains neither the password nor any information about you, but a check value derived from it. It cannot be read by scripts on the page, is only transmitted over encrypted connections and is deleted after 30 days. Shopping cart (local storage "shop-warenkorb-v1") Your shopping cart is stored in your browser's local storage so that it is kept when you click on or reload the page. It only contains the selected articles, variants or dates and the respective quantity, no information about you. After an order from the shopping cart, the items ordered are removed from it – immediately for payment by bank transfer, and for online payment only once the payment has been completed and you return to your order overview; otherwise it remains until you empty it or delete the website data in your browser. Assignment of shopping cart and order (local storage "shop-korb-bestellt-v1") After an order from the shopping cart, your browser remembers which selection belongs to which order: the order ID, the articles, variants or dates ordered with their quantity, and whether they have already been removed from the shopping cart. This allows the shop to remove the ordered selection from the shopping cart only after the payment has been completed for online payment, and to offer to put it back into the shopping cart if the order is cancelled. The entry contains neither your name nor your contact or payment details. It remains until a new order replaces it, you put the selection back into the shopping cart with "Restore selection", or you delete the website data in your browser. Sign-in to the customer account (cookie "__Host-shop_kunde") Only if you sign in to your customer account: the cookie contains a random ID of your sign-in, no information about you; we only store a non-reversible check value (hash) of it. It cannot be read by scripts on the page, is only transmitted over encrypted connections and is deleted after 30 days or when you sign out. Sign-in code for the customer account (cookie "__Host-shop_code_browser") Only if you request a sign-in code for your customer account: the cookie contains a random value, no information about you. It ensures that the code is only valid in the browser in which you requested it, and that the limit on requested codes is also counted per browser; we only store a non-reversible check value (hash) of it. It cannot be read by scripts on the page, is only transmitted over encrypted connections and is deleted one hour after the last request. Access to the order overview (session storage "shop-zugang-" with the order ID appended) After an order, and when you open your order overview or the payment page via your personal link, your browser remembers the access key to your order overview for the duration of the session, so that you can return there after an online payment with redirection (e.g. to your bank). The entry is deleted when you close the tab or the browser window. Pre-filling the checkout for express checkout (session storage "shop-kasse-vorbelegung-v1") Only if Apple Pay or Google Pay does not provide all the details required for the order during express checkout in the shopping cart or on the product page (e.g. no billing address): your browser stores the details provided – email address, name, phone number and billing address, where available – together with a note of what needs to be added in the session storage, so that the checkout can pre-fill its order form with them. The checkout reads the entry once the next time it is called up and deletes it in the process; otherwise it is deleted when you close the tab or the browser window. Design of the shop (local storage "shop_laden_stil") When you call up the shop, your browser remembers its design (the value "kraftvoll"), so that the shop appears in its dark design straight away even where its offering has not yet been loaded – for example in the event of a disruption – instead of briefly appearing light. The entry contains no information about you. It remains until you delete the website data in your browser. Videos in the hero image (local storage "shop_buehne_clip") Only if the hero image on the home page shows videos – at a window width of 768 pixels or more, not in data saver mode and not with a slow connection, insofar as your browser reports this: your browser remembers the address of the video with which the hero image last started, so that it starts with a different video the next time it is called up. The entry contains no information about you. It is overwritten each time the home page is called up and remains until you delete the website data in your browser. Language of the shop (cookie "shop_laden_sprache") Only if the shop is offered in several languages and you expressly choose a language – via the language switcher or a link that names the language, for example from the English version of our website: your browser remembers the chosen language ("de" or "en") in this cookie, so that the shop appears in this language on the following pages and the next time you visit. The cookie contains no information about you, applies only to the pages of the shop, is only transmitted over encrypted connections and is deleted after one year; if you choose a language again, it is overwritten. Storage is based on Section 25 (2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), as it is strictly necessary to provide the function you have expressly requested; consent is not required for this. Further processing is based on Art. 6 (1) (b) GDPR (order) or Art. 6 (1) (f) GDPR (protection of the shop that is not yet public). You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this shop may be limited. For the cookies that Stripe