Last updated: 25 October 2026. This notice explains how personal data is processed when you visit our shop, place orders, contact us or use the shop administration area.
1. Controller and contact details
Kilea PrintProprietor: Selina Bachmayr
In den Seien 14
67685 Schwedelbach
Germany
Email: Design@Kileaprint.de
Phone: 0176 32137042
You can use these contact details for questions about data protection or to exercise your rights.
2. Purposes and legal bases
- Enquiries, orders, payment processing, production, delivery and the reversal of transactions: Article 6(1)(b) GDPR (steps before entering into a contract and performance of a contract).
- Statutory documentation and retention obligations and the handling of statutory claims: Article 6(1)(c) GDPR.
- Secure operation, prevention of misuse, troubleshooting, technical support and handling general enquiries: Article 6(1)(f) GDPR. Our legitimate interests are a functioning, protected shop and reliable communication.
We need the information marked as mandatory for the relevant order or enquiry. Without this information, we cannot process the request. Providing additional voluntary information is not a condition for placing an order. You do not need a permanent customer account.
3. Hosting, database and technical logs at Netlify
Our website, server-side shop functions and order database are provided through Netlify, Inc., San Francisco, USA. We also use Netlify Blobs for catalogue images and protected files. Mittwald does not host the shop application; it manages our domain and email services.
When you visit the website, the data processed includes, in particular, your IP address, the time of access, the requested address, browser and device information, the referring page where applicable, and technical status and error data. This is necessary to deliver the website, identify disruptions and defend against attacks. The legal basis is Article 6(1)(f) GDPR.
To prevent misuse, we also process pseudonymised hashes derived from IP addresses or access identifiers, time windows and request counters. These enable us to identify and limit unusually high numbers of requests.
Netlify uses internationally distributed infrastructure and subprocessors. Processing in the USA is possible; we do not promise that all shop data is processed exclusively in Germany or the EU. Information about international transfers is provided in section 13.
4. Orders and your personal order link
When you submit your order for payment, we store the details before you are redirected to Stripe. An incomplete or unpaid order may therefore also be stored. In particular, we process:
- First and last name, email address and delivery address, including country;
- selected products and designs, colours, sizes, quantities, product previews, prices and shipping charges;
- order number, order time, language, associated payment references and payment status;
- the contractual information applicable when the order was placed, together with the processing and communication data required.
This data is held in the shop database provided through Netlify. It is processed to handle the order, match the payment to it and prevent duplicate orders under Article 6(1)(b) GDPR. Records required by law are retained on the basis of Article 6(1)(c) GDPR.
You can access the relevant order using a personal order link. This link contains a secret access identifier and allows the order details to be viewed. Please share it only with people who are authorised to see this data.
5. Email and contact through Mittwald
Our domain management and email mailboxes are operated by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany. The shop sends order emails and other messages relating to a transaction through this email service. Recipient and sender addresses, message contents, attachments where applicable, and technical delivery data are processed.
Order and withdrawal emails are also stored in the shop database with their recipient, content and delivery status so that delivery can be tracked and retried if it fails. After a confirmed payment, you receive an order confirmation; Kilea Print receives a merchant copy at bestellung@kileaprint.de. The additional merchant copy sent to WOOGY is described in section 6.
If you contact us by email or telephone, we use the information you provide to handle your enquiry. Article 6(1)(b) GDPR applies to contract-related matters and Article 6(1)(f) GDPR to general enquiries. Article 6(1)(c) GDPR applies to records required by law.
6. Production partner WOOGY and merchant notification
WOOGY, Brucknerstraße 9a, 66877 Ramstein-Miesenbach, supports Kilea Print in producing, customising and, where applicable, shipping the goods ordered. After payment is confirmed, Andreas at WOOGY automatically receives a merchant notification at support@woogy.de.
This message includes the order number and time, your name, email address and delivery address, the items ordered with their design, colour, size, quantity and product preview, amounts and confirmed payment status. The data is shared to process and fulfil your order on the basis of Article 6(1)(b) GDPR.
Your sign-in codes are not forwarded to WOOGY. Declarations submitted through the electronic withdrawal function are acknowledged to you and Kilea Print; they are not part of this automatic merchant copy.
7. Payment with Stripe Checkout
To pay, you are redirected to Stripe’s payment page. For the European Economic Area, Stripe identifies, in particular, Stripe Payments Europe, Limited, Stripe Technology Europe, Limited and, for certain independent processing activities, Stripe Technology Company, Limited, all based in Ireland. The entity involved depends on the service used.
We transmit your email address, name and delivery address, item and variant descriptions, quantities, amounts and order references. You enter payment details such as your card number and security code directly with Stripe; they are not stored in our shop database. Stripe also processes the technical and transaction data required for payment and fraud prevention. We receive the payment reference and payment status.
Payment processing is based on Article 6(1)(b) GDPR. Depending on the processing activity, Stripe acts as a processor or as an independent controller, for example for its own statutory obligations and security checks. Stripe’s privacy notice explains the details, other recipients and international transfers.
8. Shipping and manual invoice preparation
The shipping companies actually engaged receive the recipient and address data needed to deliver the goods. Our production partner may also ship the goods. The legal basis is Article 6(1)(b) GDPR.
Kilea Print currently prepares invoices manually using Canva, a service provided by Canva Pty Ltd, 110 Kippax St, Surry Hills, NSW 2010, Australia, and sends them separately by email. The names, addresses, invoice and order details required for the invoice are processed in Canva. The website has no automatic Canva integration. The legal bases are Article 6(1)(b) and (c) GDPR. Canva may also process data outside the European Economic Area; the information in section 13 applies.
