← Back to the shop
|

Privacy Policy

1. Data Controller

Data controller within the meaning of Art. 4(7) GDPR:
Carsten Claus
Dohnaer Str. 47, 01219 Dresden, Deutschland
E-mail: info@imexcc.de

2. Data Collected and Purposes

We process the following order data, as well as the technical request data described under Hosting:

  • Email address — to deliver the book, the download link and the invoice, and to perform the contract (Art. 6(1)(b) GDPR).
  • Town and book language — the basis for creating the individual book (Art. 6(1)(b) GDPR).
  • Personal dedication (optional, freely entered) — included verbatim in the created book; may contain personal data of a third party (e.g. a recipient’s name) that you add yourself (Art. 6(1)(b) GDPR).
  • Country — for the invoice on coupon orders (Art. 6(1)(c) GDPR).
  • Payment data — processed exclusively by Link/Stripe (see 4.1); we do not store payment data (Art. 6(1)(b) GDPR).

3. Hosting

This website, static pages and API run on Cloudflare Workers and Static Assets. Cloudflare processes technical request data such as IP addresses and request metadata to deliver the service and protect it against abuse. The legal basis is Art. 6(1)(f) GDPR (secure operation). Cloudflare Privacy Policy. Cloudflare operates an international network; an exclusively EU-based processing location is not promised. Its data processing addendum covers international transfers, including Standard Contractual Clauses. Cloudflare DPA.

4. Third-Party Providers and Processors

4.1 Link / Stripe — Sale and Payment

Paid orders are handled by Link, a Stripe service (Sold through Link, LLC, USA; payment processing by Stripe Technology Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland, or Stripe Payments Company, USA). Link collects the payment on our behalf, appears as the merchant at checkout and processes the data needed for payment and VAT as an independent controller; Stripe may transfer data to the USA. We collect town, book language, dedication and email address directly from you (see 2) and pass them to Link as order details so the payment can be matched. After a successful payment, Link returns the payment confirmation and the email address entered at checkout to us (Art. 6(1)(b) GDPR). Link privacy policy: link.com/privacy

4.2 Brevo — Email Delivery

Confirmation, status and ready emails (including the PDF and invoice) are sent via Brevo SAS (formerly Sendinblue), 7 rue de Madrid, 75008 Paris, France, as a processor (Art. 28 GDPR). Legal basis: Art. 6(1)(b) GDPR.

4.3 Cloudflare D1 — Order Database

Cloudflare D1 stores order, coupon, invoice and access-token data. This includes your email address, selected location, book language and optional dedication. These data support contract performance and applicable record-keeping obligations (Art. 6(1)(b) and (c) GDPR).

4.4 Cloudflare R2 — Book Downloads

The finished PDF, including any dedication, is stored in a private Cloudflare R2 bucket. A personal, non-guessable token is required to download it through our API. The download expires 14 days after completion; the stored customer file is then removed by scheduled cleanup. Existing orders may continue to use their previous Vercel Blob storage during the transition. Legal basis: Art. 6(1)(b) GDPR.

5. Data Sources for Book Creation

Species and birding-spot research queries public, non-personal data sources (GBIF, OpenStreetMap, general web research). No personal data of the customer is transmitted to these sources.

6. Retention Period

Order and invoice data is retained for contract performance and the statutory period applicable to the respective document. Customer PDF downloads expire 14 days after completion. Download access logs become eligible for scheduled deletion after 30 days. The book is generated on our local computer; this is separate from the temporary download storage.

7. Your Rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Contact us at info@imexcc.de.

You also have the right to lodge a complaint with the competent supervisory authority. For Germany this is the Sächsischer Datenschutz- und Transparenzbeauftragter (SDTB), Devrientstraße 5, 01067 Dresden, www.saechsdsb.de.