Privacy policy

Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide the data will have no consequences. This applies only insofar as no other information is provided for the processing activities described below.

“Personal data” means any information relating to an identified or identifiable natural person.

SERVER LOG FILES

You can visit our websites without providing any information about yourself.

Each time our website is accessed, usage data is transmitted to us or to our web host / IT service provider by your Internet browser and stored in protocol data (so-called server log files). The data stored includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider.

The processing is based on Art. 6 para. 1 lit. f GDPR, due to our overriding legitimate interest in ensuring the trouble-free operation of our website and improving our services.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. An adequacy decision by the European Commission exists for Canada. For the USA, an adequacy decision by the European Commission also exists, namely the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those provided for by the European Commission’s Standard Contractual Clauses.

CONTACT

DATA CONTROLLER

You may contact us at any time. The controller responsible for data processing is:

Ellen Schiller
Falltorgasse 2
97246 Eibelstadt
Germany
+4917657741169
info@sunshinepuzzles.de

CUSTOMER-INITIATED CONTACT BY EMAIL

If you contact us proactively by email in the context of a business relationship, we collect your personal data (name, email address, message content) only to the extent provided by you. The processing of this data serves to process and respond to your inquiry.

If the contact is made for the purpose of taking pre-contractual measures (e.g. advice regarding a purchase inquiry, preparation of an offer) or concerns a contract already concluded between you and us, the processing of this data is based on Art. 6 para. 1 lit. b GDPR.

If the contact is made for other reasons, the processing of this data is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6 para. 1 lit. f GDPR.

We use your email address only to process your inquiry. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

COLLECTION AND PROCESSING OF DATA WHEN USING THE CONTACT FORM

When you use the contact form, we collect your personal data (name, email address, message content) only to the extent provided by you. The processing of this data serves the purpose of contacting you.

We use your email address only to process your inquiry. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

ORDERS

COLLECTION, PROCESSING AND DISCLOSURE OF PERSONAL DATA WHEN PLACING ORDERS

When you place an order, we collect and process your personal data only to the extent necessary to fulfil and process your order and to handle your inquiries. The provision of the data is necessary for the conclusion of the contract. Failure to provide the data means that no contract can be concluded. The processing is based on Art. 6 para. 1 lit. b GDPR and is necessary for the performance of a contract with you.

Your data will be disclosed to the extent necessary for the performance of the contract to the payment service providers selected by you, shipping and transport service providers, service providers involved in order processing, accounting and tax service providers, and IT service providers. The scope of the data transferred is limited to what is necessary for the respective purpose.

For orders to foreign countries, shipping is handled by our shipping service provider Pakajo. For this purpose, the personal data required for shipping and delivery is transmitted to Pakajo. Pakajo may forward the necessary data to the respective delivery service providers used, for example DHL, for the purpose of delivery.

ACCOUNTING AND TAX PROCESSING VIA ACCOUNTABLE

For the accounting and tax processing of our company, we use the Accountable service provided by Accountable SA, Square Victoria Régina 1, 1210 Saint-Josse-ten-Noode, Belgium.

To the extent that personal data of customers, suppliers or other business partners is processed in Accountable as part of accounting and tax processing, this may include, in particular, names, addresses, email addresses, invoice and receipt data, payment information and other information contained in accounting documents.

The processing is carried out to fulfil statutory tax and commercial obligations and to carry out and manage our business relationships, based on Art. 6 para. 1 lit. c GDPR and, insofar as the processing is necessary for the performance of the contract, on the basis of Art. 6 para. 1 lit. b GDPR.

Accountable processes personal data insofar as such data is entered or uploaded by us into the Accountable app, acting as a processor pursuant to Art. 28 GDPR. A data processing agreement has been concluded for this purpose.

Further information on data processing by Accountable can be found in Accountable’s privacy policy.

ADVERTISING

USE OF EMAIL ADDRESS FOR NEWSLETTER DISTRIBUTION

We use your email address, independently of contract processing, exclusively for our own advertising purposes to send newsletters, provided that you have expressly consented to this. The processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of your consent before its withdrawal. You can unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by contacting us. Your email address will then be removed from the mailing list. Despite being removed from the mailing list, we may continue to store your email address on a so-called blacklist in order to prevent you from receiving newsletter emails from us again in the future. This storage is based on Art. 6 para. 1 lit. f GDPR due to our legitimate interest and your legitimate interest in preventing the renewed use of your email address for sending our newsletter. You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.

REVIEWS

USE OF JUDGE.ME

We use the “Judge.me” review system provided by Judge.me Ltd (c/o Buckworths 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB; “Judge.me”) on our website.

