Privacy policy
Privacy policy
Controller
4REACT (to be completed in Settings), –, shop@4react.com
What we process and why
- Order and contract performance (Art. 6(1)(b) GDPR): name, email address, billing address and country, for businesses company and VAT ID, products ordered, payment status. For physical products the delivery address.
- Payment (Art. 6(1)(b) GDPR): payment is processed by Stripe Payments Europe Ltd. You enter your payment details only at Stripe; we do not receive or store them.
- Invoicing and statutory retention (Art. 6(1)(c) GDPR): we keep order and invoice data for ten years (Section 147 AO, Section 257 HGB).
- Downloads (Art. 6(1)(b) and (f) GDPR): we log the time and a salted hash of your IP address to enforce download limits and prevent abuse. We delete this after 90 days.
- Security and abuse protection (Art. 6(1)(f) GDPR): Cloudflare Turnstile checks at checkout and sign-in that a request comes from a human.
- Order emails (Art. 6(1)(b) GDPR): order confirmation, invoice, refund, shipping and withdrawal acknowledgement. We only send marketing emails with your separate consent.
- Passwordless customer account (Art. 6(1)(b) GDPR): sign-in via a one-time link sent by email.
Recipients
Cloudflare, Inc. / Cloudflare Germany GmbH (hosting, database, storage in the EU, delivery, Turnstile), Stripe Payments Europe Ltd. (payments), Microsoft Ireland Operations Ltd. (email delivery), tax adviser (bookkeeping, order and invoice data only). Data processing agreements or statutory bases are in place. Where data is transferred to third countries such as the USA, this is based on the EU-US Data Privacy Framework or standard contractual clauses.
Cookies
We only set strictly necessary cookies (cart, sign-in). No consent is required for these under Section 25(2) TDDDG. We use no analytics or advertising cookies.
Retention
We delete carts after 30 days, anonymise abandoned orders after 30 days, and sign-in links and sessions expire after a short time. Order and invoice data is kept for ten years because of statutory duties and then deleted.
Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR). Contact shop@4react.com. You also have the right to lodge a complaint with a data protection supervisory authority.
No automated decision-making
We do not use automated decision-making, including profiling.