DSE
Privacy policy
Updated September 25, 20262 min read
What personal data we process, why, on which legal basis and for how long.
⚠ Draft template — must be reviewed by a lawyer before launch.
The German version is legally binding.
1. Controller#
[Firmenname / Inhaber:in], Viktoriastraße 2b, 32545 Bad Oeynhausen — legal@haihastore.com
Data protection officer: [Datenschutzbeauftragte:r — falls benannt]
2. Visiting the website#
When you visit the site, our hosting provider processes technical data (IP address, date and time, page requested, browser) to deliver the site and keep it secure. Legal basis: Art. 6 (1) (f) GDPR. Server logs are deleted after 14 days at the latest.
3. Member account#
For your account we store your name, email address, password (only as a secure hash), preferred language and — if you give it — your birthday. We use this data to provide the account, stamps and rewards. Legal basis: Art. 6 (1) (b) GDPR.
4. Orders and payment#
To process orders we need your contact details, the items ordered and, for shipping, your address. Payment data is processed directly by our payment providers; we never see or store full card numbers. Invoices are kept for 10 years because of tax law (§ 147 AO).
6. Service providers#
We use carefully selected processors bound by data processing agreements (Art. 28 GDPR):
- Hosting: [Vercel Inc. / Cloudflare, Inc.]
- Database: [Turso / ChiselStrike Inc.], EU region
- File storage: [Cloudflare R2], EU jurisdiction
- Email: [Resend]
- Payments: see the payment provider policy
Where data is transferred to the USA, this is based on the EU–US Data Privacy Framework or on standard contractual clauses.
7. Your rights#
You have the right to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent at any time. See our GDPR page for how to use them. You may also complain to a data protection supervisory authority.