Privacy Policy
This is a convenience translation. The German version of this privacy policy is authoritative.
Privacy Policy
1. Data Controller
The controller responsible for the processing of personal data in connection with the online shop “born on a sunny day” is:
discover craftsmanship GmbH
Lübecker Straße 126
22087 Hamburg
Germany
Represented by its Managing Director: Elizabeth Lehnich
Telephone: +49 (0)40 98677156
Email: contact@bornonasunnyday.com
If a Data Protection Officer has been appointed or is appointed before the website goes live, their contact details will be added to this Privacy Policy.
2. General Information on Data Processing
We process personal data only insofar as this is necessary for the operation and security of the online shop, the initiation and performance of contracts, the handling of enquiries, compliance with legal obligations or on the basis of valid consent.
Personal data means any information relating to an identified or identifiable natural person. This may include, in particular, names, addresses, email addresses, telephone numbers, order and contract data, payment and shipping information, communication content, IP addresses and usage, browser and device data.
The relevant legal bases are, in particular, Article 6(1)(a) of the General Data Protection Regulation (GDPR) for consent, Article 6(1)(b) GDPR for taking steps prior to entering into a contract and for the performance of contracts, Article 6(1)(c) GDPR for compliance with legal obligations and Article 6(1)(f) GDPR for legitimate interests. The respective legitimate interest is explained in relation to each processing operation.
3. Accessing the Website and Server Log Files
When you access our website, the hosting and/or technical service provider engaged by us processes data automatically transmitted by your browser. This may include, in particular, your IP address, the date and time of access, the page or file accessed, the referrer URL, browser type and browser version, operating system, hostname of the accessing computer and status and error codes.
The processing serves to make the website technically available, ensure its stability and security and identify and prevent abusive access or access that poses a security risk. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, uninterrupted and efficient operation of the online shop.
The specific hosting provider, server location, any CDN or security services and the specific retention period for log data will be added on the basis of the technical configuration before the website goes live and checked against the actual configuration.
4. Contact by Email, Telephone and, Where Applicable, Contact Form
If you contact us by email, telephone or, where offered, through a contact form, we process the data you provide in order to handle your enquiry. This generally includes your name, contact details, the content of your message and, where necessary, information relating to an order.
Where contact is made in connection with a contract or a precontractual enquiry, the legal basis is Article 6(1)(b) GDPR. In other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the appropriate handling of and response to enquiries. Where consent has been given, the legal basis is Article 6(1)(a) GDPR.
At the drafting stage, it has not yet been conclusively determined which contact forms, mandatory fields, storage systems or support services will actually be used. This information will be added before the website goes live.
5. Orders and Contract Processing
When you place an order through our online shop, we process the data necessary for the initiation, conclusion and performance of the purchase contract. This includes, in particular, your name, billing and delivery address, email address, telephone number where applicable, goods ordered, prices, shipping information, payment status, order and contract data and communications relating to the order.
Processing is carried out on the basis of Article 6(1)(b) GDPR. Where we store data to comply with retention obligations under commercial or tax law, processing is based on Article 6(1)(c) GDPR. In addition, Article 6(1)(f) GDPR may apply insofar as processing is necessary for the establishment, exercise or defence of legal claims.
We also use the data to confirm orders, respond to queries, arrange shipping, allocate payments and maintain records required by law or contract. Order and accounting documents are stored in accordance with statutory retention periods. In all other respects, we delete data as soon as it is no longer required for the performance of the contract or in connection with any claims.
6. Payment Processing
6.1 General Payment Processing
To process a payment, we transmit the payment and transaction data required for this purpose to the payment service provider selected by you at checkout. The specific payment methods available are displayed during the respective ordering process. These are intended to include, in particular, PayPal and Stripe, in each case only insofar as the relevant payment method is offered at the specific checkout.
Processing is carried out for the performance of the contract on the basis of Article 6(1)(b) GDPR. Where payment service providers process data for their own legal obligations, fraud prevention, risk assessments or regulatory purposes, they generally act as independent controllers under data protection law in this respect.
The specific Stripe payment methods, technical providers, redirects or integrations used and the individual data processed in this context will be checked against the actual merchant and checkout model before the website goes live.
6.2 PayPal
If you select a PayPal payment method, the data required for payment processing will be transmitted to PayPal or the respective company within the PayPal group that is involved. The possible categories of data include, in particular, identity, contact, order, payment and transaction data.
PayPal may transfer data within its group of companies and to other recipients, including those outside the European Economic Area. Such transfers are subject to the data protection safeguards implemented by PayPal. The specific contracting party, the payment methods actually used and the current information on recipients and transfers to third countries will be added before the website goes live on the basis of the actual PayPal configuration.
6.3 Stripe
Where payment methods via Stripe are offered at checkout, the data required for payment processing will be transmitted to companies within the Stripe group or to service providers engaged by Stripe. The data processed may include, in particular, contact, order, payment, device, usage and transaction data.
