Privacy Policy

This is a translation provided for convenience. Only the German version is legally binding.

Unless otherwise stated below, the provision of your personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide the data. Not providing it has no consequences. This applies only insofar as no other information is given for the processing operations described below.
"Personal data" means any information relating to an identified or identifiable natural person.

Server log files

You can visit our website without disclosing any information about yourself.

Each time you access our website, usage data is transmitted by your internet browser to us or to our web host and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider.
The processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in ensuring the trouble-free operation of our website and in improving our offering.

Our website is hosted by ALL-INKL.COM - Neue Medien Münnich, Inhaber René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The web host processes the server log files and all other data processed on our website on our behalf; we have concluded a data processing agreement with it pursuant to Art. 28 GDPR. The server log files are stored only for as long as is necessary for the operation and security of the website; after that, they are deleted or anonymised.

Contact

Controller
Contact us if you wish. The controller responsible for data processing is: Storypunks Publishing UG (haftungsbeschränkt), Metzer Straße 7, 22049 Hamburg Deutschland, +494063654559, kontakt@storypunks.de

Contact initiated by the customer by e-mail
If you contact us by e-mail on your own initiative for business purposes, we collect your personal data (name, e-mail address, message text) only to the extent you provide it. The data processing serves to handle and answer your enquiry.
If the contact serves to carry out pre-contractual measures (e.g. advice on a purchase, preparation of a quotation) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 (1) (b) GDPR.
If you contact us for other reasons, this data processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in handling and answering your enquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you that is based on Art. 6 (1) (f) GDPR.
We use your e-mail address only to handle your enquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and processing when using the contact form
When you use the contact form, we collect your personal data (name, e-mail address, message text) only to the extent you provide it. The data processing serves the purpose of getting in touch.
If the contact serves to carry out pre-contractual measures (e.g. advice on a purchase, preparation of a quotation) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 (1) (b) GDPR.
If you contact us for other reasons, this data processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in handling and answering your enquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you that is based on Art. 6 (1) (f) GDPR.
We use your e-mail address only to handle your enquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Orders

Collection, processing and disclosure of personal data when you place an order

When you place an order, we collect and process your personal data only to the extent necessary to fulfil and process your order and to handle your enquiries. The provision of the data is necessary for the conclusion of the contract. If you do not provide it, no contract can be concluded. The processing is carried out on the basis of Art. 6 (1) (b) GDPR and is necessary for the performance of a contract with you.

In doing so, your data is passed on, for example, to shipping companies, dropshipping or fulfilment providers, payment service providers, service providers for order processing and IT service providers. In all cases, we strictly comply with the statutory requirements. The scope of the data transfer is limited to a minimum.

Payment service providers

If you choose to pay by invoice or by advance payment during the ordering process, we do not pass on any data to a payment service provider. For the other payment methods, we use the following payment service providers:

PayPal
If you pay with PayPal, you are redirected to the website of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg ("PayPal") to process the payment. In doing so, we transmit to PayPal the order number, the items ordered with their description, quantity and price, and the total amount including shipping costs. You log in to PayPal and enter your payment details exclusively with PayPal. Once the payment has been completed, we receive from PayPal the transaction number and the name and e-mail address of the payer; the name and e-mail address of the payer are shown on the invoice. The processing is carried out on the basis of Art. 6 (1) (b) GDPR and is necessary for the performance of the contract with you. Further information on data protection at PayPal can be found at https://www.paypal.com/de/legalhub/paypal/privacy-full.

SumUp (credit card)
If you pay by credit card, you are redirected to a payment page of SumUp Limited, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, Ireland ("SumUp") to process the payment. In doing so, we transmit to SumUp an order reference, the amount and a description of the items ordered. You enter your card details exclusively on the SumUp payment page; they are not transmitted to us. We only receive information from SumUp on whether the payment was successful. The processing is carried out on the basis of Art. 6 (1) (b) GDPR and is necessary for the performance of the contract with you. Further information on data protection at SumUp can be found at https://www.sumup.com/de-de/datenschutzbestimmungen/.

Customer account

Registration and use of the customer account
You can create a customer account with us. When you register, we collect your name and your e-mail address. We then send you an e-mail with a confirmation link that is valid for seven days. Your customer account is only activated once you have set a password via this link. We store your password exclusively in encrypted form (as a hash value). Registrations that are not confirmed are deleted automatically about 30 days after the confirmation link has expired.
In your customer account, we store the data you enter there or save there when placing an order, in particular your name, your address, where applicable your company and VAT identification number, the addresses in your address book, the e-mail addresses for PDF vouchers and for parcel notifications, and your parcel notification setting. You can also view your orders as well as your invoices and correction documents there. Orders that you placed without a customer account using the same e-mail address are assigned to your customer account once you have confirmed your e-mail address or when you log in, unless they are already assigned to another customer account or belonged to a closed customer account.
The processing is carried out on the basis of Art. 6 (1) (b) GDPR and is necessary for the performance of the contract for the use of the customer account and for processing your orders.

