Privacy policy of Aufnäher.de

As at 4 September 2026

We are delighted that you are interested in our products and services. The protection of your personal data is important to us. Below, we explain what data we process when you use our website and when we fulfil your order, the purpose and legal basis for doing so, how long we store the data, and what rights you have.

1. Data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is the organisation mentioned above. If you have any questions regarding data protection, please contact us using the contact details provided.

2. Data Protection Officer

We are not legally obliged to appoint a data protection officer. For any enquiries regarding data protection and to exercise your rights, please use the contact details provided in section 1.

3. Definitions and general principles

Personal data is any information relating to an identified or identifiable natural person (Article 4(1) of the GDPR) – such as a name, address, email address or IP address.

We process personal data only where there is a legal basis for doing so. In this statement, we set out the relevant legal basis for each instance of processing:

• Article 6(1)(a) of the GDPR – You have given your consent (e.g. in the case of optional cookies).
• Article 6(1)(b) of the GDPR – processing is necessary for the performance of a contract with you or for the implementation of pre-contractual measures (e.g. order processing, enquiries regarding quotations).
• Article 6(1)(c) of the GDPR – we are legally obliged to process the data (e.g. retention requirements under commercial and tax law).
• Article 6(1)(f) of the GDPR – processing is necessary to safeguard our legitimate interests and your interests do not override them (e.g. operational security, prevention of misuse).

We do not carry out any automated decision-making, including profiling within the meaning of Article 22 of the GDPR.

4. Hosting and server log files

Our website is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen. The servers are located in Germany (Nuremberg data centre). We have entered into a data processing agreement with Hetzner in accordance with Article 28 of the GDPR.

When you visit our website, information transmitted by your browser is automatically collected; this information is technically necessary to display the page to you and to ensure its stability and security:

• IP address of the requesting device
• Date and time of access
• page or file accessed
• Amount of data transferred and notification of successful retrieval
• Browser type and version, operating system used
• previous page visited (referrer), if provided

Purpose: To host the website, ensure system security and investigate unauthorised access. Legal basis: Article 6(1)(f) of the GDPR. Retention period: 7 days; in the case of security-related incidents, until the matter has been fully resolved.

5. Order processing, quotations and customer accounts

In order to process your enquiry, prepare a quotation and fulfil an order, we process the data you have provided: Title, first name and surname, billing address and, where applicable, a different delivery address, email address, telephone number, company name and VAT registration number for business customers, details of the desired specification (shape, size, quantity, fastening, design) and the chosen payment method.

When you create a customer account, we also store your login details and your order history so that you can view your enquiries and orders. You can have your customer account deleted at any time.

Purpose: Initiation and performance of contracts; customer service. Legal basis: Article 6(1)(b) of the GDPR; for data retention, additionally Article 6(1)(c) of the GDPR. Retention period: see clause 17.

You can log in to your customer account without a password. To do so, we will send you a temporary login link to your registered email address upon request. The data processed includes your email address, the time of the request and a unique random value (token).

Purpose: secure login without a password. Legal basis: Article 6(1)(b) of the GDPR. Retention period: the token expires after a short time and is then deleted.

6. Contact and enquiry forms, image upload

If you contact us via a form, by email or by telephone, we will process the details you provide (mandatory fields: name, email address, message; optional: telephone number, company name, quantity, country, preferred version) in order to process your enquiry and provide you with a quotation.

Using our configurators and enquiry forms, you can Upload files (Logos, coats of arms, designs; up to six files, totalling a maximum of 20 MB). We process these files solely for the purpose of checking your design, creating an embroidery programme and providing you with a draft.

Purpose: To process your enquiry, draw up a quotation and prepare your order. Legal basis: Article 6(1)(b) of the GDPR; for general enquiries not relating to a contract, Article 6(1)(f) of the GDPR (legitimate interest in responding to enquiries). Retention period: 12 months after final processing, provided no order is placed; where an order is placed, in accordance with the time limits set out in clause 17.

7. Protection against spam and misuse

To protect our forms from automated submissions and misuse, we employ technical checks. These involve analysing the sender’s IP address, the time of submission and characteristics of the content submitted. Submissions that appear suspicious are placed in quarantine and checked manually; in the event of repeated misuse, individual IP addresses may be temporarily blocked.

In addition, we use the plugin Antispam Bee, which runs locally on our server and does not transmit any data to third parties.

Purpose: To prevent spam and misuse, and to ensure the smooth running of the system. Legal basis: Article 6(1)(f) of the GDPR. Retention period: Quarantine entries for 90 days; blacklists until the reason for their inclusion ceases to apply.

8. Payment methods

To process your payment, we pass on the necessary data to the payment service provider you have chosen. These providers process your data on their own responsibility; their privacy policies also apply. The providers’ scripts are only loaded during the ordering process once you have selected the relevant payment method.

Supplier	Data controller	Privacy Notice
PayPal	PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg	paypal.com
Klarna	Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden	klarna.com
Wero	EPI Company SE, Brussels, Belgium	wero-wallet.eu
Payment in advance / Bank transfer	Processing via our bank	—

Purpose: To process the payment. Legal basis: Article 6(1)(b) of the GDPR; additionally, for the loading of scripts during checkout, Section 25(2)(2) of the TDDDG (absolutely necessary for the service you have requested).

