Privacy policy

Unless stated otherwise below, the provision of your personal data is neither legally nor contractually required, nor necessary for the conclusion of a contract. You are not obliged to provide the data. Non-provision has no consequences. "Personal data" is any information relating to an identified or identifiable natural person.

Server Log Files

You can visit our website without providing any information about yourself. Each time our website is accessed, usage data is transmitted by your internet browser to us or to our shop provider Shopify (see "Collection, processing and transfer of personal data for orders") and stored in log data (so-called server log files). The data stored includes, for example, the name of the page accessed, the date and time of access, the IP address, the data volume transferred and the requesting provider. When a page is accessed, a connection may also be established to another Shopify service (shop.app); Shopify also receives your IP address in this process. Processing is based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in ensuring the trouble-free operation of our website and in improving our services. Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. For Canada, there is an adequacy decision of the EU Commission. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. Transfers within the Shopify group of companies are based on binding internal data protection rules (Binding Corporate Rules, Art. 47 GDPR), transfers to Shopify's sub-processors on the EU Commission's standard contractual clauses; you can request a copy from us. Shopify stores this data according to its own retention periods (see Shopify's privacy notice: https://www.shopify.com/de/legal/datenschutz). You have the right to object to this processing at any time on grounds relating to your particular situation.

Contact

Controller

The controller responsible for data processing is: Kratoein, owner as named in the legal notice, c/o IP-Management #2269, Ludwig-Erhard-Straße 18, 20459 Hamburg, Germany, +49 152 19332777, info@kratoein.com

Customer-initiated contact by email

If you contact us by email on your own initiative for business purposes, we collect your personal data (name, email address, message text) only to the extent provided by you. The data processing serves to handle and respond to your contact request. If the contact serves the implementation of pre-contractual measures or concerns a contract already concluded between you and us, this data processing is based on Art. 6(1)(b) GDPR. If you contact us for other reasons, this data processing is based on Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in handling and responding to your enquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6(1)(f) GDPR. We use your email address to process your enquiry and otherwise only as described in this privacy policy. How long your emails are stored is set out under "Storage in our mailboxes".

Contact form. Messages you send via the contact form of our shop are forwarded by our shop system (see "Collection, processing and transfer of personal data for orders") as an email to our mailbox; your email address is used as the reply-to address. The form is protected against spam (see "hCaptcha (spam protection in forms)"). This section and the following section apply to further handling.

Withdrawal form. You can declare your withdrawal online via the withdrawal button in our shop. The information you enter there (usually your contact details, details of your order and your declaration of withdrawal) is transmitted by email to our mailbox by a third-party app integrated into our shop. Processing is carried out to fulfil our legal obligations in connection with your withdrawal on the basis of Art. 6(1)(c) GDPR and to unwind the contract on the basis of Art. 6(1)(b) GDPR. A transfer to third countries by the provider of the app cannot be ruled out. Storage in our mailbox is governed by "Storage in our mailboxes".

Email service (Zoho Mail). We handle our email communication with you via the addresses info@kratoein.com and support@kratoein.com – incoming and outgoing emails, for example regarding enquiries, orders, payments, withdrawals or complaints – via the email service Zoho Mail. The provider is Zoho Corporation GmbH, Trinkausstr. 7, 40213 Düsseldorf, Germany. Zoho processes the data as our service provider. Your emails, including name, email address, message text and attachments, are stored in data centres in the European Union (Amsterdam and Dublin) operated for Zoho by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands. The legal basis is the same as for the respective communication, i.e. for enquiries the one stated in the first paragraph of this section. Access to your data from third countries outside the EU, in particular by group companies in India and the USA working for Zoho, cannot be ruled out. There is no adequacy decision of the EU Commission for India. Zoho is not certified under the TADPF. The transfer is based on an intra-group agreement based on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR); you can request a copy from us. Further information: https://www.zoho.com/privacy.html

Other mailboxes (IONOS). We receive emails to our address for wholesale enquiries as well as automatic notifications about undeliverable emails via the email service of IONOS SE (see "Web space and email (IONOS)").

Storage in our mailboxes. We currently delete emails in our mailboxes manually; there is no fixed deletion period.

Processing of emails with the support of artificial intelligence (Anthropic Claude)

In order to review incoming emails more quickly and to answer your enquiries more quickly and more completely, we use the AI language model "Claude". The provider and our processor is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland ("Anthropic"). For the processing described in this section, we use Claude via Anthropic's application programming interface (API); Anthropic's commercial terms and data processing agreement apply. Claude is used in two places: in an automation program on our server (hereinafter "server program") and in a program for answering emails on the owner's computer (hereinafter "customer service program"). For the use of Claude in order processing, see "Shipping preparation, payment reconciliation and accounting". In detail:

Summary of incoming emails. The server program, which we operate ourselves on our rented server (see "Server / Hosting (Hostinger)"), continuously retrieves new emails from our business mailboxes and from other mailboxes used by the owner in the course of business. It transmits each new email to Anthropic so that Claude can create a short summary for us. The data transmitted are the sender's name and email address, the subject, the beginning of the message text (in individual cases including technical details and the beginning of attachments), the subject lines of earlier emails from the same sender and – if you have ordered from us – up to three of your order numbers with payment status. The only exceptions are duplicate emails and emails from senders we have blocked as spam. This program does not carry out any content pre-screening, for example for information about your health; such information in your email may therefore be transmitted to Anthropic and included in the summary. We receive the summary via an internal notification service (see "Internal notifications via Telegram"). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the prompt review and prioritisation of incoming emails. If your email concerns an order, processing is based on Art. 6(1)(b) GDPR.

Internal queries. The owner can ask the internal notification service questions about day-to-day business. The server program answers them with the help of Claude and, for this purpose, transmits to Anthropic: mailbox, sender, subject, processing status and summary of the day's emails and of the emails still open, as well as, for the most recent orders, customer name, amount, payment and shipping status, order date and up to three ordered items. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a quick overview of open enquiries and orders.

Categorisation and draft replies. To answer your emails to info@kratoein.com and support@kratoein.com, we use the customer service program. It reads these mailboxes, including the information whether an email has already been read, moved or deleted there, in order to close completed cases. Only two things are changed in the mailbox: it marks answered emails as read and moves detected spam to the spam folder; nothing is deleted. To match your enquiry to an order, it queries your orders from the last 60 days in our shop system using your email address or an order number you provide. Claude first assigns your enquiry to a topic (e.g. shipping, payment, order status) and then creates a draft reply.

