moviestripes

Privacy policy

Last updated: 7 November 2026. This is a translation for your convenience; only the German version is legally binding.

1. Controller

The controller responsible for data processing on this website is:
Tristan Fischer – moviestripes
Huiskensstr. 51
47877 Willich
Germany
Email: [email protected]

We have not appointed a data protection officer because there is no legal obligation to do so. For questions about data protection, write to the email address above.

2. The essentials

  • We use no tracking or advertising cookies, no Google Analytics, no social media plugins and no externally loaded fonts. That is why there is no cookie banner.
  • Our visitor statistics run on our own server, without cookies and without storing IP addresses.
  • We process personal data mainly to fulfil your order.

3. Hosting and delivery of the website

Hosting at Hetzner

The website runs on a server that we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, and manage ourselves. The server is located in a Hetzner data centre within the EU. Hetzner processes the data as a processor on our behalf; we have concluded a data processing agreement with Hetzner (Art. 28 GDPR). When you visit, the server processes technically necessary data such as IP address, date and time, requested address, referrer and browser identification. We do not keep access logs with IP addresses. Error logs may contain the requested address; they are deleted after 14 days at the latest. The legal basis is our legitimate interest in operating the website securely and reliably (Art. 6 (1) (f) GDPR).

Cloudflare

All requests to the website pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare provides the encrypted connection, protects the website from attacks and forwards requests to our server. In doing so, Cloudflare processes in particular your IP address, the requested address and technical information about your browser. Cloudflare is certified under the EU-US Data Privacy Framework; we have concluded a data processing agreement with Cloudflare including the EU standard contractual clauses. The legal basis is our legitimate interest in delivering the website securely and quickly (Art. 6 (1) (f) GDPR). More information: cloudflare.com/privacypolicy.

4. Cookies

We only use cookies that are technically required for the shop:

  • sessionid: stores your cart. Deleted after two weeks without use.
  • csrftoken: protects forms against misuse (cross-site request forgery). Valid for up to one year.

These cookies are strictly necessary for the service you requested (§ 25 (2) no. 2 TDDDG); no consent is required. The related processing is based on Art. 6 (1) (b) and (f) GDPR.

5. Visitor statistics (Umami, self-hosted)

To understand which pages are used, we use the open-source software Umami, which runs on our own server. No data is passed to third parties and no cookies or similar identifiers are stored on your device. We record the page visited, the referring page, browser, operating system, device type, screen size, language and country (derived from the IP address). Your IP address and browser identification are only converted into an anonymous value that changes monthly and are not stored. We cannot link the data to you. For orders we also record the order value, without any personal details. The legal basis is our legitimate interest in privacy-friendly audience measurement (Art. 6 (1) (f) GDPR). You can object by enabling "Do Not Track" in your browser or by writing to us.

6. Orders

For your order we process your email address, delivery and billing address, the items ordered including your design (films, design, title, subtitle), payment status and order number. Without this data we cannot conclude and perform the contract. The legal basis is Art. 6 (1) (b) GDPR (contract) and, for retention, Art. 6 (1) (c) GDPR (legal obligations).

We pass data to the following recipients:

  • Print service provider: receives the print file plus name and delivery address to print, pack and ship the poster. It acts as our processor and is based in the EU.
  • Shipping carrier (e.g. DHL): receives name and delivery address for delivery.
  • Payment providers: see section 7.
  • Email service provider: sends order and shipping confirmations on our behalf.

We keep order and invoice data for as long as commercial and tax law requires (invoices and accounting records eight years, business letters six years, § 147 AO, § 257 HGB). We delete print files no later than three months after delivery, so that we can reprint in case of a complaint.

7. Payment via Stripe

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. In the payment step you are forwarded to a Stripe page, where you enter payment details and your delivery and billing address; Stripe processes this data. We receive name, address, email address, payment status and the payment method chosen from Stripe, but no full card or account details. Stripe is partly a controller in its own right for payment processing, e.g. for fraud prevention and its own legal obligations, and sets its own cookies on its pages for this. Stripe may transfer data to affiliated companies in the USA; Stripe is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6 (1) (b) GDPR. More information: stripe.com/privacy.

If you choose PayPal or Klarna, Stripe passes the data needed for payment to that provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (privacy), or Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (privacy). These providers are controllers for their own processing. For pay-later or instalment purchases, Klarna may run an identity and credit check.

8. Gift vouchers

When you buy a voucher we also process the recipient's name and your personal message, if you enter them, to create the voucher (Art. 6 (1) (b) GDPR). For redemption we store the voucher code, value and remaining balance until it expires.

9. Film request form and contact by email

If you tell us about a film via the film request form, we process your name, email address, the film title, release year and your message, to add the film and let you know. If you email us, we process your address and the content to reply. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual request) or Art. 6 (1) (f) GDPR (answering your request). We delete film requests six months after handling them, and emails once the matter is settled, unless they must be kept as business letters.

While ordering is not possible yet, you can leave your email address on the order summary to be told as soon as you can order. For this we process only your email address and language, write to you once and delete the address afterwards. The legal basis is Art. 6 (1) (b) GDPR (your request). You can cancel the notification at any time by email.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). An email to [email protected] is enough.

Right to object: where we process data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you can object to this processing at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.

11. No automated decisions

We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles. For Klarna's credit check, see section 7.