Last updated: September 2026

Protecting your personal data is important to us. Here we explain what data we collect, why, and what rights you have.

1. Controller

kunstform GmbH, Rotebühlstr. 63, 70178 Stuttgart, Germany
Phone: +49 711 / 219 548 90
Email: [email protected]
Managing Director: Daniel Fuhrmann | VAT ID: DE287664592

2. Website and Hosting

Our website is encrypted via HTTPS. Fonts are loaded locally - no Google Fonts, no data transfer to third parties.

When you visit, server log files are automatically recorded (IP address, page visited, browser, timestamp). These serve security and error detection purposes and are deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR. The website is hosted on servers in Germany.

We use Cloudflare (San Francisco, USA) as CDN and firewall. Traffic is routed through Cloudflare (IP address, URL, HTTP headers). Cloudflare may set security cookies. Cloudflare is EU-US Data Privacy Framework certified. Cloudflare Privacy

3. Cookies

Necessary cookies (no consent required): Session (cart, login), language setting, cookie consent, Cloudflare security. Legal basis: Art. 6(1)(b) and (f) GDPR.

Analytics cookies (consent only): Google Analytics 4 (_ga, _ga_*) - stored up to 14 months.

Marketing cookies (consent only): Google Ads Remarketing - stored up to 13 months.

You can withdraw your consent at any time via the cookie banner.

4. Customer Account and Orders

When registering or ordering, we process: name, email, address, phone (optional), order data, payment information. Your password is stored encrypted and is not visible to us. Guest checkout is available.

Guest orders: When you order as a guest, we create a guest account through which you can view, change and return your order. If you order again as a guest with the same email address and the same postcode, we combine your guest orders in this guest account so you can see them together. Legal basis: Art. 6(1)(b) GDPR and our legitimate interest in clear order handling (Art. 6(1)(f) GDPR). The guest account is deleted 10 days after your last guest order unless you set a password; the order data itself is kept for the statutory retention periods.

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment). You can delete your account at any time in your settings.

5. Payment Providers

Depending on the payment method, data is transmitted to:

• PayPal (Luxembourg) - for PayPal, installments, invoice. Privacy
• Stripe (Dublin, Ireland) - for credit card, Apple Pay, Google Pay, Klarna. EU-US DPF certified. Privacy
• Apple Pay and Google Pay - processed through PayPal or Stripe. When you pay, your device transmits name, delivery address, email address and an encrypted payment token to the processor; neither we nor the processor receive your card number in clear text.
• Bank transfer - no data transmitted to third parties
• Cash on delivery / Cash - no payment data to third parties

Legal basis: Art. 6(1)(b) GDPR.

Express buttons in the cart and in the checkout: To show the buttons for PayPal, Apple Pay and Google Pay, your browser loads code from PayPal (www.paypal.com), from Google (pay.google.com) and, in Safari, from Apple (applepay.cdn-apple.com). This transmits your IP address to those providers; Google sets a cookie of its own in the process. This happens only in the cart and in the checkout, because you want to pay there (Art. 6(1)(b) GDPR); product pages do not load that code.

6. Shipping

We ship via DHL (Deutsche Post DHL Group, Bonn). We transmit name, address, email, and phone number if provided. Legal basis: Art. 6(1)(b) GDPR. DHL Privacy

7. Contact and Newsletter

Contact: When you contact us by email, phone, or form, we process your data to handle your request. Legal basis: Art. 6(1)(b)/(f) GDPR.

Newsletter: Double opt-in signup. We only need your email address. Sent via our own system through Postmark (ActiveCampaign, LLC, Chicago, USA). You can unsubscribe anytime via the link in every email. Postmark Privacy. Legal basis: Art. 6(1)(a) GDPR.

Optional details for the newsletter: After confirming, you can optionally give your name, your interests (for example BMX Street, BMX Race or MTB) and your birthday. We use them to address you by name, to send you content and pictures that match what you ride, and to send you a voucher on your birthday. If you have a customer account we store them there, otherwise with your newsletter subscription. You can change them in your account under “Newsletter & Personalization” or by sending us a short message; when you unsubscribe we delete the details that belong only to the subscription. Legal basis: Art. 6(1)(a) GDPR.

