1. Controller
The controller responsible for data processing on this website is:
AMP & BRANDSTIFTER GmbH
Dieselstraße 15
61239 Ober-Mörlen
Hesse, Germany
Email: [email protected]
Phone: +49 (0) 6002 939350
Full company details: see Imprint.
2. Data collected when you visit the website (server logs)
When you access our website, the following data is automatically processed in the server logs of our hosting provider (Cloudflare Pages):
- IP address (anonymised after 14 days)
- Date and time of access
- Page / file requested
- Amount of data transferred
- Browser type and version, operating system
- Referrer URL (page visited before)
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in security and stability).
Retention: 14 days, then automatic deletion.
3. Hosting
This website is hosted by:
Cloudflare, Inc.
101 Townsend St, San Francisco, CA 94107, USA
Data processed in EU data centres (Frankfurt/Amsterdam)
A data processing agreement including EU standard contractual clauses is in place with Cloudflare. Details: cloudflare.com/privacypolicy.
3a. Lead database (Cloudflare D1)
Enquiries from the contact form, sample-set requests and newsletter sign-ups are stored in a Cloudflare D1 database (SQLite backend) in the EU data centre in Madrid. We process the following data:
- Newsletter: email address, time of sign-up, source (e.g. popup), language
- Contact form: name, email, phone (optional), topic, message, time of enquiry, language
- Orders: Stripe session ID, email, shipping address, product dimensions/finish/mounting, order value, advertising channel that led to the order (see section 4)
- Customer profile: if you save a delivery or billing address in your account, plus your marketing consent and its timestamp
- IP addresses: stored only as a 16-character hash (irreversible) for spam detection
Legal basis: Art. 6 (1) (a) GDPR (consent for the newsletter) or (b) (pre-contractual steps and contract performance for enquiries and orders).
Retention: newsletter until you unsubscribe; contact enquiries 12 months after the last correspondence; order data 10 years under § 147 AO (German tax law).
4. Cookies and local storage
We do not set tracking cookies without your consent. The following entries are stored in your browser's local storage:
bs_popup_last/bs_popup_done: when the newsletter popup was last shown, and whether you have already signed up — so it does not appear again.bs_consent_marketing: your decision in the consent banner regarding the Meta Pixel (see section 5).bs_attr: the advertising channel that brought you to the site (UTM parameters of the link you clicked, e.g. "meta / paid"). Kept for 30 days and attached to an order so we can see which channel led to a purchase. No third party has access to this value.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in functionality and measuring our own advertising); for the Meta Pixel, Art. 6 (1) (a) GDPR (consent).
5. Meta Pixel (advertising measurement)
Only if you click "Accept" in the consent banner, we load the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel lets us measure whether our Facebook and Instagram adverts lead to visits and purchases, and show relevant adverts to visitors of this site.
Data processed: usage data (pages viewed, purchase events), IP address, browser information, and — if you are logged in to Facebook or Instagram — the link to your Meta account. Meta may transfer this data to the USA; Meta is certified under the EU-US Data Privacy Framework and standard contractual clauses apply.
Legal basis: Art. 6 (1) (a) GDPR (consent). Withdrawal: at any time by deleting this site's data in your browser (which removes bs_consent_marketing) or by emailing us. Without consent the pixel is never loaded. Meta's privacy policy: facebook.com/privacy/policy.
6. Contact form & email enquiries
If you contact us via the contact form, an order or by email, your details (name, email, phone, address, message) are processed to handle your enquiry.
Legal basis: Art. 6 (1) (b) GDPR (pre-contractual steps / contract performance) or (f) (legitimate interest in answering).
Retention: until the correspondence is complete, then according to commercial and tax retention periods (6–10 years).
7. Newsletter
If you sign up for our newsletter, we process your email address to send product and workshop updates (max. once a month). Sign-up uses double opt-in. Emails are sent via Resend (Resend, Inc., USA) using its EU data region.
Legal basis: Art. 6 (1) (a) GDPR (consent).
Unsubscribe: at any time via the unsubscribe link in every newsletter or by emailing [email protected].
8. Orders & payment processing
For order processing we use the following payment service provider:
Stripe Payments Europe Ltd.
C/O A&L Goodbody, IFSC, North Wall Quay, Dublin 1, Ireland
During checkout, payment data is transmitted directly to Stripe. We ourselves store no credit card, bank or Klarna data. Stripe is PCI-DSS certified. Details: stripe.com/privacy.
For delivery we pass your address to our shipping partner (DPD, GLS or a freight forwarder depending on size).
9. Live chat (Crisp)
Our website uses the chat service Crisp (Crisp IM SAS, 2 boulevard de Launay, 44100 Nantes, France). If you open the chat and send messages, the message content, IP address, browser information and any contact details you provide voluntarily are transmitted to Crisp.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in customer service).
Crisp privacy policy: crisp.chat/en/privacy/.
10. Google Fonts
We load fonts (Cormorant Garamond, Inter) from Google Fonts. When a font is loaded, a connection to Google servers (USA) is established and your IP address is transmitted.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Privacy policy: policies.google.com/privacy.
11. Your rights as a data subject
You have the following rights at any time:
- Access to your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure ("right to be forgotten", Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing (Art. 21 GDPR)
- Withdrawal of consent given (Art. 7 (3) GDPR)
- Complaint to a data protection supervisory authority (Art. 77 GDPR)
Competent supervisory authority for Hesse: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.
12. Data security
We take appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse:
- TLS/SSL encryption of the entire website
- Encrypted storage of sensitive data
- Regular security updates of all systems
- Access restrictions on personal data
13. Changes to this privacy policy
We reserve the right to amend this policy to reflect changes in the law or in our services. The current version is always available on this page.
14. Questions
If you have questions about how we process your personal data, you can reach us at:
Email: [email protected]
Phone: +49 (0) 6002 939350