Privacy policy
Who is responsible
march second GmbH, Hornau 9, 87600 Kaufbeuren, Germany. Managing director: Fabian Warmdt. Email: hello@showerandbach.com.
Reading the site
The shop uses no analytics cookies and no third-party analytics. The only cookie the storefront sets is the checkout cookie described below; it is set when you press a buy button. Our hosting provider, Vercel, processes the technical data every web request carries, such as your IP address, browser type and the time of the request, to deliver the pages and keep the site secure. Legal basis: our legitimate interest in a working and secure site, Art. 6(1)(f) GDPR.
Buying a product
When you press a buy button, our server sets a cookie whose name starts with fdg_checkout_capability. The cookie is HttpOnly, scoped to the path /api/storefront, and lasts 1 day. It lets this browser reopen its own checkout. It does not provide order status, on-page downloads or a way to refresh download links. It is sent over HTTPS only to our checkout endpoint, and this site's scripts cannot read it. It is strictly necessary for the purchase you asked for (ยง 25(2) no. 2 TDDDG) and is processed to perform that contract (Art. 6(1)(b) GDPR).
Payment happens on Stripe Checkout. Stripe collects your email address and payment details. We never see your card details. You need to give an email address and pay to buy; without them we cannot deliver the files.
Our order records hold the product, price, currency, Stripe's checkout and payment references, and the time of purchase. They do not hold your name, postal address or card details.
After payment, we read your email address from Stripe once and send a receipt email with a download link through Resend. If the email does not arrive or a link expires or reaches its download limit, contact us at hello@showerandbach.com. Your email address is held in the order record for this purchase.
Order records and the delivered files are kept with Supabase.
We keep order records as long as German law requires, generally up to 10 years.
Legal basis: performance of the contract, Art. 6(1)(b) GDPR, and our legal duty to keep accounting records, Art. 6(1)(c) GDPR.
Writing to us
Email you send to hello@showerandbach.com is processed by our email provider, Resend. We use it to answer you and keep it as long as needed for that and for any follow-up questions or claims, then delete it unless a statutory retention duty applies. Legal basis: Art. 6(1)(b) or (f) GDPR.
Service providers
Vercel (hosting), Supabase (database and file storage), Stripe (payment) and Resend (email). They process data on our behalf under our instructions; Stripe also processes payment data under its own responsibility for payment, fraud prevention and legal duties.
Transfers outside the EEA
Some of these providers process data outside the European Economic Area, including in the United States. Where they do, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, if the provider is certified, or on EU Standard Contractual Clauses.
Automated decisions
We make no decisions based solely on automated processing that have legal or similarly significant effects on you.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection under Articles 15 to 21 GDPR. In particular you may object at any time to processing based on our legitimate interests (Art. 21 GDPR). Write to hello@showerandbach.com. You may also complain to a data protection supervisory authority.