Privacy policy

Last updated: September 2026 · The German version is authoritative.

I run a one-person workshop. This policy explains which personal data is processed when you visit this shop or place an order, for what purpose, on what legal basis, who receives it and how long it is kept.

1. Controller

PrintableArtForge, owner Joel Kilb
Mecklenburgerstraße 4, 64297 Darmstadt, Germany
Phone: +49 178 8269995
Email: support@printableartforge.com

A data protection officer is not required by law. For any privacy question, an email to the address above is enough.

2. Shop platform and visiting the website

The shop runs on Shopify. For merchants in Europe the provider is Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores and processes the shop's data as a processor on my behalf.

Each page request involves technically necessary data: IP address, date and time, requested URL, browser and operating system, referring page. This is used to deliver the page, keep it secure and prevent abuse. The legal basis is my legitimate interest in a secure, working shop (Art. 6(1)(f) GDPR). Shopify determines how long these logs are kept.

Shopify also transfers data to Shopify Inc. in Canada (EU adequacy decision) and to service providers in the United States (EU-US Data Privacy Framework where certified, otherwise standard contractual clauses).

Fonts and the 3D viewer are loaded from Shopify or from the shop itself, not from Google or other third parties.

3. Overview: who receives data

I only pass on data where the purpose requires it or you have consented. Recipients are the service providers named below — as processors under a contract pursuant to Art. 28 GDPR or, where they act on their own account (payment providers, carriers, customs authorities, advertising platforms), as independent controllers. Where a recipient is outside the EU, I state the basis for the transfer with that service.

4. Cookies and similar technologies

The shop stores information on your device or reads it (cookies, local storage). Strictly necessary, and permitted without consent (§ 25(2) no. 2 TDDDG), are: shopping cart, checkout, language and country settings, security, and storing your cookie choice.

Everything else — analytics and advertising (section 12) — is only activated after you consent in the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” or “Your privacy choices” link at the bottom of every page.

5. Orders and customer account

For an order I process your name, delivery and billing address, email address, phone number where given, the items ordered, and payment and shipping status. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal obligations, in particular record-keeping (Art. 6(1)(c) GDPR). Without this information I cannot conclude the contract.

A customer account is optional. If you create one, I keep the details until you ask for the account to be deleted (Art. 6(1)(b) GDPR).

Invoices and accounting records are kept in Lexware Office (Haufe-Lexware GmbH & Co. KG, Munzinger Str. 9, 79111 Freiburg, Germany) as a processor.

Orders you place through a marketplace (such as Etsy) are imported into the shop to fulfil them. Processing on the marketplace itself is governed by its own privacy policy.

6. Payment

You enter payment details directly with the payment provider; I only receive the confirmation and the information needed for bookkeeping. The legal basis is Art. 6(1)(b) GDPR. Depending on the method you choose:

Card, SEPA direct debit, Apple Pay, Google Pay, Shop Pay via Shopify Payments; the payment service provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. With Apple Pay and Google Pay, Apple or Google also process the payment under their own terms; with Shop Pay, Shopify does.
PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg.
Klarna (invoice, instalments, pay now): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Before a purchase on invoice Klarna checks your identity and creditworthiness and partly decides automatically (Art. 22 GDPR). You have the right to obtain human review, to express your point of view and to contest the decision — with Klarna. Details are in Klarna's privacy notice.

Deposits and balance payments for personalised orders are managed with the app Depo (Sidepanda Services LLP, India), which receives the order data needed for this. The transfer to India is based on the European Commission's standard contractual clauses.

7. Shipping, customs and import charges

For delivery I pass your name and delivery address to the carrier: Deutsche Post AG (DHL), Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany. In the destination country the local postal service often makes the final delivery. The legal basis is Art. 6(1)(b) GDPR.

Within the EU I only pass on your email address or phone number for delivery notifications if you have agreed to this (Art. 6(1)(a) GDPR). For shipments outside the EU, customs and carriers require the recipient's contact details; passing them on is then necessary to perform the contract (Art. 6(1)(b) GDPR).

For deliveries to the United Kingdom, the United States, Canada, Australia and New Zealand, Shopify calculates duties and import taxes at checkout. For this and for the customs declaration, your name, address, a description of the goods and their value are sent to the customs authorities of the destination country. This transfer is necessary to perform the contract (Art. 49(1)(b) GDPR).

