Last updated: November 1, 2026
1. Controller
Burak Basci, trading as benotable Art, Witte-Wie 18, 44892 Bochum, Germany, email burakbascishop@gmail.com, phone +49 1590 2640684 (“we”). We have not appointed a data protection officer as there is no legal obligation to do so.
2. Overview of processing
| Purpose | Data | Legal basis (GDPR) | Recipients |
|---|---|---|---|
| Visiting the website, security | IP address, date/time, requested page, browser data (server log files, stored for a short period) | Art. 6 (1) (f) – secure and stable operation | Hosting provider Hetzner |
| Order processing and delivery | Name, billing and shipping address, email, phone (optional), order contents, payment status | Art. 6 (1) (b) – contract | Printify and print provider, carriers, payment providers |
| Payment | Payment data entered with the provider, order amount, email, address | Art. 6 (1) (b), (f) – fraud prevention | Stripe, PayPal, Klarna, Amazon Pay |
| Customer account | Name, email, password hash, order history | Art. 6 (1) (b) – contract / (a) – consent | Hosting provider |
| Contact and support | Name, email, message content, order number | Art. 6 (1) (b), (f) | Mail server (Hetzner infrastructure) |
| Accounting and tax | Invoice and order data | Art. 6 (1) (c) – legal obligation (HGB, AO, UStG) | Tax advisor, tax authorities |
| Design tool and community gallery | Uploaded images and texts, design data, chosen display name | Art. 6 (1) (b); gallery publication: Art. 6 (1) (a) – consent | Hosting provider; public if you publish |
| Newsletter (optional) | Email address, consent record (text, times, pseudonymised IP hash), confirmation status | Art. 6 (1) (a) – consent; (f) – proof of consent | Email hosting provider (Hetzner) |
| Discount offers | Short note in the cart session that you came from a Pinterest offer; pseudonymised hash of the email address for welcome codes | Art. 6 (1) (b), (f) | Hosting provider |
| Reach measurement (only with consent) | Pages visited, clicks on selected page elements, hovering, scroll depth, internal search terms, checkout field focus, cart and order events (no name, address or email), referring domain, browser, operating system, device, screen, language, country, pseudonymous visit ID (derived from IP address and user agent; the IP address is not stored) | Art. 6 (1) (a) GDPR, § 25 (1) TDDDG – consent | Own server at Hetzner (self-hosted Umami), no third party |
3. Hosting
The website is hosted on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data centres in Germany/EU). We have a data processing agreement with the provider. Server log files are processed to deliver the site and ensure security.
4. Orders and shop (WooCommerce)
We use the shop software WooCommerce on our own server. We process the data you enter in the checkout to carry out your order, to send confirmations and to meet bookkeeping duties. Guest orders are possible; a customer account is optional. Order and invoice data must be kept for up to 10 years under commercial and tax law (§ 257 HGB, § 147 AO); all other data is deleted when it is no longer needed.
5. Fulfilment: Printify and print providers
Our products are produced and shipped by print providers connected through Printify. To fulfil your order we transmit your name, shipping address, email address, phone number if provided, and the ordered products (including User Content you uploaded for a personalised product) to Printify (Printify, Inc. and its group companies) and to the print provider that produces and ships your order. Print providers are often located in the USA or other third countries. Where the recipient is in a country without an EU adequacy decision, transfers are protected by EU standard contractual clauses or the EU–US Data Privacy Framework where the recipient is certified. Carriers receive the delivery data they need to deliver the parcel.