  • What is sent to Anthropic for categorisation: the emails of the case (at most five) with date, subject, mailbox folder and your own text without quoted earlier messages, as well as the number of attachments.
  • What we replace beforehand: Before transmission, we replace bank details, third-party email addresses, postal addresses and telephone numbers in the subject and text with placeholders.
  • What remains included: names in the text or in the signature, order and tracking numbers, and amounts.
  • What is additionally sent to Anthropic for the draft: the same information and – insofar as your enquiry concerns an order – the order data required for this from our shop system: order number and order date, amount, payment status, payment date and payment method, cancellation with date and reason where applicable, shipping status, tracking numbers with tracking link, shipping carrier, shipping and delivery dates, delivery country and language of your order; your first name only if you write from the email address provided with the order. We insert the link to your order status page into the draft only on the owner's computer.
  • What is not sent to Anthropic: your sender address, your name from the sender field and the attachments themselves; furthermore, from the order, not the ordered items, your postal address, your email address or your payment data.

If your enquiry concerns a delivery to one of the countries for which we have excluded AI support, or if the order data cannot be retrieved due to a malfunction, we do not transmit your email to Anthropic; the owner handles it without AI. If your enquiry concerns an order or the conclusion of a contract, processing is based on Art. 6(1)(b) GDPR, otherwise on Art. 6(1)(f) GDPR on the basis of our legitimate interest in prompt and factually correct answers.

Repeated transmission and second check. If the payment or shipping status of your order changes before we have replied, we query the status in the shop system again and, where necessary, have the draft recreated with the same information. Your email may therefore be transmitted to Anthropic several times. Each draft is additionally checked for errors a second time by Claude; for this purpose, the same information is sent to Anthropic again together with the draft. Only the owner sees the result of this check.

Enquiries from a different email address. As a rule, we provide information about an order to the email address provided with the order. If someone writes to us – by email or via the contact form – from a different address and states an order number, the owner decides on a case-by-case basis after personal review whether to provide information on the status of this order; such information may include payment and shipping status, tracking number with tracking link and, where applicable, amount, payment method and delivery country. For the draft, the order data of this order mentioned above, but without first name, is sent to Anthropic. We disclose name, postal address, ordered items and the link to the order status page only to the email address provided with the order. Vis-à-vis the person who placed the order, the legal basis is Art. 6(1)(b) GDPR; if another person writes, disclosure to them is based on Art. 6(1)(f) GDPR on the basis of our legitimate interest in answering enquiries about orders promptly even when they come from a different email address.

Automatic replies. For some standard topics (receipt of payment, shipping status, delivery time, payment methods, shipping questions before ordering), we may send replies automatically without prior review by a human. You can recognise them by the sender "Kratoein Support (AI)" (in German "Kratoein Support (KI)"). We send automatic replies only to senders whose email address is technically verified, not in response to messages via the contact form and not for enquiries about an order from a different email address. All other replies are reviewed and sent by the owner personally. If you reply to an automatic reply, the owner handles your message personally. This does not involve a decision producing legal effects within the meaning of Art. 22 GDPR.

Automatic spam detection. Emails that match known spam patterns, come from senders whose emails the owner has previously classified as spam, or that Claude identifies as spam during categorisation are closed by the customer service program without a reply and moved to the spam folder of the mailbox. The owner can still see these cases and can reopen them at any time. This does not involve a decision producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protection against unwanted and fraudulent messages.

Particularly sensitive information and withdrawals. Before the customer service program transmits an email to Anthropic, it automatically checks it for typical terms relating to health information (Art. 9 GDPR) and to withdrawals; the owner handles matches without AI. Anything this check does not detect may be sent to Anthropic for categorisation; if Claude detects such a reference in the process, we handle this case without further AI support. This check applies only to categorisation and draft replies, not to the summary of incoming emails described above.

Improvement of our replies. To ensure that our replies are consistent and factually correct, we evaluate our own reply emails: once in October 2026 those of the preceding 90 days and, from November 2026, monthly those of the most recent 30 days.

  • Removal of identifiers: On the owner's computer, we first remove quoted earlier messages and signatures, then largely remove names, email addresses, postal addresses, telephone, order and tracking numbers, amounts and bank details. Automatic removal may miss individual details, such as names appearing freely in the text. Only then do we transmit these texts to Anthropic.
  • Result: From these, Claude creates general style and knowledge texts, which we review before use.
  • Your emails to us: In the one-off evaluation, we also transmitted your emails addressed to us to Anthropic after the same removal, in order to sort them by topic.
  • Test before use: Before we use a new version, we have Claude write test drafts for some current enquiries. In this process, the enquiry text as well as payment and shipping status with dates are sent to Anthropic after the same removal, without first names, numbers, amounts and delivery country.
  • Exceptions: Emails with detected health information or withdrawals, emails identified as spam and enquiries about deliveries to countries for which we have excluded AI support are excluded.
  • Deletion: We delete the data compiled for the evaluation when we decide on the new version, at the latest after 30 days. The results are worded in such a way that they contain no reference to individual persons; we use them without time limit for answering future enquiries and keep at most the last 20 of earlier versions; we currently keep versions identified as corrupted for troubleshooting without a fixed period.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in consistently good and correct replies. We have verified that this purpose is compatible with the original purpose – answering your enquiry – (Art. 6(4) GDPR), in particular because of the prior removal of identifiers. Recipients, third-country transfers and storage at Anthropic are governed by the following paragraphs.

No training. Under Anthropic's commercial terms, Anthropic may not use the content transmitted via the API to train its AI models without our express permission.

Storage at Anthropic. Anthropic generally deletes inputs and outputs within 30 days of receipt or generation. Longer storage is possible where required by law or if Anthropic's automated safety systems flag a request as a possible violation of the usage policies (in that case, inputs and outputs for up to 2 years and the results of the safety review for up to 7 years).