Stripe may transfer personal data within its group of companies and to service providers in third countries. Where required, appropriate safeguards under Chapter V GDPR, in particular Standard Contractual Clauses or other permissible transfer mechanisms, must be used. The specific Stripe contracting party, the payment methods offered and the actual recipients will be reviewed before the website goes live and specified in greater detail in this Privacy Policy.
7. Shipping and Logistics
To deliver your order, we transmit the data required for this purpose to the company responsible for shipping. The intended shipping service providers include, in particular, DHL and DPD. The data generally transmitted includes your name and delivery address as well as additional contact details where these are required for delivery notifications or the selected shipping option.
Processing is carried out for the performance of the contract on the basis of Article 6(1)(b) GDPR. An email address or telephone number will only be disclosed for optional delivery notifications where an appropriate legal basis exists and the specific shipping option provides for this.
The shipping service provider used in each individual case depends on selection and availability. The specific technical transmission of data and the delivery options involved will be checked against the shipping and shop systems before the website goes live.
8. Cookies, Local Storage and Comparable Technologies under Section 25 TDDDG
Our online shop may use cookies, local storage entries and comparable technologies. Where information is stored on or retrieved from your terminal device, the permissibility of such storage or access is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The subsequent processing of personal data is governed by the GDPR.
Technologies that are strictly necessary may be used insofar as they are required to provide a digital service expressly requested by you or to enable the transmission of a communication over a public telecommunications network. Where the conditions of Section 25(2) TDDDG are not met, information will only be stored or accessed after you have given your consent.
At the drafting stage, a complete list of the cookies, local storage entries and comparable technologies actually used, including their purposes, providers, retention periods and legal bases, is not yet available. This information will be determined through a technical assessment before the website goes live and checked for consistency with this Privacy Policy and the consent management tool.
9. Consent Management
Where a consent management system is used for the online shop, you can use it to give, refuse, withdraw or change your consent to non-essential technologies with effect for the future. Non-essential cookies, pixels, tags and comparable technologies must not be activated before valid consent has been given.
To document consent, the time of consent, the selection made, the version of the consent declaration and technical evidence data may be processed in particular. The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG insofar as access to information on the terminal device or storage of information on that device is concerned.
The specific consent management tool, information about its provider and data storage, the scope of the evidence recorded and a permanently accessible means of withdrawing consent will be added before the website goes live. Until then, no specific information about tools or cookies may be published as established fact.
10. Audience Measurement, Analytics and Marketing
It has not yet been conclusively determined whether and which analytics, tracking or marketing services will be used in the online shop. Possible services, insofar as they are actually used, include audience measurement, conversion measurement, Google services, Meta Pixel, LinkedIn Insight Tag or comparable technologies.
Services that are not technically necessary and that access or store information on your terminal device may generally only be activated after you have given your prior consent. Where a service is used following consent, processing is generally based on Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You may withdraw any consent given at any time with effect for the future through the accessible privacy or cookie settings.
The specific services, purposes, data categories, providers, retention periods, recipients and any transfers to third countries will be determined through a technical assessment before the website goes live and added to or removed from this Privacy Policy as appropriate.
11. Newsletter and Direct Marketing
At the drafting stage, no specific newsletter provider has been confirmed. Where a newsletter is offered, we generally process the contact details provided during registration on the basis of your consent under Article 6(1)(a) GDPR. A double opt-in procedure may be used and recorded to provide evidence of registration.
You may withdraw any consent given at any time with effect for the future, in particular by using the unsubscribe link in a newsletter email. Direct marketing to existing customers that is permitted by law shall remain unaffected, provided the relevant conditions are met. You may object to the processing of your data for direct marketing purposes at any time.
The newsletter provider, double opt-in procedure, data fields collected, sending and analysis functions and specific retention period will be added before the website goes live if a newsletter is actually set up.
12. Social Media and External Content
We may provide links on our website to our profiles on LinkedIn, Instagram and Facebook. In principle, links of this kind only result in data being transmitted to the respective platform operator when you actively click on the link. Processing on the platform accessed is governed by the privacy information applicable to that platform.
If, however, social media feeds, plugins, embedded posts, videos, maps, external fonts, review services, chat or support systems or comparable third-party content are technically integrated into the website, a connection to the servers of the respective third-party provider may be established as soon as the page loads. Such integrations may only be described and activated in accordance with the actual technical configuration and, where required, after prior consent has been obtained.
At the drafting stage, it has not been confirmed whether external fonts, maps, videos, social media feeds, review services, chat or support systems will be used. The specific integration, local or external provision, providers, purposes and any transfers to third countries will be reviewed before the website goes live.
13. Customer Account and Guest Checkout, Where Offered
Where the online shop offers a customer account, the data required to set up and use the account may be processed, in particular names, email addresses, login credentials, order data and communication data. Processing is carried out to provide the customer account and to process contracts on the basis of Article 6(1)(b) GDPR.