Closing the customer account
You can close your customer account yourself at any time or ask us to close it. When it is closed, we immediately delete the personal data stored in the customer account, in particular your name, your e-mail address, your address, where applicable your company and VAT identification number, your password, your address book, the e-mail addresses for PDF vouchers and parcel notifications and any trade proof you have uploaded. We keep your orders and invoices with the billing data they contain insofar as we are obliged to do so by retention periods under tax and commercial law (see "Storage period"); they are then no longer assigned to any customer account, not even to a new customer account with the same e-mail address. To that extent, the processing is carried out on the basis of Art. 6 (1) (c) GDPR.

Application for a dealer account and trade proof
As a retailer, you can apply for a dealer account. For this purpose, we collect the name of your company and your VAT identification number and/or a proof of trade, which you upload as a PDF, JPEG or PNG file. If you apply without an existing customer account, we also collect your name and your e-mail address and create a customer account for you, which you confirm as described above. The data processing serves the purpose of verifying that you are a retailer and deciding on your application. The processing is carried out on the basis of Art. 6 (1) (b) GDPR and is necessary for taking steps at your request prior to entering into a contract.
We store the trade proof in storage that is not publicly accessible and that only our staff can access. It is deleted as soon as a decision has been made on your application, regardless of whether the application is accepted or rejected. If the application is accepted, your company, VAT identification number and the decision remain stored in your customer account. If it is rejected, we delete your company, VAT identification number, the decision and its reasons from your customer account six months after the decision; the customer account itself remains.

Advertising


Use of your e-mail address for sending newsletters
We use your e-mail address to send you information and offers by newsletter, provided you have expressly consented to this. The data processing serves exclusively the purpose of direct advertising. For this purpose, we process your e-mail address and, where applicable, any further data you have voluntarily provided when subscribing to our newsletter.
The processing is carried out on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.
To do so, you can unsubscribe from the newsletter at any time by using the corresponding link in the newsletter or by notifying us. Your e-mail address will then be removed from the mailing list. Despite removal from the mailing list, we may continue to store your e-mail address in a so-called blacklist in order to prevent you from receiving newsletter e-mails from us in the future. This storage is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our and your legitimate interest in preventing your e-mail address from being used again to send our newsletter. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

Use of CleverReach
We use the service of CleverReach GmbH & Co. KG (Schafjückenweg 2, 26180 Rastede; “CleverReach”) to send our newsletter, as a processor acting on our behalf.
We pass on the information you provide when subscribing to the newsletter (e-mail address and, where applicable, first and last name) to CleverReach. The data processing serves the purpose of sending the newsletter and evaluating it statistically.
In order to evaluate newsletter campaigns, the newsletters sent contain a 1x1 pixel graphic (tracking pixel) or a tracking link. This enables us to determine whether you have opened the newsletter and whether you have clicked on any links it contains. Conversion tracking enables us to analyse, for example, whether a purchase was made after clicking a link in the newsletter or whether you registered on our website. In this context, we collect personal data such as your IP address, browser type and device, and the time. Pseudonymised usage profiles may be created from this data. The data collected is not used to identify you personally. The data collected is used solely for statistical evaluation in order to improve newsletter campaigns.
Your personal data is processed on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in a targeted, effective and user-friendly newsletter system. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.
Further information and the privacy policy of CleverReach can be found at: https://www.cleverreach.com/de-de/datenschutz/ and https://www.cleverreach.com/de-de/newsletter-tool/newsletter-reporting/.

Shipping service providers

Disclosure of your e-mail address to shipping companies to inform you about the shipping status
As part of the performance of the contract, we pass on your e-mail address to the carrier (Deutsche Post AG or DHL Paket GmbH), provided you have expressly consented to this during the ordering process (parcel notification by e-mail). For this we use the e-mail address you enter for the parcel notification or, if you do not enter one, your contact address. The disclosure serves the purpose of informing you about the shipping status by e-mail. The processing is carried out on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time by notifying us or the carrier, without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Disclosure of your e-mail address to DriveThruRPG for PDF vouchers
If your order includes a PDF edition, we pass on the e-mail address you enter for it during the ordering process or, if you do not enter one, your contact address, once to DriveThruRPG (operated by Roll20, LLC, USA). The disclosure serves the purpose of sending you the voucher for the PDF edition by e-mail. The processing is carried out on the basis of Art. 6 (1) (b) GDPR and is necessary for the performance of the contract with you. As DriveThruRPG is based in the USA, your data is transferred to a third country in the process. No adequacy decision applies to this transfer, because the provider is not certified under the EU-U.S. Data Privacy Framework. The transfer is based on Art. 49 (1) (b) GDPR, as it is necessary for the performance of the contract with you.