sets on the payment page and – for express checkout – in the shopping cart, at checkout and on the product page, see section 5 under "Online payment with Stripe"; for Cloudflare see section 2. Calling up the shop and protection against misuse When you call up the shop, your browser transmits data to our servers for technical reasons, in particular your IP address, the time of the request, the address requested, and the browser type and browser version. The shop cannot be displayed without this data. To protect the shop against automated mass requests, against guessing of the access password and against fake orders – every order reserves tour places or goods –, we limit the number of requests, orders and password attempts per internet connection. For this purpose, the server keeps your IP address (for IPv6 only the first 64 bits, which identify the connection) together with a counter exclusively in working memory. The entry expires after the respective time window (between one minute and 24 hours). It is not stored permanently and is not linked to your order; your IP address is not stored with an order. For the customer account, we additionally limit the number of sign-in codes requested per email address and the failed sign-in attempts. For this purpose, we store a non-reversible check value (HMAC) of your email address with a counter until at the latest 75 minutes after the request, as well as the number of failed attempts on your customer account for 15 minutes. This data is not merged with other data sources. Processing is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically error-free provision of the shop and in its protection against misuse. Enquiries by email or phone If you contact us by email or phone, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. This data is processed on the basis of Art. 6 (1) (b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on your consent (Art. 6 (1) (a) GDPR) and/or on our legitimate interests (Art. 6 (1) (f) GDPR), as we have a legitimate interest in the effective handling of enquiries addressed to us. The data you send to us via contact enquiries remains with us until you ask us to delete it, withdraw your consent to storage, or the purpose for storing the data no longer applies (e.g. after your request has been dealt with). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected. 5. eCommerce and payment providers Processing of data (customer and contract data) We collect, process and use personal data only insofar as it is necessary for the establishment, content or modification of the legal relationship (inventory data). This is done on the basis of Art. 6 (1) (b) GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures. We collect, process and use personal data about the use of this shop (usage data) only insofar as this is necessary to enable the user to use the service or to bill for it. The customer data collected will be deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected (see section 7). What data we process when you place an order Mandatory details: first and last name, email address, street and house number, postcode, city and country (billing address). Voluntary details: phone number and a note on the order (e.g. details of motorcycle, riding experience or size). Order contents: the selected articles and variants or tours, trainings and events with date and location, quantities, prices, taxes and total amount. Processing data: order number, order date, payment method, payment deadline, payment status and payment date, for online payment the ID of the payment transaction at Stripe, invoice number, time of the order confirmation, for shipped goods the shipping service provider, tracking number and shipping date, as well as a randomly generated access key to your order overview. We need the mandatory details for the conclusion of the contract, its processing and the invoice; an order is not possible without them. The legal basis is Art. 6 (1) (b) GDPR, and for the invoice additionally Art. 6 (1) (c) GDPR (tax and commercial law obligations). Order overview After placing the order, you receive a personal link to an overview of your order with your details, the items, the payment status, the current status of your dates and – for goods – the shipping status. The link contains the access key; anyone who knows the link can view the order. Therefore, do not pass it on. With a customer account, you see the same overview after signing in. For dates, you can download a calendar file (.ics) there; it is generated in the shop itself, without any further services. Invoice After receipt of payment, we create an invoice as a PDF with your name, your billing address and the items ordered. The invoice is generated on the shop's server without involving any further services, and stored in our shop system (Appwrite, see section 2). You can download it in your order overview and in your customer account. The legal basis is Art. 6 (1) (b) and (c) GDPR. Order confirmation by email We send you an order confirmation to the email address you provided: for payment by bank transfer immediately after the order, for online payment after receipt of payment or, for a SEPA direct debit, as soon as it is being processed. It contains your name, your billing address and email address, the items and amounts, the payment method (for bank transfer with our bank details, payment reference and payment deadline), our general terms and conditions and the cancellation policy, as well as the link to your order overview. The email is sent from a sender address of the elvio platform; replies to the email reach us. In the same way, when we ship goods to you, we send you a