Privacy policy

Last updated: 24 August 2026

1. Controller

Waldbyte Digital Agentur, owner Nayab Noor, Niederwaldstraße 1b, 76437 Rastatt, Germany
Telephone: +49 176 58824334
Email: info@waldbyte.de

2. Hosting and server logs

This shop is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as our processor. When the site is accessed, the server processes the IP address, date and time, requested URL/file, referrer, browser and operating-system information, response status and transferred volume. This is necessary to deliver the website, maintain security and investigate faults (Article 6(1)(f) GDPR). Logs are normally deleted after 14 days unless an incident requires longer retention.

3. Necessary shop functions and cookies

PrestaShop uses technically necessary storage for the session, cart, language, authentication, checkout, security and consent settings. Processing is necessary to provide the shop and perform a contract (Article 6(1)(b) GDPR) and to protect the shop (Article 6(1)(f) GDPR). The PHPSESSID session cookie and the PrestaShop shop cookie are configured as Secure and HttpOnly with a maximum duration of 480 hours (20 days); data can be removed earlier by logging out or clearing browser data. The consent choice is stored inside the necessary shop cookie. Optional analytics and marketing technologies remain disabled until consent is given.

4. Customer accounts, orders and digital downloads

When you create an account or order, we process details such as name, billing address, country, email address, account credentials in hashed form, cart, products, licence/order information, prices, payment status, order history, download access and communication. The purposes are contract conclusion and performance, delivery of digital products, licence administration, fraud prevention, support, and compliance with accounting and tax obligations. The legal bases are Article 6(1)(b), (c) and (f) GDPR. Contract and accounting records are retained for the applicable statutory periods, generally six, eight or ten years; account data is retained until deletion unless orders require longer storage.

5. Payments

Depending on the payment method selected, the data required to process payment is disclosed to the relevant bank or payment provider. PrestaShop Checkout may involve PrestaShop S.A., 4 rue Jules Lefebvre, 75009 Paris, France, and PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. When a cart or checkout page is opened, technical resources may already be retrieved from the PrestaShop-provided domain assets.prestashop3.com; this transmits connection data including the IP address, referrer, and browser/device information. Bank transfers are processed through the participating banks. Providers process payment, connection, and fraud-prevention data under their own privacy notices. The legal basis is Article 6(1)(b) GDPR for pre-contractual steps and payment processing and Article 6(1)(f) GDPR for a secure, functional checkout and fraud prevention.

6. Contact, support and withdrawal requests

If you contact us or use the withdrawal form, we process your name, email address, order reference, message, attachments provided voluntarily and the associated account/order history. This is used to answer the request, identify the purchase and document its handling (Article 6(1)(b), (c) and (f) GDPR). Support and withdrawal messages can be stored with the order. Please do not send special-category personal data or unnecessary secrets in attachments.

7. Email delivery

Incoming email is handled through Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands. Technical and transactional outgoing email may be delivered through Sand Dune Mail Ltd (SMTP2GO), 96–106 Manchester Street, Christchurch 8011, New Zealand. The providers process addresses, headers, delivery metadata and, where technically necessary, message content. New Zealand benefits from an EU adequacy decision. SMTP delivery logs are normally kept for up to 35 days.

8. Newsletter

If you subscribe to a newsletter, we process your email address and evidence of subscription on the basis of consent (Article 6(1)(a) GDPR). We send a verification email after signup and activate the subscription only after the confirmation link is clicked (double opt-in). The signup and confirmation data required as evidence is logged. You may withdraw consent at any time through the unsubscribe function or by contacting us. Proof of consent may be retained for limitation periods so that we can demonstrate lawful subscription.

9. Consent settings

Our consent tool stores whether necessary, analytics, functional and marketing categories were accepted or rejected. To demonstrate the choice, we log the consent version, categories, language, time, an internal customer or guest ID where available, and a salted one-way hash of the IP address. The legal bases are Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR and Article 6(1)(f) GDPR. Records are reviewed and deleted when no longer needed, normally after the applicable three-year limitation period. Settings can be changed at any time using the floating privacy button.

10. Google Analytics 4

If Google Analytics is configured and you consent to analytics, this shop uses Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google tag is blocked before consent. When enabled, Google may process online identifiers, cookie identifiers, abbreviated IP and approximate location information, device/browser data, visited pages, referrer, interactions, ecommerce events and transaction/product data. We do not deliberately send names, email addresses or full billing details to Analytics.

The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Typical cookies are _ga and _ga_<container-id>, generally for up to two years. Google Analytics data retention is configured for no longer than 14 months where the setting applies. You can withdraw consent at any time in the privacy settings; this does not affect processing before withdrawal.

Google may process data in the United States. Transfers are safeguarded, as applicable, by the EU-US Data Privacy Framework and/or EU standard contractual clauses. More information is available in Google’s privacy policy.

11. Recipients and international transfers

Data is disclosed only where necessary to hosting, IT, email, payment, accounting and support providers, professional advisers, public bodies where legally required, and analytics providers after consent. Processors are contractually bound. For transfers outside the EEA we use an adequacy decision, the EU-US Data Privacy Framework or standard contractual clauses as applicable.

12. Your rights

Subject to the legal requirements, you have rights of access, rectification, erasure, restriction, portability and objection. You may withdraw consent at any time with effect for the future. Where processing is based on legitimate interests, you may object for reasons arising from your particular situation. Contact info@waldbyte.de.

13. Complaints and automated decisions

You may complain to a data-protection authority, in particular the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, poststelle@lfdi.bwl.de. We do not use solely automated decision-making that produces legal or similarly significant effects.

14. Product reviews

When you submit a product review, we process the name you provide, review title, star rating, comment, the relevant product and, for signed-in customers, an internal customer link. After moderation, the name, title, rating and comment are published on the product page. The legal bases are Article 6(1)(b) GDPR for the requested publication and Article 6(1)(f) GDPR for moderation and abuse prevention. Reviews remain published until deleted or no longer needed; legally required evidence may be kept longer.

15. Changes

We update this notice when services, providers or legal requirements change. The version published here applies.