Surrealm

Privacy policy

This English text is a courtesy translation. The German-language version is the legally binding one.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

We have not appointed a separate data protection officer, as there is no legal obligation to do so.

2. General information on processing

We process personal data only insofar as this is necessary to provide a functional shop and to process your order. The legal bases are in particular Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (legal obligation, e.g. tax retention) and Art. 6(1)(f) GDPR (legitimate interest).

3. Order and contract fulfilment

To process your order we process the data you provide: first and last name, delivery and billing address (street, house number, postcode, city, country), e-mail address, the chosen edition and quantity, the language of the guide, and the server-computed shipping cost and order total.

Purpose: conclusion and performance of the contract (made-to-order production, shipping, invoicing, order-related communication). The legal basis is Art. 6(1)(b) GDPR; for tax retention obligations additionally Art. 6(1)(c) GDPR.

Providing this data is necessary to conclude the contract. Without it we cannot accept or fulfil your order.

4. Payment

You can pay by advance bank transfer (SEPA / Vorkasse) or by credit card (via Stripe). If you pay by advance bank transfer, you receive the bank details by e-mail after your order; for the transfer we process your order and payment-reconciliation data (e.g. order number, amount, incoming payment), and we learn your account details through the incoming payment via our bank. If you pay by credit card, the payment is processed immediately via a payment page hosted by Stripe; you enter your payment and card data directly with Stripe, which processes them as a payment service provider (see section 10). The legal basis is Art. 6(1)(b) GDPR.

5. Customer account (optional)

You may create a customer account; this is voluntary. For the account we process your e-mail address and a password you choose (stored only as a cryptographic hash), as well as your order history. To confirm your e-mail address we send you a verification e-mail. Alternatively, you can order as a guest without an account; you access your guest order via a secure, non-guessable access link. The legal basis is Art. 6(1)(b) GDPR and, with regard to the convenient account management, Art. 6(1)(f) GDPR. You can have your account deleted at any time.

6. Transactional e-mails

As part of the order and account management we send transactional e-mails: e-mail address confirmation, password reset, order confirmation (with bank details in case of advance bank transfer), production status updates and the dispatch notification. They are sent from our own mail server; no external e-mail/SMTP provider is used. The legal basis is Art. 6(1)(b) GDPR (contract-related communication).

7. Web analytics with Umami (self-hosted)

For the statistical evaluation of the use of our website we use the self-hosted, open-source analytics software Umami, available at analytics.neuronetz.ai. Umami works without cookies: no cookies are set and no cross-site tracking is carried out. Your IP address is not stored in full. We collect aggregated information such as pages viewed, referral source and coarse device and browser information.

To measure conversions we also record anonymous events about the order flow (order value, currency, payment method and order reference). No personal data such as name, email address or postal address is transmitted; the evaluation is carried out in aggregate only.

The purpose is to improve our offering and measure reach. The legal basis is our legitimate interest in data-minimising, cookieless analytics pursuant to Art. 6(1)(f) GDPR. As no cookies or comparable technologies within the meaning of § 25 TDDDG are stored on or read from your device, no consent is required according to the current understanding.

You can object to the analytics; information on your rights is provided below.

8. Server log files and hosting

When you access our website, our hosting provider collects technically necessary access data (server log files), such as the address requested, date and time, amount of data transferred, status code and the requesting IP address. This is necessary to deliver the website, ensure its stability and security and detect misuse. The legal basis is Art. 6(1)(f) GDPR.

Our hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, acting as a processor. We have concluded a data processing agreement (DPA) with Hetzner under Art. 28 GDPR. Further processors are named in section 10.

9. Cookies and session

For logging in to the customer account and to protect against Cross-Site Request Forgery (CSRF) we use a technically necessary session cookie. It is required to operate the shop and does not require consent (§ 25(2) TDDDG). No tracking for advertising purposes is carried out.

10. Recipients and processors

Your data is passed on only insofar as this is necessary to perform the contract or permitted by law. Recipients may be: the logistics/shipping service provider commissioned with dispatch (to deliver your order), our hosting provider (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany) and our payment service provider for card payments. E-mails are sent from our own mail server; no external e-mail provider is involved. Insofar as external service providers process data on our behalf, this is done on the basis of a data processing agreement under Art. 28 GDPR.

Credit card payments are processed via Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. To execute the card payment, Stripe processes your payment and card data as well as related order data. This may involve a transfer of data to Stripe, Inc. in the USA; such transfer takes place on the basis of the EU standard contractual clauses. If you do not choose card payment, no data is transferred to Stripe.

11. Transfer to third countries

A transfer of your personal data to countries outside the European Union or the European Economic Area is generally not intended. An exception is card payment: here our payment service provider Stripe may transfer data to Stripe, Inc. in the USA (see section 10). This transfer takes place on the basis of the EU standard contractual clauses as an appropriate safeguard within the meaning of Art. 44 et seq. GDPR.

12. Retention period

We store personal data only for as long as is necessary for the stated purposes. Order and invoice data are subject to the statutory retention periods (generally up to ten years under commercial and tax law). Account data is stored until the account is deleted. Unpaid reservations lapse after the payment deadline expires; the associated order history may be retained for evidence and accounting reasons. Log files and analytics data are kept only for as long as necessary for the stated purposes.

13. Your rights

Under the GDPR you have the following rights vis-à-vis the controller:

To exercise your rights, a message to the e-mail address given above is sufficient.

14. Right to withdraw consent

Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected.

15. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). Competent authorities include the authority of your habitual residence and the authority at the controller's registered office. The supervisory authority competent for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Back to the product page