shipping notification with the shipping service provider and tracking number, and – if you request it – the sign-in code for your customer account. For sending, elvio GbR uses the email service Resend of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA ("Resend"). Resend processes your email address and the content of the email. The legal basis is Art. 6 (1) (b) GDPR and Art. 6 (1) (c) GDPR in conjunction with Section 312i (1) sentence 1 No. 3 and Section 312f (2) BGB (obligation to confirm receipt of the order and the content of the contract). We do not send you advertising via the shop. Customer account You can use a customer account; an order is also possible without an account. To sign in, you enter your email address and receive a six-digit code by email (valid for 15 minutes). Optionally, you can additionally set a password; we only store it as a non-reversible check value (scrypt hash). In the account, we store your email address, on request your name, phone number and address (to pre-fill them for your next order), the times at which your email address was confirmed and at which you last signed in, as well as your sign-in sessions. Your account shows all orders placed in this shop with the same email address – including earlier orders without an account. If you are signed in, we use your account's email address for new orders. In the account, you can change your data, download information about the data stored about you as a file, sign out on all devices and delete your account. When deleting, we remove the account, sign-in sessions and open sign-in codes; we continue to keep orders and invoices because of the statutory retention obligations (section 7). The legal basis is Art. 6 (1) (b) GDPR, and for limiting sign-in attempts Art. 6 (1) (f) GDPR (protection of your account against unauthorised access). Shipping of goods If we ship goods, we deliver to your billing address. For this purpose, we pass your name and address on to the commissioned shipping service provider. We show you the tracking number in your order overview with a link to shipment tracking; if you call up this link, the shipping service provider's privacy policy applies on its page. The legal basis is Art. 6 (1) (b) GDPR. Data transfer upon conclusion of a contract for online shops, retailers and shipping of goods We only transfer personal data to third parties if this is necessary in the context of processing the contract, for example to the companies entrusted with the delivery of the goods or to the credit institution commissioned with payment processing. Any further transfer of data does not take place, or only takes place if you have expressly consented to the transfer. Your data will not be passed on to third parties without express consent, for example for advertising purposes. The basis for data processing is Art. 6 (1) (b) GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures. Data transfer upon conclusion of a contract for services and digital content We only transfer personal data to third parties if this is necessary in the context of processing the contract, for example to the credit institution commissioned with payment processing. Any further transfer of data does not take place, or only takes place if you have expressly consented to the transfer. Your data will not be passed on to third parties without express consent, for example for advertising purposes. The basis for data processing is Art. 6 (1) (b) GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures. Payment by bank transfer If you choose payment by bank transfer, we show you our bank details, the payment reference (your order number) and a GiroCode (QR code for your banking app). The GiroCode is generated in the shop itself. No payment service provider is involved in this payment method; we learn your name and account details from our bank's account statement in order to assign the payment to your order. The legal basis is Art. 6 (1) (b) GDPR. Online payment with Stripe For online payment we use the payment service Stripe. The contracting party for companies in the European Economic Area is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin, D02 H210, Ireland ("Stripe"). After submitting the order, you are taken to our payment page. There you enter your payment details into a form provided by Stripe – e.g. card number, expiry date and security code or, for a SEPA direct debit, the name of the account holder, email address and IBAN. This data goes directly to Stripe; we do not receive it. From us, Stripe receives the amount, the order number, a description consisting of the shop name and order number, and internal IDs of the shop and the order. With the order, we only store the ID of the payment transaction at Stripe and the payment status. The payment is processed via our own Stripe account. This is connected to Stripe via elvio GbR as a platform (Stripe Connect); elvio GbR can view the payment transactions within the scope of data processing on our behalf. On the payment page – and, if we offer express checkout, in the shopping cart and at checkout as soon as there is something to order there, as well as on the product page as soon as a date or variant has been selected or preselected there – the Stripe.js program library is loaded from Stripe's servers. A date or variant is preselected, for example, if an offer has only one bookable date or only one available variant, or if you call up the product page via a link with a date, for example from "Next dates" on the home page; Stripe.js is then loaded as soon as the page is called up, without you clicking anything. Stripe receives your IP address in the process and, to prevent fraud, collects