Third-country transfer. Anthropic stores data in the USA; depending on capacity, processing may also take place in other countries (including in Europe, Asia and Australia). Anthropic does not offer processing exclusively in the EU. Anthropic uses further sub-processors, including providers of cloud infrastructure with locations worldwide. Anthropic is not certified under the TADPF. The transfer is based on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which form part of our data processing agreement with Anthropic; you can request a copy from us. Further information: https://www.anthropic.com/legal/data-processing-addendum and https://trust.anthropic.com/subprocessors

Storage period. Your email itself is stored in accordance with the rules of the section "Customer-initiated contact by email". The customer service program deletes its local copy of your emails 90 days after receipt. We delete processing cases, including the draft reply and the check result, 90 days after completion; cases not yet completed remain stored until they are completed. As proof of who received a reply and when, we store the email address, subject and a checksum of the text for 90 days. We delete logs of mailbox maintenance (marked as read, moved to the spam folder) after 90 days, and compilations for answering requests for access after 30 days. We currently store, without a fixed period, sender addresses classified as spam, a log of AI calls (without content, with case number) and individual technical status files that may contain order numbers. All this data is additionally contained in a nightly backup copy, also on the owner's computer; we delete copies after 7 days (only in the event of a longer backup failure does the last copy remain until the next successful backup). Deleted data may therefore remain there for up to 7 days longer. If we delete your data at your request, we also replace the backup copies.

The server program stores:

  • Emails: the most recent 800 emails with text and details of the most recent 5,000 emails (sender, subject, summary, without text). There is no time limit for this; older entries are only overwritten when this number is reached.
  • Senders: Sender profiles (name, number of emails, last subject) and the list of blocked senders remain stored until manually deleted.
  • Logs: The program's error logs (the last 200 entries; they may contain excerpts from emails or orders) and event logs (the last 500 events; they may contain email addresses) are continuously overwritten. The program's execution logs are also continuously overwritten; at most the last approximately 10,000 executions are kept (currently about two days). They may contain email content, order data and – for payment confirmations – email addresses.
  • Working copies: Any internal working copies of the program files remain stored until manually deleted.

For backup copies, see "Data backups"; for storage at Anthropic, see above.

Information about other persons. If an email contains information about other persons (such as the recipient of a delivery) or someone states another person's order number (see "Enquiries from a different email address"), we process this information as described in this section. The source is the sender's email or our shop system; the data processed are the details stated in the email or the order data mentioned above. With this privacy policy, we also inform these persons (Art. 14 GDPR).

Objection. Insofar as the processing is based on Art. 6(1)(f) GDPR, you can object to it at any time on grounds relating to your particular situation. Following an objection, the processing will cease unless we can demonstrate compelling legitimate grounds for the processing. An email in which you object may, upon receipt, already have been summarised, categorised and transmitted to Anthropic for a draft reply including the check, as described above. Until we have implemented your objection, further emails from you may still be processed as described. Further information on processing by Anthropic as our processor: https://www.anthropic.com/legal/data-processing-addendum and https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data

Internal notifications via Telegram

We keep ourselves informed internally about new emails, orders and open cases via notification programs (bots) in the messaging service Telegram. The provider is Telegram Messenger Inc., Commerce House, Wickhams Cay 1, PO Box 3140, Road Town, Tortola, VG1110, British Virgin Islands; representative in the EU: European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium. The messages are sent only to the owner's chats. The following is transmitted:

  • from the server program for each new email (except from blocked senders and duplicates): mailbox, sender's name and email address, subject, a note on earlier emails or orders from the sender and the summary of the content created by Claude; if the summary fails, the first lines of the email. Attachments and the full text are not transmitted;
  • from the same program for orders:
    • upon receipt: order number, customer's name and email address, amount and payment status;
    • upon receipt of payment: order number, name and amount;
    • upon shipping: order number, name, tracking number, shipping carrier and tracking link;
    • upon the owner's query about an order: additionally email address, payment and shipping status and the ordered items;
  • from the same program also: the answers to internal queries (see "Internal queries"), overviews of open emails with sender and subject and of today's emails with subject, where applicable notes on longer email threads with subject and sender address, confirmations of blocked sender addresses and error messages of the program, which in individual cases may contain excerpts from emails or orders;
  • from the customer service program: the mailbox concerned, the order number and the type of matter (e.g. withdrawal, data protection or particularly sensitive information), no names, email addresses or message texts;
  • from daily order processing: only order numbers and fixed notes.

The legal basis is Art. 6(1)(f) GDPR on the basis of our legitimate interest in the prompt handling of enquiries and orders; if the notification concerns your order, additionally Art. 6(1)(b) GDPR. Telegram is based outside the EU; there is no adequacy decision of the EU Commission for the British Virgin Islands. Telegram offers neither a data processing agreement nor standard contractual clauses for bots; the transfer therefore takes place without safeguards under Art. 46 GDPR. The messages remain stored in the chats until we delete them there; there is no fixed period. The customer service program additionally stores its notifications on the owner's computer for 90 days. You have the right to object to this processing at any time on grounds relating to your particular situation. Further information: https://telegram.org/privacy

Customer Account / Orders

Customer account

When you open a customer account, we collect your personal data to the extent stated there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. Processing is based on Art. 6(1)(b) GDPR. You can request the deletion of your customer account at any time by notifying us. Our shop system also reports newly created customer accounts to our internal customer management; the customer profile there remains stored until manually deleted (see "Internal order overview and customer management") and will also be deleted at your request.

Collection, processing and transfer of personal data for orders

When you place an order, we collect and process your personal data only to the extent necessary for the fulfilment and processing of your order and for handling your enquiries. Processing is based on Art. 6(1)(b) GDPR. The information marked as mandatory fields is required for the conclusion of the contract; without it, we cannot accept and execute your order. Our shop system and our website are operated by Shopify International Ltd., c/o Intertrust Ireland, 2nd Floor 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"), as our processor (Art. 28 GDPR). Your data is disclosed, for example, to shipping companies, payment service providers and IT service providers. The scope of the data transfer is limited to a minimum. Which service providers we use in detail is described in the following sections and under "Processing of emails with the support of artificial intelligence (Anthropic Claude)", "Shipping Service Providers", "Payment Service Providers" and "Plug-ins and Miscellaneous". Your data may be transferred to third countries outside the EU, in particular Canada and the USA. For Canada, there is an adequacy decision of the EU Commission. Shopify is not certified under the TADPF. Transfers within the Shopify group of companies are based on binding internal data protection rules (Binding Corporate Rules, Art. 47 GDPR), transfers to Shopify's sub-processors on the EU Commission's standard contractual clauses; you can request a copy from us. Further information: https://www.shopify.com/legal/dpa

Origin of your visit. With your order, we store via which link or which advertisement you came to us (campaign information from the link accessed and, where applicable, a referral identifier). For this, we use Shopify's own app "Checkout Blocks". The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in understanding through which channels orders are generated. The information remains stored for as long as the order (see "Retention period"). You have the right to object to this processing at any time on grounds relating to your particular situation.

