DRAFT - taken from the legal pack of 05/10/2026. Have a lawyer check it, then delete this line.
Datenschutz (Privacy Policy)
1. Who is responsible
The controller under the General Data Protection Regulation (GDPR) is FluidAffection, Inh. Marcello Sortino Souza, Casinostrasse 59, 56068 Koblenz, Germany, e-mail: hello@allergictodigital.com. We have not appointed a data protection officer.
2. Visiting the website
When you visit our website, your browser sends technical data to our server, including your IP address, so that we can deliver the pages to you. Our server may keep technical access logs for security and for finding faults. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running a secure website).
We measure visits without cookies. We do not store your IP address for statistics. From technical data of your visit, our server computes a one-way code that changes every day. We store only this code and the two-letter country code. The code cannot be traced back to you and cannot be used to recognise you on another day. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing how the website is used).
We use no advertising cookies and no third-party tracking tools. Fonts and images are served from our own server.
3. Cookies
Pages with a form set a session cookie that protects the form against forgery (CSRF protection). It is strictly necessary for the form to work and is deleted when you close your browser. Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.
Our statistics cookie "atd_v" is optional. It is stored for 13 months and only if you accept it in the cookie banner. Legal basis: your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, using the cookie settings on our website, and you can delete the cookie in your browser.
4. Reservation, order and payment
When you reserve a camera, we process your name, e-mail address, delivery address, your message and, if you give it, your telephone number. The telephone number is optional. We use this data to handle your reservation, to calculate the shipping cost, to send you the total and the payment details, to conclude and perform the purchase contract, to ship the camera, to deal with a withdrawal or a warranty claim, and to keep our accounts. Legal basis: Art. 6(1)(b) GDPR (contract and steps before the contract) and Art. 6(1)(c) GDPR (tax and commercial law obligations). Without the required data we cannot accept a reservation.
A reservation is not a purchase and does not cost anything. If you do not pay within 72 hours of receiving the total, the reservation ends. We may keep the record of an unpaid reservation as long as needed to deal with questions and to prevent abuse (see the section Fraud prevention).
If you pay by bank transfer, we receive from our bank (N26) your name, your account details and the payment reference. If you pay with PayPal, we receive from PayPal your name, e-mail address, the amount and the order number you enter in the note.
We keep order data and accounting records for as long as the law requires: generally 8 years for accounting vouchers such as invoices and bank statements, 10 years for books and annual accounts and 6 years for business correspondence (§ 147 AO, § 257 HGB). After the retention period ends, we delete or anonymise the data.
5. Contact by e-mail
If you write to hello@allergictodigital.com, we process your e-mail address, your message and the data you give in it to answer you. Legal basis: Art. 6(1)(b) GDPR if your message concerns a contract or a reservation, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). We delete the correspondence when the matter is finished, unless we must keep it by law.
6. Newsletter and waiting list
If you join our newsletter or waiting list, we use your e-mail address (and your name if you give it) to send you the information you signed up for. We use a double opt-in: we send you a confirmation e-mail and only add you after you click the link. We keep a record of your sign-up and confirmation as proof of your consent. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw at any time with effect for the future, using the link in every e-mail or by writing to us. We then remove you from the list and keep only the data we need to prove the consent and to make sure you receive nothing more (Art. 6(1)(f) GDPR).
7. Who receives your data
Hosting. Our website and its database run on a server of Hostinger International Limited, located in Frankfurt am Main, Germany. Hostinger processes the data on our behalf under a data processing agreement (Art. 28 GDPR).
E-mail. We send and receive e-mails (reservation confirmations, payment details, tracking information, newsletters) through the Private Email service of Namecheap, Inc., Phoenix, Arizona, USA (SMTP server mail.privateemail.com). Namecheap processes the content and the connection data of these e-mails on our behalf under a data processing agreement (Art. 28 GDPR). See section 8 on the transfer to the USA.
Payment. If you pay with PayPal, your payment data are processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, which is responsible for its own processing under its privacy policy. If you pay by bank transfer, the payment goes through our bank, N26 Bank, Berlin, Germany. Legal basis: Art. 6(1)(b) GDPR.
Shipping. To deliver your camera we give your name, delivery address and, where the carrier needs it for the delivery, your e-mail address or telephone number to DHL (DHL Paket GmbH, Bonn, Germany, and the DHL Group companies involved in international delivery). For deliveries outside the EU, data from the customs declaration are also given to the customs authorities. Legal basis: Art. 6(1)(b) GDPR.
Video. See section 9.
We do not sell your data and we do not pass it on to other third parties unless the law requires it.
8. Transfers outside the EU
Namecheap, Inc. is based in the USA. For the processing of our e-mails, we rely on the Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR), which are part of Namecheap's data processing addendum. You can get a copy by writing to us.
If you order a camera for delivery to a country outside the EU, we and the carrier must transmit your name and address to the carrier and the customs authorities of that country to deliver the goods. Legal basis: Art. 49(1)(b) GDPR (performance of the contract).
9. YouTube video
Some product pages contain a test video from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the privacy-enhanced mode (youtube-nocookie.com). The video is not loaded when you open the page. It loads only after you click play. Before that click, no data is sent to YouTube. By clicking play, you consent to the loading of the video, and your IP address and information about your device are transmitted to Google, which may also store or read information on your device and process data in the USA. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw your consent at any time by closing the video and deleting the data stored by your browser. Google LLC takes part in the EU-US Data Privacy Framework.
10. Your rights and complaints
You have the right to access (Art. 15 GDPR), correction (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object at any time to processing based on our legitimate interests (Art. 21 GDPR), and you can withdraw a consent at any time with effect for the future. Legal retention periods can limit erasure. To use your rights, write to hello@allergictodigital.com.
You may complain to a data protection authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.
Fraud prevention
To protect the shop and its buyers against abuse, a reservation is checked automatically: the email address is compared with a list of throw-away mailbox providers and with a blocklist kept by the shop owner, and the number of reservations from the same connection and email is counted using the one-way code described above. A suspicious reservation is held for a manual check before payment details are sent. Legal basis: legitimate interest in preventing fraud, Art. 6(1)(f) GDPR.
Access, deletion and retention
On request, the shop owner sends you a copy of all data held about you, or anonymises it. Data that tax law requires the shop to keep for a sale (order, address and payment records) is kept for that period, with marketing use switched off, and anonymised afterwards.