Privacy Policy.

1. Data Controller

3D-Druck Alexander Christl (MagfedSchmiede)

Alexander Christl

Prälatenweg 3

96117 Memmelsdorf

Germany

Email: info@magfedschmiede.de

Telephone: +49 162 9541725

2. General Information and Legal Bases

We process personal data only to the extent necessary to operate our online shop, handle orders, enquiries, reviews and withdrawal requests, and comply with legal obligations.

The relevant legal bases are, in particular, Article 6(1)(b) of the General Data Protection Regulation (GDPR) (steps before entering into a contract and performance of a contract), Article 6(1)(c) GDPR (legal obligations), Article 6(1)(f) GDPR (legitimate interests, such as security and prevention of misuse), and Article 6(1)(a) GDPR (consent), where required.

3. Hosting and Technical Logs (Vercel)

Our shop pages and server-side features are hosted by Vercel. When you access the site, technically necessary information, such as your IP address, the time of access, the page requested, browser and device information, and error or security logs, may be processed. This is necessary to provide, maintain and secure the shop (Article 6(1)(f) GDPR).

Depending on the technical configuration, hosting and security providers may process information in countries outside the European Economic Area. In such cases, the applicable data-protection requirements, including suitable safeguards under Articles 44 et seq. GDPR, must be observed. Details of subprocessors and retention are governed by the relevant provider agreements.

4. Orders and Database (Supabase)

To process orders, we use your name, billing and delivery address, email address, products ordered, quantities, prices, destination country, order number, payment and processing status, and invoice information.

Order and product data are processed in a secured database hosted by Supabase. The database for our MagfedSchmiede project is located in the EU (Frankfurt) region. Additional technical processing by the provider or its subprocessors may take place.

Legal bases: Article 6(1)(b) and (c) GDPR. Information is shared only insofar as necessary for order processing, delivery, reconciliation of payments and legal obligations. We do not sell customer data.

5. Payments

The shop may offer bank transfer, PayPal and Stripe (including card payment). Bank transfers involve processing of payment information by the banks concerned. Where you choose PayPal or Stripe, the respective payment provider processes your payment. This may require us to transmit the order reference, amount, currency and contact or transaction information necessary for payment.

We do not collect or store complete payment-card numbers ourselves. We record the payment status and transaction identifiers required to administer the order (Article 6(1)(b) and (c) GDPR).

6. Dispatch and Delivery

We provide our shipping provider (DHL) with the recipient and address details necessary to deliver your order (Article 6(1)(b) GDPR). Shipping details and tracking numbers may be stored to process the order.

7. Email Communications, Invoices and Archiving

Order confirmations and invoices are sent using our business email account with STRATO. We process order and invoice details to generate invoices.

A copy of each invoice is forwarded to a dedicated Google Gmail mailbox for document ingestion and then stored in our self-hosted document archive, Paperless-ngx, on a NAS. This is done to meet statutory documentation and retention obligations (Article 6(1)(c) GDPR). A copy of the PDF invoice is also stored in a protected, private area of the shop backend.

When you contact us by email or through the contact form, we process the name, email address, subject, message and any links or print files you choose to provide to handle your enquiry or prepare an offer (Article 6(1)(b) or (f) GDPR). Files submitted using the contact form are processed temporarily by the server and sent as attachments to our STRATO business mailbox; they are not separately stored permanently in the shop backend. For abuse prevention, we count requests using a pseudonymised, secretly signed connection identifier, which is kept for no longer than two days. Please avoid including unnecessary personal information in files.

7a. Automatic 3D-Printing Quotes and Print-File Archives

If you use our optional 3D-printing price calculator or configurator, we process the STL or 3MF files you provide, or print files created by the server, together with the filename, printer settings, material and quantity. These details are used to provide a non-binding price estimate, check printability and, if you subsequently place an order, manufacture the part and process that order (Article 6(1)(b) GDPR).

Files are temporarily stored in a private area of Supabase so that they can be retrieved securely by our self-hosted NAS for technical calculations with OrcaSlicer. We also store the original file and the order data required for processing in access-controlled folders on the NAS. Merely calculating a price does not cause a file to be printed or published.