6. Payment providers
We offer payment via Stripe (cards, Apple Pay and Google Pay where your device supports them, Link, Klarna, Amazon Pay, BLIK, EPS and Bancontact) and PayPal. Your payment data is entered directly with the provider; we do not store full card numbers or PayPal login data. The providers process data as independent controllers or as our processors for fraud prevention, risk assessment and legal duties. Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland (and Stripe, Inc., USA); privacy information at stripe.com/privacy. PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg; privacy information at paypal.com/privacy. The payment scripts of Stripe (js.stripe.com) and PayPal (paypal.com) are only loaded in the cart and at checkout (we measured that product, collection and other pages load no third-party scripts and set no third-party cookies). Stripe’s express payment buttons can additionally load the Apple Pay script (applepay.cdn-apple.com, Apple Distribution International Ltd., Ireland) and Stripe’s bot protection hCaptcha (hcaptcha.com, Intuition Machines, Inc., USA), which may set the cookies __cf_bm, __cflb and hmt_id. When these scripts load, the providers receive your IP address and device information and may set or read identifiers (for Stripe for example the cookies __stripe_mid and __stripe_sid, valid 1 year and 30 minutes) to prevent fraud and to process the payment securely. Access to this information is technically required for the payment you request and for fraud prevention (§ 25 (2) no. 2 TDDDG); the subsequent processing is based on Art. 6 (1) (b) and (f) GDPR. Transfers to the USA are covered by the EU–US Data Privacy Framework and/or standard contractual clauses.
Klarna, Amazon Pay, BLIK, EPS, Bancontact. If you choose one of these methods in the checkout, it is processed through Stripe together with the respective provider: Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden), Amazon Pay (Amazon Payments Europe S.C.A., Luxembourg), BLIK, EPS (Austrian bank transfer) or Bancontact (Belgian bank payment). Depending on the method, the provider or your bank receives the data needed to process the payment (such as name, email, billing and delivery address, order amount and, for Klarna, order details) and may carry out identity, risk or credit checks under its own privacy policy; you then authorise the payment with the provider or your bank. We do not receive your bank login or card data. Legal basis: Art. 6 (1) (b) GDPR (performing the contract), for fraud prevention also (f). Scripts of these providers are loaded by Stripe only in the checkout (see above for the legal basis of access to your device).
7. Emails
Transactional emails (order confirmation, shipping notice, password reset, replies to enquiries) are sent through the authenticated mail server we use for this shop (operated on Hetzner infrastructure in the EU). The recipient’s mail provider receives the content of the email. Emails are transport-encrypted where supported by the recipient’s server. Order emails and the newsletter are sent through the SMTP service of our email hosting provider (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany), with which we have a data processing agreement (Art. 28 GDPR); the content and the recipient’s address are processed only for delivery. Our emails contain no tracking pixels and no click tracking. We do not send reminder emails for abandoned carts.
8. Cookies and similar technologies
Essential shopping cookies and local storage entries include: woocommerce_cart_hash and woocommerce_items_in_cart (session cookies that keep your cart), wp_woocommerce_session_* (cart session, 48 hours), wordpress_logged_in_* (only if you log in) and, in your browser’s local/session storage, cart data and a security token of the shop (storeApiCartData, storeApiNonce). In addition, the payment providers described in section 6 (Stripe, PayPal, hCaptcha as part of Stripe’s fraud and bot protection) may set cookies or read identifiers as soon as you open the cart or the checkout, not earlier. They are legally permitted without consent under § 25 (2) no. 2 TDDDG and are deleted when the session ends or after the stated lifetime. In addition, our site stores two short-lived flags in your browser’s session storage (keys bbIntro and bbVT) to show the page-load animation only once per visit and to animate page transitions. They contain no personal data, are not sent to us or to any third party and are deleted when you close the tab; they are strictly necessary for the display functions you requested (§ 25 (2) no. 2 TDDDG). If you switch the size unit (cm or inches) on a product page, our site stores that choice in your browser’s local storage (key bbUnit, value cm or in) so that it also applies on other product pages. It contains no personal data, is not sent to us or to any third party and stays on your device until you delete it in your browser data; it is strictly necessary for the display function you requested (§ 25 (2) no. 2 TDDDG). If you arrive through a link from Pinterest with a Pinterest offer (see section 15), a short note about this is kept in the cart session (wp_woocommerce_session_*, at most 2 days). We do not use advertising trackers or load third-party analytics. Our reach measurement (section 16) is off unless you allow it under “Privacy choices”. Your choice (allow or reject) is kept for about 180 days in your browser’s local storage (key bb-statistics-choice-v1); only if you allow statistics, a signed first-party cookie bb_insights is additionally set for at most 30 minutes. Without your consent no statistics script is loaded and nothing is measured. Third-party payment services are described above.