Judge.me enables us to collect customer reviews and display them on our website in order to provide you with insight into the quality of our services.

After placing an order, you may receive an invitation from us or Judge.me to submit a review and may then provide a review. In this context, the following data may be processed by us and/or Judge.me: email address, name, telephone number, address, information about your device (IP address, information about your web browser and the operating system used), information about the purchased product or service used (order number, product details), the content of your review and the star rating you provide, as well as your product photos or videos (if you have attached them to your product review). This data may also be used, where applicable, to verify the authenticity of your review.

Judge.me uses technologies such as cookies.

Your data may be transferred outside the EU to the United Kingdom. An adequacy decision by the European Commission exists for the United Kingdom.

Your data may be transferred to the USA. An adequacy decision by the European Commission exists for the USA, namely the Trans-Atlantic Data Privacy Framework (TADPF). Judge.me is not certified under the TADPF. This data transfer is based on specific contracts approved for use in the United Kingdom and offering the same level of protection as personal data receives in the United Kingdom.

The use of cookies or comparable technologies is based on your consent pursuant to Section 25 para. 1 sentence 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. The processing of your personal data is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR, insofar as you have expressly consented to the transfer of your data and to receiving the review request. You may withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of your consent before its withdrawal.

Further information on data protection when using Judge.me can be found in Judge.me’s privacy policy.

REVIEW REMINDER

After your order, we would like to ask you to review your purchase from us. For this purpose, we use your personal data (name, email address, order information), independently of contract processing, to send you a review reminder by email after a completed order, provided that you have expressly consented to this.

The processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You may withdraw your consent at any time using the corresponding link in the email or by contacting us.

SHIPPING SERVICE PROVIDERS

DISCLOSURE OF EMAIL ADDRESS TO SHIPPING COMPANIES FOR SHIPPING STATUS INFORMATION

As part of contract processing, we may disclose your email address to the shipping company used if this is necessary to inform you about the shipping status and delivery and you have given your consent to this.

For orders to foreign countries, shipping is handled by Pakajo. Pakajo may transmit the data required for shipping to the respective shipping service providers used, such as DHL, for the purpose of delivery.

The processing of the email address for the purpose of providing shipping status information is based on Art. 6 para. 1 lit. a GDPR, insofar as consent is required for this purpose. You may withdraw your consent at any time by contacting us or the respective shipping service provider.

Insofar as the transfer of personal data to the shipping service provider is directly necessary for the fulfilment of the purchase contract and delivery, the processing is based on Art. 6 para. 1 lit. b GDPR.

PAYMENT SERVICE PROVIDERS

USE OF PAYPAL EXPRESS

We use the PayPal Express payment service provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg; “PayPal”) on our website.

The processing of data serves the purpose of enabling you to make payments using the PayPal Express payment service. To integrate this payment service, PayPal may collect, store and analyse data when you access the website, such as your IP address, device type, operating system, browser type and information about the device used. Cookies may also be used for this purpose. Cookies enable your browser to be recognised.

The processing of your personal data is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in offering a customer-oriented range of payment methods. You have the right to object at any time, on grounds relating to your particular situation, to this processing of your personal data.

When selecting and using PayPal Express, the data required for payment processing is transmitted to PayPal in order to fulfil the contract with you using the selected payment method. This processing is based on Art. 6 para. 1 lit. b GDPR.

Further information on data processing by PayPal can be found in PayPal’s privacy policy.

USE OF PAYPAL CHECKOUT

We use the PayPal Checkout payment service provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg; “PayPal”) on our website.

When selecting and using payment via PayPal, credit card via PayPal, direct debit via PayPal or “Pay Later” via PayPal, the data required for payment processing is transmitted to PayPal in order to fulfil the contract with you using the selected payment method. This processing is based on Art. 6 para. 1 lit. b GDPR.

Cookies may be stored to enable recognition of your browser. The resulting data processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in offering a customer-oriented range of payment methods. You have the right to object at any time, on grounds relating to your particular situation, to this processing of your personal data.

CREDIT CARD VIA PAYPAL, DIRECT DEBIT VIA PAYPAL & “PAY LATER”

For certain payment methods such as credit card via PayPal, direct debit via PayPal or “Pay Later” via PayPal, PayPal reserves the right to obtain a credit assessment based on mathematical-statistical procedures using credit agencies.

For this purpose, PayPal transmits the personal data required for the credit assessment to a credit agency and uses the information received regarding the statistical probability of payment default to make a balanced decision regarding the establishment, performance or termination of the contractual relationship.

The credit assessment may contain probability values or scores calculated on the basis of scientifically recognised mathematical-statistical procedures, in which address data may also be taken into account. Your legitimate interests are taken into account in accordance with the statutory provisions.

