Privacy policy

This is a translation for your convenience. The German version is legally binding.

As of November 2026

1. Controller

Lukas-Domenik Sonnenfeld
Anschrift siehe Impressum
Germany
E-Mail: sunfieldshops@gmail.com

2. Overview

This website sets no cookies, uses no analytics or tracking services, loads no third-party fonts and embeds no third-party scripts. We only process personal data where necessary to run the website and handle your order.

3. Hosting

The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit, Cloudflare processes technically necessary access data (IP address, date and time, page requested, browser and operating system details, referrer) in server log files in order to deliver the site and protect it against misuse. The legal basis is Art. 6(1)(f) GDPR. Transfers to the USA are based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. A data processing agreement is in place with Cloudflare.

4. Ordering and payment with PayPal

Neither PayPal nor Stripe is embedded on our pages. When you click a payment button (“Order with obligation to pay – PayPal” or “Order with obligation to pay – card, Apple Pay, Google Pay, Klarna, SEPA & more”), the order details (order number, product, chosen payment method, language, country, customer type and your consent) are sent to us via Cloudflare Workers KV and you are then forwarded to PayPal or to Stripe (see section 5). The payment service provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, which processes your payment data under its own responsibility; PayPal's privacy policy applies. From PayPal we receive your name, email address, amount, time, transaction ID and the product purchased. We use these data to send the download link, confirm the order and keep our accounts (Art. 6(1)(b) and (c) GDPR); we need your country to apply the correct VAT rules. Tax-relevant records are kept for the statutory periods (usually 8 to 10 years).

5. Online payment via Stripe

If you choose “Order with obligation to pay – card, Apple Pay, Google Pay, Klarna, SEPA & more” at checkout, you will be redirected to Stripe’s payment page. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Data is transferred to Stripe only once you click this button; before that, this website does not load any content from Stripe. Stripe processes the data you enter there (name, optionally company name, email address, billing address, payment details such as card number or IBAN), the amount and the product purchased, as well as technical data about your device (for example your IP address), in order to process the payment, prevent fraud and comply with legal obligations.

We do not receive card numbers or other complete payment details. From Stripe we receive your name, company name if provided, email address, billing address, amount, product and payment status in order to send you the download link and issue the invoice. The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations under Section 147 of the German Fiscal Code (AO) and Section 14b of the German VAT Act (UStG)). Stripe itself is responsible for fraud prevention and for complying with its own regulatory obligations.

Stripe may transfer data to affiliated companies, in particular to Stripe, Inc. in the USA. According to Stripe, such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses. If you pay with Klarna, Apple Pay, Google Pay or by SEPA Direct Debit, the respective providers additionally process data in accordance with their own privacy notices. On its payment page, Stripe uses cookies and similar technologies that are necessary for secure payment and fraud prevention; this website itself still does not set any cookies. Stripe’s privacy policy: stripe.com/privacy.

6. Email contact and delivery

We send the download link and the order confirmation by email. If you write to us, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR). We do not use your address for advertising.

7. Withdrawal via the online function

If you use “Cancel contract”, your name, order details and email address are sent to us via Cloudflare Workers KV (Cloudflare, Inc., see above) so that we can process your withdrawal and confirm receipt (Art. 6(1)(c) GDPR in conjunction with § 356a BGB). We store these data as long as necessary for processing and statutory retention obligations.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).