If you specify another person as the delivery address, we process their name and address for delivery as described in this section and under "Internal order overview and customer management", "Shipping preparation, payment reconciliation and accounting" and "Shipping Service Providers"; the source is the information you provide when ordering (Art. 14 GDPR).

Address autocompletion at checkout (Google)

When you enter your delivery address at checkout, our shop system suggests matching addresses. Shopify provides this function using a service of Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; "Google"); for this purpose, the characters entered in the address field are transmitted to Google. Your data may also be transferred to the USA. Google is certified under the TADPF. Processing is based on Art. 6(1)(f) GDPR on the basis of our legitimate interest in correct delivery addresses and smooth delivery. You have the right to object to this processing at any time on grounds relating to your particular situation. Further information: https://policies.google.com/privacy

Internal order overview and customer management

Our shop system automatically reports new orders, incoming payments, shipments and newly created customer accounts to the server program (see "Server / Hosting (Hostinger)"). In doing so, the shop system transmits the order or customer data, including name, email address, addresses, ordered items and amounts. From this, the program maintains an internal overview of the last 2,000 orders (name, email address, amount, status, items, tracking number) as well as customer profiles (name, email address, customer number and customer attributes from the shop system, number of orders, total revenue, date of the first and last order, a classification as a particularly loyal customer and a loyalty score) and notifies us via Telegram (see "Internal notifications via Telegram"). The customer profiles may additionally contain a history of previous contacts (time, subject, topic). We also use the overview to match incoming emails to an order. This does not involve any automated decision about you. The legal basis is Art. 6(1)(b) GDPR, and for the customer profiles Art. 6(1)(f) GDPR on the basis of our legitimate interest in an overview of our customer relationships. There is no time limit: the order overview is only continuously overwritten once 2,000 orders have been reached, and customer profiles remain stored until manually deleted. You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.

Confirmations and notifications by email

Payment confirmation. As soon as your payment has been received by us, we automatically send a confirmation to the email address provided with the order, containing your first name, order number, amount, link to the order status page and, where applicable, shipping status – without AI and using a fixed template, via our customer service program and our email service (see "Customer-initiated contact by email"). The logo of the email is loaded from Shopify servers when the email is opened; Shopify receives your IP address and the time of retrieval. To avoid duplicate confirmations, we store the order number, time and technical sending status of the confirmation without a fixed period; we delete the email address and amount after 90 days.

Confirmation for card payments. If you pay via Card2Crypto (see "Payment processing via Card2Crypto"), you will also receive an email "Payment received" with the order number, the amount paid in cryptocurrency and the transaction ID. This email is sent by our payment page (see "Web space and email (IONOS)") via our email service; sending is triggered at short intervals by the server program.

Confirmation for crypto payments. If you pay via BTCPay Server, BTCPay Server sends a confirmation via our email service to the email address stored in the invoice after receipt of payment.

Shipping and delivery notification. As soon as we have registered your shipment with DHL, our shop system sends you a shipping confirmation with the tracking number; when DHL reports delivery, you will receive a delivery notification from our shop system (see "Shipping Service Providers").

Payment reminders. If an order has not yet been paid, the Payster service of Digismoothie s.r.o. (Rohanské nábřeží 678/29, 186 00 Prague, Czech Republic) reminds you of the payment by email on our behalf and, where applicable, informs you of the cancellation of the unpaid order. For this purpose, according to its own information, Payster processes the necessary order data as our processor and in the EU, such as name, email address, order number and amount. The emails are sent via the Mailgun service of Mailgun Technologies, Inc. (112 E. Pecan Street #1135, San Antonio, TX 78205, USA); data may be transferred to the USA in the process. Mailgun is certified under the TADPF; standard contractual clauses are also in place. Payster stores the data according to its own retention periods; details can be found in the provider's privacy notice. Further information: https://www.digismoothie.com/company/privacy-policy and https://www.mailgun.com/legal/privacy-policy/

Processing is based on Art. 6(1)(b) GDPR; the loading of the logo is based on Art. 6(1)(f) GDPR on the basis of our legitimate interest in a uniform design of our emails. You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.

Shipping preparation, payment reconciliation and accounting

For the daily handling of orders – reconciliation of incoming payments, creation of invoices and shipping labels, shipping notifications – the owner uses a further program for order processing, which is run with the support of Claude. In doing so, Claude processes the current order data from our shop system (name, email address, delivery address, ordered items, amounts, payment method, order events) as well as the incoming payments on our business account (payer's name, payment reference, amount, date). In addition, we use Claude to check daily, based on order number, delivery country, amount, payment and cancellation status, whether VAT delivery thresholds within the EU are reached. We also use Claude for other administrative work – for example for accounting, for analyses in our shop system or business account, for testing and further developing our internal programs and, if registering a shipment via the interface fails, for registering it via a shipping app in the browser; the same order and payment data may be processed in this context. For this, we use a consumer plan from Anthropic (provider: Anthropic Ireland, Limited, address as above); there is no data processing agreement for this. Anthropic processes the content under its consumer terms on its own responsibility; we have excluded use for training in the settings. Anthropic generally deletes the content of deleted conversations within 30 days. If Anthropic's automated safety systems flag content as a possible violation of the usage policies, Anthropic retains this content for up to 2 years and the results of the safety review for up to 7 years. Anthropic stores data in the USA; processing may also take place in other countries. Our contractual partner is Anthropic Ireland, Limited, which is established in the EU; Anthropic carries out transfers to third countries on its own responsibility (see https://www.anthropic.com/legal/privacy). We store histories and working notes of these sessions on the owner's computer until manually deleted.

