Privacy policy

1. Controller

The controller under the GDPR is DiLight Entertainment UG (haftungsbeschränkt), Waldstraße 15, 82024 Taufkirchen, Germany, email info@dilight.website.

2. Visiting this website

The web server processes technically necessary data your browser sends (IP address, date and time, page requested, referrer, browser and operating system) in server logs, to deliver the website, keep it secure and find errors (Art. 6 (1) (f) GDPR). Logs are deleted once no longer needed for these purposes. Fonts, images and videos are served from our own server; we use no analytics or advertising services.

3. Technically necessary cookies

“csrftoken” protects forms against forged requests; “lang” stores the language. If you sign in, sign-in cookies recognise you until you sign out or they expire. None of them is used for analytics or advertising (§ 25 (2) no. 2 TDDDG, Art. 6 (1) (f) GDPR).

4. Cart

Your browser keeps the models and quantities in your cart in local storage on your device; they are not sent to our server until you go to checkout (§ 25 (2) no. 2 TDDDG).

5. Orders and payment

When you go to checkout, we store the order (models, quantities, prices, time and, if you are signed in, your account) on our server and forward you to our shop’s checkout at Shopify (Shopify International Limited, Victoria Buildings, 2nd floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland), where you enter the details needed for order, payment and delivery. Legal basis: Art. 6 (1) (b) and (c) GDPR. Shopify may also process data in Canada and the USA (EU-US Data Privacy Framework or standard contractual clauses). See shopify.com/legal/privacy. We keep order data as long as commercial and tax law requires.

If you pay with a card, Apple Pay or Google Pay, we forward you with the order (order number, items, amount) to the payment page of Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. If you pay with PayPal, to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. There you enter your payment details and your delivery and billing address. Stripe and PayPal tell us whether the payment succeeded and pass on name, email address, phone number (if given) and the delivery address, which we store with the order to deliver and invoice it. Legal basis: Art. 6 (1) (b) and (c) GDPR. Stripe and PayPal process payment data under their own responsibility and may also process data in the USA (EU-US Data Privacy Framework or standard contractual clauses); see stripe.com/privacy and paypal.com/de/legalhub/privacy-full.

6. Optional customer account

If you create an account, we store your email address, a username and your password (only as an irreversible hash). The account is optional; you can order as a guest. You can have it deleted at any time by writing to us (Art. 6 (1) (b) GDPR).

7. Contact form and email

When you write to us, we store your details (topic, name, email, message and, if given, your practice, studio or school) and, to prevent abuse, time, IP address, browser identifier and the page the form was sent from, to handle your enquiry (Art. 6 (1) (b) or (f) GDPR). We delete them once your enquiry is settled, unless statutory retention applies.

8. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR). A message to the address above is enough. You may also complain to a supervisory authority; ours is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.

The German version of this privacy policy is legally binding.