Opens and clicks in our emails: Our emails contain a small image and links that tell us whether an email was opened and which link was clicked. We use this to improve our emails, to see which order follows an email, and so that we do not keep writing to people who do not read us: if none of our emails has been opened or clicked for two years, we ask once whether you still want to hear from us and remove you from the list after 21 days without a reply. The measurement is part of your newsletter consent (Art. 6(1)(a) GDPR) and ends when you unsubscribe. If your email program does not load images, we do not learn about an open either.

8. Analytics and Marketing

Google Analytics 4 is used via server-side tagging (cdn.trkkn.com) - data does not go directly from your browser to Google. IP addresses are anonymized. Only active with consent. Opt-out browser add-on

Google Tag Manager is a technical tool for managing tags. It does not store data or set cookies of its own.

Google Ads Remarketing shows you relevant ads after visiting our shop. Only active with consent. Disable personalized ads

Google Customer Reviews asks you after your purchase whether you would like to take part in a review survey. The dialog appears on the order confirmation only, and only for orders whose items are all in stock. It transmits your order number, email address, delivery country, the estimated delivery date and the EAN of the items ordered. You only receive the survey if you explicitly agree in that dialog. The legal basis is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time; without consent for external services the dialog is not loaded at all.

Review request after delivery. If you have ordered from us, we ask you once by email, a few days after delivery, for a review on Google. For this we use the email address you gave us with your order; the email contains no product advertising and no voucher. The legal basis is our legitimate interest in reviews of our shop (Art. 6(1)(f) GDPR) together with § 7(3) of the German Unfair Competition Act (UWG). You can object to this use of your email address at any time, at no cost other than the transmission costs at basic rates: via the link in every such email, in your customer account under “Newsletter & Personalization”, or by sending us a message. After an objection you will receive no further review requests; we store only your email address with the date of the objection for that. Whether you leave a review is entirely up to you; we do not learn who has written one.

Google is EU-US Data Privacy Framework certified. Google Privacy. Legal basis: Art. 6(1)(a) GDPR.

9. YouTube and Social Media

YouTube videos are only loaded when you actively click on them (lazy loading, enhanced privacy mode). No connection to YouTube is established beforehand. Legal basis: Art. 6(1)(a) GDPR.

Vimeo videos are likewise only loaded once you allow "external data sources". Your browser then loads Vimeo's player (Vimeo.com, Inc., New York, USA); this transmits your IP address and device information to Vimeo in the USA. Legal basis: Art. 6(1)(a) GDPR.

Instagram videos (reels in news articles) are likewise only loaded once you allow "external data sources" in the cookie settings. Your browser then loads Instagram's player (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland); this transmits your IP address and device information to Meta, possibly also to the USA, and Meta may set cookies. Legal basis: Art. 6(1)(a) GDPR.

TikTok videos (in news articles) are likewise only loaded once you allow "external data sources" in the cookie settings. Your browser then loads the player from TikTok (TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland); this transfers your IP address and device information to TikTok, possibly to third countries such as the USA, and TikTok may set cookies. Legal basis: Art. 6 (1) (a) GDPR.

Social media links (Facebook, Instagram, TikTok) are simple hyperlinks - no plugins, no trackers. Data is only transferred when you click a link. Embedded Instagram and TikTok videos in news articles load only with your consent, see above.

10. Your Rights

Under the GDPR, you have the following rights:

• Access (Art. 15) - find out what data we store about you
• Rectification (Art. 16) - correct inaccurate data
• Erasure (Art. 17) - have your data deleted, unless retention is legally required
• Restriction (Art. 18) - restrict processing of your data
• Data portability (Art. 20) - receive your data in a machine-readable format
• Objection (Art. 21) - object to processing, especially for direct marketing
• Withdrawal (Art. 7) - withdraw any consent at any time

Contact us using the details in section 1.

Right to complain: You can file a complaint with the supervisory authority:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart. www.baden-wuerttemberg.datenschutz.de

11. Data Retention

We store data only as long as necessary. Statutory retention periods: 10 years for invoices/accounting records (§ 257 HGB, § 147 AO), 6 years for business correspondence. Server logs: 30 days. Newsletter data: until unsubscription. Customer account: until deletion. Guest account: 10 days after the last guest order.

We reserve the right to update this privacy policy as needed. The version published on our website always applies.