We create invoices from the order data (name, address, email address, telephone number, ordered items, amounts) using the Shopify app "Order Printer Pro" of Shop Circle Ltd (25 Eccleston Place, London SW1W 9NF, United Kingdom). The provider is based in the United Kingdom and does not state a server location or specific safeguards under Art. 46 GDPR; a transfer to third countries can therefore not be ruled out. According to its own information, it stores the data for as long as there is a business need. Further information: https://shopcircle.co/pages/privacy-policy

For payment by bank transfer, we store the invoice as a receipt for the credit entry in our business account (see "Payment in advance (bank transfer)"). We pass on invoices and a list of crypto payments to our tax advisor, who acts independently as a professional bound by professional secrecy and processes them for accounting and tax returns. For the registration of shipments, see "Shipping Service Providers"; we receive internal notes from this process via Telegram with order numbers only.

The legal basis is Art. 6(1)(b) GDPR, for accounting, taxes and the check of delivery thresholds Art. 6(1)(c) GDPR, and otherwise, for the support by Claude, Art. 6(1)(f) GDPR on the basis of our legitimate interest in low-error and time-saving processing. We delete the working data of this process on the owner's computer after 30 days; we currently keep lists for approving orders (with names and amounts), daily reports (with names of payers), shipping data (tracking numbers for orders) and shipping labels (name and address) without a fixed period, and invoices and proofs of payment within the statutory retention periods (see "Retention period"). You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.

Advertising

Use of the email address for newsletters: You can subscribe to our newsletter via the sign-up form in the footer of our shop. We use your email address to send newsletters if you have expressly consented to this. Your subscription is stored in our shop system. We send newsletters and advertising emails via the email functions of our shop system (Shopify Messaging, partly automated via Shopify Flow; see "Collection, processing and transfer of personal data for orders"). Each of these emails contains an unsubscribe link. Processing is based on Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example by email to info@kratoein.com; we use your email address for the newsletter until you withdraw your consent.

Use of the email address for direct marketing: If you have purchased goods from us, we use the email address obtained in the process for electronic advertising of our own similar goods, unless you have objected (§ 7(3) UWG, German Act Against Unfair Competition). Processing is based on Art. 6(1)(f) GDPR on the basis of our legitimate interest in direct marketing. You can object to this use at any time without incurring any costs other than the transmission costs according to the basic rates; we point this out in every advertising email. You can send your objection informally to info@kratoein.com.

Shipping Service Providers

Disclosure of data to DHL: To deliver your order, we register the shipment with DHL Paket GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany ("DHL") and, for this purpose, transmit your name, company and address supplements where applicable, your delivery address or, for delivery to a Packstation or a branch, its number and your PostNumber, the order number as a reference and the parcel weight. We do not transmit your telephone number. Processing is based on Art. 6(1)(b) GDPR.

Disclosure of the email address to DHL: To coordinate delivery and to notify you of the shipment status, we also transmit your email address to DHL; deliveries to a Packstation are excluded. For international shipments, it is required for delivery to a pick-up point; processing is then based on Art. 6(1)(b) GDPR. For domestic shipments, it is based on Art. 6(1)(f) GDPR on the basis of our legitimate interest in smooth delivery; you have the right to object to this processing at any time on grounds relating to your particular situation. DHL processes the data for delivery and parcel notification on its own responsibility.

Shipment tracking: We query the delivery status from DHL using the tracking number; you receive the shipping confirmation and delivery notification via our shop system (see "Confirmations and notifications by email"). Alternatively, we register shipments via the Shopify app "easyDHL" of 247APPS UG (haftungsbeschränkt), In der Goldgrube 28, 56073 Koblenz, which acts as our processor in this context; the same data is transmitted to DHL in the process. Further information: https://www.dhl.de/de/toolbar/footer/datenschutz.html

Payment Service Providers

Payment in advance (bank transfer)

If you pay by bank transfer, your payment is received in our business account with QONTO SA (6 impasse Bonne Nouvelle, 75010 Paris, France; German branch: Chausseestraße 29, 10115 Berlin). Qonto processes the details of your transfer as an independent controller in order to provide its payment services and to fulfil its legal obligations. We receive the details of your transfer (name and account details of the payer, payment reference, amount, date). We reconcile this information with your order (see "Shipping preparation, payment reconciliation and accounting") and store the invoice as a receipt for the credit entry in the business account. Processing is based on Art. 6(1)(b) GDPR, and retention as an accounting record on Art. 6(1)(c) GDPR.

Payment processing via Card2Crypto

If you choose to pay by card via our external payment service provider Card2Crypto, our payment page (see "Web space and email (IONOS)") redirects you to the Card2Crypto payment page. In doing so, we transmit the amount, currency and your email address to the payment page. To generate the payment address, we transmit the order number and amount to the Card2Crypto interface or – if this is not available – directly to the interface of PayGate.to, the technical service provider via which Card2Crypto processes payments. The card payment itself is processed by payment service providers commissioned by these providers; you enter your card details there, and we do not receive them. After payment, we receive a confirmation with the amount, cryptocurrency and transaction IDs, which we note with your order in our shop system. Processing is carried out for the purpose of payment processing and fraud prevention on the basis of Art. 6(1)(b) GDPR. Card2Crypto and PayGate.to do not publish any information on the operator, registered office or the card payment service providers used; processing of your data outside the EU can therefore not be ruled out. Further information can be found in the privacy policies of Card2Crypto: https://card2crypto.org/privacy and PayGate.to: https://paygate.to/info/privacy-policy/

Payment processing via BTCPay Server (cryptocurrencies)

If you choose to pay with cryptocurrency, payment processing is handled via our self-operated BTCPay Server on our server rented from Hostinger (see "Server / Hosting (Hostinger)"). BTCPay Server is open-source software. The invoice is created by our payment page (see "Web space and email (IONOS)"); in this process, the order number, amount and currency as well as your name and email address from your order are transmitted to BTCPay Server and stored there together with the payment data (payment address, transaction ID, amount). After receipt of payment, BTCPay Server sends you a confirmation (see "Confirmations and notifications by email"). No external payment service provider is involved in a payment with Bitcoin.

