5% – Summer deal
Deutsch
Zcratch
Made in Germany

Privacy Policy – Zcratch

Last updated: August 2026

This is a translation for your convenience. In case of doubt, the German version at zcratch.de/pages/datenschutzerklaerung prevails.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

Tim Siegmund Klausdorfer Weg 23 12307 Berlin Germany

Email: info@zcratch.de Phone: +49 176 708 77 801

We are not required to appoint a data protection officer (Sec. 38 BDSG). For any privacy matter please contact the email address above.

2. Principles

We process personal data only where necessary to provide a functional website and shop, or where you have given consent. The legal bases are:

  • Art. 6(1)(a) GDPR – consent (e.g. statistics and marketing cookies)
  • Art. 6(1)(b) GDPR – contract and pre-contractual measures (orders, withdrawal, enquiries)
  • Art. 6(1)(c) GDPR – legal obligation (commercial and tax retention)
  • Art. 6(1)(f) GDPR – legitimate interest (secure operation, anonymous reach measurement)
  • Sec. 25(1) TDDDG – consent for storing or accessing information on your device
  • Sec. 25(2) no. 2 TDDDG – strictly necessary storage without consent

3. Hosting, delivery and server logs

The website is delivered through our hosting provider's infrastructure (Lovable / Cloudflare, EU data centres). Technically necessary connection data is processed on each request: IP address (shortened or only transiently processed), date and time, requested URL, status code and volume, referrer URL, browser type and operating system.

Purpose is secure operation, error analysis and attack prevention (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days at the latest unless a security incident requires longer retention. Data processing agreements under Art. 28 GDPR are in place with all providers.

4. Our own cookieless traffic measurement

We measure usage with our own first-party system:

  • No cookies and no persistent identifiers are stored on your device. A random session ID lives only in the browser tab (sessionStorage) and is deleted when the tab closes.
  • Your IP address is never stored. It only feeds a salted SHA-256 hash that rotates daily and cannot be traced back to you.
  • We record the page viewed, language version, coarse device type, referrer domain, UTM parameters, scroll depth and shop events (e.g. product view, add to cart).

Legal basis: legitimate interest in privacy-friendly statistics (Art. 6(1)(f) GDPR). Data is aggregated or deleted after 12 months.

5. Consent management

On your first visit we ask for consent to statistics and marketing services. Your choice is stored in your browser (localStorage, key zc_consent_v2) together with a timestamp and version so we can demonstrate consent (Art. 7(1) GDPR). Consent expires after six months. You can withdraw it at any time via the Cookie settings link in the footer, with effect for the future.

6. Google Analytics 4 (consent only)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

After your consent, Google Analytics sets cookies and processes usage data (shortened IP address, device and browser information, pages viewed, interactions) to provide us with pseudonymous statistics. IP anonymisation is enabled. Data is deleted after 14 months at the latest.

Legal basis: Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG.

7. Google Ads / conversion tracking (consent only)

Provider: Google Ireland Limited (address as above).

After your consent we measure whether a click on one of our ads led to an order and build remarketing audiences. Cookies are set and usage data is transmitted to Google. Conversion cookies are stored for up to 90 days.

Legal basis: Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG.

Third-country transfer: data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework and EU standard contractual clauses apply in addition. Access by US authorities cannot be fully excluded. By consenting you also consent to this transfer (Art. 49(1)(a) GDPR).

8. Shop, orders and payment (Shopify)

Our cart and checkout run on Shopify (Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland). During an order we process your name, delivery and billing address, email address, optional phone number, order and payment data, discount codes and technical data for fraud prevention.

Purpose is performance of the contract (Art. 6(1)(b) GDPR). Payment data is processed directly by the payment providers (e.g. PayPal, Klarna, card payments via Shopify Payments); we never receive full card details. Necessary data is passed to the shipping company. Commercial and tax retention periods of 6 and 10 years remain unaffected (Art. 6(1)(c) GDPR). A data processing agreement with Shopify is in place.

9. Contacting us

If you contact us by email, phone or a form, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR). Data is deleted once the request is settled and no statutory retention applies.

10. Online withdrawal form

For withdrawals we provide an online form. The details entered (name, address, email, order number, order and delivery date, message) are stored in our database inside the EU to process and evidence the withdrawal. Legal basis: Art. 6(1)(b) and (c) GDPR. Data is deleted after the statutory retention periods.

11. Embedded YouTube videos

Some pages embed YouTube videos (Google Ireland Limited) in privacy-enhanced mode (youtube-nocookie.com). Loading such a page establishes a connection to Google's servers and transmits your IP address and information about the page; Google may create a usage profile, especially if you are logged in to Google. In privacy-enhanced mode, according to Google, cookies or comparable identifiers are only set once playback starts. Purpose is a clear presentation of our application guides; legal basis is our legitimate interest in illustrative product information (Art. 6(1)(f) GDPR). If you want to avoid this transfer, do not play the videos and do not open the relevant pages. More information: Google Privacy Policy.

12. Recipients and processors

Categories of recipients: hosting and CDN providers, shop and payment providers, shipping companies, tax advisers and – after consent – Google as analytics and advertising provider.

13. Retention

We store personal data only as long as necessary for the respective purpose or as required by law (in particular 6 years under Sec. 257 HGB and 10 years under Sec. 147 AO). Afterwards the data is deleted or anonymised.

14. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we process data based on legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.

A message to info@zcratch.de is sufficient to exercise these rights.

Right to lodge a complaint: you may complain to a supervisory authority; the competent one for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.

15. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

16. Changes

We update this policy when our processing or the legal situation changes. The version published on this page applies.