Privacy Policy

1. Overview

We take the protection of your personal data seriously. This privacy policy explains what data is processed when you visit the alex pfeffer store, why, on which legal basis, how long it is kept, and what rights you have under the EU General Data Protection Regulation (GDPR).

The short version: visiting the Store creates only the technical server logs that any website produces. The Store sets no cookies, runs no analytics and loads no fonts or scripts from third parties. Your cart lives only in your browser. Purchases are not yet available; the section on purchases below describes the processing that will apply once they open.

2. Controller

Email: alex@alexpfeffer.com

There is no legal obligation for us to appoint a data protection officer.

3. Hosting and server logs

The Store is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you open a page, your browser sends a request to Vercel's servers, which process the technical data needed to deliver the page and keep the service secure: your IP address, the date and time of the request, the requested URL, the referring page, your browser type and version, and your operating system.

Vercel keeps this data in server logs for a limited period for security and error analysis and then deletes it. We do not combine it with other data or use it to identify individual visitors.

Legal basis: our legitimate interest in providing a stable and secure website (Art. 6 (1) (f) GDPR). We have concluded a data processing agreement with Vercel. Vercel participates in the EU-US Data Privacy Framework; where data is transferred to the USA, the transfer is based on that framework and on the EU standard contractual clauses included in the agreement.

Vercel's own privacy policy: https://vercel.com/legal/privacy-policy

4. Fonts and scripts

The fonts used by the Store (Manrope and Geist Mono) are served from our own hosting. Your browser does not connect to Google or any other font provider. The Store loads no external scripts, no tracking pixels and no social media plugins.

5. Cart and demo audio in your browser

When you add a product to your cart, the list of product IDs is stored in your browser's session storage. This data stays on your device, is never sent to us, and is deleted automatically when you close the browser tab. It is not a cookie and cannot be used to recognise you.

The interactive AB Player demo on the homepage generates its audio inside your browser. Nothing is recorded, no microphone is accessed, and no audio data leaves your device.

6. Cookies

The Store does not set cookies. Because no cookies or comparable technologies are used, no consent banner is shown.

7. Contact by email

If you contact us by email, we process the data you provide (your email address, your name if given, and the content of your message) in order to handle your request.

Legal basis: performance of a contract or pre-contractual steps (Art. 6 (1) (b) GDPR) where your request concerns a purchase, otherwise our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR).

We delete your messages once your request has been dealt with, unless we are required to keep business correspondence under commercial or tax law (Section 257 HGB, Section 147 AO), in which case it is kept for six or ten years respectively.

8. Purchases and download access

To sell you a product we will process your name, email address, billing address and country (needed to calculate VAT), the products ordered, the price paid, the payment status and a transaction reference. Payment details such as card numbers or PayPal credentials are entered directly with the payment service provider and are never stored by us.

To give you access to your downloads, we will store the email address used at checkout and, when you request access, send a one-time verification code to it and record the time of the request and the IP address it came from. This protects your purchases from being retrieved by someone else.

Legal basis: performance of the contract (Art. 6 (1) (b) GDPR) and, for invoice data, our legal obligation to keep accounting records (Art. 6 (1) (c) GDPR).

Order and invoice data is kept for ten years from the end of the year of purchase (Section 147 AO). Verification codes expire after a short time and are then deleted; access logs are kept for a limited period for security purposes.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15 GDPR),
• request correction of inaccurate data (Art. 16 GDPR),
• request deletion of your data (Art. 17 GDPR),
• restrict processing of your data (Art. 18 GDPR),
• receive your data in a portable format (Art. 20 GDPR),
• object to processing based on our legitimate interest (Art. 21 GDPR),
• withdraw any consent you have given, with effect for the future (Art. 7 (3) GDPR),
• lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise these rights, email alex@alexpfeffer.com. The supervisory authority responsible for us is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, https://datenschutz-hamburg.de. You may also contact the authority of your own place of residence.

10. Changes to this policy

We update this policy when the Store changes, for example when purchases open or a new service provider is added. The date at the top shows the current version.