If you pay with a cryptocurrency other than Bitcoin, the exchange is handled via the exchange service Trocador (operated, according to the information on its website, by Reta Development Assets LLC) and a partner exchange selected by you during the payment process. In this process, Trocador and the partner exchange process, on their own responsibility, your refund address, the amount, the destination address and technical data (IP address, browser identifier, language setting). According to its own information, Trocador deletes trading data after 14 days; the partner exchange's own privacy notice applies to it. The operator does not state Trocador's registered office; a transfer to third countries without an adequate level of data protection can therefore not be ruled out. The legal basis for the forwarding is Art. 6(1)(b) GDPR. Further information: https://trocador.app/en/privacypolicy/

Cryptocurrency transactions are technically irreversible once sent; transaction data (wallet address, amount, timestamp) is publicly stored on the blockchain. For Monero (XMR), transaction details are not publicly visible by default due to privacy-by-default mechanisms. There is currently no fixed deletion period for the invoice data in BTCPay Server; it is included in our data backups (see "Data backups"). Processing is based on Art. 6(1)(b) GDPR for contract performance. Further information on BTCPay Server: https://btcpayserver.org/privacy-policy

Cookies

Our website uses cookies. Cookies are small text files that are stored by the internet browser on a user's computer system. You have full control over the use of cookies. You can prevent the storage of cookies through appropriate technical settings in your browser. Cookies that have already been stored can be deleted at any time. Please note that you may then not be able to use all functions of this website to their full extent. Cookies are deleted when their respective lifetime expires, unless you delete them in your browser beforehand.

Browser help on cookies: Chrome · Firefox · Safari · Microsoft Edge

Technically necessary cookies

We use technically necessary cookies to make our service more user-friendly, effective and secure. Use is based on § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 6(1)(f) GDPR. You have the right to object to this processing at any time on grounds relating to your particular situation.

Shopify Consent Tool (Shopify Privacy & Compliance)

We use the consent tool "Shopify Privacy & Compliance" of Shopify International Ltd. (c/o Intertrust Ireland, 2nd Floor 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify"). The tool enables you to give consent to data processing and to withdraw consent. Your data may be transferred to Canada and the USA. Shopify is not certified under the TADPF; the data transfer within the Shopify group of companies is based on binding internal data protection rules (Binding Corporate Rules, Art. 47 GDPR), and to sub-processors on the EU Commission's standard contractual clauses (you can request a copy from us); for Canada, there is an adequacy decision of the EU Commission. The data processing is carried out to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR. Further information: https://www.shopify.com/de/legal/datenschutz

Analytics / Advertising Tracking

The providers of the following services store the data according to their own retention periods; details can be found in the respective linked privacy notices. For Google Analytics 4, the storage period is a maximum of 14 months.

Google Analytics 4

We use Google Analytics 4 of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google"). The data processing serves the analysis of this website and its visitors as well as marketing and advertising purposes. We integrate Google Analytics 4 via the Shopify app "Google & YouTube". The use of cookies is based on your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time. If you have consented, customer data such as your email address, your name or your telephone number may also be transmitted in hashed form (converted into a check value, not in plain text) in order to attribute advertising success. We also use Google Signals for cross-device tracking (only where personalised advertising is enabled in your Google account). Google is certified under the TADPF. Further information: https://policies.google.com/privacy

Shopify Analytics

We use the statistics and analytics functions of Shopify International Ltd. as part of processing on our behalf. The data processing serves the analysis of the website and its visitors. Shopify is not certified under the TADPF; data transfer within the Shopify group of companies on the basis of binding internal data protection rules (Binding Corporate Rules, Art. 47 GDPR), to sub-processors on the basis of the EU Commission's standard contractual clauses; you can request a copy from us. Use with your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. Further information: https://www.shopify.com/de/legal/datenschutz

Google Ads Conversion Tracking

We use Google Ads and conversion tracking of Google Ireland Limited. When you click on an ad placed by Google, a conversion cookie is stored on your computer. Use is based on your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. If you have consented, customer data such as your email address, your name or your telephone number may also be transmitted in hashed form (converted into a check value, not in plain text) in order to attribute advertising success. Google is certified under the TADPF. Further information: https://www.google.de/policies/privacy/

Pinterest Tag

We use the Pinterest Tag of Pinterest Europe Limited (Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland; "Pinterest") for targeted advertising on the social network Pinterest. If you have consented, customer data such as your email address, your name or your telephone number may also be transmitted in hashed form (converted into a check value, not in plain text) in order to attribute advertising success. Your data may be transferred to the USA; Pinterest is not certified under the TADPF; transfer on the basis of the EU Commission's standard contractual clauses; you can request a copy from us. Use with your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. Further information: https://policy.pinterest.com/de/privacy-policy

TikTok Pixel

We use the TikTok Pixel of TikTok Technology Limited and TikTok Information Technologies UK Limited. The data processing serves the analysis of our website and targeted advertising on TikTok. If you have consented, customer data such as your email address, your name or your telephone number may also be transmitted in hashed form (converted into a check value, not in plain text) in order to attribute advertising success. TikTok is not certified under the TADPF; transfer on the basis of the EU Commission's standard contractual clauses; you can request a copy from us. Use with your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. Further information: https://www.tiktok.com/legal/page/eea/privacy-policy/de

Plug-ins and Miscellaneous

Google Tag

We integrate Google Analytics 4 and Google Ads via the Shopify app "Google & YouTube" (Google tag) of Google Ireland Limited; we do not use a separate Google Tag Manager. When a page is accessed, a connection to Google servers may be established, in which Google receives your IP address; content and cookies from Google are only loaded after your consent (see "Analytics / Advertising Tracking"). The connection is established on the basis of Art. 6(1)(f) GDPR on the basis of our legitimate interest in short loading times of our website. You have the right to object to this processing at any time on grounds relating to your particular situation. Further information: https://policies.google.com/privacy

hCaptcha (spam protection in forms)

To protect our forms (contact, newsletter, comments, customer account) against spam and abuse, our shop system Shopify integrates the hCaptcha service of Intuition Machines, Inc. (1065 SW 8th St #704, Miami, FL 33130, USA). When you use such a form, your IP address, browser and device information as well as mouse, scroll, keyboard and touch events, among other things, are evaluated in order to distinguish human input from automated input; a cookie may be set in the process. Intuition Machines also processes data in part for its own purposes, for example to improve the service. Your data is transferred to the USA; Intuition Machines is certified under the TADPF, and standard contractual clauses are also in place. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protection against spam and abuse. Access to your terminal device is based on § 25(2) no. 2 TDDDG, as it is necessary for the submission of the form that you have requested. According to hCaptcha, cookie and analytics data are stored for up to one year after the cookie expires, predominantly without reference to a person, and longer in the event of abuse. You have the right to object to this processing at any time on grounds relating to your particular situation. Further information: https://www.hcaptcha.com/privacy

Judge.me (customer reviews)

For product reviews, we use the Shopify app Judge.me of Judge.me Ltd. (C/O Buckworths, 2nd Floor, 1-3 Worship Street, London EC2A 2AB, United Kingdom). The review display and images from Judge.me are loaded when our pages are accessed; Judge.me receives your IP address and technical information about your browser in the process. If you have consented to analytics in the cookie banner, Judge.me also receives events from your visit via our shop system (its own tracking script). After an order, we ask you by email via Judge.me to submit a review; for this purpose, Judge.me processes your name, your email address and the reference to your order. If you submit a review, your review text, any photos and your name (abbreviated where applicable) are displayed on our website. For this data, Judge.me is our processor; for information that you provide directly to Judge.me (for example when creating your own account with Judge.me), Judge.me is itself the controller.

