Privacy policy

Controller

Tom Schneider
Gottschalkring 16
21073 Hamburg
Germany

Email: [email protected]

In short

• You don't need an account. You can pay through Stripe; you enter your name, address and payment details there, not with us.
• All files of the site (scripts, styles, icons) come from this server, not from third parties.
• The site is delivered through Cloudflare, which protects it from attacks.
• We count page views and generated PDFs on our server, without cookies.
• We record how you use the site (for example clicks) with PostHog, without cookies and without storing anything in your browser.

Hosting and server log files

The site runs on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Deutschland). We have a data processing agreement with the provider under Art. 28 GDPR. Details are in its privacy policy.

With every request, the server processes technically necessary data: IP address, time, requested address, status code, amount of data transferred, and information about your browser and operating system. Our application logs only the method, path, status code and duration of these, without the IP address. To keep anyone from overloading the server with requests, it also briefly counts in memory how many PDFs are requested from an IP address; this count is neither stored nor passed on. The processing serves to deliver the site, keep it secure and find errors; the legal basis is our legitimate interest in secure and stable operation (Art. 6 (1)(f) GDPR). We delete logs as soon as they are no longer needed for these purposes.

Delivery and protection by Cloudflare

All requests to this site go through the network of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). Cloudflare forwards your requests to our server, delivers the site faster and fends off attacks and mass automated access. To do so, Cloudflare processes the technically necessary data of every request: IP address, time, requested address, information about your browser and operating system, and the content transferred. We have a data processing agreement with Cloudflare under Art. 28 GDPR. Details are in Cloudflare's privacy policy.

To detect bots and attacks, Cloudflare may set technically necessary cookies: "__cf_bm" (lifetime 30 minutes) and, after a security check, "cf_clearance". These cookies serve security only, not analytics or advertising, and are strictly necessary for that purpose (Section 25 (2) no. 2 TDDDG).

Cloudflare may also process data in the USA. The transfer relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework, which Cloudflare has joined, and additionally on the European Commission's standard contractual clauses. The legal basis is our legitimate interest in a fast, secure site that is protected from overload (Art. 6 (1)(f) GDPR).

Generating the PDFs

When you generate a PDF or a preview, the server processes your selection (for example template, year, region, variant). We keep finished files in a cache so that the same selection doesn't have to be calculated again. The cache is ordered by selection only and has no link to you. The legal basis is providing the service you asked for (Art. 6 (1)(b) GDPR).

Paying with Stripe

For payment we send you on to the checkout of Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). There you enter your email address, billing address and payment details. From these, Stripe calculates the taxes of your country, checks the payment for fraud, sends you the receipt and answers questions about the payment. Stripe processes this data under its own responsibility; Stripe's privacy policy applies. Stripe may also process data in the USA; the transfer relies on the EU-US Data Privacy Framework, which Stripe has joined, and additionally on the European Commission's standard contractual clauses.

From Stripe we ourselves receive the order (template, selected options, amount, time of your consent to the loss of the right of withdrawal, language of the page), the payment status and the details we need for bookkeeping and queries. We never see card numbers. We use your email address to send you the order confirmation with the download link; for this we pass it on to our email provider, which processes it on our behalf (Art. 28 GDPR). The legal basis is performance of the purchase contract (Art. 6 (1)(b) GDPR) and our legal obligation to keep records (Art. 6 (1)(c) GDPR, Section 147 AO, Section 257 HGB: up to ten years).

Cookies and storage in your browser

Apart from Cloudflare's security cookies (see above), we don't set any cookies, and apart from your language choice (see next paragraph) we don't store anything in your browser.

Language choice: When you change the language of the site with the flags at the top right, or visit our home page for the first time, your browser remembers the language (de or en) in local storage (localStorage) under the key locale. On your first visit to the home page, we use it to redirect you once to the English version if your browser reports English as a preferred language. The entry stays on your device, is not transmitted to us or to third parties, and only serves to avoid asking for the language on every visit. It is technically necessary to keep the language you chose (Section 25 (2) no. 2 TDDDG); you don't need to consent to it. You can delete it at any time in your browser settings under site data.

Audience measurement on the server

To see which pages and templates are in demand, our server counts page views and generated PDFs and sends them to PostHog (PostHog Inc., San Francisco, USA). For this, the server needs no data from your browser. The server also reports its own errors there (for example a failed PDF); these reports contain no information about you.

The following is transmitted: requested path, time, referring domain (only for visits from elsewhere), campaign parameters in the address (utm_…), the language of the page (de or en), your browser's information about browser, operating system and device (user agent) and, when a PDF is generated, the selected options, duration and success. To tell visits apart, the server forms a checksum from IP address and user agent with a random key that exists only in memory and changes daily. We don't pass on the IP address itself; after the day changes, the checksum can no longer be linked to anyone, not even by us (exception: with a purchase, see next paragraph). We don't create personal profiles.

So that we can see which pages lead to purchases, the server also counts the way to checkout and the completed purchase: product, selected options, price, the language of the page and the checksum of your visit are transmitted. For this we store the checksum in your order with Stripe, because the confirmation of the payment comes from Stripe and not from your browser. Through the order, the page views counted that day can thus be linked to your purchase. We don't pass your name and email address on to PostHog.

The legal basis is our legitimate interest in improving the offer based on usage figures (Art. 6 (1)(f) GDPR). You can object at any time without writing to us: if "Global Privacy Control" or "Do Not Track" is switched on in your browser, the server doesn't count you. We don't count requests by bots and scripts.

Usage analysis in the browser with PostHog

In addition, the site loads PostHog's script and records how you use it: clicks, entries in selection fields (no free text), scrolling, time on page, screen size and approximate location (country, region, city). PostHog derives the location from your IP address; the IP address itself is not stored.

PostHog runs without cookies: neither cookies nor entries in local storage are created on your device. As an identifier, the script uses the same daily checksum as our server (see above), which it fetches from us when the page loads; this lets us assign page views and usage to the same visit. We don't recognise returning visitors across days. The data goes through our own proxy at k.pdf-manufaktur.de; your browser doesn't connect to PostHog directly.

For both kinds of measurement: PostHog processes the data on our behalf (Art. 28 GDPR) on servers in the European Union (Frankfurt am Main).

The legal basis is our legitimate interest in improving the offer based on usage figures (Art. 6 (1)(f) GDPR). If "Do Not Track" is switched on in your browser, the script records nothing. You can also object to the measurement at any time by writing to us.

For both kinds of measurement: we keep the recorded events as long as we need them for analysis and delete them after two years at the latest.

PostHog's privacy policy: posthog.com/privacy

Link to Etsy

We also sell ready-made calendars through Etsy (Etsy Ireland UC, One Le Pole Square, Ship Street Great, Dublin 8, Ireland). Your browser only connects to Etsy when you click the link to the shop; there Etsy's privacy policy applies. Etsy itself is responsible for data processing in the shop; the order data we receive there, we process only to handle your order (Art. 6 (1)(b) GDPR).

Contact by email

When you write to us, we process your message and your contact details to answer your request (Art. 6 (1)(b) GDPR for questions about a contract, otherwise Art. 6 (1)(f) GDPR). We delete the data when the matter is settled and no statutory retention obligations apply.

Your rights

You have the right to information about the data we hold about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time (Art. 7 (3) GDPR); the lawfulness of the processing carried out until then remains unaffected. A short email is enough.

Right to object: If we process data on the basis of legitimate interests (Art. 6 (1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority of your place of residence or the authority responsible for us.

There is no automated decision-making including profiling (Art. 22 GDPR). You are not obliged to provide us with data; without the technically necessary data, however, the site cannot be delivered.