9. Design tool and community gallery
Images, text and design data you upload or create in our design tool are stored on our server to provide the tool and to fulfil your order. If you choose to publish a design in the community gallery, it is visible to all visitors together with the display name you provide. You can ask us to remove it at any time. Please do not upload personal data of other people without their consent. Uploaded images are checked by us only manually where needed (for example after a complaint). See also section 9 of our Terms of service.
10. Withdrawal function
If you use our online withdrawal function (“Withdraw from contract”) we process your name, order number, email addresses and the details you enter, store the declaration with the time of receipt as proof and send you an acknowledgement of receipt by email. Legal basis: Art. 6 (1) (c) and (b) GDPR in connection with § 356a BGB. We keep the record for the statutory retention period.
11. Contact form
If you contact us through the contact form or by email, we process your details and message to answer your request. We delete the data when the request is resolved and no statutory retention duty applies. After you send a message we may send an automatic confirmation of receipt to the address you entered; it contains no content of your message, and we send at most one such confirmation per address within 24 hours.
12. Newsletter
If you subscribe to our newsletter, we use your email address to send you information about new designs, products and offers. Subscribing is voluntary. The legal basis is your consent (Art. 6 (1) (a) GDPR); we use no cookies or tracking pixels for this. You can subscribe on our website or by ticking the optional checkbox in the checkout. The checkbox is never pre-ticked, and ordering does not depend on it.
Double opt-in and proof of consent. After signing up we send you a confirmation email. You are only added to the newsletter after you click the confirmation button. To be able to prove your consent (Art. 7 (1) GDPR) we store your email address, the wording of the consent text, the time of the sign-up, the time the confirmation email was sent, the time of your confirmation, and a pseudonymised hash (HMAC-SHA256 with a secret key) of the IP address at sign-up and at confirmation. We do not store the IP address itself. Legal basis for this record: Art. 6 (1) (f) GDPR (our legitimate interest in proving a lawful consent). Sign-ups that are not confirmed are deleted automatically after 30 days.
Welcome discount. After you confirm, we send a one-time discount code. For this, a coupon is created in our shop system. To make sure that every mailbox receives only one welcome code, we keep a pseudonymised value (a keyed hash, HMAC-SHA-256) of your email address next to the code; it is deleted together with the code when we clean up expired codes. Legal basis: Art. 6 (1) (b) and (f) GDPR (delivering the promised benefit and preventing abuse).
Unsubscribe. You can withdraw your consent at any time with effect for the future, using the unsubscribe link in every newsletter (one click on a confirmation button, no login) or by email to burakbascishop@gmail.com. After unsubscribing we keep a minimal record (email address, status, time of consent and unsubscription) for up to three years to prove that we have honoured your objection and to avoid sending you further emails; on request we delete these data completely, unless this would endanger the proof of a lawful consent in a pending dispute.
13. Review request (optional)
If you tick the optional checkbox in the checkout (never pre-ticked, not required for your order), we send you one email asking you to review your order. Legal basis: your consent (Art. 6 (1) (a) GDPR, § 7 (2) no. 3 UWG); you can withdraw it at any time with effect for the future using the unsubscribe link in that email. As proof of consent we store the time and wording of your consent and a pseudonymised hash of your IP address (HMAC-SHA256 with a secret key; not the IP address itself) with the order. The email is sent 7 days after the carrier reports delivery, or, if no delivery is reported, 14 days after the last shipping email, and only once per order; without consent or after withdrawal nothing is sent. It is sent through the SMTP service described in section 7. The email and our pages contain links to the review platform Trustpilot (and possibly Google later). These are plain links: nothing is loaded from or transmitted to these providers and no cookies are set until you click one. After the click you leave our site; the provider’s own privacy policy applies, and we transmit no data to it. If you write a review there, the provider is responsible for the processing of that data.