Credit check with Klarna: If you select a payment method from Klarna, Klarna may carry out an identity and credit check to determine whether the contract can be concluded, and may exchange data with credit reference agencies for this purpose. This check is carried out by Klarna on its own responsibility; we merely receive the result from Klarna as to whether the selected payment method can be offered. Klarna provides information on the details of this process, the credit reference agencies used and your rights in its privacy policy.

9. Delivery

To arrange delivery of your order, we will pass on your name and delivery address to the designated courier service:

• DHL – DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn
• UPS – United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss

If you have consented to receiving a delivery notification, or if this is required for the delivery, we will also pass on your email address or mobile phone number so that the service provider can inform you of the delivery.

We deliver worldwide. For deliveries to countries outside the European Union (third countries, e.g. Switzerland, the United Kingdom, Norway), we provide the information required for customs clearance (recipient, address, value of goods, description of goods) to the transport provider and the relevant customs authorities.

Purpose: Dispatch and delivery, customs clearance. Legal basis: Article 6(1)(b) of the GDPR; for customs clearance, additionally Article 6(1)(c) of the GDPR.

10. Sending emails

We use an SMTP service to send system and business emails (enquiry confirmations, quotations, order confirmations, dispatch information). In doing so, your email address and the content of the message are processed. We log the delivery status for troubleshooting purposes.

Purpose: reliable delivery of business emails. Legal basis: Article 6(1)(b) of the GDPR; for logging, Article 6(1)(f) of the GDPR. Retention period for delivery logs: 90 days.

11. Trusted Shops

On our website, this is the Trust Badge from Trusted Shops SE, Subbelrather Straße 15c, 50823 Cologne, is integrated into the site. It displays our quality seal and the reviews submitted to Trusted Shops. When the Trustbadge is loaded, your IP address is transmitted to Trusted Shops so that the content can be delivered to your browser.

Buyer protection: If you make use of the Trusted Shops Buyer Protection scheme, we – or you yourself – will forward the necessary order details to Trusted Shops. Trusted Shops is solely responsible for this.

Request for a review: Following a purchase, we may send you a one-off email asking you to rate your order on Trusted Shops. You may object to this at any time; we will then not send any further requests.

Purpose: Display of the quality seal and reviews; administration of buyer protection; collection of reviews. Legal basis: for the Trustbadge, Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG (your consent); for buyer protection: Article 6(1)(b) GDPR; for the review request: Article 6(1)(f) of the GDPR. Data protection information: trustedshops.de.

12. Display of customer reviews

On our website, we display an aggregate rating based on the reviews on Google, ProvenExpert (Expert Systems AG, Quedlinburger Straße 1, 10589 Berlin) and Trusted Shops compiles. No personal data relating to our website visitors is processed in this process; we merely reproduce the average scores and figures published on the portals. The reviews themselves are submitted on the portals and processed there by the respective providers.

13. Cookies and consent

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device.

Certain cookies are essential for the website to function – for example, for the shopping basket, the configurator, session management, login and security. We use these without your consent.

Legal basis: Section 25(2)(2) of the TDDDG and Article 6(1)(b) and (f) of the GDPR.

We utilise all other technologies – in particular statistics and marketing – only with your consent . No connection is established with the respective providers’ servers and no corresponding cookies are set until you have given your consent.

Legal basis: Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) of the GDPR.

We record your consent as evidence in accordance with Article 7(1) of the GDPR. We store your IP address exclusively as a salted hash value, not in plain text. Your consent is valid for 12 months; after that, we will ask for it again. If the list of services used changes, we will also seek your consent again.

You may withdraw your consent at any time with effect for the future (Article 7(3) of the GDPR) – via the button "Cookie settings" at the bottom of each page. The lawfulness of any processing carried out prior to revocation remains unaffected.

14. Google services

The provider of the following services is the Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use all Google services solely with your consent one.

Google Tag Manager (container ID GTM-5P7BHCJ) is used to manage the services listed below. The Tag Manager itself does not create user profiles or store cookies; it simply ensures that the services you have authorised are loaded.

We use Google Analytics 4 (Measurement ID G-ZGG7MKJ2WQ), in order to analyse the use of our website statistically and to improve our service. The data processed includes, amongst other things, truncated IP addresses, pages visited, time spent on the site, the source of the visit, approximate location at country/city level, and device and browser information. IP anonymisation is enabled.

We use Google Ads to promote our services and measure the success of our adverts (conversion tracking). In doing so, advertising and remarketing cookies may be set, which may be used to display interest-based adverts to you on other websites.

Site Kit connects our website to the aforementioned Google services and Google Search Console, and displays their analytics to us in the admin area. No data processing takes place beyond the scope of these services.

We use Google Consent Mode, version 2. Before you give your consent, all consent indicators are set to denied; no cookies are set and no personal data is transmitted to Google. The signals are only updated once you have given your consent.