Shipping labels are created with shipping software that receives your name and address: Post & DHL Shipping (DHL), easyDHL (247APPS, Germany) and ShipStation (Auctane, USA; transfer based on the EU-US Data Privacy Framework or standard contractual clauses).

8. Personalised orders and photos

For a figure made from a photo you send me photos and information for the design. I use them solely to make your order (Art. 6(1)(b) GDPR). I do not analyse faces technically and do not use the photos to identify anyone.

I delete photos and 3D files 90 days after delivery or after the order ends, unless you expressly ask me to keep them longer — for example for a repeat order.

I only show your finished figure in the portfolio, on the website or on social media if you have expressly agreed (Art. 6(1)(a) GDPR). You can withdraw that consent at any time; I will then remove the image from my own channels.

If the photos show other people, please make sure they agree to their use.

Photos you send through an upload form in the shop itself are stored with Shopify.

9. Contact and enquiries

If you email me, use a contact or request form, or call, I process your details and any files you send to answer your enquiry — under Art. 6(1)(b) GDPR for enquiries about an order, otherwise under Art. 6(1)(f) GDPR. I delete the enquiry once it has been dealt with; if it leads to an order, the periods in section 14 apply.

For messages in the shop I use Shopify's messaging function.

10. Withdrawal via the withdrawal button

You can also declare withdrawal from a contract using the withdrawal button in the shop. This function is provided by the app EU Widerruf Button (401layers UG (haftungsbeschränkt), Germany). The information you enter there, such as order number, name and email address, is processed to handle the withdrawal (Art. 6(1)(c) GDPR).

11. Reviews

Reviews are collected and displayed with Judge.me (Judge.me Ltd., United Kingdom; EU adequacy decision).

You only receive an email asking for a review if you have consented (Art. 6(1)(a) GDPR).
If you write a review, it is published with your first name and the initial of your last name, and a photo if you add one. The legal basis is your consent. You can ask for deletion at any time.
Displaying reviews in the shop loads content from Judge.me, which transmits your IP address (Art. 6(1)(f) GDPR, interest in showing genuine customer reviews).

12. Analytics and advertising — only with consent

With your consent in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG) I measure how the shop is used and make my products visible on other platforms. The following services set cookies or pixels and receive usage data such as pages viewed, cart and purchase events, device and browser data and your IP address:

Google (Google Analytics, Google Ads, Merchant Center, store widget): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Meta (Facebook, Instagram): Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. For collection via the pixel I am jointly responsible with Meta (Art. 26 GDPR); Meta is the central point of contact for your rights.
TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
Pinterest: Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

These providers also transfer data to the United States and other third countries, based on the EU-US Data Privacy Framework (where certified) or standard contractual clauses. None of these services is active without your consent.

13. Newsletter and waiting list

If you join a waiting list or sign up for the newsletter, I send you product news by email (Art. 6(1)(a) GDPR). You confirm the sign-up via a link in an email (double opt-in); I keep the time and IP address of the sign-up as proof. You can unsubscribe at any time via the link in every email. Emails are sent via Shopify.

14. How long data is kept

Invoices and accounting records: 8 years; business correspondence (such as order confirmations): 6 years, each from the end of the calendar year (§ 147 AO, § 257 HGB).
Other order data: until warranty and possible claims have expired, usually 3 years from the end of the year of delivery.
Photos and 3D files for personalised orders: 90 days after delivery (section 8).
Enquiries without an order: until dealt with, at the latest after one year.
Customer account, newsletter, consents: until you delete the account, unsubscribe or withdraw; proof of a consent is then kept for as long as it may be legally required.
Cookie choice: 12 months.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to withdraw any consent with effect for the future (Art. 7(3)). An email to support@printableartforge.com is enough.

Right to object (Art. 21 GDPR). Where I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons; I will then no longer use your data for that purpose.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

16. Automated decisions

I do not make automated decisions within the meaning of Art. 22 GDPR. An exception may be Klarna's credit check for purchases on invoice (section 6).

17. Customers outside the EU

This policy applies to all customers, whatever their country. If you live in the United Kingdom, you have the same rights under the UK GDPR, and you may also contact the Information Commissioner's Office (ICO). Customers in the United States, Canada, Australia and New Zealand can exercise their rights in the same way via the email address above. I do not sell personal data.