Privacy policy

Please note: This is a non-binding translation. The German version is legally binding.

1. Data controller

Julian Sekora, Süderstraße 33, 24955 Harrislee, Germany, email hallo@walleria.de.

2. Overview

We only process personal data to the extent necessary to operate the shop, process orders and – with your consent – for reach measurement and marketing. The legal bases are Art. 6(1)(b) GDPR (contract), (c) (legal obligations, e.g. retention), (f) (legitimate interests, e.g. security) and (a) (consent). Section 25 TDDDG applies to the storage and retrieval of information on your end device.

3. Hosting and server log files

The site is hosted on GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA; represented in the EU by GitHub B.V., Amsterdam). A data processing agreement has been concluded with GitHub; the transfer to the USA is based on the EU Commission's Standard Contractual Clauses. When you visit the site, your IP address, time, page accessed, browser and referrer are stored in log files and deleted after a short period (Art. 6(1)(f) GDPR).

4. Ordering and personalisation

To process your order, we process your name, address, email address, phone number (if applicable) and the personalisation data you enter (child's name, date of birth, uploaded ultrasound image). This data is required to fulfil the contract (Art. 6(1)(b) GDPR). We delete uploaded images [30] days after dispatch; we retain invoice data for 10 years (Section 147 AO). A customer account is not required.

5. Payment processing (Stripe)

We process payments via Stripe Payments Europe Ltd., Dublin, Ireland. Stripe receives the data required for the payment (name, email, amount, payment method); card details are processed exclusively by Stripe (Art. 6(1)(b) GDPR). If you pay via PayPal or Klarna, their respective privacy policies also apply. Stripe uses technically necessary cookies for fraud prevention.

6. Shipping

For delivery, we transmit your name and address to DHL / Deutsche Post AG, Bonn (Art. 6(1)(b) GDPR). Your email address will only be shared for parcel notifications with your consent.

7. Email dispatch, thank-you voucher and newsletter

We send order confirmations, download links and shipping notifications via Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin); a data processing agreement in accordance with Art. 28 GDPR is in place with Brevo, and processing takes place in the EU (Art. 6(1)(b) GDPR).

Thank-you voucher: After a purchase, we will show you a one-time voucher code for your next order on the thank-you page (only after matching the order number and email address) and in the order confirmation. The code is linked to your order number and does not contain any personal data; whether it has been redeemed is processed by our payment service provider Stripe (Section 5). This recommendation to existing customers for similar posters is based on Section 7(3) UWG and Art. 6(1)(f) GDPR; you can object to this at any time – a quick reply to our email or a message to hallo@walleria.de is sufficient, without incurring any costs other than the transmission costs according to the basic rates.

Newsletter: You will only receive our newsletter after registering with confirmation (double opt-in, Art. 6(1)(a) GDPR); we store the time of registration and confirmation as proof. You can unsubscribe at any time via the link in each issue.

Cart reminder: If you enter your email address at checkout and tick the box 'remind me of my cart' (or if you have confirmed our newsletter), we will store the contents of your cart together with your email address for a maximum of 30 days and remind you up to twice by email (Art. 6(1)(a) GDPR). Without the tick and without a newsletter subscription, we do not store anything. Each reminder contains a link to opt out of further reminders; we delete the entry after a purchase or after 30 days at the latest.

8. Cookies and consent

We set technically necessary cookies (cart, cookie settings, payment security) on the basis of Section 25(2)(2) TDDDG. All other cookies and technologies (statistics: Google Analytics 4 and Microsoft Clarity; marketing: Google Ads, ChatGPT Ads, Meta) we use only with your consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your selection at any time via the 'Cookie settings' link in the footer.

9. Access counting

To see how often the shop is visited, we count page views ourselves – without cookies, without an analysis service and without anything being stored on your device. We record the time, page accessed, the domain of the referring page (not the full link), a device class (mobile, tablet, computer), the country and the duration of the visit. We also count – likewise without any personal reference – clicks on 'Add to cart', visits to the checkout, completed purchases with order value, as well as the selected size, finish, colour and design, and whether the search was used (not the search term).

To distinguish recurring visits on a single day by different visitors, we generate an identifier on our server from the IP address, browser ID and a daily changing random value. We do not store the IP address itself, the identifier cannot be traced back, and because the random value changes every day and old values are deleted, recognition over several days is technically impossible. The legal basis is Art. 6(1)(f) GDPR, our interest in simple reach measurement. Since nothing is stored on or read from the end device, no consent under Section 25 TDDDG is required. We respect 'Do Not Track' and 'Global Privacy Control' signals: if either is set, we do not count. We delete the raw data after 14 months.

Google Analytics 4 (statistics, only with consent) (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland): If you allow 'Statistics' in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), Google Analytics records page views, duration of visit, origin (e.g. search engine, ad), device and browser as well as shop events (product view, cart, checkout start, purchase with order value and order number – without names). Google Analytics sets cookies (_ga, 2 years) and also processes the data in the USA (EU-U.S. Data Privacy Framework). IP addresses are not stored by Google Analytics 4; retention is limited to 2 months. If you also allow 'Marketing', we activate Google signals and the collection of data provided by you: Google then links your visits with data from logged-in Google accounts (e.g. demographic characteristics, interests, cross-device use) and we transmit your hashed email address to Google Analytics when you make a purchase; you can view and delete this data at myactivity.google.com. Without marketing consent, Google signals remain disabled. A data processing agreement is in place with Google. Withdrawal at any time via 'Cookie settings' in the footer; more at policies.google.com/privacy.

