Privacy

Who is responsible

Scar's Sticker Shop c/o Leon Sibum, Margeritenstraße 52
49733 Haren
Deutschland, mail@scar-printing.de

What is stored, and why

Orders: name, contact (e-mail and/or Telegram username), delivery address or the con for the handover, your notes and remarks on designs, the artists you name for your designs and the files you upload, to make your stickers and get in touch with you (Art. 6(1)(b) GDPR). Uploaded files are processed automatically on this server to create cut lines and small previews; they are not passed on.

Telegram: if you sign in or connect an order, your Telegram ID, first name, username and language, to send you updates through the bot (Art. 6(1)(b) GDPR). Signing in on the website goes through Telegram's login page (oauth.telegram.org); Telegram then tells this shop your ID, name and username and, if you allow it, lets the bot message you (once, right after your first sign-in). Telegram messages are delivered by Telegram (Telegram FZ-LLC, Dubai); their privacy policy applies there. You can turn updates off at any time (/stop in the bot, or in your account) and delete your account.

Telegram sticker packs: if you send the bot a sticker or a link to a pack, the pack's name, title and list of stickers are stored with your account, so you can choose from them on the order form (Art. 6(1)(b) GDPR). The stickers are fetched from Telegram through the bot and kept on this server for up to 7 days; the stickers you order are stored like uploaded files. The list of your packs is deleted 30 days after you last sent the pack, when you remove a pack yourself, and with your account.

Reviews: if you review a completed order, the stars, your text, the name you enter (none if you publish anonymously) and a photo if you add one. They are published with your consent (Art. 6(1)(a) GDPR) after I have checked them. Photos are stored anew, without location and other metadata. You can change or delete your review on your order's page at any time; deleting your account deletes your reviews too.

Server logs: requests are logged without IP addresses. For protection against abuse, IP addresses are kept in memory only for a few minutes and never written to disk (Art. 6(1)(f) GDPR).

Cookies: only what is needed: your language, and a session cookie when you sign in (plus a short-lived one while the Telegram sign-in runs). No tracking, no analytics, no external fonts or scripts. Inside Telegram, Telegram's Mini App script is loaded from telegram.org.

How long

Uploaded files, their previews and cut files: deleted 90 days after an order is completed or cancelled. Cancelled orders: deleted after 30 days. Completed orders: name, contact, address, artist names and remarks on designs are deleted after 1095 days; what remains is needed for accounting. Reviews: until you delete them or ask me to. Backups: a daily copy of the database stays on the server for 14 days; a weekly encrypted copy of the database and the files is kept off the server for up to 90 days, so deleted data can remain in backups that long. Sign-in sessions expire after 30 days.

Hosting

The shop runs on a server in Germany (netcup GmbH, Karlsruhe), under a data processing agreement.

Your rights

You have the right to access (your account offers a download of your data), rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), and to lodge a complaint with a data protection supervisory authority. Write to the contact above.