Purpose: Audience measurement, optimisation of the service, advertising and performance measurement. Legal basis: Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG. Retention period: see cookie expiry dates; analytics user data is deleted after 14 months. Privacy policy: policies.google.com/privacy.

15. WP Statistics

In addition, we use our own self-hosted statistics software WP Statistics. It processes the data exclusively on our own server; no data is passed on to third parties. The information collected includes the pages accessed, the time, the referrer and a anonymised and additionally hashed IP address. The browser identifier (user agent) is not stored, and no geographical location is determined. We are therefore unable to link this to any specific individual.

Purpose: statistical analysis of website usage without reference to specific individuals. Legal basis: Article 6(1)(f) of the GDPR (legitimate interest in tailoring our services to users’ needs). Retention period: 12 months.

16. Recipients and data processing on behalf of a client

We will only pass on your data where this is permitted:

• for the performance of the contract (Article 6(1)(b) of the GDPR) – to payment and delivery service providers,
• in accordance with a legal obligation (Article 6(1)(c) of the GDPR) – for example, to tax authorities or customs,
• to safeguard legitimate interests (Article 6(1)(f) of the GDPR) – for example, to our tax adviser or for the purposes of legal proceedings,
• on the basis of your consent (Article 6(1)(a) of the GDPR) – for example, to Google.

We engage service providers who process personal data on our behalf in accordance with our instructions – in particular for hosting, email dispatch and IT maintenance – on the basis of a Data Processing Agreement pursuant to Article 28 of the GDPR These service providers are contractually obliged to process the data solely in accordance with our instructions and in compliance with the GDPR.

Your data will not be passed on to third parties for marketing purposes.

17. Retention period

We only retain personal data for as long as is necessary for the relevant purpose or where statutory retention periods apply:

Data	Duration	Basis
Server log files	7 days	legitimate interest
Enquiries without an order, uploaded images	12 months after completion	legitimate interest
Invoices, order and booking details	10 years	Section 147(1) of the German Fiscal Code (AO), Section 257(4) of the German Commercial Code (HGB)
Commercial and business letters	6 years	Section 257(4) of the German Commercial Code (HGB)
Customer account	until you delete it	Contract; thereafter, only data subject to retention requirements, restricted
Evidence of consent	3 years after revocation	Article 7(1) of the GDPR, duty to provide evidence
Statistical data (WP Statistics)	12 months	legitimate interest
Spam quarantine	90 days	legitimate interest

18. Data transfers to third countries

When using Google services (clause 14), personal data – in particular online identifiers and the truncated IP address – may be transmitted to the Google LLC in the USA be transmitted.

Google LLC operates under the EU-US Data Privacy Framework certified. An adequacy decision by the European Commission dated 10 July 2023 (Article 45(3) of the GDPR) therefore applies to the transfer. In addition, Google has entered into the Standard Contractual Clauses agreed with the European Commission in accordance with Article 46(2)(c) of the GDPR.

We would like to expressly point out that, despite these safeguards, it cannot be entirely ruled out that US authorities may access the data transferred. The transfer takes place solely on the basis of your consent (Article 6(1)(a) of the GDPR), which you may withdraw at any time.

When dispatching goods to countries outside the European Union, we provide the transport service provider and the customs authorities of the country of destination with the data required for customs clearance. The legal basis for this is Article 6(1)(b) and (c) of the GDPR; the transfer is necessary for the performance of the contract (Article 49(1)(b) of the GDPR). For some countries of destination – such as Switzerland and the United Kingdom – there is also an adequacy decision by the European Commission.

19. Data security

Our website operates exclusively via an encrypted SSL/TLS connection delivered; you can recognise this by the padlock symbol and the address https://. This ensures that the data you send to us is protected against unauthorised access whilst in transit. Furthermore, we implement technical and organisational measures in accordance with Article 32 of the GDPR to safeguard your data against loss, destruction and unauthorised access.

20. Your rights

You have the following rights in relation to your personal data:

• Information (Article 15 of the GDPR) – You can find out whether we process data about you, what data we process, for what purpose and for how long, and you can obtain a copy of it.
• Correction (Article 16 of the GDPR) – You have the right to have inaccurate data rectified and incomplete data completed.
• Deletion (Article 17 of the GDPR) – You may request the erasure of your data, provided that there is no legal obligation to retain it.
• Restriction of processing (Article 18 of the GDPR) – You may request that we continue to store your data but cease to process it further.
• Data portability (Article 20 of the GDPR) – You may receive the data you have provided in a commonly used, machine-readable format.
• Objection (Art. 21 GDPR) – see the note highlighted separately below.
• Withdrawal of consent (Article 7(3) of the GDPR) – You may withdraw any consent you have given at any time with effect for the future.
• Complaint to a supervisory authority (Article 77 of the GDPR) – see paragraph 21.

To exercise your rights, simply send an informal message to info@aufnaeher.de or to the address given in point 1. We will reply without delay, and at the latest within one month.

21. Competent supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data (Article 77 of the GDPR). The competent authority for us is:

22. Changes to this Privacy Policy

We will update this privacy policy if there are changes to our services, the services we use or the legal situation. The version published on this page is the one that applies at any given time. The date shown above indicates when we last updated it.