Privacy policy

Privacy policy

As of: 4 November 2026

1. Controller

Lukas-Domenik Sonnenfeld · Postfein
Anschrift siehe Impressum, Germany
Email: sunfieldshops@gmail.com

We have not appointed a data protection officer, as this is not required by law.

2. The key points

• This website sets no cookies, uses no analytics or advertising services and loads no content from third-party servers.
• We only process data when you place an order, withdraw from a contract or write to us – and only to handle that request.
• Payment is processed by PayPal or Stripe. PayPal or Stripe only comes into play once you click the respective payment button.

3. Hosting and server logs

This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit the site, Cloudflare processes technically necessary data (IP address, time, page requested, browser information) in order to deliver the site and protect it against misuse. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; EU standard contractual clauses apply in addition. We have a data processing agreement with Cloudflare. Wir selbst speichern keine Protokolldaten; Cloudflare speichert sie nur so lange, wie es für Betrieb und Sicherheit nötig ist, und löscht sie danach.

Auch der Hosting-Anbieter Cloudflare setzt keine Cookies. Cloudflare blendet ein kleines Hinweisfeld „Powered by Cloudflare“ ein; das zugehörige Skript wird vom selben Server geladen, setzt keine Cookies und speichert nur, ob du das Feld ausgeblendet hast, im Speicher deines Browsers.

4. Orders and payment via PayPal

When you click “Order with obligation to pay – PayPal”, the PayPal payment page of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg opens. Only then is any data transmitted to PayPal; before that, nothing from PayPal is embedded on our site. PayPal processes your payment data under its own responsibility – see PayPal’s privacy statement (paypal.com, section “Privacy”).

To process your order, PayPal gives us your name, email address, the amount, the time and the transaction number. We use this data to send you the download link and to keep our accounts (Art. 6(1)(b) and (c) GDPR). We process the country you select in the order summary, and whether you are buying as a private individual or a business, for billing and to determine how VAT applies (Art. 6(1)(c) GDPR). We keep records relevant to invoicing for the periods required by German tax and commercial law (usually eight or ten years, § 147 AO, § 257 HGB).

5. Online payment via Stripe

If you choose “Order with obligation to pay – card, Apple Pay, Google Pay, Klarna, SEPA & more” at checkout, you will be redirected to Stripe’s payment page. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Data is transferred to Stripe only once you click this button; before that, this website does not load any content from Stripe. Stripe processes the data you enter there (name, optionally company name, email address, billing address, payment details such as card number or IBAN), the amount and the product purchased, as well as technical data about your device (for example your IP address), in order to process the payment, prevent fraud and comply with legal obligations.

We do not receive card numbers or other complete payment details. From Stripe we receive your name, company name if provided, email address, billing address, amount, product and payment status in order to send you the download link and issue the invoice. The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations under Section 147 of the German Fiscal Code (AO) and Section 14b of the German VAT Act (UStG)). Stripe itself is responsible for fraud prevention and for complying with its own regulatory obligations.

Stripe may transfer data to affiliated companies, in particular to Stripe, Inc. in the USA. According to Stripe, such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses. If you pay with Klarna, Apple Pay, Google Pay or by SEPA Direct Debit, the respective providers additionally process data in accordance with their own privacy notices. On its payment page, Stripe uses cookies and similar technologies that are necessary for secure payment and fraud prevention; this website itself still does not set any cookies. Stripe’s privacy policy: stripe.com/privacy.

6. Order email and contact by email

If you send us the prepared order email or write to us, we process your details (email address, order number, product, time of your consent under § 356(5) BGB, your message) in order to handle your order or enquiry (Art. 6(1)(b) GDPR). We keep your consent to early performance as evidence for as long as claims under the contract are possible (usually three years from the end of the year). We send and receive emails via Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (Gmail bzw. Google Apps Script). Soweit Daten in die USA übermittelt werden, geschieht das auf Grundlage des EU-US Data Privacy Framework bzw. von Standardvertragsklauseln.

7. Withdrawal via the online function

If you use “Withdraw from contract”, your name, order details and email address are transmitted to us via Cloudflare Workers KV (Cloudflare, Inc., see section 3) so that we can process your withdrawal and confirm its receipt (Art. 6(1)(c) GDPR in conjunction with § 356a BGB). We keep this information for as long as claims under the contract are possible (usually three years from the end of the year).

8. What this website stores in your browser

Nothing. The order form does not store your entries in your browser and does not send them to us; only your own click opens the order email in your email program.

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). An informal message is enough.

10. Right to lodge a complaint (Art. 77 GDPR)

You can lodge a complaint with a data protection supervisory authority, in particular in the member state where you live or work. For example, you can complain to the data protection authority responsible for your place of residence (list of authorities: https://www.bfdi.bund.de).

11. External links

Links to other websites (e.g. Sitemuno, Promtano) are ordinary links. Data is only transmitted once you click such a link.