characteristics of your device and browser as well as information on the use of the page (e.g. mouse movements and time spent). According to Stripe, Stripe.js sets the cookies "__stripe_mid" (lifetime 1 year) and "__stripe_sid" (lifetime 30 minutes) for this purpose, as well as cookies on Stripe domains (e.g. "m" on m.stripe.com, lifetime up to 2 years). Stripe may also integrate the hCaptcha service of Intuition Machines, Inc., USA, to detect automated access. According to its own information, Stripe does not use this data for advertising. Your data is transferred to Stripe on the basis of Art. 6 (1) (b) GDPR (processing for the fulfilment of a contract). Stripe's cookies and fraud prevention are based on Section 25 (2) No. 2 TDDDG, as they are strictly necessary for the online payment you requested, and on Art. 6 (1) (f) GDPR; our legitimate interest lies in secure payment processing without fraud. Insofar as Stripe processes your data for its own purposes – in particular for fraud prevention, to fulfil legal obligations (e.g. to prevent money laundering) and to process the payment with banks and card networks –, Stripe is itself responsible for this. Stripe checks payments automatically in the process and may reject a payment. Further information can be found in Stripe's privacy policy: https://stripe.com/privacy Express checkout with Apple Pay or Google Pay In the shopping cart, at checkout and on the product page, you can order directly with Apple Pay or Google Pay. Your wallet provider transmits the details required for the order to us via Stripe: name, email address (not if you are signed in to your customer account), billing address and, if stored, phone number. We use these details in the same way as those entered in the order form. Apple (Apple Distribution International Ltd., Ireland) or Google (Google Ireland Limited, Ireland) process your wallet data under their own responsibility in accordance with their privacy policies. The legal basis is Art. 6 (1) (b) GDPR. Further payment methods in the payment form Depending on activation, Stripe's payment form offers further payment methods in addition to credit card and SEPA direct debit, e.g. Apple Pay, Google Pay, Klarna, PayPal or Link (a Stripe service for storing payment details). If you choose such a payment method, its provider additionally processes the data required for the payment under its own responsibility and in accordance with its privacy policy; if you are redirected to a page of the provider, its provisions apply there. The legal basis for the transfer is Art. 6 (1) (b) GDPR. 6. Transfer to third countries Some of the service providers named have their registered office in the USA or in Israel or belong to companies based there. A transfer of your data to these countries – including in the form of access from there – cannot be ruled out. For the USA, the European Commission has determined that companies certified under the EU-US Data Privacy Framework (DPF) ensure an adequate level of data protection (adequacy decision pursuant to Art. 45 GDPR). According to the list at https://www.dataprivacyframework.gov/list, the following companies are certified (as of 30.09.2026): Cloudflare, Inc. (network service, section 2) Amazon.com, Inc., including Amazon Web Services, Inc. (parent company of our host AWS, section 2) Fastly, Inc. (delivery network of Appwrite, section 2) Plus Five Five, Inc. (Resend, email sending, section 5) Stripe, LLC (US company of the Stripe group, section 5) Intuition Machines, Inc. (hCaptcha, section 5) For Israel, where Appwrite has its registered office, the European Commission has likewise determined an adequate level of data protection (Art. 45 GDPR). Insofar as Appwrite uses further service providers outside the EU, Appwrite, according to its own information, bases the transfer on adequacy decisions or on standard contractual clauses of the European Commission. For the providers of further payment methods and for Apple or Google for express checkout (section 5), their own privacy policies apply. 7. Storage period We only store your personal data for as long as is necessary for the respective purpose or as required by statutory retention obligations: We store order data for as long as it is required for the processing of the contract, for warranty and queries, and for the assertion or defence of claims; the regular limitation period is three years from the end of the year in which the claim arose (Sections 195, 199 BGB). Insofar as we are subject to statutory retention obligations, we keep invoices and other accounting records for eight years (Section 147 (1) No. 4 and (3) AO, Section 257 (1) No. 4 and (4) HGB, Section 14b (1) UStG), and order confirmations and other commercial and business letters for six years (Section 147 (1) Nos. 2 and 3 and (3) AO, Section 257 (1) Nos. 2 and 3 and (4) HGB). The period begins in each case at the end of the calendar year in which the document was created. We delete orders that did not come about (e.g. after a cancelled online payment) as soon as they are no longer needed for traceability. The server's error logs are deleted after 14 days, and the counters for protection against misuse after 24 hours at the latest (section 4). We store your customer account until you delete it. Sign-in sessions end after 30 days or when you sign out and are then deleted; sign-in codes are valid for 15 minutes, and their record is deleted at the latest one hour afterwards. For cookies and browser storage, the lifetimes stated in sections 4 and 5 apply. After the periods have expired, the data is deleted. As long as a retention obligation exists, the data is only processed for this purpose.