Cookies

Our website uses cookies. Cookies are small text files that are stored in or by the internet browser on a user's computer system. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is visited again.

Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can be notified before cookies are set, decide individually whether to accept them, and prevent cookies from being stored and the data they contain from being transmitted. Cookies that have already been stored can be deleted at any time. Please note, however, that you may then not be able to use all functions of this website to their full extent.

The following links explain how to manage cookies (including how to disable them) in the most common browsers:

Chrome: https://support.google.com/accounts/answer/61416?hl=de
Microsoft Edge: https://support.microsoft.com/de-de/edge/manage-cookies-in-microsoft-edge-view-allow-block-delete-and-use

Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen

Safari: https://support.apple.com/de-de/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Technically necessary cookies

Unless otherwise stated in this privacy policy below, we only use these technically necessary cookies for the purpose of making our offering more user-friendly, effective and secure. Furthermore, cookies enable our systems to recognise your browser even after you change pages and to offer you services. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after a page change.

Cookies or comparable technologies are used on the basis of Section 25 (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Your personal data is processed on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our offering.

You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

Analytics

Use of Matomo
On our website we use the open-source analytics tool Matomo. We run Matomo ourselves on our own server (matomo.storypunks.de) at our web host ALL-INKL.COM; the data collected is not transmitted to the maker of Matomo or to any other third party.
The data processing serves the purpose of analysing this website and its visitors. The following information, among other things, may be collected: IP address, shortened by two bytes and thus anonymised before it is stored (e.g. 192.168.xxx.xxx), information about the browser you use and about the device you use, files you click on or download, clicks on links to third-party websites, referrer URL (the website from which you accessed our website), URL of our website, date and time of the visit, time zone, location data. Pseudonymised usage profiles may be created from this data. The data collected with the Matomo technologies is not used to identify visitors to this website personally and is not merged with personal data about the bearer of the pseudonym.

Matomo does not set any cookies for this. To assign several page views to one visit, Matomo forms a hash value from technical characteristics of your request (operating system, browser and browser language, IP address). This value includes a random value that changes daily and is different for each of our websites. A visit is therefore only recognised on the same day and on the same website; Matomo does not recognise you across several days or websites. The hash value is stored with the data of the visit.

Your personal data is processed on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in designing the website in line with demand and in a targeted manner. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you. The use of Matomo and the associated data collection and storage can be deactivated at any time with effect for the future:

Further information on data protection at Matomo is available at https://matomo.org/gdpr-analytics/.

Rights of data subjects and storage period

Storage period
After the contract has been completely processed, the data is stored initially for the duration of the warranty period, then in compliance with statutory retention periods, in particular those under tax and commercial law, and is deleted once these periods have expired, unless you have consented to further processing and use.
Orders and invoices are accounting records; we keep them for eight years from the end of the calendar year in which the invoice was issued (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code). After that, we delete the names, addresses, e-mail addresses and the other personal details of the order as well as the invoice and correction documents. Only details without any personal reference remain, such as items, amounts, date and invoice number, which we use for statistics and royalty accounting.

Records of consent
If you accept our terms and conditions, the cancellation policy and this privacy policy when placing an order or consent to the parcel notification, and if you accept this privacy policy when registering or applying for a dealer account, we store the time and the version of the respective text. This serves as proof under Art. 7 (1) GDPR; the processing is carried out on the basis of Art. 6 (1) (c) GDPR. We keep these details for as long as the order or customer account they belong to; for a dealer application, at most for as long as the details of the application.

Rights of the data subject
Where the statutory requirements are met, you have the following rights under Art. 15 to 20 GDPR: the right of access, the right to rectification, the right to erasure, the right to restriction of processing and the right to data portability.
In addition, under Art. 21 (1) GDPR you have the right to object to processing based on Art. 6 (1) (f) GDPR and to processing for the purposes of direct marketing.

Right to lodge a complaint with the supervisory authority
Under Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you consider that the processing of your personal data is not lawful.

You can lodge a complaint, among others, with the supervisory authority responsible for us, which you can reach at the following contact details:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Str 22, 7. OG
20459 Hamburg
Tel.: +49 40 428544040
Fax: +49 40 428544000
E-Mail: mailbox@datenschutz.hamburg.de

Right to object
Where the processing of personal data described here is based on our legitimate interest under Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time with effect for the future on grounds relating to your particular situation.
Once you have objected, the processing of the data concerned will be stopped, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Last updated: 4 November 2026