Datenschutz

Privacy Policy

1. Principles of Data Processing


The protection of your personal data is very important to us. We want you to know what data we collect, how we use it, and what rights you have regarding your data.

Personal data refers to all information relating to an identified or identifiable natural person (e.g., name, address, email address, IP address). Information that cannot be related to your person is not considered personal data.

We process personal data exclusively within the framework of the legal provisions of the GDPR and only when this is necessary – for example, to provide our website, to fulfill contractual obligations, or based on your consent. As soon as the purpose of processing no longer applies and no legal retention obligations exist, the data will be deleted.

This privacy policy explains what data we process when you use our website, for what purposes this is done, on what legal basis it occurs, and how long the data is stored. It also informs you about your rights as a data subject.

Please note: This privacy policy applies exclusively to our own website. We assume no responsibility for the content and data protection practices of external sites to which we merely link. Please inform yourself directly on the respective pages about their privacy policies.

 

2. Responsible Body


The party responsible for data processing on this website is:

Kunst mit Freude x Joy Dahlmann KMF x Joy Studio Owner: Joy Dahlmann Hammer Straße 17 59269 Beckum

📧 Email: joy@kunst-mit-freude.com 🌐 Website: www.joydahlmann.de

 

3. Hosting & Server Log Files


Our website is operated via the service provider Shopify International Ltd., 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. The technical infrastructure and hosting services are provided by Shopify Inc., 151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada.

Shopify stores data on servers in various data centers, including in Canada, the USA, and the European Union.

Canada has an adequacy decision from the European Commission according to Art. 45 GDPR, ensuring an adequate level of data protection. For data transfers to other third countries, Shopify relies on appropriate safeguards, in particular standard contractual clauses of the EU Commission.

A data processing agreement in accordance with Art. 28 GDPR is in place with Shopify.

a) Type of data processed

When you access our website, technical information transmitted by your browser to the server is automatically collected. This includes:

  • IP address

  • Date and time of access

  • Referrer URL (previously visited page)

  • Browser type and browser version

  • Operating system

  • Access status / HTTP status code

This data is technically necessary to provide the website and ensure system security.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in a secure and functioning website). Storage period: The data will be deleted as soon as it is no longer required for the purpose of collection.

 

4. Cookies


Our website uses cookies to provide basic shop functions and – if you consent – to enable analytics, marketing, and convenience features.

Cookies are small text files that are stored on your device and saved by your browser. They serve to make our offer more user-friendly, effective, and secure.

Since our website is operated via Shopify, some cookies are set directly by Shopify International Ltd., Dublin, Ireland, or Shopify Inc., Canada.

Further information on Shopify cookies can be found here:
https://www.shopify.com/legal/cookies

Types of Cookies

Technically necessary cookies
These cookies are required for the website to function correctly. This includes, for example, functions such as:

  • Shopping cart

  • Login status

  • Security settings

  • Checkout process

Without these cookies, the operation of the online shop cannot be guaranteed.

Typical Shopify cookies may include, for example:

  • _session_id – Stores session information

  • _shopify_visit – Captures visitor information

  • _shopify_uniq – Counts customer visits

  • cart – Stores shopping cart contents

  • secure_session_id – Security in checkout

Analytics Cookies

Analytics cookies help us understand how visitors use our website. This allows us to improve our offerings and our website.

These cookies collect, for example:

  • Page views

  • Time spent on site

  • Visitor origin

  • Interactions with the website

These cookies are only used with your consent via our cookie consent tool.

Marketing and Social Media Cookies

Marketing cookies can be used to display personalized advertising to visitors on websites.

Social media cookies enable, for example:

  • sharing content via social networks

  • integrating social media functions

These cookies are also only set with your consent.

Cookie Settings

When you first visit our website, you can select which cookies may be set via our cookie banner.

You can change or revoke your consent at any time.

In addition, you can set your browser to:

  • block cookies

  • allow cookies only in individual cases

  • delete cookies automatically when the browser is closed

Please note that disabling cookies may limit the functionality of our website.