9. Shop administration and technical support
Only authorised people have access to the protected administration area. They include the shop proprietor and technical support provided by goRealise. As part of support, troubleshooting and order administration, these people may view the order and customer data needed for those tasks. The legal bases are the secure provision and support of the shop under Article 6(1)(f) GDPR and, for order processing, Article 6(1)(b) GDPR.
The authorised email address, a time-limited sign-in code and session data are processed for sign-in. This includes technical information such as the IP address and browser identifier. The sign-in code is sent to the relevant address through Mittwald and stored on the server in hashed form. It is valid for five minutes; an administration session expires after no more than twelve hours. Catalogue changes are logged with the time and the account making the change.
10. Cookies and browser storage
We currently use no analytics or advertising trackers on our shop pages. Fonts and catalogue images are loaded through the shop infrastructure. Technically necessary cookies and comparable browser storage are used for the functions you access:
- Basket: products, variants and quantities are stored in local browser storage. Your name, email address and address are not stored there as basket data. This storage has no fixed expiry; you can remove the entries through the basket or your browser’s website data settings.
- Checkout and withdrawal: a random transaction identifier and a fingerprint calculated from your entries are stored in session storage to prevent duplicate submissions. The contact details are not present in plain text in this fingerprint. Storage is tied to the browser session.
- Completed orders: a technical completion marker in the browser prevents an order link opened again later from changing a basket that has since been refilled. This marker has no fixed expiry in local storage and can be deleted with the website data.
- Administration: sign-in cookies secure the session and authorised access; the session is limited to twelve hours.
Where this storage or access is strictly necessary for the function you have expressly requested, it is based on section 25(2), no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Subsequent processing of personal data is based on Article 6(1)(b) GDPR for order functions and Article 6(1)(f) GDPR for security and administration. When you move to the payment page, Stripe’s information about its own technologies also applies.
11. Electronic withdrawal declaration
When you use the “Withdraw from contract” function, we process your name, email address, order number or contract reference, the scope of the declaration, any additional details and the time of receipt. The declaration is stored and its receipt is acknowledged by email. This does not automatically trigger a refund. The legal bases are Article 6(1)(b) and (c) GDPR.
12. Designs and image files
Uploading customers’ own designs is disabled in the current shop. Files previously submitted with individual enquiries may remain with the associated enquiry in separate, access-protected storage at Netlify. They are not accessible as public catalogue images. They are processed to handle the relevant enquiry and, where applicable, fulfil the order under Article 6(1)(b) GDPR.
Catalogue designs and product mockups published by Kilea Print are publicly visible shop images. The product illustration selected for an order may also be included in its order email.
13. Recipients and international processing
To the extent described, recipients are authorised shop administrators and technical support staff, hosting and email providers, payment service providers, production and shipping partners, and the invoice preparation service. Where required by law, tax advisers or competent authorities may also receive documents.
Netlify, Stripe and Canva may also process data in countries outside the European Economic Area or make it accessible to service providers there. According to their provider information, the mechanisms used depend on the recipient and include adequacy decisions, the EU–US Data Privacy Framework for appropriately certified US recipients, and EU Standard Contractual Clauses. The respective privacy and contractual information explains the applicable mechanisms and subprocessors. You can contact us for information about the safeguards applicable to your data or to obtain a copy.
14. Retention periods
The retention period depends on the purpose concerned and any statutory obligations. For order and payment data, relevant factors include completion and processing of the transaction, unresolved queries, returns, warranty claims and the establishment or defence of legal claims. For incomplete orders, the deciding factor is whether the transaction may still be continued or is needed to resolve a payment issue.
Invoice and accounting documents are subject to the applicable tax and commercial-law retention periods. Such obligations do not justify blanket retention of all browser data, image files or messages. For communications, withdrawal declarations and historical production files, we consider whether the matter has been resolved and whether further reasons for documentation or retention remain.
Technical logs and security identifiers are assessed according to their necessity for operation, troubleshooting and protection against misuse, and according to the settings of the services used. The validity period of a sign-in code or session is distinct from the retention of associated security records. Browser storage periods are described in section 10.
Stored orders, messages and associated historical image files are currently not automatically deleted after a fixed number of days. Please contact us if you would like access to or erasure of your data. Statutory retention obligations or other lawful reasons for further storage are then assessed for the specific case.
15. Your rights and the right to complain
Subject to the conditions set out by law, you have the following rights:
- Access to your personal data (Article 15 GDPR);
- Rectification of inaccurate or incomplete data (Article 16 GDPR);
- Erasure (Article 17 GDPR);
- Restriction of processing (Article 18 GDPR);
- Data portability (Article 20 GDPR);
- Objection to processing based on legitimate interests on grounds relating to your particular situation (Article 21 GDPR).
Where processing is based on your consent, you may withdraw it at any time with effect for the future. This does not affect the lawfulness of processing carried out beforehand. Please send your request to Design@Kileaprint.de.
You may lodge a complaint with a data protection supervisory authority, in particular in the place where you live or work, or where you believe an infringement has occurred. In Rhineland-Palatinate, you can contact the State Commissioner for Data Protection and Freedom of Information at Hintere Bleiche 34, 55116 Mainz, email: poststelle@datenschutz.rlp.de.