Privacy Policy
1. Controller
Maximilian Sperlich
Hagenmattenstr. 31
79117 Freiburg im Breisgau
Germany
Email: krshI27@gmail.com
There is no statutory obligation to appoint a data protection officer.
2. Principles
I process personal data only to the extent necessary to operate this website, to fulfil orders, or to answer enquiries. Depending on the case, the legal bases are Art. 6 (1) (a) GDPR (consent), (b) (contract or pre-contractual steps), (c) (legal obligation) and (f) (legitimate interest in a secure, functioning service).
3. Website hosting
This website runs on Wix. The provider is Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel. Wix processes, on my behalf, all data arising when you visit the website, using its own data centres and sub-processors, including in the United States.
An adequacy decision of the European Commission exists for Israel. For transfers to the United States, Wix relies on the European Commission's Standard Contractual Clauses. A data processing agreement pursuant to Art. 28 GDPR is in place.
Legal basis: Art. 6 (1) (f) GDPR.
4. Server log files
When the website is accessed, data transmitted by your browser is collected automatically: the page requested, date and time, volume of data transferred, referrer, browser type and version, operating system and a shortened IP address. This data cannot be attributed to a specific person by me and serves secure, trouble-free operation. Legal basis: Art. 6 (1) (f) GDPR.
5. Cookies and consent
This website uses cookies. Technically necessary cookies make basic functions such as the shopping cart, language selection and login work; under § 25 (2) TDDDG they are set without consent. All other cookies are only set if you have consented via the cookie banner (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You may withdraw your consent at any time with effect for the future by reopening the cookie settings on this website.
6. Content delivery network
To deliver the website and the associated applications I use Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes visitors' IP addresses in order to deliver content and repel attacks. Cloudflare is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6 (1) (f) GDPR.
7. Contacting me
If you write to me by email or through a form, I process your details in order to handle the enquiry and any follow-up questions. The legal basis is Art. 6 (1) (b) GDPR where the enquiry concerns a contract, otherwise Art. 6 (1) (f) GDPR. I delete the data once the enquiry has been conclusively dealt with and no statutory retention obligations prevent deletion.
8. Customer account and members area
You may create an account. I store the data you provide until the account is deleted. Legal basis: Art. 6 (1) (b) GDPR. An account is not required in order to place an order.
9. Orders and performance of the contract
To process an order I handle your name, delivery and billing address, email address, where applicable your telephone number, and the details of the goods ordered. Legal basis: Art. 6 (1) (b) GDPR. Invoice data is retained for up to ten years under § 147 AO and § 257 HGB; the legal basis for this is Art. 6 (1) (c) GDPR.
The ordering and invoicing process is handled technically through Wix services.
10. Payment processing
Payment is handled through the payment service providers integrated by Wix. You enter your payment details directly with the respective payment service provider; I do not receive full payment data such as card numbers. The payment service provider is independently responsible for that processing. Legal basis: Art. 6 (1) (b) GDPR.
11. Production and shipping through a service provider
Prints and products are not manufactured by me but produced and dispatched by a fulfilment provider on a drop-shipping basis. The provider is Prodigi Group plc, United Kingdom, which also uses production partners at further locations.
So that your order can be delivered, I transmit to this provider your name, delivery address, where applicable your telephone number and email address for shipping notifications, and the order and artwork data. A data processing agreement pursuant to Art. 28 GDPR is in place. An adequacy decision of the European Commission exists for the United Kingdom; where production takes place in a country without an adequacy decision, the transfer is based on the Standard Contractual Clauses.
Legal basis: Art. 6 (1) (b) GDPR.
12. Creative tools on my own servers
Several web applications reachable under karoshirt.art addresses let you generate images. These applications do not run on Wix but on a server I rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, located in Nuremberg. A data processing agreement pursuant to Art. 28 GDPR is in place.
Some of these applications let you upload your own images or photographs for processing. Such files may contain personal data, for example where people are depicted. They are processed solely for the duration of your session in order to compute the requested result, and are neither stored permanently, nor passed to third parties, nor analysed for any other purpose. Please do not upload images to which you hold no rights, or on which third parties are identifiable without their consent.
Legal basis: Art. 6 (1) (b) GDPR, for providing the function you requested.
If you publish a result via a sharing link or a QR code, the data required for this is stored permanently on the same server so that the link remains retrievable. This happens only at your express instruction; legal basis: Art. 6 (1) (a) GDPR.
13. Blog
Articles on this website are provided through the Wix blog function. Where a comment function is active, your name, email address and the text of the comment are stored. Legal basis: Art. 6 (1) (a) GDPR.
14. Support and donation link
The page footer contains a link to an external support service. Data is only transmitted to that provider once you click the link; that provider's own privacy policy applies to its processing.
15. Retention
I store personal data only for as long as is necessary for the respective purpose or as required by statutory retention periods. The data is then deleted or anonymised.
16. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to withdraw consent at any time with effect for the future (Art. 7 (3)).
Right to object: where I process data on the basis of Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
An informal message to krshI27@gmail.com is sufficient to exercise your rights.
17. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for me is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Germany
18. No automated decision-making
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.
19. Changes
I will adapt this privacy policy where the services offered or the legal situation change. The version available on this page at the time applies.
Last updated: September 2026