Privacy
Privacy notice
This notice explains how personal data is processed when you use the storefront, customer account, checkout and Lightworks Studio.
Last updated 14 August 20261. Controller
Benjamin Nöst - Lightworks Rorichmoorer Str. 76 26802 Moormerland Deutschland Email: kontakt@lightworks.de Phone: 0174 2827317
No data protection officer has been appointed. Privacy requests may be sent to the email address above.
2. Purposes and legal bases
We process personal data only where required to provide the website and its functions, take pre-contractual steps, perform contracts, comply with legal obligations, protect legitimate interests or act on valid consent.
- Article 6(1)(b) GDPR: contracts, orders, customer accounts and pre-contractual inquiries.
- Article 6(1)(c) GDPR: commercial, tax and consumer-law obligations.
- Article 6(1)(f) GDPR: secure and economic operation, abuse prevention, troubleshooting, legal claims and customer service, after balancing the interests involved.
- Article 6(1)(a) GDPR: voluntary publication or other processing for which explicit consent is requested. Consent can be withdrawn for the future at any time.
3. Hosting, delivery and server logs
The application is operated by the following processor: Contabo GmbH, Aschauer Straße 32a, 81549 München, Deutschland.
Each request may process the IP address, date and time, requested URL, referrer, transferred volume, HTTP status, browser, operating system and user agent. This is necessary for delivery, stability, abuse prevention and error diagnosis under Article 6(1)(f) GDPR.
Regular server-log retention: 14 Tage. Security-relevant records may be retained longer where necessary to investigate an incident or pursue legal claims.
For data-minimised audience statistics, previously sanitised server logs may be imported into a self-hosted Matomo installation running on the same server. No Matomo JavaScript is loaded in the browser, Matomo sets no cookies for this purpose and no additional device information is requested. Full IP addresses, URL query parameters and identifiers are removed before import; IP addresses are replaced with at least 0.0.0.0. Personal raw data is retained for no more than six months, after which only aggregated statistics remain. Processing is based on Article 6(1)(f) GDPR and our interest in evaluating shop usage and technical quality in aggregate. You may object on grounds relating to your particular situation.
5. Fonts
The storefront uses local fonts or system fonts available on the visitor's device. It does not retrieve stylesheets or font files from Google Fonts or another external font provider for typography.
6. Catalogue, cart and checkout
Catalogue and cart use processes product and variant choices, quantities, promotion codes, country, cart identifier and necessary technical metadata. Checkout additionally processes email, shipping and optional billing address, phone number, shipping and payment choices, prices, timestamps and the accepted legal-document version.
The legal bases are Article 6(1)(b) GDPR for pre-contractual steps and the contract, and Article 6(1)(c) GDPR for legal evidence and retention duties.
7. Payment processing
We use Stripe for payment processing. Depending on the agreement applicable to Lightworks, the contracting entity is in particular Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Available methods are presented through Stripe's Payment Element in checkout.
Stripe receives payment and billing details entered in the payment form, transaction amount and currency, and device, browser, IP and fraud-prevention data where required for authorisation, settlement, refunds, abuse prevention and legal duties. Our disclosure is based on Article 6(1)(b) GDPR and additionally Article 6(1)(f) GDPR for fraud prevention and operational security. Stripe also processes certain data as an independent controller. Stripe's data processing agreement and data transfer addendum form part of its services agreement. Data may be transferred in particular to Stripe, LLC in the United States and other sub-processors; Stripe identifies the EU-US Data Privacy Framework and EU standard contractual clauses as safeguards. Notices: https://stripe.com/de/privacy and https://stripe.com/de/legal/dpa.
8. Orders, production and delivery
We process order and contact data, product configurations, production files, delivery status and communications to fulfil orders, manufacture and deliver goods and handle complaints, cancellation and returns. Order and shipping processing uses Billbee GmbH, Arolser Str. 10, 34477 Twistetal, Germany. Recipient, address, shipment and communication data required for delivery is disclosed to DHL Paket GmbH or Deutsche Post AG. Processing is based on Article 6(1)(b) GDPR and, for statutory records, Article 6(1)(c) GDPR.
Contract and accounting records are generally retained for six, eight or ten years under applicable German commercial and tax law. Other order data is erased or anonymised once the contract, warranty and possible claims are complete and no retention duty remains.
9. Customer account
Registration and account use process email, password authentication data, name, phone number, saved addresses, order history and account status under Article 6(1)(b) GDPR. Passwords are not displayed in plain text and the session is held in a protected HttpOnly cookie.