The review display is loaded on the basis of Art. 6(1)(f) GDPR on the basis of our legitimate interest in displaying customer reviews in our shop; insofar as information is stored on or read from your terminal device in the process, on the basis of § 25(2) no. 2 TDDDG. Events from your visit are transmitted with your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR, which you can withdraw at any time. We send the review request by email on the basis of Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG (see "Advertising"); you can object to it at any time, for example by email to info@kratoein.com. Your review is published with your consent on the basis of Art. 6(1)(a) GDPR, which you can withdraw at any time. Judge.me uses servers of Heroku (Salesforce) and Amazon Web Services; data may be transferred to the USA in the process. The transfer is based on the EU Commission's standard contractual clauses, which form part of Judge.me's data processing agreement; Salesforce and Amazon are also certified under the TADPF. Published reviews remain on our website until they are deleted; otherwise, the storage period at Judge.me is governed by its privacy notice. You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. Further information: https://judge.me/privacy

Smile.io (loyalty programme)

For our loyalty and rewards programme, we use the Shopify app "Smile" of Smile Inc. (Canada; privacy contact: PO Box 33042 Ira Needles, Waterloo, ON, N2T 2M9, Canada). The Smile programme window is loaded when our pages are accessed; Smile receives your IP address and information about your browser in the process. For the programme, Smile also processes the name, email address, postal address as well as order and points data of our customers in order to manage points, rewards and referrals. If you have consented to analytics in the cookie banner, Smile also receives events from your visit via our shop system (its own tracking script). According to its own information, Smile is our processor in this respect. As part of the programme, you receive emails from Smile, for example about your points balance and rewards; each of these emails contains an unsubscribe link.

The programme window is loaded on the basis of Art. 6(1)(f) GDPR on the basis of our legitimate interest in offering you our loyalty programme in the shop; insofar as information is stored on or read from your terminal device in the process, on the basis of § 25(2) no. 2 TDDDG. Your points and rewards are managed on the basis of Art. 6(1)(b) GDPR, and events from your visit are transmitted with your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR, which you can withdraw at any time. Smile processes data in Canada and the USA. For Canada, there is an adequacy decision of the EU Commission. Smile is not certified under the TADPF and does not state any safeguards under Art. 46 GDPR for processing in the USA; a transfer to the USA without appropriate safeguards can therefore not be ruled out. Smile stores the data for as long as it is necessary for the purpose, and, according to its own information, IP address and browser information for up to 24 months. If we delete your customer account, your data will also be deleted at Smile. You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. Further information: https://smile.io/privacy-policy

Corner Cart (shopping cart, free gifts and volume discounts)

For the shopping cart view, free gifts and volume discounts, we use the Shopify app "Corner Cart" of Messengerify Labs Pvt Ltd (NASSCOM 10k Startup Warehouse, Infopark Campus, Kochi 682030, India). The app is loaded when our pages are accessed, including a service of the app for comparison tests of display variants (A/B tests). In doing so, the provider processes your shopping cart content as well as technical data (IP address, browser, operating system, approximate location); according to its own information, it also uses cookies and similar technologies for this. According to its own information, the provider generally acts as our processor.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a convenient shopping cart function and the presentation of our offers. Insofar as information is stored on or read from your terminal device in the process, this is based on § 25(2) no. 2 TDDDG. The provider is based in India and operates its servers in the USA. There is no adequacy decision of the EU Commission for India; the provider is not certified under the TADPF and does not state any appropriate safeguards under Art. 46 GDPR. A transfer to third countries without an adequate level of data protection can therefore not be ruled out. According to its own information, the provider stores the data for as long as necessary for the respective purpose. You have the right to object to this processing at any time on grounds relating to your particular situation. Further information: https://help.cornercart.com/en/article/cornercart-privacy-policy-utobwv

Synctrack (estimated delivery date)

To display the estimated delivery date, we use a Shopify app by Synctrack (Omega) of Cyber Software Joint Stock Company (No. 3, Alley 175/55 Lac Long Quan, Tay Ho Ward, Hanoi, Vietnam). The app is loaded when our pages are accessed. In doing so, the provider processes your IP address, the approximate location derived from it, device and browser information as well as values stored in the browser; the app also has access to order and shipping data in our shop system. Under its data processing agreement, the provider is our processor.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in showing you an estimated delivery date before purchase. Insofar as information is stored on or read from your terminal device in the process, this is based on § 25(2) no. 2 TDDDG. The data is hosted in Canada; for Canada, there is an adequacy decision of the EU Commission. Transfers to Vietnam are subject to the EU Commission's standard contractual clauses. The storage period depends on the settings of the app; after the end of our use, the provider deletes the data within 30 days. You have the right to object to this processing at any time on grounds relating to your particular situation. Further information: https://www.omegatheme.com/privacy-policy-app

Iconify (icons)

When our pages are accessed, icons are loaded from the application programming interface of Iconify OÜ. In doing so, your IP address is transmitted to their servers; these are distributed worldwide (including in Frankfurt am Main and London) and are reached via the network of Cloudflare, Inc. (USA). A transfer to third countries can therefore not be ruled out. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a uniform presentation of our shop. Iconify does not state whether and for how long IP addresses are stored in the process. You have the right to object to this processing at any time on grounds relating to your particular situation. Further information: https://iconify.design/privacy/

Essential Preorder (pre-orders and back-in-stock notifications)

