Privacy policy

When a page is accessed, the respective server automatically processes: IP address, date and time, page accessed, amount of data transferred, browser and operating system, and the previously visited page (referrer). We need this data to deliver the site, to operate it stably and securely and to detect attacks. It is not merged with other data and is deleted after 30 days at the latest, unless it is needed as evidence of an attack.

Legal basis: Art. 6 (1) (f) GDPR.

The website and the configurator (pages, preview, price calculation, template upload, forms, generation of production files) run at Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel is certified under the EU-US Data Privacy Framework; in addition the EU Commission’s standard contractual clauses apply; the data processing agreement is part of the Vercel contracts. More: vercel.com/legal/privacy-policy.

Shop, customer account and checkout run on the Shopify platform of Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes the data on our behalf; a data processing agreement pursuant to Art. 28 GDPR is part of the Shopify terms of service (Data Processing Addendum). Shopify may also process data in Canada and the USA; this is covered by an adequacy decision of the EU Commission (Canada) and the EU Commission’s standard contractual clauses as well as certification under the EU-US Data Privacy Framework (USA). More: shopify.com/legal/privacy.

We set strictly necessary cookies and similar storage without consent: for the cart, the checkout, the customer account, the language choice, session security and for your cookie decision itself. They are required to run the shop.

Legal basis: § 25 (2) no. 2 TDDDG, Art. 6 (1) (f) GDPR.

So that nothing you entered gets lost, the website keeps some information in your browser’s storage. It stays on your device and is only transmitted when you send it – for example when you click “Buy now”:

• your cart and your order note – until you buy or remove them
• your last configuration on the “Made to measure” page – 30 days
• the checkout you last started, so that the cart is empty after the purchase – at most seven days
• the welcome code from the newsletter sign-up – 30 days or until you buy
• your view in the installation guide (exact cut or cut it yourself)
• only until you close the tab: the PPF Advisor conversation, your answers in the film assistant and an unsent form draft (at most 24 hours)

You can delete this information at any time by clearing the site data in your browser.

All other cookies and identifiers – for statistics and marketing, see section 5 – are set only with your consent via the cookie banner. You can choose statistics and marketing separately. We store your decision in your browser for one year; via “Cookie settings” at the bottom of the page you can change it or withdraw it with effect for the future at any time.

Without consent, Meta Pixel and Microsoft Clarity do not load. Google Analytics and Google Ads then run in “consent mode”: without cookies and without storing a user identifier; Google only receives cookieless signals from which it models aggregate figures.

Legal basis: § 25 (1) TDDDG, Art. 6 (1) (a) GDPR.

• page views and events such as “configurator started”, “added to cart” or “checkout opened” with shape, film and amount
• when you search, the event “search” with the number of results; Google Analytics also receives the search term in simplified form – we do not pass on terms containing email addresses or long sequences of digits
• approximate location (from the IP address), device and browser
• a random identifier in a cookie

We do not pass on names, addresses, email addresses, messages or uploaded templates to these services.

Legal basis: Art. 6 (1) (a) GDPR.

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics does not store IP addresses. The identifier is passed along in the link when you move to the checkout so that the purchase can be attributed to the same visit. Google retains the data for at most 14 months. Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework.

Google Ireland Limited, address as above. We measure whether an enquiry or order follows a click on one of our ads (conversion tracking) and may address visitors again with ads later (remarketing). Google sets its own cookies for this and links the data to your Google account if you are signed in there.

Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel reports page views and the events listed above to Meta so that Meta can measure the effect of our ads on Facebook and Instagram and build audiences. For the collection we are jointly responsible with Meta (Art. 26 GDPR, Meta’s controller addendum); Meta is responsible for the further processing. Data may be transferred to the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how visitors use the site – clicks, scrolling, mouse movements – and turns this into session recordings and heatmaps. Input in form fields is masked before transmission. Data may be transferred to the USA; Microsoft Corporation is certified under the EU-US Data Privacy Framework.

When you order, we process: name, billing and delivery address, email address, telephone number if provided, the items ordered, your payment method (not the payment data itself) and your configuration – shape, dimensions, film type, cutting option, any uploaded template and your order note if you write one in the cart. Without this information we cannot cut and deliver the film. You receive the order confirmation and the shipping notification by email from Shopify.

Legal basis: Art. 6 (1) (b) GDPR.

From the configuration we automatically generate a cutting file (DXF) and a dimension sheet (PDF). Both are assigned to the order in Shopify and sent by email to our production. The dimension sheet contains the order number, dimensions, your name (or your email address if there is no name) and your order note so that production cuts the part correctly and can match it to the parcel.

We send this email and all other emails from this website that do not come from Shopify via Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) on the basis of the EU Commission’s standard contractual clauses. Which emails these are is listed in section 11.

Payment is processed via the payment service providers offered at checkout. You enter your payment data (card number, account details, credentials for a payment account) directly with the respective provider; we do not receive it, only the confirmation of payment. The provider processes the data under its own responsibility according to its privacy notice, which is shown to you at checkout.

Legal basis: Art. 6 (1) (b) GDPR.

For shipping we pass on your name, delivery address and – if you provide them – your email address or telephone number for delivery notifications to the commissioned carrier.

Legal basis: Art. 6 (1) (b) GDPR.

If you write to us by email or via the contact form, we store your details and the message in order to answer the enquiry. Enquiries from the form reach us as an email via Resend; an attached photo is forwarded without its metadata (such as location and camera). We delete the enquiry as soon as it has been dealt with and no statutory retention obligations prevent this.

If a request via the form is not sent (for example without a connection), the text fields you entered remain in your browser’s session storage for up to 24 hours so that you can send them again after reloading. They do not leave your browser and are deleted when you close the tab; attachments are not stored.

Legal basis: Art. 6 (1) (b) or (f) GDPR.

If you declare a withdrawal via the withdrawal function, we process your name, email address, order number and your details about the order in order to handle the withdrawal and confirm its receipt to you. We send the confirmation via Resend to your email address and in copy to us.

Legal basis: Art. 6 (1) (b) and (c) GDPR.

If you check your order status, we compare the order number and email address with the order in our shop and show you only its status and tracking. We do not store these details for this; to prevent misuse, we count requests per IP address for a short time in memory.

Legal basis: Art. 6 (1) (b) GDPR; prevention of misuse: (f).

If you sign up for our newsletter, we first send you an email with a confirmation link via Resend. Only once you confirm the subscription on our site do we store your email address, the time of confirmation and your consent as a customer record at Shopify and send you the newsletter with Shopify Email.

If you do not confirm, we store nothing: the link in the email carries your address with our signature and expires after seven days. To prevent misuse, we count sign-ups per IP address and per email address for a short time in memory.

Legal basis: Art. 6 (1) (a) GDPR; prevention of misuse: (f).

You can unsubscribe at any time – via the link at the end of every newsletter email or by sending us a message. We keep the record of your consent for as long as we send you the newsletter and afterwards for as long as we need to be able to prove the consent.

You can withdraw consent at any time with effect for the future (Art. 7 (3) GDPR): for statistics and marketing via “Cookie settings” at the bottom of the page, for the newsletter via the unsubscribe link in every email – or by sending us a message.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, datenschutz.hessen.de.