Privacy Policy

Governing language

This English version is provided for convenience only. The German version of this document is the legally binding version; in the event of any discrepancy or dispute, the German text prevails.

Introduction

Morax Studios takes the protection of your personal data seriously. This Privacy Policy describes which data we process when you visit the website and place an order, what we use it for, how long we retain it and what rights you have. We comply with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Our principles

We process data only where there is a legal basis for doing so: for the performance of a contract with you (Art. 6(1)(b) GDPR), on the basis of legal obligations (point (c)), on the basis of a legitimate interest such as the security of the website (point (f)), or with your consent (point (a)). We collect only what we need for the respective purpose, keep the data up to date and protect it by technical and organisational measures. We do not sell data and do not use advertising networks.

Controller

The controller responsible for data processing on this website is:

Morax Studios GmbHIsabell Schreiber

Your rights

You have the right at any time to

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (“right to be forgotten”, Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw consent you have given, with effect for the future (Art. 7(3) GDPR).

To exercise these rights, an informal message to us is sufficient. We will respond within one month.

Which data we collect

Order data: name, email address, telephone number, delivery address or Packstation, products ordered, payment method and order number. Payment data (PayPal account, bank details, wallet addresses) is processed by the respective payment service providers; we store only the payment status and, for bank transfers, additionally the sender’s name and IBAN from the account statement as well as any proof of payment you upload voluntarily.

Technical data: When you access the website, our server automatically processes your IP address, date and time, the page accessed, browser and operating system. This log data serves security and error analysis and is deleted after no more than 14 days.

Partner accounts: For participants in the partner programme we store name, email address, partner code, referred orders and payout details.

Support: the content of your enquiries to us, including your contact details.

What we use the data for

• processing and shipping your order and reconciling payments,
• answering enquiries and handling complaints,
• settling the partner programme,
• fulfilling retention obligations under commercial and tax law,
• fraud prevention and security of the website,
• anonymised usage statistics, but only with your consent via the cookie banner.

We do not send newsletters or advertising without your express consent.

Storage and security

All data is stored exclusively on servers within the European Union.

Transmission is encrypted via TLS (https). Access to order data and uploaded proof of payment is restricted to the persons who need it for processing.

Retention periods

• order and invoice data: 10 years (Section 147 AO, Section 257 HGB),
• proof of payment (uploads): until the order is completed, at the latest after 30 days,
• server log data: 14 days,
• support enquiries: until final processing, then deletion,
• partner accounts: until participation is terminated, settlement data 10 years,
• cookie consent: 12 months.

Cookies

We use technically necessary cookies. We use statistics cookies only with your consent. Which cookies these are, how long they are stored and how you can change your selection at any time is described in our Cookie Policy.

Third-party providers

PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg): When you pay via PayPal, we transmit the order number and amount; PayPal informs us of the payment status. PayPal’s privacy notice applies.

Crypto payment service provider (based in the EU): processing of crypto payments. The order number, amount and payment address are processed; no personal data. Transactions are publicly visible on the respective blockchain.

DHL (Deutsche Post AG): For delivery, DHL receives your name and delivery address or Packstation details.

Data processing agreements pursuant to Art. 28 GDPR are in place with all service providers that process data on our behalf as processors. We do not use Google services, Meta Pixel or other tracking providers.

Data transfers to third countries

Your data remains in the EU or the EEA. Should a payment service provider transfer data to a third country, this is done on the basis of an adequacy decision or the standard contractual clauses of the European Commission.

Minors

Our offer is directed exclusively at persons aged 18 and over. We do not knowingly collect data from minors; should we become aware of such data, we will delete it immediately.

Supervisory authority

If you believe that we are not processing your data lawfully, you may lodge a complaint with the data protection supervisory authority responsible for you (Art. 77 GDPR). We would appreciate it if you contacted us first so that we can resolve the matter directly.

Changes

We update this Privacy Policy when our processes or the legal situation change. The current version, with its date, can always be found on this page.

Contact

For questions about data protection and to exercise your rights:

Morax Studios GmbHIsabell Schreiber

You can reach us at any time via the contact options in the shop.