Where guest checkout is available, only the data required for ordering, payment, delivery, communication and statutory record keeping is processed. The actual availability of guest checkout, the scope of customer account functions and the respective data fields must be checked against the shop system before the website goes live.
Where a customer account is deleted, data that continues to be required due to statutory retention obligations or for the establishment, exercise or defence of legal claims will be retained to the extent necessary.
14. Recipients and Processors
We use external service providers insofar as this is necessary for operations, hosting, technical maintenance, payment processing, shipping, communication and other business processes. Where service providers process personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Article 28 GDPR.
Categories of recipients may include, in particular, hosting and IT service providers, shop system operators, payment service providers, shipping and logistics companies, providers of email and communication services, providers of consent management or security services, tax and legal advisers as well as public authorities and other bodies where there is a legal obligation to disclose data.
The intended Ready2Order point of sale system and any integration of SumUp devices or services will only be taken into account insofar as they are actually connected to the online shop or to payment processing or inventory management. The specific role, data transmission and responsibilities under data protection law will be reviewed before the website goes live.
The specific providers, recipients, subprocessors and contractual bases will be added before the website goes live on the basis of the systems actually used.
15. Transfers of Data to Third Countries
Where certain service providers are used, particularly in the areas of payment processing, hosting, analytics, marketing or external content, personal data may be transferred to countries outside the European Union or the European Economic Area. Whether such transfers actually take place depends on the final technical and contractual configuration.
Transfers will only take place where the requirements of Articles 44 et seq. GDPR are met, in particular on the basis of an adequacy decision by the European Commission or appropriate safeguards such as Standard Contractual Clauses. Where necessary, supplementary protective measures will be taken into account.
Before the website goes live, the recipients, destination country, purpose of the transfer, applicable safeguard and, where required, additional information on protective measures will be added for each service actually used. This applies in particular to PayPal, Stripe and any analytics, marketing, hosting or consent management services.
16. Retention Periods and Deletion
We store personal data only for as long as is necessary for the respective processing purpose. In addition, we retain data where statutory retention, documentation or evidentiary obligations apply or for as long as the data is required for the establishment, exercise or defence of legal claims.
Where the purpose of processing no longer applies and there is no other legal basis for continued storage, the data will be deleted or, where deletion is temporarily not possible, its processing will be restricted.
The specific deletion and retention periods depend on the respective system, processing operation and applicable statutory obligations. The actual deletion and retention procedures in the shop system and in connected payment, shipping, point of sale and communication systems will be documented before the website goes live and checked for consistency with this Privacy Policy.
17. Your Rights under the GDPR
Subject to the applicable statutory requirements, you have the following rights in particular:
- The right of access to personal data processed about you under Article 15 GDPR.
- The right to rectification of inaccurate data or completion of incomplete data under Article 16 GDPR.
- The right to erasure of personal data under Article 17 GDPR, provided no statutory exceptions apply.
- The right to restriction of processing under Article 18 GDPR.
- The right to data portability under Article 20 GDPR, where the statutory requirements are met.
- The right to object to processing based on Article 6(1)(e) or (f) GDPR under Article 21 GDPR.
- The right to withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal shall remain unaffected.
- The right to lodge a complaint with a data protection supervisory authority under Article 77 GDPR.
Where we process personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. Where personal data is processed for direct marketing purposes, you may object to such processing at any time without giving reasons.
To exercise your rights, you may contact the controller named above. In principle, an informal notification is sufficient to withdraw consent. Where a consent management tool is used, you may also change or withdraw your selection using the settings provided by that tool.
Automated decision-making, including profiling within the meaning of Article 22 GDPR, is not assumed to be an established processing activity in this draft. If a payment service provider, analytics service or security service carries out such processing and it is relevant to the online shop, information on the logic involved, its significance and envisaged consequences as well as the available rights and safeguards will be added before the website goes live.
18. Right to Lodge a Complaint with the Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority. For a company based in Hamburg, the following supervisory authority is responsible in particular:
Hamburg Commissioner for Data Protection and Freedom of Information
(Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit)
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany
Telephone: +49 (0)40 428 54-4040
Email: mailbox@datenschutz.hamburg.de
19. Data Security
We implement appropriate technical and organisational measures to protect personal data against loss, destruction, manipulation, unauthorised access and other risks. The security measures are regularly reviewed and adapted, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing and the varying likelihood and severity of the risks.
The specific security, backup, access authorisation, encryption and recovery measures depend on the systems and service providers actually used and will be documented internally before the website goes live.
20. Updates to this Privacy Policy
We will update this Privacy Policy if legal requirements, our data processing activities, the services used or the technical configuration of the online shop change. The version published in the online shop at the relevant time shall apply.
Last updated: October 2026