Privacy Policy

1. Introduction

Thank you for your interest in our offering. Protecting your privacy is important to us. We collect, process and use your personal data only in accordance with this privacy policy and applicable data protection regulations, in particular the GDPR.

2. Collection and processing of personal data

We process personal data when you order from us, create a customer account, contact us, send a product enquiry or declare a withdrawal. You can see which data this is from the respective input fields (e.g. name, address, email address, phone number, company, VAT ID, order details). The legal bases are the performance of the contract and pre-contractual measures (Art. 6(1)(b) GDPR), compliance with legal obligations such as commercial and tax retention obligations (Art. 6(1)(c) GDPR), and our legitimate interest in answering your enquiries and operating the shop securely (Art. 6(1)(f) GDPR).

3. Sharing of data

We only pass on your data where necessary to perform the contract: to DHL the data needed for delivery (name and delivery address), to Stripe for card payments (section 5), to our processors (section 5) and, where we are legally obliged to do so, to authorities. We do not pass on data for advertising purposes.

4. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to withdraw any consent you have given at any time with effect for the future. To do so, please contact info@schirmer.store. You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany.

5. Processors, hosting and payment processing

For hosting, database, file storage, email delivery and operational telemetry, we use Microsoft (Microsoft Ireland Operations Ltd., Dublin, Ireland) as a processor under Art. 28 GDPR:

• Azure App Service (France Central, Paris) - Operation of the website and interfaces.
• Azure SQL Database (Germany West Central, Frankfurt) - Storage of customer, order and product data.
• Azure Blob Storage (Germany West Central, Frankfurt) - Storage of product images and of your invoices and delivery notes (private, only accessible via your account).
• Azure Communication Services (Germany) - Delivery of confirmation and service emails.
• Azure Application Insights (Germany West Central, Frankfurt) - Pseudonymised server-side error and performance data for secure operation. No analysis of your browsing behaviour.

The Microsoft services run in data centres in the EU. For support and security purposes, Microsoft may in individual cases access data from third countries; Microsoft is certified under the EU-US Data Privacy Framework, and the EU standard contractual clauses also apply.

Payment processing with Stripe

Card payments are processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter your card details directly on Stripe’s payment page; we do not receive them. For the payment we send Stripe your email address, the amount and an order reference (Art. 6(1)(b) GDPR). Stripe is an independent controller for fraud prevention and its own legal obligations (stripe.com/privacy). Stripe may transfer data to the USA and is certified under the EU-US Data Privacy Framework.

6. Browser storage (cookies and LocalStorage)

We do not use tracking or advertising cookies. We store the following entries in your browser because they are strictly necessary for the site’s functions (Section 25(2) no. 2 TDDDG):

• schirmer_cart Contents of your cart (browser storage, up to 30 days).
• authToken Login token after successful sign-in (browser storage, expires after 72 hours at the latest).
• schirmer_cookie_consent_v1 Confirmation that you have read the notice on browser storage.
• .AspNetCore.Culture Cookie with your chosen language so the site stays in your language (1 year).
• .AspNetCore.Antiforgery.* Security cookie against misuse of forms (until the browser is closed).
• schirmer_checkout_draft_v1 Your checkout entries (address, email, phone) so they survive a reload (this tab only, until the order is complete).
• schirmer:checkout-receipt Summary of your last order for the order confirmation page (this tab only, 24 hours at most).
• schirmer.guest-order.* Access key from the order link in your email so you can view your guest order (this tab only).
• schirmer.recent.v1, schirmer.catalog.v1 Recently viewed items and your position in the catalogue (this tab only).

7. Sign-in with Google

You can use “Sign in with Google” to log in (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The service is only loaded when you explicitly click the button. Before that, the site does not connect to Google. After the click, in particular your IP address and technical browser data are transmitted to Google; if you sign in, Google provides us with your name and email address. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) or the initiation or performance of a contract (Art. 6(1)(b) GDPR). Google may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time by reloading the page and not using the button again.

8. Map of the delivery address (Google Maps)

On the order confirmation page you can load a map of your delivery address. Only after you click “Load map” are the delivery address and your IP address transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework.

9. VAT ID check

If you enter a VAT ID at checkout, we check it via the European Commission’s VAT Information Exchange System (VIES) and store the company name recorded there with the order. The legal basis is compliance with tax obligations (Art. 6(1)(c) GDPR, Section 6a UStG).

10. Server logs and security

When you access the site, we process technically necessary data such as IP address, time, requested address and browser information. We use it to prevent misuse (e.g. limiting requests per IP address) and to analyse errors. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). The logs are deleted after 90 days at the latest.

11. Storage period

We retain order and invoice data in accordance with commercial and tax law (accounting records 8 years, commercial and business letters 6 years; Section 147 AO, Section 257 HGB). We delete enquiries once they have been fully dealt with and no retention obligation applies. We store your customer account until you delete it; your orders are kept because of the retention obligations.

12. Customer account and two-factor sign-in

For a customer account, we store your email address, an encrypted password and your optional profile details (address, company, VAT ID, separate billing address). If you set up two-factor sign-in, we also store a secret key. You can delete your account yourself at any time in the customer area.