This is a translation provided for convenience. Only the German version is legally binding. Deutsche Fassung

Draft – to be reviewed before publication.

Privacy policy

1. Controller

Lukas-Domenik Sonnenfeld
Anschrift siehe Impressum, Germany
Phone: siehe Impressum · Email: sunfieldshops@gmail.com

No data protection officer has been appointed, as this is not required by law.

2. Summary

• We use no analytics or tracking tools, no cookies, no social media plugins, and we do not load fonts or scripts from third-party servers.
• Orders and online withdrawals are transmitted to us via the form system of our hosting provider Cloudflare (Cloudflare Workers KV). You only reach PayPal via a link after you have placed your order; you only reach Stripe’s payment page by clicking the Stripe payment button.
• The website is provided by Cloudflare.

3. Provision of the website (hosting)

This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The pages are delivered via Cloudflare's global server network (content delivery network).

Each time a page is accessed, Cloudflare processes technically necessary data, in particular the IP address, date and time, the page or file accessed, the amount of data transferred, and information about the browser and device.

• Purpose: delivery of the pages, stability, security and prevention of misuse.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and functioning website.
• Processing on our behalf: we have concluded a data processing agreement with Cloudflare pursuant to Art. 28 GDPR. Cloudflare uses further sub-processors; details in Cloudflare's privacy notice.
• Third countries: Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR). For other third countries, Cloudflare uses EU standard contractual clauses (Art. 46(2)(c) GDPR).
• Storage period: Wir selbst speichern keine Protokolldaten; Cloudflare speichert sie nur so lange, wie es für Betrieb und Sicherheit nötig ist, und löscht sie danach.

Cookies: our pages do not set any cookies themselves. Auch der Hosting-Anbieter Cloudflare setzt keine Cookies. Cloudflare blendet ein kleines Hinweisfeld „Powered by Cloudflare“ ein; das zugehörige Skript wird vom selben Server geladen, setzt keine Cookies und speichert nur, ob du das Feld ausgeblendet hast, im Speicher deines Browsers.

4. Orders

For an order, we process the details from the order form (or, if direct transmission fails, from your order email): name, email address, optionally your billing address, your country and whether you are ordering as a consumer or a business, the folder ordered, price, the chosen payment method, order number, time, the language of the shop and your consent to early performance of the contract. When you click one of the payment buttons (“Order with obligation to pay – PayPal” or “Order with obligation to pay – card, Apple Pay, Google Pay, Klarna, SEPA & more”), these details are transmitted to us via Cloudflare Workers KV (Cloudflare, Inc., see section 3; processing on our behalf) and stored there until we have transferred them to our order records. Before you click, your entries remain in your browser; the order summary does not use cookies or browser storage.

• Purpose: conclusion and performance of the contract (sending the download link, invoice, customer service) and compliance with tax obligations.
• Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR in conjunction with § 147 AO (German Fiscal Code) and § 14b UStG (retention obligations). We process your country and customer type for invoicing and tax allocation (Art. 6(1)(c) GDPR).
• Recipients: Cloudflare (form transmission) and our email provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (Gmail bzw. Google Apps Script). Soweit Daten in die USA übermittelt werden, geschieht das auf Grundlage des EU-US Data Privacy Framework bzw. von Standardvertragsklauseln as processors; tax authorities where required by law.
• Storage location: Sunfield auf eigenem Rechner in Deutschland
• Storage period: order data until any warranty and limitation periods have expired; invoices and accounting records for eight years, business letters for six years, in each case from the end of the calendar year (§ 147(3) AO, § 14b UStG).
• Required information: without your name and email address, we cannot conclude the contract or send the download link.

5. Payment with PayPal

If you pay with PayPal, a link takes you to the website of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. The link is only shown after your order; before that, no data is transferred to PayPal and no PayPal script is loaded. PayPal processes your payment data as an independent controller; PayPal's privacy statement applies. From PayPal we receive your name, email address, the amount, date and transaction number and, where applicable, your message.

• Legal basis: Art. 6(1)(b) GDPR (payment processing for the contract).
• Storage period: as for orders (section 4).
• We do not receive any payment card data.

6. Online payment via Stripe

If you choose “Order with obligation to pay – card, Apple Pay, Google Pay, Klarna, SEPA & more” at checkout, you will be redirected to Stripe’s payment page. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Data is transferred to Stripe only once you click this button; before that, this website does not load any content from Stripe. Stripe processes the data you enter there (name, optionally company name, email address, billing address, payment details such as card number or IBAN), the amount and the product purchased, as well as technical data about your device (for example your IP address), in order to process the payment, prevent fraud and comply with legal obligations.

We do not receive card numbers or other complete payment details. From Stripe we receive your name, company name if provided, email address, billing address, amount, product and payment status in order to send you the download link and issue the invoice. The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures) and Art. 6(1)(c) GDPR (statutory retention obligations under Section 147 of the German Fiscal Code (AO) and Section 14b of the German VAT Act (UStG)). Stripe itself is responsible for fraud prevention and for complying with its own regulatory obligations.

Stripe may transfer data to affiliated companies, in particular to Stripe, Inc. in the USA. According to Stripe, such transfers are based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses. If you pay with Klarna, Apple Pay, Google Pay or by SEPA Direct Debit, the respective providers additionally process data in accordance with their own privacy notices. On its payment page, Stripe uses cookies and similar technologies that are necessary for secure payment and fraud prevention; this website itself still does not set any cookies. Stripe’s privacy policy: stripe.com/privacy.

7. Withdrawal via the online function

If you withdraw from a contract using our withdrawal function (“Withdraw from contract”), your details are transmitted to us via Cloudflare Workers KV (Cloudflare, Inc., see section 3; processing on our behalf). We process your name, the contract details, your email address and the date and time of receipt in order to handle the withdrawal and confirm its receipt. The legal basis is Art. 6(1)(c) GDPR in conjunction with § 356a BGB (German Civil Code). We keep the data together with the order records (section 4).

8. Contact by email

If you write to us, we process your details in order to respond to your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete the details once your request has been dealt with, unless statutory retention obligations apply. Emails are generally not end-to-end encrypted.

9. Links to other websites

Our pages contain links to other websites (e.g. PayPal, Stripe, Cloudflare, our sister service Promtano). Data is only transferred to these websites when you click a link.

10. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An informal message to sunfieldshops@gmail.com is sufficient.

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

Right to lodge a complaint: you may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). For example, you can complain to the data protection authority responsible for your place of residence (list of authorities: https://www.bfdi.bund.de).

11. No automated decision-making

You do not have to provide any personal data to visit the website. No automated decision-making, including profiling, takes place.

As of: November 2026

This is a translation provided for convenience. Only the German version is legally binding. Deutsche Fassung