Privacy notice

1. Controller

Email: support@open-effort.com · Phone: +49 172 3418413

We are not required to appoint a data protection officer.

2. Visiting the shop

When you open our pages, your browser sends technical data: IP address, time, requested address, browser and device information. Cloudflare uses them to deliver the pages and to fend off attacks and abuse. Legal basis: our legitimate interest in a secure, working shop (Art. 6(1)(f) GDPR). Server logs are deleted after at most 14 days.

We use no tracking, analytics, advertising or marketing cookies. Your browser stores only what the shop needs: your language choice (local storage), and during checkout a temporary payment reference in the session storage so a payment is not started twice. These are strictly necessary (§ 25(2) no. 2 TDDDG).

3. Orders and payment

To take and fulfil your order we process your email address, name, delivery address, the items, the amount and the payment status. Legal basis: the contract (Art. 6(1)(b) GDPR) and our tax and commercial retention duties (Art. 6(1)(c) GDPR).

Payments are processed by Stripe. Card and wallet data go directly to Stripe and never reach us. Stripe also processes device and payment data to prevent fraud, as an independent controller. Stripe's privacy policy: stripe.com/privacy.

We pass your name and delivery address to DHL to deliver your parcel. We send order and shipping confirmations by email through Plunk. Without this data we cannot take or deliver your order.

4. Customer account and purchase redemption

You can create an account to redeem a purchase with its order code and decide how your share of the profit is reinvested. We then process your email address, a protected password hash, your language and display settings, the purchases you linked and your investment choices (Art. 6(1)(b) GDPR). Signing in sets a strictly necessary session cookie, valid for up to 7 days. Sign-in, sign-up and password reset are protected against automated abuse by Cloudflare Turnstile, which checks technical browser data (Art. 6(1)(f) GDPR).

Emails about investments are sent only if you switch them on; you can switch them off at any time in your account (consent, Art. 6(1)(a) GDPR). Suggestions you submit are deleted after 90 days unless we adopt them.

You can delete your account at any time in your account settings. We then remove your profile. Records we must keep by law (see section 6) stay, separated from any profile.

5. Contact and withdrawal

If you write to us or call us, we process your message and contact details to answer it and, for withdrawals and claims, to handle the contract (Art. 6(1)(b) GDPR). Business correspondence is kept for 6 years. A declaration made with our online withdrawal function (name, order, email address, items and time of receipt) is stored as such correspondence and confirmed by email; the form is protected by Cloudflare Turnstile.

6. How long we keep data

• Unfinished or cancelled checkouts: customer data deleted 30 days after the checkout ended.
• Orders and payment records: 8 years (booking vouchers, § 147 AO), ledgers 10 years, from the end of the calendar year.
• Delivery data: phone number deleted 30 days after the order is completed (delivered, return period over, no open return); name and address restricted and then deleted 2 years after completion; the order email address is anonymised after 6 years.
• Content of confirmation emails: deleted 30 days after delivery.
• Server logs: at most 14 days. Backups: at most 30 days.
• Customer account: until you delete it; a record of the deletion itself is kept for 3 years.

A legal hold, for example during a dispute, can extend a period for the data concerned.

7. Recipients and transfers outside the EU

• Cloudflare, Inc. (USA): Hosting of the shops and the customer account, database, protection against attacks and spam (Turnstile), server logs. Processor; transfers to the USA based on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses.
• Stripe Payments Europe, Ltd. (Ireland): Payment processing. Stripe processes payments on our behalf and acts as an independent controller for fraud prevention and its legal obligations; transfers to the USA based on the Data Privacy Framework and the Standard Contractual Clauses.
• Plunk (hosted by Hetzner Online GmbH, Germany; sending through Amazon Web Services): Sending order, shipping and account emails. Processor.
• DHL Paket GmbH (Germany): Parcel delivery; receives the name and delivery address as an independent controller.
• Apple Distribution International Ltd. (Ireland), iCloud Mail: Mailbox for messages sent to support@open-effort.com.

Our database is stored in the EU. We do not sell data and use no automated decision-making or profiling.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR), and you can withdraw a consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object: where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR).

You can complain to a supervisory authority, for example the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.