Last updated: March 2026

Protecting your personal data is important to us. Here we explain what data we collect, why, and what rights you have.

1. Controller

kunstform GmbH, Rotebühlstr. 63, 70178 Stuttgart, Germany
Phone: +49 711 / 219 548 90
Email: [email protected]
Managing Director: Daniel Fuhrmann | VAT ID: DE287664592

2. Website and Hosting

Our website is encrypted via HTTPS. Fonts are loaded locally - no Google Fonts, no data transfer to third parties.

When you visit, server log files are automatically recorded (IP address, page visited, browser, timestamp). These serve security and error detection purposes and are deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR. The website is hosted on servers in Germany.

We use Cloudflare (San Francisco, USA) as CDN and firewall. Traffic is routed through Cloudflare (IP address, URL, HTTP headers). Cloudflare may set security cookies. Cloudflare is EU-US Data Privacy Framework certified. Cloudflare Privacy

3. Cookies

Necessary cookies (no consent required): Session (cart, login), language setting, cookie consent, Cloudflare security. Legal basis: Art. 6(1)(b) and (f) GDPR.

Analytics cookies (consent only): Google Analytics 4 (_ga, _ga_*) - stored up to 14 months.

Marketing cookies (consent only): Google Ads Remarketing - stored up to 13 months.

You can withdraw your consent at any time via the cookie banner.

4. Customer Account and Orders

When registering or ordering, we process: name, email, address, phone (optional), order data, payment information. Your password is stored encrypted and is not visible to us. Guest checkout is available.

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment). You can delete your account at any time in your settings.

5. Payment Providers

Depending on the payment method, data is transmitted to:

• PayPal (Luxembourg) - for PayPal, installments, invoice. Privacy
• Stripe (Dublin, Ireland) - for credit card, Apple Pay, Google Pay, Klarna. EU-US DPF certified. Privacy
• Bank transfer - no data transmitted to third parties
• Cash on delivery / Cash - no payment data to third parties

Legal basis: Art. 6(1)(b) GDPR.

6. Shipping

We ship via DHL (Deutsche Post DHL Group, Bonn). We transmit name, address, email, and phone number if provided. Legal basis: Art. 6(1)(b) GDPR. DHL Privacy

7. Contact and Newsletter

Contact: When you contact us by email, phone, or form, we process your data to handle your request. Legal basis: Art. 6(1)(b)/(f) GDPR.

Newsletter: Double opt-in signup. We only need your email address. Sent via our own system through Postmark (ActiveCampaign, LLC, Chicago, USA). You can unsubscribe anytime via the link in every email. Postmark Privacy. Legal basis: Art. 6(1)(a) GDPR.

8. Analytics and Marketing

Google Analytics 4 is used via server-side tagging (cdn.trkkn.com) - data does not go directly from your browser to Google. IP addresses are anonymized. Only active with consent. Opt-out browser add-on

Google Tag Manager is a technical tool for managing tags. It does not store data or set cookies of its own.

Google Ads Remarketing shows you relevant ads after visiting our shop. Only active with consent. Disable personalized ads

Google is EU-US Data Privacy Framework certified. Google Privacy. Legal basis: Art. 6(1)(a) GDPR.

9. YouTube and Social Media

YouTube videos are only loaded when you actively click on them (lazy loading, enhanced privacy mode). No connection to YouTube is established beforehand. Legal basis: Art. 6(1)(a) GDPR.

Social media links (Facebook, Instagram, TikTok) are simple hyperlinks - no plugins, no trackers. Data is only transferred when you click a link.

10. Your Rights

Under the GDPR, you have the following rights:

• Access (Art. 15) - find out what data we store about you
• Rectification (Art. 16) - correct inaccurate data
• Erasure (Art. 17) - have your data deleted, unless retention is legally required
• Restriction (Art. 18) - restrict processing of your data
• Data portability (Art. 20) - receive your data in a machine-readable format
• Objection (Art. 21) - object to processing, especially for direct marketing
• Withdrawal (Art. 7) - withdraw any consent at any time

Contact us using the details in section 1.

Right to complain: You can file a complaint with the supervisory authority:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart. www.baden-wuerttemberg.datenschutz.de

11. Data Retention

We store data only as long as necessary. Statutory retention periods: 10 years for invoices/accounting records (§ 257 HGB, § 147 AO), 6 years for business correspondence. Server logs: 30 days. Newsletter data: until unsubscription. Customer account: until deletion.

We reserve the right to update this privacy policy as needed. The version published on our website always applies.