The processing of data serves the purpose of assessing creditworthiness for the initiation of a contract. The processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in protecting ourselves against payment defaults when PayPal makes an advance payment.

You have the right to object at any time, on grounds relating to your particular situation, to this processing of your personal data based on Art. 6 para. 1 lit. f GDPR by notifying PayPal.

The provision of the data is necessary for the conclusion of the contract using the payment method you have selected. Failure to provide the data means that the contract cannot be concluded using the payment method selected by you.

THIRD-PARTY PROVIDERS

When paying using the payment method of a third-party provider, the data required for payment processing is transmitted to PayPal. This processing is based on Art. 6 para. 1 lit. b GDPR. To process this payment method, the data may subsequently be forwarded by PayPal to the respective provider. This applies in particular to the payment methods and payment service providers offered through PayPal Checkout.

PAYMENT BY INVOICE VIA PAYPAL

When paying by invoice, the data required for payment processing is initially transmitted to PayPal. To process this payment method, the data may subsequently be forwarded by PayPal to the respective payment service provider in order to fulfil the contract with you using the selected payment method.

Further information on data processing when using PayPal’s payment service can be found in PayPal’s privacy policy.

USE OF STRIPE PAYMENT SERVICE

For payment processing in our online shop, we use the payment infrastructure of Shopify Payments, in which Stripe is integrated as a payment service provider and/or banking partner.

When selecting and using the payment methods offered via Shopify Payments, the data required for payment processing is transmitted to the payment service providers involved. This may include, in particular, your name, billing and delivery address, email address, order information, payment information and technical data.

The processing serves to perform and process the purchase contract concluded with you and is based on Art. 6 para. 1 lit. b GDPR.

To prevent fraud and verify payment transactions, additional personal data may be processed and payment and transaction security checks may be carried out.

Where Stripe or other service providers involved in payment processing process personal data in third countries, data transfers are carried out on the basis of the applicable data protection transfer mechanisms.

All Stripe transactions are subject to the privacy policies of the respective provider.

Further information on data processing can be found in the privacy policies of Shopify and Stripe.

COOKIES

Our website uses cookies. Cookies are small text files that are stored in the Internet browser or by the Internet browser on a user’s computer system. When a user visits a website, a cookie may be stored on their operating system. This cookie contains a characteristic string of characters that can enable unique identification of the browser when the website is visited again.

Cookies are stored on your computer. Therefore, you have control over the use of cookies. By selecting the appropriate technical settings in your Internet browser, you can be notified before cookies are set and decide individually whether to accept them, as well as prevent the storage and transmission of the data contained in them. Cookies that have already been stored can be deleted at any time. However, please note that you may then not be able to use all functions of this website to their full extent.

You can find information on how to manage cookies in the most important browsers via the following links:

Chrome: see the provider’s help pages
Microsoft Edge: see the provider’s help pages
Mozilla Firefox: see the provider’s help pages
Safari: see the provider’s help pages

TECHNICALLY NECESSARY COOKIES

Unless otherwise stated in this privacy policy, we use only technically necessary cookies for the purpose of making our services more user-friendly, effective and secure. Cookies also enable our systems to recognise your browser after a page change and provide you with services. Some functions of our website cannot be provided without the use of cookies. For these functions, it is necessary for the browser to be recognised after a page change.

The use of cookies or comparable technologies is based on Section 25 para. 2 TDDDG. The processing of your personal data is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our services.

You have the right to object at any time, on grounds relating to your particular situation, to this processing of your personal data.

USE OF COMPLIANZ GDPR COOKIE CONSENT

We use the Complianz GDPR Cookie Consent plugin provided by iubenda s.r.l. (Via San Raffaele 1, 20121 Milan, Italy; “iubenda”) on our website.

The plugin enables you to give consent to data processing via the website, in particular the setting of cookies, and to exercise your right to withdraw consent that has already been given. The processing of data serves the purpose of obtaining and documenting the necessary consent for data processing and thereby complying with legal obligations. Cookies may be used for this purpose. The following information may be collected and transmitted to iubenda, among other things: a uniquely assignable ID and consent status. This data is not disclosed to other third parties.

The processing of data is carried out to fulfil a legal obligation on the basis of Art. 6 para. 1 lit. c GDPR.

Further information on data protection can be found in Complianz’s privacy policy.

ANALYTICS

USE OF GOOGLE ANALYTICS 4

We use the Google Analytics web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) on our website.

The processing of data serves the purpose of analysing this website and its visitors as well as for marketing and advertising purposes. Google may, on behalf of the operator of this website, evaluate information about the use of the website, compile reports on website activity and provide other services related to website and Internet usage.