Temporary copies in private cloud storage are cleaned up after a limited period. In the current worker process, cleanup is planned within up to 30 days for regular uploaded files and after approximately 24 hours for incomplete uploads. This cleanup depends on the responsible service operating correctly. Original files archived on the NAS are retained only while required to review, handle or fulfil an order or to comply with statutory retention duties. No single fixed deletion deadline is promised for all original files. The relevant criteria are whether the purpose has ended and whether any legal retention duties remain. Files that are no longer required are deleted.

You can request deletion of print files that are no longer required by contacting info@magfedschmiede.de; mandatory statutory retention obligations remain unaffected. Please avoid uploading files containing unnecessary personal data.

8. Basket, Wishlist and Display Preferences

The shop uses information stored locally in your browser (Local Storage) to retain your basket, wishlist and display preferences, including light/dark mode. This information is used for features you request and is not submitted to the shop as an order merely because it is stored locally.

Notices on the homepage and a reminder shown when leaving a non-empty basket may be hidden for the rest of the browser session after closing or after a single display (Session Storage). This storage is used only to control the notice. You can delete this information using your browser settings.

9. Reviews and Abuse Prevention

If you submit a product review, we process the name you enter, your star rating, review text and the product to which the review relates. Reviews are checked before publication. Short-lived technical identifiers, a security cookie and pseudonymised connection identifiers may be used to prevent automated abuse (Article 6(1)(f) GDPR). Published reviews are visible to visitors.

10. Administrator Login

We use Supabase Auth for internal shop administration. This involves technically necessary session cookies. Administrative areas and protected customer areas are not required for ordinary visits to the shop.

11. Withdrawals

When a withdrawal is submitted electronically, we process the name supplied, details identifying the order or the relevant part of the contract, the email address for the acknowledgement and the time at which the withdrawal was received. This is necessary to provide and document the statutory withdrawal function (Article 6(1)(b) and (c) GDPR). We do not require a reason for withdrawal.

12. Retention Periods

We retain personal data only while necessary for the purposes described above or for applicable statutory retention periods. Tax-relevant invoices and accounting documents are generally retained for eight years after the end of the relevant calendar year; other periods may apply to different categories of documents. Data for which there is no continuing purpose or legal retention obligation is deleted or anonymised.

13. Your Rights

Subject to the statutory conditions, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection (Article 21). You may withdraw consent at any time with effect for the future.

You may lodge a complaint with a data-protection supervisory authority (Article 77 GDPR), particularly the Bavarian Data Protection Supervisory Authority (Bayerisches Landesamt für Datenschutzaufsicht). Please send requests to info@magfedschmiede.de.

14. Google Analytics 4 (Optional Analytics)

We use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Analytics helps us understand how customers use our shop and improve its navigation, products and checkout flow. With your consent, we track events such as page views, product views, basket and checkout interactions and completed purchases, including the associated monetary amounts.

The Google tag is loaded only after you explicitly choose to allow analytics in our consent dialog. If you choose essential storage only, we do not load Google Analytics scripts. We use the basic implementation of Consent Mode v2; consent for advertising storage and personalised advertising remains disabled. Your choice is stored locally in your browser and may be changed using Cookie settings in the footer.

If you consent, information about your device, browser, pages visited, visit times, and technical identifiers and analytics cookies such as _ga and _ga_* may be processed. The maximum lifetime we set for Google Analytics cookies is 365 days. We do not transmit customers' names, email addresses, postal addresses, uploaded files or personalisation text to Google Analytics. Purchase events may include product data, euro amounts and a pseudonymous order reference to avoid duplicate event counting. You may use the shop normally if you decline analytics.

The legal basis for optional storage of or access to information on your device is your consent under section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Subsequent processing is based on Article 6(1)(a) GDPR. You can withdraw consent at any time for the future using Cookie settings. Withdrawal does not make past processing unlawful. On withdrawal, we stop further analytics transmission and delete accessible Google Analytics cookies where technically possible.

Google may process information outside the European Economic Area, particularly in the United States. The applicable data-protection safeguards are relevant to such transfers. Retention within Google Analytics depends on our GA4 property settings. Google's privacy information is available at https://policies.google.com/privacy

15. Changes

We update this information if our shop features, providers or legal requirements change. This privacy policy applies to the MagfedSchmiede online service.

Last updated: November 2026.