Privacy policy

1. Controller

The controller responsible for data processing on this website is:

2. Summary

• This website does not set cookies of its own, uses no analytics or tracking tools and shows no ads.
• Fonts, images and videos are loaded directly from this website – without Google Fonts, YouTube or similar services.
• Only you can load the Spotify player on the Aveltuna page – with a click. Until then, no data is sent to Spotify.
• Personal data is only processed when you visit the website (technically necessary data at the host), load the Spotify player, order a book via PayPal, send me an email or withdraw from a purchase online.

3. Hosting and visiting the website

This website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit it, Cloudflare processes technically necessary data to deliver the pages and protect them against attacks: your IP address, date and time of access, the requested address, the referring page and information about your browser and operating system.

The legal basis is my legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR). A data processing agreement is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework, so transfers to the USA are based on the European Commission’s adequacy decision (Art. 45 GDPR).

I do not analyse this data myself. To protect against attacks, Cloudflare may set technically necessary cookies (for example “__cf_bm”) on the basis of Section 25(2) no. 2 TDDDG. See Cloudflare’s privacy policy.

4. Fonts, images and videos

All fonts, images and videos are hosted on this website itself. No data is sent to third parties such as font providers or video platforms when they are displayed.

5. Spotify player (playlist)

On the Aveltuna page you can listen to my playlist in an embedded Spotify player. The player is only loaded when you click “Load Spotify player”; before that, no data is sent to Spotify. From the click onwards, Spotify receives, among other things, your IP address, information about your browser and device and the address of the page, and Spotify may use cookies and similar technologies. If you are logged in to Spotify, Spotify can link the visit to your account.

The provider is Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It only applies to the current page view: if you reload the page, the player stays off until you click again. According to Spotify, transfers to countries outside the EU are based on adequacy decisions or the European Commission’s standard contractual clauses. See Spotify’s privacy policy.

6. Orders via PayPal and shipping

The PayPal checkout is only loaded when you click “Order now” on the Books page. From that moment on, data is sent to PayPal, including your IP address and information about your browser and device, and PayPal may set cookies. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract that you initiate yourself); for PayPal’s cookies, Section 25(2) no. 2 TDDDG.

PayPal processes your payment data as an independent controller; seePayPal’s privacy statement.

After an order, PayPal sends me your name, delivery address, email address and the order details. I use them to process the order and ship the book (Art. 6(1)(b) GDPR). For delivery, I pass your name and address to Deutsche Post. I keep order and invoice data for as long as commercial and tax law requires (Art. 6(1)(c) GDPR) and delete it afterwards.

You are not obliged to give me any data. Without a name and address, however, I cannot send you a book.

7. Contact by email

If you write to me, I process your email address and your message in order to reply – for questions about an order on the basis of Art. 6(1)(b) GDPR, otherwise on the basis of my legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

My emails run through Gmail (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Data may also be processed in the USA; Google is certified under the EU-US Data Privacy Framework. SeeGoogle’s privacy policy. I delete messages once they have been dealt with and no retention obligation applies.

8. Online withdrawal

If you withdraw from a purchase using the “Withdraw from contract” function, I process your name, your order details, your email address and the date and time of receipt. This is necessary to handle the withdrawal and to send you the confirmation of receipt required by law (Art. 6(1)(c) GDPR in conjunction with Section 356a BGB).

The function opens your email app with a prepared message to me; nothing is sent until you send it yourself. I keep the details for as long as necessary to process the withdrawal and to meet statutory retention obligations.

9. Links to other services

I link to my Discord server and to my playlist on Spotify and on YouTube. These are plain links: no data is transferred until you click them. After that, the privacy policy of the respective service applies –Discord,Spotify orGoogle (YouTube).

10. Your rights

You have the right of access to your stored data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). An email to me is enough.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example in your place of residence.