Legal Bases

  • Art. 6 para. 1 lit. f GDPR – Processing of technically necessary cookies (legitimate interest in operating the website)

  • Art. 6 para. 1 lit. a GDPR – Processing of cookies requiring consent (consent via the cookie banner)

5. Data Processing for Orders & Contract Fulfillment


If you order products (e.g., artworks, prints, or other items), we process the data required for this purpose:

  • Name

  • Address

  • Email address

  • Phone number (if provided)

  • Payment information

Purpose: Order processing, delivery, invoicing. Legal basis: Art. 6 para. 1 lit. b GDPR (contract fulfillment). Storage period: Until the contract is fulfilled and according to legal retention periods (e.g., HGB, AO).

 

6. Payment Providers

We offer various payment methods in our shop.

PayPal

We use PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg as a payment service provider.
When selecting the PayPal payment method, the data required for the payment process is transmitted to PayPal.

This includes, in particular:

  • Name

  • Billing address

  • Email address

  • Payment information

  • Transaction data

  • IP address

The processing takes place for the execution of the payment process.

Further information can be found in PayPal's privacy policy.

Legal basis: Art. 6 para. 1 lit. b GDPR (contract fulfillment).

Shopify Payments

For credit card and other electronic payments, we also use Shopify Payments, a payment service of Shopify International Ltd., 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, Ireland.

The payment processing is technically carried out by Shopify Inc., 151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada.

The following data may be processed, among others:

  • Name

  • Billing address

  • Email address

  • Payment information (e.g., credit card data, encrypted)

  • Transaction data

  • IP address

Shopify Payments may involve other payment service providers or banks for payment processing. Data may also be transferred to countries outside the European Union.

Canada has an adequacy decision from the European Commission according to Art. 45 GDPR, ensuring an adequate level of data protection. For further data transfers, Shopify uses appropriate safeguards such as the EU Commission's standard contractual clauses.

Further information can be found in Shopify's privacy policy.

Legal basis: Art. 6 para. 1 lit. b GDPR (execution of the payment process).

 

7. Contact (Form & Email)


If you contact us via the contact form or email, we process the data you provide exclusively to handle your inquiry.

Processed data may include:

  • Name

  • Email address

  • Content of your message

Legal bases:

  • Art. 6 para. 1 lit. a GDPR (consent for the contact form)

  • Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to inquiries)

Storage period: The data will be deleted as soon as your inquiry has been conclusively processed, provided there are no legal retention obligations.

 

8. Newsletter


If you subscribe to our newsletter, we will use your data exclusively for sending information about our offers, products, and news.

The registration takes place using the double opt-in procedure. This means that after registration, you will receive an email in which you must confirm your registration. Only after this confirmation will your email address be added to our mailing list.

For sending our newsletter, we use the Shopify Email function, a service of Shopify International Ltd., 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, Ireland.

The technical provision is carried out by Shopify Inc., 151 O’Connor Street, Ground Floor, Ottawa, Ontario, Canada.

The following data may be processed:

  • Email address

  • Name (if provided)

  • IP address at the time of registration

  • Date and time of registration

  • Information about opening and clicking emails (for statistical evaluation)

This data is used to send the newsletter and to statistically evaluate newsletter usage.

Canada has an adequacy decision from the European Commission according to Art. 45 GDPR, ensuring an adequate level of data protection.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent).

You can unsubscribe from the newsletter at any time via the unsubscribe link in each email or by sending us a message. Your data will then be deleted, provided there are no legal retention obligations.

 

9. Social Media


We operate online presences on social networks to inform about our services and products and to communicate with interested parties.

You can find our profiles on the following platforms:

  • Instagram – Provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

  • Facebook – Provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

When you visit our social media profiles, personal data is processed by the respective platform operators. This may include, in particular:

  • IP address

  • Usage data

  • Device information

  • Interactions with posts

This data may also be used for market research and advertising purposes. Further information on data processing can be found in the privacy policies of the respective providers.

If content from Instagram is embedded on our website or if there is a link to our social media profiles, a connection to Meta's servers may be established when this content is accessed.

Web analysis

Our website uses web analysis functions to better understand user behavior and optimize our offerings.

