Privacy Policy

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is: Fynn Kopany, Bodelschwinghstraße 10/2, 72636 Frickenhausen, Deutschland, support@36dsp.com — see our Imprint for full details. For any questions about data protection, please contact us at support@36dsp.com.

When you create an account, we process the email address, password (stored only as a bcrypt hash, never in plain text), display name, and, if you choose to upload one, a profile picture. When you purchase a license, we additionally store the ordered product, the issued license key, and its activation status, linked to your account.

We process this data to create and administer your account, to fulfil purchase contracts, and to provide license management (Art. 6 (1)(b) GDPR — performance of a contract). Email verification codes and password-reset codes are short-lived (they expire after one hour) and are processed on the same legal basis as well as our legitimate interest in account security (Art. 6 (1)(f) GDPR).

This website and our database are operated on infrastructure provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Like most websites, our server automatically logs technical information for every page request, such as IP address, browser type, referring page, date and time, in server log files. This occurs to ensure stable and secure operation of the website (Art. 6 (1)(f) GDPR — legitimate interest) and these logs are deleted after a short period unless needed to investigate a security incident.

We use only the following storage technologies on your device:

• Session cookie — set by our authentication system (NextAuth) once you log in, to keep you signed in. This cookie is strictly necessary for the Shop and account area to function.
• Shopping cart (localStorage) — the contents of your cart are stored locally in your browser so they persist between visits. This data is not transmitted to our servers until you check out.

We do not use analytics, advertising, or tracking cookies. Because the technologies above are strictly necessary for the service you requested, no consent banner is required under Sec. 25 (2) No. 2 TDDDG (German Telecommunications-Digital Services Data Protection Act). You can delete cookies and local storage at any time via your browser settings; doing so will log you out and clear your cart.

We send transactional emails (email verification codes, password-reset codes) via an SMTP relay. At present this relay is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Gmail SMTP”), which acts as a processor on our behalf (Art. 28 GDPR) and may process data on servers outside the EEA, in which case Google’s standard contractual clauses apply. We are working towards migrating to a dedicated transactional email provider; this section will be updated accordingly.

Live payment processing is not yet enabled in the Shop, so no payment service provider currently receives your card or bank data through us. Once a payment provider (e.g. a card or PayPal processor) is activated, we will update this Privacy Policy to name the provider, describe the data shared with it, and obtain any consent required before activation.

We retain account and license data for as long as your account remains active. If you delete your account, we erase your personal data without undue delay, except for information we are legally required to retain — for example, invoice-relevant data, which must be kept for up to ten years under German commercial and tax law (Sec. 257 HGB, Sec. 147 AO). Verification and password-reset codes are deleted automatically after expiry (one hour) or use.

Under the GDPR, you have the right to:

• request access to the personal data we hold about you (Art. 15 GDPR);
• request rectification of inaccurate data (Art. 16 GDPR);
• request erasure of your data (Art. 17 GDPR), e.g. by deleting your account;
• request restriction of processing (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on legitimate interest (Art. 21 GDPR);
• lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR) — for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), Königstraße 10a, 70173 Stuttgart, www.lfdi-bw.de.

To exercise any of these rights, contact us at support@36dsp.com.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Our offer is not directed at individuals under the age of 16. If you are under 16, please do not create an account or submit personal data without the consent of a parent or legal guardian.

We may update this Privacy Policy to reflect changes to our data processing practices (for example, when payment processing or a new email provider is activated). The current version is always available on this page.