- Data Controller Identification
The entity responsible for the collection, processing, and use of personal data on this website in accordance with the General Data Protection Regulation (GDPR) and applicable data protection legislation is:
Website Domain (Data Controller): www.cookicutter.com
Brand: Cookicutter
Company: SSP Konsumgüter TRADE & CONSULT GmbH
Address: Philipp-Reis-Str. 15 B3/B4, 63128, Dietzenbach
Phone: +4917620374072
Email: cutter@cookicutter.com
If you have any queries regarding the collection, handling, or erasure of your personal details, please direct your correspondence to the email address provided above.
- Information Collected and Scope of Processing
When you visit www.cookicutter.com, place an order for cookie cutters, or communicate with customer support, certain personal data is processed to facilitate fulfilling the contract, maintaining technical stability, and complying with statutory obligations.
A. Server Log Files and Browsing Data
During standard internet usage, your browser automatically transmits information to our web servers. This technical data includes:
IP address of the requesting device
Date and time of server access
Browser type and operating system version
Requested pages, file downloads, and response codes
Legal Basis: Article 6(1)(f) GDPR (Legitimate Interest in ensuring system functionality, security, and integrity).
B. Order Processing and Customer Account Data
To process purchases of cookie cutters made through www.cookicutter.com, we collect the necessary transactional details:
Name, billing address, and delivery address
Email address and telephone number
Order items, quantity, price, and payment confirmation status
Legal Basis: Article 6(1)(b) GDPR (Performance of a Contract to which the data subject is party).
- Payment Processing via Stripe
Payment execution on www.cookicutter.com is facilitated through our integrated third-party payment service provider:
When you initiate checkout, your payment details (such as credit or debit card numbers, account details, and purchase totals) are transmitted directly to Stripe via secure, encrypted data transfers. www.cookicutter.com does not collect, view, or store raw financial payment credentials or full payment card numbers on our internal servers.
Stripe processes payment information to authorise transactions, perform anti-fraud screening, and facilitate billing processing.
Legal Basis: Article 6(1)(b) GDPR (Contract Performance) and Article 6(1)(f) GDPR (Legitimate Interest in securing legitimate payment processing).
For comprehensive information regarding Stripe’s data protection practices, please refer to the Stripe Privacy Policy at: https://stripe.com/privacy.
- Cookies and Analytical Technologies
www.cookicutter.com utilises cookies and similar web technologies to enable core website functionalities, manage shopping bag selections, and remember user preferences.
Essential Cookies: Strictly necessary for technical functionality and order placement. Legal Basis: Article 6(1)(b) GDPR and Section 25(2) TDDDG.
Non-Essential / Preference Cookies: Placed only upon obtaining your explicit consent via our website consent management tool. Legal Basis: Article 6(1)(a) GDPR and Section 25(1) TDDDG.
You may adjust your internet browser settings at any time to block or delete cookies; however, disabling technical cookies may limit access to certain features on www.cookicutter.com.
- Data Retention Periods
Personal data managed by www.cookicutter.com is stored only for as long as necessary to fulfill the purpose for which it was collected, or to comply with statutory retention requirements under German legal codes:
Commercial & Tax Records: Under Section 147 of the German Fiscal Code (Abgabenordnung – AO) and Section 257 of the German Commercial Code (Handelsgesetzbuch – HGB), transactional invoices, order records, and relevant accounting documentation are retained for up to ten (10) calendar years.
Customer Enquiries & General Correspondence: Standard email communications are retained for up to three (3) calendar years following the end of the year in which the inquiry was resolved, matching standard civil prescription statutes (Bürgerliches Gesetzbuch – BGB).
Technical Log Files: Server security logs are automatically deleted or anonymised within seven (7) to fourteen (14) calendar days, unless retained temporarily to investigate security incidents.
Upon expiry of statutory retention limits, data is routine erased or permanently anonymised in compliance with GDPR standards.
- Sharing Data with Third-Party Processors
Your personal data is shared only with trusted technical service providers where strictly required to fulfill orders or comply with legal duties:
Logistics and Delivery Partners: Address details are disclosed to logistics providers (e.g., postal or parcel delivery services) solely for physical delivery execution.
Hosting and IT Infrastructure Providers: Server and storage infrastructure operating under Data Processing Agreements (DPAs) in compliance with Article 28 GDPR.
Payment Processor: As described in Section 3, payment details are processed directly by Stripe Payments Europe, Ltd.
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
- Rights of the Data Subject
Under the GDPR, individuals located within the European Union and the Federal Republic of Germany retain statutory rights concerning their personal data:
Right of Access (Art. 15 GDPR): You have the right to request confirmation as to whether your personal data is being processed, along with copies of processed data.
Right to Rectification (Art. 16 GDPR): You may request correction of incorrect or incomplete personal data held by us.
Right to Erasure / Right to be Forgotten (Art. 17 GDPR): You may request deletion of personal data, provided retention is not required by legal tax obligations or legitimate defense of claims.
Right to Restriction of Processing (Art. 18 GDPR): You may request restricted data handling under specified statutory conditions.
Right to Data Portability (Art. 20 GDPR): You have the right to receive personal data provided to us in a structured, standard, and machine-readable format.
Right to Object (Art. 21 GDPR): You retain the right to object at any time to processing based on legitimate interests (Art. 6(1)(f) GDPR).
Right to Withdraw Consent: Where processing relies on your consent (Art. 6(1)(a) GDPR), you may withdraw consent at any time with future effect.
To exercise any of these rights, please submit your request to our customer support address: cutter@cookicutter.com.
- Supervisory Authority Notification Right
If you consider that the processing of your personal data infringes applicable data protection legislation, you have the statutory right under Article 77 GDPR to lodge a complaint with a competent supervisory authority, specifically in the EU Member State of your habitual residence, place of work, or the location of the alleged infringement (such as the State Data Protection Officer of the German Federal State where the business address is maintained). - Data Security Measures
www.cookicutter.com implements technical and organisational security controls (including SSL/TLS encryption protocols) designed to protect customer data against unauthorized access, loss, or manipulation. Security measures are continuously evaluated and updated to reflect contemporary technical standards; however, internet communications cannot be declared completely exempt from external vulnerability. - Revisions to This Privacy Policy
We reserve the right to amend this Privacy Policy to ensure alignment with changing legal regulations, judicial decisions, or operational updates. The most current ve