Microsoft Clarity (statistics, only with consent) (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): If you allow 'Statistics' in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), we load Microsoft Clarity. Clarity creates heatmaps and anonymised recordings of individual sessions: mouse movements, scrolling, clicks and typing, the pages accessed, device, browser, screen size, country and duration of the visit are recorded. Contents of input fields (names, email, address, custom texts) are masked before transmission and are not recorded; payment details are entered at Stripe and are not visible to Clarity. We use the recordings to identify where visitors get stuck in the shop and to improve the shop accordingly. Clarity sets cookies (_clck and CLID, 1 year; _clsk, 1 day; MUID, ANONCHK, MR and SM on Microsoft domains, up to 1 year) and also processes the data in the USA (EU-U.S. Data Privacy Framework). Microsoft may also use the collected data to improve its own products in accordance with its terms. Individual session recordings are deleted after 30 days, aggregated evaluations after 13 months. You can withdraw your consent at any time via 'Cookie settings' in the footer. More: privacy.microsoft.com.

10. Marketing (only with consent)

We only load the following advertising measurement services if you allow 'Marketing' in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). They measure whether ads lead to purchases; data transfer to the USA is based on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. Withdrawal at any time via 'Cookie settings' in the footer.

Google Ads Conversion Tracking (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland): We only load the Google tag with your marketing consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It sets cookies and reports to Google whether a purchase was made after clicking on one of our ads – with order value and order number, as well as product view, cart and checkout start. For matching purposes, we only transmit your email address in hashed form when you make a purchase ('enhanced conversions'). Google also processes the data in the USA (EU-U.S. Data Privacy Framework). You can withdraw your consent at any time via 'Cookie settings' in the footer. More: policies.google.com/privacy.

Google Customer Reviews (Google Ireland Ltd.): After a purchase – only with your marketing consent (Art. 6(1)(a) GDPR) – we display a window from Google in which you can agree to a subsequent review survey. For this purpose, we transmit the order number, email address, delivery country and the expected delivery date to Google. Without your consent in the window, Google will not send a survey. Further information: policies.google.com/privacy.

Meta Pixel (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland): records page views, product views, checkout start and purchases (with amount, without names) and enables targeted advertising on Facebook and Instagram. More: facebook.com/privacy/policy.

ChatGPT Ads tracking pixel (OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland): records page views, product views, checkout start and purchases (with amount and order number, without names) so we can see if ads in ChatGPT lead to purchases. More: openai.com/policies/privacy-policy.

11. Fonts and external content

Fonts are loaded locally from our server; no connection to Google servers takes place. (In the prototype, Google Fonts are still loaded externally – integrate locally before going live.)

12. Order status and reviews (Supabase)

We store order data, reviews and access counts with Supabase (Supabase Inc., 970 Toa Payoh North, Singapore) in the Frankfurt am Main data centre (eu-central-1). A data processing agreement in accordance with Art. 28 GDPR is in place: Supabase concludes it upon acceptance of the terms of use, including the EU Commission's Standard Contractual Clauses (module two, controller to processor).

Via the page Track your order you can check the status of your order. You do not need a customer account for this: the order number and email address must match. The order number is randomly assigned and cannot be guessed. We only display the processing status, ordered items, total and tracking number there – address and payment details are deliberately not shown. Queries are limited to orders from the last twelve months and restricted to five attempts per five minutes to prevent guessing numbers. For this purpose, we store the time and a random identifier generated in your browser for 24 hours (Art. 6(1)(f) GDPR, interest in the security of processing in accordance with Art. 32 GDPR). We retain the order data itself due to commercial and tax retention periods in accordance with Section 147 AO and Section 257 HGB.

13. Internal advertising tool 'Walleria Ads Tool' – Handling of Google user data

To evaluate our own Google Ads campaigns, we operate an internal tool called 'Walleria Ads Tool'. It uses the Google Ads API and logs in via Google OAuth 2.0. This statement describes how the tool accesses, uses, stores and shares Google user data.

Who is affected? Exclusively ourselves as the operator of walleria.de. The tool is only connected to our own Google account. Visitors and customers of walleria.de do not log in there, and no third-party Google accounts are linked.

Access (access): The tool requests the OAuth scope 'https://www.googleapis.com/auth/adwords' and thus reads data from our own Google Ads advertising account: campaigns, ad groups, budgets and performance metrics such as impressions, clicks, costs and conversions. It does not access any emails, contacts, files, calendars or other content of a Google account.

Use (use): The retrieved metrics are used solely to monitor our advertising campaigns, generate reports for ourselves and manage budgets. They are not used for advertising to third parties, profiling, creditworthiness checks or training AI models.

Storage (store): We store OAuth access and refresh tokens in encrypted form on an access-protected computer in Germany. Retrieved campaign metrics are stored locally as reports and deleted after 24 months at the latest. Access can be revoked at any time at myaccount.google.com/permissions after which the tokens will be deleted.

Sharing (share): Google user data from the tool is not sold, rented or shared with third parties. It is only transmitted to Google itself as part of the API usage. Humans only read the data to the extent necessary to evaluate our own advertising.

The use and transfer of information from Google APIs to other applications is governed by the Google API Services User Data Policy including the Limited Use requirements. If you have any questions, please contact us at the email address provided in the Legal notice.

14. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent at any time with future effect. You can lodge complaints with a data protection supervisory authority; for our registered office, this is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel.

15. Validity

As of: September 2026. We will adapt this policy if services or the legal situation change.