The following data may be processed in particular:

  • IP address (shortened/anonymized)

  • Page views

  • Time spent

  • Device type and browser information

Processing only takes place with your consent via our cookie consent tool.

Legal basis: Art. 6 para. 1 lit. a GDPR (consent).

Further information on data processing by Google can be found here:
https://policies.google.com/privacy

 

10. Web analysis


To analyze user behavior, we may use Google Analytics (Google Ireland Ltd.). Google uses cookies to create anonymized statistics about the use of our website.

It cannot be ruled out that data will be transferred to the USA. Google is certified under the EU-U.S. Data Privacy Framework.

Legal basis: Art. 6 para. 1 lit. a GDPR (your consent via the cookie banner).

You can withdraw your consent at any time via the cookie settings.

11. Rights of data subjects

According to the General Data Protection Regulation, you have the following rights:

  • Right to information about the processed data (Art. 15 GDPR)

  • Right to rectification of inaccurate data (Art. 16 GDPR)

  • Right to erasure ("right to be forgotten", Art. 17 GDPR)

  • Right to restriction of processing (Art. 18 GDPR)

  • Right to data portability (Art. 20 GDPR)

  • Right to object to certain processing (Art. 21 GDPR)

  • Right to withdraw consent (Art. 7 para. 3 GDPR)

  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

 

Competent supervisory authority in NRW:

State Commissioner for Data Protection and Freedom of Information NRW Kavalleriestraße 2–4 40213 Düsseldorf 📞 0211 38424‑0 📧 poststelle@ldi.nrw.de

12. Disclosure of data to third parties

We only transmit personal data to third parties if:

a) You have given your express consent (Art. 6 para. 1 lit. a GDPR), b) the disclosure is necessary for the fulfillment of the contract (Art. 6 para. 1 lit. b GDPR), c) we are legally obliged to do so (Art. 6 para. 1 lit. c GDPR), d) the disclosure is necessary for the protection of legitimate interests and there is no overriding protective interest (Art. 6 para. 1 lit. f GDPR), e) we use processors according to Art. 28 GDPR (e.g. hosting service providers, payment providers).

Legally obliged recipients may include tax authorities, social security institutions, supervisory authorities or law enforcement agencies.

 

13. Data security


We implement technical and organizational measures to protect your data from loss, misuse or unauthorized access. These include, among others:

  • SSL or TLS encryption

  • Access restrictions

  • Regular security checks

Please note that the transmission of data via e-mail without encryption can entail security risks. We assume no liability for unencrypted communication.

 

14. Changes to this privacy policy


We reserve the right to adapt this privacy policy as required, e.g. in the event of new legal requirements or changes to our services. The current version can always be found on this website.

 

15. Your rights in detail

 

Within the framework of the General Data Protection Regulation (GDPR), you, as the data subject, have the following rights:

Withdrawal of consent (Art. 7 para. 3 GDPR)
You can revoke a given consent at any time with effect for the future.

Right to information (Art. 15 GDPR)
You have the right to request information as to whether we process personal data concerning you. If this is the case, you have a right to information about this data and to further information in accordance with Art. 15 GDPR.

Right to rectification (Art. 16 GDPR)
You have the right to demand the immediate rectification of inaccurate or the completion of your personal data stored by us.

Right to erasure (Art. 17 GDPR)
You can demand the erasure of your personal data, provided that no legal retention obligations or other legitimate reasons oppose such erasure.

Right to restriction of processing (Art. 18 GDPR)
You have the right to demand the restriction of the processing of your personal data, provided that the legal requirements for this are met.

Right to data portability (Art. 20 GDPR)
You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format or to request the transmission to another controller, insofar as this is technically feasible.

Right to object (Art. 21 GDPR)
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 para. 1 lit. e or f GDPR. Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing for such marketing.

Automated individual decision-making (Art. 22 GDPR)
Decision-making based solely on automated processing – including profiling – does not take place unless explicitly stated otherwise.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. For example, the
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia is responsible.

Exercising your rights
To exercise your rights, you can contact us at any time using the contact details provided in the imprint.