You may request account deletion through the privacy contact. Data required by law or needed for legal claims will be restricted rather than erased until those grounds cease to apply.
10. Contact and project inquiries
The contact form processes name, email, optional phone, message, inquiry type, place or motif, format, quantity and voluntarily uploaded reference files in PNG, JPEG or PDF format. Attachments are stored privately, can only be retrieved by authorised staff through inquiry management and are not sent as email attachments. Processing is based on Article 6(1)(b) GDPR for pre-contractual inquiries and otherwise Article 6(1)(f) GDPR for orderly business communication.
Inquiries not followed by an order are generally erased after twelve months after the inquiry is closed, unless consent or a legal obligation permits longer retention.
The electronic cancellation function processes your name, email address, order number or other contract identifier, cancellation statement, receipt time and technical delivery status. Processing is necessary to perform and document the cancellation under Article 6(1)(b) and (c) GDPR. Unless these details form part of records that must be retained for the contract, the retention periods described for the relevant order apply.
11. Transactional email and Brevo
Order, shipping, cancellation, service and inquiry emails are sent through Brevo. Depending on the contracting entity shown in the Brevo account, processing is carried out in particular by Brevo GmbH or Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. Recipient address, name, order or inquiry reference and message content are transmitted under Article 6(1)(b) GDPR and, for internal routing and operational security, Article 6(1)(f) GDPR. Brevo states that it processes data on servers in the European Union. The data processing agreement must be accepted in the Brevo account.
In explicitly enabled development outbox mode, email content is stored for no more than seven days in a private local directory and is deleted automatically. This mode is not intended for production.
12. Lightworks Studio and Mapbox
Studio processes the selected place and map view, format, material, accessories, text, pins and technical configuration. A share link stores the configuration under a random code while its edit token is stored only as a hash. An order creates an immutable production snapshot under Article 6(1)(b) GDPR.
Studio share links that are not connected to an order or catalogue product are deleted automatically twelve months after the last change. Ordered configurations are retained with the order data for the periods stated there.
Maps, geocoding and map data are loaded from Mapbox, Inc. This may transmit IP address, device and browser information, search terms, map position, zoom, token and usage data. The request occurs only when the expressly requested Studio is used and is necessary to provide the requested map function under Article 6(1)(b) GDPR. Mapbox states that data is processed in particular in the United States and relies on the EU-US Data Privacy Framework and, where required, EU standard contractual clauses. Notices: https://www.mapbox.com/legal/privacy and https://www.mapbox.com/legal/dpa.
13. Voluntary Studio feedback
Voluntary feedback processes answers, free text, the current Studio step and configuration categories, user agent and browser language. It is not used for automated individual decisions. The legal basis is Article 6(1)(a) GDPR and consent may be withdrawn for the future.
Feedback is generally erased or anonymised after twelve months.
14. Reviews
For a native review, we verify the customer account, fulfilled order and eligibility. We store rating, title, text, name, internal customer and order reference, moderation status and timestamps. Only approved content, the first name, abbreviated last name and verified-order label are public. Publication is based on explicit consent under Article 6(1)(a) GDPR, which can be withdrawn for the future.
Imported Etsy reviews remain clearly labelled. Etsy source references and technical import data are processed internally to document provenance and avoid duplicates.
15. Recipients and international transfers
Recipients receive data only where necessary for their task. Categories may include hosting and IT providers, email delivery, payment providers, carriers, production partners, tax advisers, authorities and legal advisers. Processors are bound under Article 28 GDPR.
Transfers outside the EU/EEA occur only where Articles 44 et seq. GDPR are satisfied, for example by an adequacy decision or appropriate safeguards such as EU standard contractual clauses and any required supplementary measures.
16. Your rights
Requests may be sent to kontakt@lightworks.de.
- Access (Article 15 GDPR)
- Rectification (Article 16 GDPR)
- Erasure where no overriding ground applies (Article 17 GDPR)
- Restriction (Article 18 GDPR)
- Data portability where applicable (Article 20 GDPR)
- Objection to processing under Article 6(1)(e) or (f) GDPR (Article 21 GDPR)
- Withdrawal of consent for the future (Article 7(3) GDPR)
We do not use solely automated decisions producing legal or similarly significant effects within Article 22 GDPR.
17. Complaint
You may complain to a supervisory authority under Article 77 GDPR, in particular where you live, work or believe an infringement occurred. The authority competent for our establishment is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Deutschland, https://www.lfd.niedersachsen.de.
18. Updates
We update this notice when functions, providers or the law change. The current version and date are published here. Material changes affecting ongoing contractual or consent-based processing will also be communicated appropriately.