The following information may be collected, among other things: IP address, date and time of the page visit, click path, information about the browser and device used, pages visited, referrer URL, location data and purchasing activities.

The IP address is shortened by Google within Member States of the European Union or in other contracting states of the European Economic Area Agreement in advance, insofar as this is provided for by the respective technical configuration.

Google uses technologies such as cookies, browser web storage and tracking pixels, which enable analysis of website usage. The use of cookies or comparable technologies is based on your consent pursuant to Section 25 para. 1 sentence 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR.

The processing of your personal data is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out on the basis of your consent before its withdrawal.

In this context, we also use the Google Signals service. Google Signals enables cross-device tracking if the necessary requirements are met.

Further information on data processing and data protection can be found in Google’s privacy information.

ADVERTISING TRACKING

USE OF META PIXEL

We use the Meta Pixel provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “Meta”) on our website.

Meta and we are joint controllers for the collection of your data and its transmission to Meta in connection with the integration of this service. This joint controllership is based on an agreement between us and Meta concerning the joint processing of personal data.

The application serves the purpose of targeting website visitors with interest-based advertising on the social networks Facebook and Instagram. The tag can transmit to Meta information about which of our pages you have visited. Meta may associate this information with your personal Facebook or Instagram user account.

The application also serves the purpose of creating conversion statistics. We receive statistical information about the use of our advertisements and the actions triggered by them.

Your data may be transferred to the USA. An adequacy decision by the European Commission exists for the USA, namely the Trans-Atlantic Data Privacy Framework (TADPF). Meta is certified under the TADPF.

The processing of your personal data is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR. You may withdraw your consent at any time.

Further information on the collection and use of data by Meta and on your rights can be found in Meta’s privacy information.

USE OF GOOGLE ADS CONVERSION TRACKING

We use the “Google Ads” online advertising programme and, in this context, conversion tracking provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) on our website.

When you click on an advertisement placed by Google, a cookie for conversion tracking may be stored on your computer. If you visit certain pages of this website and the cookie has not yet expired, Google and we can recognise that you clicked on the advertisement and were redirected to this website.

The information collected using the conversion cookie is used to create conversion statistics.

We use the advanced implementation of Consent Mode (“Advanced Consent Mode”). Even if consent has not been given, certain technical signals or “pings” may be transmitted to Google. These may include information such as IP address for deriving the IP country, date and time of the page visit, URL of the pages visited, user agent, referrer URL or information about website events that have been triggered.

Your data may be transferred to Google servers in the USA. An adequacy decision by the European Commission exists for the USA, namely the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF.

You may withdraw your consent at any time.

Further information and Google’s privacy policy can be found in Google’s privacy information.

USE OF GOOGLE FONTS

We use Google Fonts provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) on our website.

The processing of data serves the purpose of ensuring a consistent presentation of fonts on our website. A connection to Google’s servers may be established to load the fonts. In this context, your IP address and information about the browser you use may be processed and transmitted to Google.

Your data may be transferred to the USA. An adequacy decision by the European Commission exists for the USA, namely the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF.

Further information on data processing and data protection can be found in Google’s privacy information.

DATA SUBJECT RIGHTS AND RETENTION PERIOD

RETENTION PERIOD

After the contract has been fully performed, the data is initially stored for the duration of the statutory warranty period and subsequently, taking into account statutory retention obligations, in particular under tax and commercial law, and then deleted once the retention period has expired, unless you have consented to further processing and use.

RIGHTS OF DATA SUBJECTS

Subject to the applicable legal requirements, you have the following rights under Articles 15 to 20 GDPR:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability

In addition, pursuant to Art. 21 para. 1 GDPR, you have the right to object to processing based on Art. 6 para. 1 lit. f GDPR, as well as to processing for the purpose of direct marketing.

USE OF ZIGPOLL

We use Zigpoll, a service provided by Zigpoll Inc., on our website to conduct customer surveys after purchases. In this context, your responses and technical information (e.g. anonymised usage data) are transmitted to and stored on Zigpoll’s servers. Participation in the survey is voluntary. The data collected is used exclusively to improve our services and is not disclosed to third parties.

Further information on data protection at Zigpoll can be found in Zigpoll’s privacy policy.

RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data is not lawful.

You may lodge a complaint, among others, with the supervisory authority responsible for us:

Bavarian State Office for Data Protection Supervision

Postal address:

Postfach 1349
91504 Ansbach
Germany

Telephone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de

RIGHT TO OBJECT

Where the personal data processing described here is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR, you have the right to object to such processing at any time, on grounds relating to your particular situation, with effect for the future.

Following an objection, the processing of the data concerned will be terminated unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

Last updated: 24 September 2026