Privacy Policy

The controller responsible for data processing within the meaning of the GDPR is:

Sebastian Felsberg
felsberg-design.de Web & App Development
Tulpenstraße 18
01705 Freital
Germany
Phone: +49 173 6722738
E-Mail: kontakt@felsberg-design.de

This privacy policy applies to my homepage felsberg-design.de, my online shop shop.felsberg-design.de and the licence check of my desktop software, which communicates with the shop server.

I only process personal data as far as it is necessary to run the website, provide my content, answer your enquiries and handle orders. There is no tracking, no analytics tools, no advertising and no embedded social media plugins. External services are only used for payments in the shop (Stripe, section 7) and – if you turn them on – for push notifications (section 9).

The homepage and the shop run on a server provided by Strato GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. When you visit a page, the web server automatically processes technically required data: IP address, date and time, the requested page, the amount of data transferred, the referrer URL, and your browser and operating system.

This serves the secure and stable operation of the site (e.g. defending against attacks). The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after 14 days at the latest unless they are needed for longer to investigate a security incident. A data processing agreement (Art. 28 GDPR) is in place with the host.

For security reasons, the homepage and the shop use SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar.

When you write to me using the contact form, I process your first name, last name, e-mail address, your message and the time of your consent. The data is stored in my database on the server mentioned above and also forwarded to my mailbox by e-mail.

The legal basis is your consent (Art. 6(1)(a) GDPR) and – if your enquiry relates to a contract – Art. 6(1)(b) GDPR. You can withdraw your consent at any time by e-mail; this does not affect the lawfulness of processing carried out before the withdrawal.

To protect against spam, your IP address is briefly kept in the server's memory when you send a message in order to limit the number of messages per hour. It is not stored permanently and is discarded after one hour at the latest (Art. 6(1)(f) GDPR).

I delete your message once your enquiry has been fully dealt with, unless statutory retention obligations apply (e.g. if it results in an order).

When you order in the shop, I process your name, e-mail address, billing address (street, house number, postcode, city, country), the products ordered and their prices, the order and payment status and the licence keys assigned to you. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

For customers for whom I carry out an individual project, I also create the order, customer account and licence keys myself. In doing so, I process your name, e-mail address, your address if provided, the agreed products, licences (including time-limited ones) and prices, as well as internal notes on the project. In this case payment is made outside the shop, e.g. by invoice and bank transfer; no data is transmitted to Stripe. Here too, the legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).

After payment you receive an order confirmation with your licence keys by e-mail. To sign in to your customer account and for certain activations, I send you a six-digit code by e-mail. The code is only stored as a hash and expires after a few minutes. E-mails are sent via my e-mail provider.

To protect against attacks, failed sign-in attempts are briefly counted in the database together with your IP address and deleted once the lock-out period has ended (Art. 6(1)(f) GDPR).

I keep order and invoice data for as long as statutory retention periods require (generally 6 or 8 years under Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code) and delete it afterwards. Download links for purchased software are signed and only valid for one hour.

Payments in the shop are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details (e.g. card number) directly with Stripe; I do not receive them. Your name, e-mail address, billing address, order amount and order number are also transmitted to Stripe. Stripe also creates and sends the invoices and provides a customer portal for managing subscriptions.

For the payment form, a script from js.stripe.com is loaded on the checkout page. Stripe receives your IP address and device information and sets cookies used for fraud prevention. The legal basis is Art. 6(1)(b) GDPR and Section 25(2) No. 2 TDDDG, as this is necessary for the payment you requested.

Stripe may also transfer data to Stripe, Inc. in the USA. Stripe is certified under the EU-US Data Privacy Framework; EU standard contractual clauses also apply. Stripe acts as an independent controller for its own purposes (e.g. fraud prevention, legal obligations). More information: stripe.com/privacy.

When you activate my desktop software with a licence key, it sends the following to the shop server: the licence key, a technically generated device ID, optionally the device name and – if confirmation is required – your e-mail address and a confirmation code. The device ID, device name, time of activation and time of the last check are stored. This ensures that a key is only used on the number of devices purchased (Art. 6(1)(b) GDPR). The entries are kept for as long as the licence exists or until the device is reset.

When you start a free trial, the device ID, device name, start and end of the trial period and the time of the last check are stored so that only one trial per device is possible (Art. 6(1)(f) GDPR). Please note that, depending on your settings, the device name may contain your name.

You can install the website as an app on your device. For this, a so-called service worker is stored in your browser. It does not cache any content and does not send any data to me; it is only needed to display notifications.

Only if you explicitly turn on notifications and confirm your browser's prompt does your browser create a subscription with the push service of your browser or device manufacturer (e.g. Google Firebase Cloud Messaging for Chrome and Android, Apple Push Notification service for Safari and iOS, Mozilla for Firefox, Microsoft for Edge on Windows). I only store the technical delivery address (endpoint), two encryption keys, the selected language and the time. No name, e-mail address or other details are collected for this.

Messages are delivered in encrypted form via the respective push service, which may involve a transfer to the USA. Google, Apple and Microsoft are certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

You can withdraw your consent at any time by turning notifications off via “Turn off” in the menu or on the news page, or in your browser settings. The subscription is then deleted or automatically removed the next time a message is sent.

The homepage does not set any cookies for regular visitors. The display mode you choose (light/dark) is only stored in your browser's local storage and is never sent to me.

The shop only sets technically necessary cookies:

• a sign-in cookie for your customer account (valid for 30 days or until you sign out),
• a short-lived cookie while signing in with a code (valid for 10 minutes),
• Stripe cookies on the checkout page (see section 7).

In addition, the shop stores your shopping cart and the display mode you choose (light/dark) in your browser's local storage so that both are kept when you reload the page. These entries are not sent to me automatically – the cart only when you submit an order. You can delete them at any time in your browser settings.

Session cookies are also set for the password-protected admin areas. All of these cookies and entries are strictly necessary for the function you requested (Section 25(2) No. 2 TDDDG); no consent is required.

Neither the homepage nor the shop loads fonts from third parties. No connection to Google or any other font provider is made when you load a page.

The homepage and the shop contain links to external sites, e.g. project repositories or download sites such as GitHub or itch.io through which individual programs and games are provided. These sites are not embedded; they only open when you click a link. Those sites are covered by the privacy policies of their respective providers. No data is transferred until you click such a link.

Within the limits of the law you have the right at any time to:

• access the data stored about you (Art. 15 GDPR)
• have inaccurate data rectified (Art. 16 GDPR)
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• withdraw your consent with effect for the future (Art. 7(3) GDPR)

An informal e-mail to kontakt@felsberg-design.de is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority, for example the Saxon Data Protection and Transparency Commissioner, Devrientstraße 5, 01067 Dresden, Germany.

I update this privacy policy when the website or the legal situation changes. The version published here applies. Further details can be found in the legal notice. In case of doubt, the German version is authoritative.