This is a translation provided for convenience. Only the German version is legally binding: Deutsche Fassung.

Privacy notice

Draft – to be reviewed by a lawyer before publication.

1. Controller

Lukas-Domenik Sonnenfeld
Belegano
Anschrift siehe Impressum
Germany
Email: sunfieldshops@gmail.com

2. In brief

This website does not set cookies, does not use trackers or analytics services, and does not load fonts or scripts from third-party servers. PayPal or Stripe is only involved once you expressly click the payment link (“Pay now with PayPal” or “Order with obligation to pay – card, Apple Pay, Google Pay, Klarna, SEPA & more”) after ordering.

3. Hosting

This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Each time you visit, Cloudflare processes technically necessary data (IP address, date and time, page requested, amount of data transferred, browser and device information) to deliver the pages and keep them secure. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a secure, working website. We have a data processing agreement with Cloudflare (Art. 28 GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; the transfer to the USA is based on the European Commission’s adequacy decision (Art. 45 GDPR). We do not store any log data ourselves.

4. Your order

When you order, an email opens containing your order details (email address, name, optionally your address, country, whether you order as a private individual or a business, product, price, order number, time of your consent). Nothing is stored or transmitted on this website in the process; we only receive the data when you send the email. We use it to perform the contract (download link, invoice) and to meet statutory retention obligations. We process your country and customer type to issue the invoice and to allocate the sale correctly for tax purposes. Legal basis: Art. 6(1)(b) and (c) GDPR. We keep invoices and order data for up to 8 years under § 147 AO and § 257 HGB (German tax and commercial codes); after that they are deleted. Our email inbox is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (Gmail bzw. Google Apps Script). Soweit Daten in die USA übermittelt werden, geschieht das auf Grundlage des EU-US Data Privacy Framework bzw. von Standardvertragsklauseln.

5. Payment with PayPal

For payment, we only forward you to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg after you click. PayPal processes your payment data there as an independent controller; PayPal’s privacy notice applies. From PayPal we receive your name, email address, amount, payment reference and payment status. Legal basis: Art. 6(1)(b) GDPR. No connection to PayPal is made before you click.

6. Online payment via Stripe

If you choose “Order with obligation to pay – card, Apple Pay, Google Pay, Klarna, SEPA & more” at checkout and then click the payment link, you will be redirected to Stripe’s payment page. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Data is transferred to Stripe only once you click this link; before that, this website does not load any content from Stripe. Stripe processes the data you enter there (name, optionally company name, email address, billing address, payment details such as card number or IBAN), the amount and the product purchased, as well as technical data about your device (for example your IP address), in order to process the payment, prevent fraud and comply with legal obligations.

We do not receive card numbers or other complete payment details. From Stripe we receive your name, company name if provided, email address, billing address, amount, product and payment status in order to send you the download link and issue the invoice. The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations under Section 147 of the German Fiscal Code (AO) and Section 14b of the German VAT Act (UStG)). Stripe itself is responsible for fraud prevention and for complying with its own regulatory obligations.

Stripe may transfer data to affiliated companies, in particular to Stripe, Inc. in the USA. According to Stripe, such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses. If you pay with Klarna, Apple Pay, Google Pay or by SEPA Direct Debit, the respective providers additionally process data in accordance with their own privacy notices. On its payment page, Stripe uses cookies and similar technologies that are necessary for secure payment and fraud prevention; this website itself still does not set any cookies. Stripe’s privacy policy: stripe.com/privacy.

7. Cancelling online

If you use “Cancel your contract”, your name, your order details and your email address are sent to us via Cloudflare Workers KV (Cloudflare, Inc., see section 3) so that we can process your cancellation and confirm its receipt. Legal basis: Art. 6(1)(c) GDPR in conjunction with § 356a BGB (German Civil Code). We keep this information for as long as claims under the contract are possible (usually three years from the end of the year).

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a data protection supervisory authority, e.g. the authority responsible for Hessen.

Last updated: 4 November 2026

This is a translation provided for convenience. Only the German version is legally binding: Deutsche Fassung.