For pre-orders and back-in-stock notifications, we use the Shopify app "Essential Preorder" by Essential Apps (Baltupio g. 45-27, LT-08324 Vilnius, Lithuania). For a pre-order, your order data (including name, address, telephone number) is processed; for a notification, your email address as well as technical data (IP address, browser, internet provider); values may be stored in your browser for display purposes. The legal basis is Art. 6(1)(b) GDPR (pre-order) or your consent under Art. 6(1)(a) GDPR (notification), which you can withdraw at any time; storage in the browser is based on § 25(2) no. 2 TDDDG. According to the provider, data may be processed outside Europe, including in Canada and the USA; it does not state any safeguards for this, and a transfer to third countries without an adequate level of data protection can therefore not be ruled out. The provider does not provide any information on the storage period; we store pre-orders like other orders (see "Retention period"). Further information: https://essential-apps.com/essential-preorder-presale-privacy-policy/

Server / Hosting (Hostinger)

We operate our own server applications – the server program for emails and orders (see "Processing of emails with the support of artificial intelligence (Anthropic Claude)" and "Internal order overview and customer management"), our BTCPay Server (see "Payment processing via BTCPay Server (cryptocurrencies)") and monitoring of the availability of our services – on a rented virtual server of Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus ("Hostinger"). Hostinger provides the server infrastructure and is our processor in this respect; the data processing agreement forms part of Hostinger's terms of use. The data described in the sections mentioned is processed on the server; the monitoring receives order numbers in individual cases, and these entries are continuously overwritten. When our servers are accessed, technically necessary connection data (including the IP address) is processed. The server is located in a data centre in Frankfurt am Main, Germany. Insofar as Hostinger uses sub-processors outside the EU, the transfer is based on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which form part of the data processing agreement. Hostinger is not certified under the TADPF. The legal basis is Art. 6(1)(f) GDPR on the basis of our legitimate interest in the secure and cost-effective operation of our own applications or – insofar as order or payment data is concerned – Art. 6(1)(b) GDPR. You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. Further information: https://www.hostinger.com/legal/dpa and https://www.hostinger.com/legal/privacy-policy

Web space and email (IONOS)

For our payment page for card payments and for creating invoices for crypto payments, we use web space of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany ("IONOS"); in addition, we receive emails to our address for wholesale enquiries as well as notifications about undeliverable emails via IONOS. IONOS processes the data as our service provider. With each new order, our shop system transmits the order number, email address as well as first and last name to our payment page so that we can send payment confirmations and create invoices for crypto payments; we delete this information after 30 days (clean-up once a week). In addition, the payment page logs the receipt of each order with the email address, the receipt of payment with order number, transaction IDs, cryptocurrency and amount, the sending of payment confirmations with your email address and, in the event of errors and when the fallback route to PayGate.to is used, your IP address and browser identifier. We currently keep these logs without a fixed deletion period. The payment logs also serve as proof of payment for our accounting (see "Retention period"); this does not apply to the logs of received orders and sent confirmations (with your email address), which we currently also keep without a fixed period. We also regularly store a copy of the payment logs as proof of payment for our accounting on the owner's computer and currently keep it without a fixed period; it also contains the entries about sent confirmations with your email address. Processing at IONOS generally takes place in the EU or the EEA. The legal basis is Art. 6(1)(b) GDPR, for the proofs of payment Art. 6(1)(c) GDPR, and for the error logs as well as the logs of received orders and sent confirmations Art. 6(1)(f) GDPR on the basis of our legitimate interest in a secure, trouble-free and traceable payment process. You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. Further information: https://www.ionos.de/terms-gtc/avv/

Data backups

To protect against data loss, we regularly back up our data:

  • Server (Hostinger): We back up the databases of our BTCPay Server (with invoices including the buyer's name and email address), of our server program (with the emails, orders and profiles stored there) and of our availability monitoring (with occasional order numbers) daily on the server and keep these backups for 7 days. Once a week, we store an encrypted copy in a non-public storage area at GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA ("GitHub"); only the owner holds the decryption key, and GitHub cannot read the contents. We keep the last 7 versions there (about 7 weeks). GitHub is certified under the TADPF. In addition, Hostinger backs up the entire server weekly; 2 versions of these are kept.
  • Payment page (IONOS): We back up a copy of our web space including the logs weekly on a computer of the owner and keep the last 8 weeks.
  • Customer service program: We back up the data every night, likewise on the owner's computer; we delete copies after 7 days (see "Processing of emails with the support of artificial intelligence (Anthropic Claude)", paragraph "Storage period").

The legal basis is Art. 6(1)(f) GDPR on the basis of our legitimate interest in the security and recoverability of our data. You have the right to object to this processing at any time on grounds relating to your particular situation. Further information: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

Data Subject Rights and Retention Periods

Retention period

After complete processing of the contract, the data is initially stored for the duration of the warranty period, then in compliance with statutory retention periods, in particular those under tax and commercial law, and then deleted after the period has expired, unless you have consented to further processing and use.

Deviating or additional periods for individual processing operations are stated in the respective sections. Deleted data may still be contained in backup copies until the periods stated in the section "Data backups" have expired.

Rights of the data subject

Subject to the legal requirements, you have the following rights under Arts. 15 to 20 GDPR: right of access, to rectification, to erasure, to restriction of processing and to data portability. In addition, under Art. 21(1) GDPR you have a right to object to processing based on Art. 6(1)(f) GDPR and to processing for direct marketing purposes.

If processing is based on your consent (Art. 6(1)(a) GDPR), you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). You can withdraw your consent to cookies and pixels by deleting our shop's cookies in your browser; the cookie banner will appear again on your next visit. Otherwise, an email to info@kratoein.com is sufficient. The lawfulness of the processing carried out until the withdrawal remains unaffected.

Right to lodge a complaint with a supervisory authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority competent for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen

Postfach 20 04 44, 40102 Düsseldorf

Tel.: +49 211 38424-0 · Fax: +49 211 38424-999

Email: poststelle@ldi.nrw.de

Right to object under Art. 21 GDPR

If processing is based on our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time with effect for the future on grounds relating to your particular situation. Following an objection, the processing of the data concerned will cease unless we can demonstrate compelling legitimate grounds for the processing.

If we process your data for direct marketing, you can object to this at any time without giving reasons; we will then no longer process it for this purpose.

In both cases, you can send your objection informally to info@kratoein.com.

Last updated: 19.10.2026