14. Pinterest links and our Pinterest profile
Our pages contain plain links to our Pinterest profile (pinterest.de/burak_basci), and product pages contain a “Save” link. They are ordinary links: no Pinterest script or content is loaded and no data is sent to Pinterest or its servers until you click one. If you click, you leave our site, and Pinterest Europe Ltd. (Dublin, Ireland) processes your data under its own privacy policy. We also publish product images and links on our own Pinterest account (Art. 6 (1) (f) GDPR, our legitimate interest in advertising our products); on Pinterest, Pinterest is the controller for the data it collects there. Product feeds that we provide to Pinterest and Google contain product data only, no personal data.
15. Discount offers and referral links
Pinterest offer. If you arrive at our shop through a link from Pinterest that contains the parameter utm_source=pinterest, we store in your shopping-cart session (the technically necessary session cookie wp_woocommerce_session_*, deleted after at most 2 days) a short note that you came through this offer. We use it only to apply the advertised discount automatically at checkout, not for analytics or profiling, and we do not pass it on. Legal basis: Art. 6 (1) (b) GDPR (performing the offer you requested); to the extent the session cookie is set before you add anything to your cart, it is strictly necessary to deliver the offer you asked for (§ 25 (2) no. 2 TDDDG).
16. Reach measurement with your consent (self-hosted)
To understand which pages and products are used and where visitors leave the shop, we measure usage – only if you consent. The measurement uses the open-source software Umami, which we run ourselves on our own server at Hetzner (stats.burakbasci.de, Germany). No data is passed to third parties, and no advertising or cross-site tracking takes place. Without your consent no measurement script is loaded, nothing is read from your device and nothing is sent to the statistics system – this includes server-side cart and order events. The same applies if your browser sends a Do-Not-Track or Global-Privacy-Control signal, or if the opt-out cookie bbs_off (set by an earlier version of this page) is present.
Your choice. A banner (“Privacy choices”) asks whether you allow statistics. “Allow statistics” is your consent; “Reject statistics” keeps the measurement off. Your choice is kept for about 180 days in your browser’s local storage (key bb-statistics-choice-v1) so we do not ask on every page; this entry is strictly necessary to honour your choice (§ 25 (2) no. 2 TDDDG). If you allow statistics, a signed first-party cookie bb_insights is set for at most 30 minutes; it contains only a coarse source category (for example direct, search, Pinterest) and an expiry time, no identifier. You can change or withdraw your choice at any time with “Privacy choices” in the footer of every page or with the button below. The withdrawal takes effect immediately: the measurement stops and the cookie is deleted.
What is measured with your consent: page views, clicks on selected page elements (for example size options, filters, search, design studio, add to cart), hovering over trust elements, scroll depth (25/50/75/100 %), internal search terms, the name (never the content) of the checkout field last used when leaving the checkout, and cart and order events (order value, number of items, shipping country, payment method; never name, address or email). Sent are the referring website (domain only, without path) and the address of the page you view including selected parameters (such as search term, campaign and filter parameters, but without order keys); the page title is not sent. Stored are browser, operating system, device type, screen size, language, country (city and region are not stored) and a pseudonymous visit ID derived from IP address and user agent; the IP address itself is not stored. Records are deleted after 6 months.
Aggregate counters. With the same consent, our shop additionally counts product views, successful add-to-cart actions, cart views and checkout views in daily counters on our own server, grouped by a coarse source (for example Pinterest, search, email or direct) and, where known, the public product ID. The coarse source may be attached to an order for sales reporting. These counters contain no visitor or session identifier, no IP address, no user agent and no email address. They and the attached source categories are deleted after 90 days.
Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time with effect for the future (Art. 7 (3) GDPR); the lawfulness of the processing until then is not affected. Shopping and checkout remain fully available if you reject. The consent does not cover newsletters, third-party advertising tracking or other analytics services.
17. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. You have the right to lodge a complaint with a supervisory authority; the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. There is no automated decision-making including profiling. Provision of the data required for an order is necessary for the contract; without it we cannot fulfil your order.
18. Changes
We may update this privacy policy when our services or the legal situation change. The current version is published on this page.