Privacy Policy

Last updated on March 17, 2025

Unless otherwise stated below, the provision of your personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide the data has no consequences. This only applies insofar as no other information is provided in the following processing operations.
"Personal data" is all information that relates to an identified or identifiable natural person.


Server Log Files
You can visit our website without providing any personal information. 
Every time you access our website, usage data is transmitted to us or our web host/IT service provider through your internet browser and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, date and time of access, IP address, amount of data transferred, and the requesting provider.
The processing is based on Art. 6 (1) lit. f GDPR from our overriding legitimate interest in ensuring trouble-free operation of our website and improving our services. 

 
Contact

Controller
Contact us if you wish. The controller for data processing is: Stetic GmbH, Schwanengasse 7, 64380 Roßdorf Germany, 06154 5755947, hey@headyshot.com

Customer's Initiative Contact via Email
When you contact us by email on your own initiative for business purposes, we collect your personal data (name, email address, message text) only to the extent you provide it. The data processing serves to process and respond to your contact request.
If the contact serves to carry out pre-contractual measures (e.g., consultation in case of purchase interest, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is based on Art. 6 (1) lit. b GDPR.
If the contact is made for other reasons, this data processing is based on Art. 6 (1) lit. f GDPR from our overriding legitimate interest in processing and responding to your request. In this case, you have the right to object at any time to this processing of personal data concerning you based on Art. 6 (1) lit. f GDPR for reasons arising from your particular situation.
We only use your email address to process your request. Your data will then be deleted in compliance with legal retention periods, unless you have consented to further processing and use.


Collection and Processing when Using the Contact Form
When using the contact form, we collect your personal data (name, email address, message text) only to the extent you provide it. The data processing serves the purpose of establishing contact.

If the contact serves to carry out pre-contractual measures (e.g., consultation in case of purchase interest, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is based on Art. 6 (1) lit. b GDPR.
If the contact is made for other reasons, this data processing is based on Art. 6 (1) lit. f GDPR from our overriding legitimate interest in processing and responding to your request. In this case, you have the right to object at any time to this processing of personal data concerning you based on Art. 6 (1) lit. f GDPR for reasons arising from your particular situation.
We only use your email address to process your request. Your data will then be deleted in compliance with legal retention periods, unless you have consented to further processing and use.

Collection and Processing when Sending Images via Upload
We provide an upload function for image files on our website. This makes it possible to send images to us via encrypted data transmission. When transmitting your images, we collect your personal data (depiction of identifiable persons) only to the extent you provide it. The data processing serves the purpose of creating personalized products. The transmitted image serves as a template for the product and is used for this purpose (e.g., T-shirt printing). The processing is based on Art. 6 (1) lit. b GDPR and is necessary for the performance of a contract with you.
In this case, your data may be passed on to service providers whom we use within the framework of order processing. There is no transfer to other third parties.
We only use the image you sent within the framework of service provision. Your data will then be deleted in compliance with legal retention periods, unless you have consented to further processing and use.

Customer Account      Orders      

Customer Account
When opening a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing is based on Art. 6 (1) lit. a GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. Your customer account will then be deleted.


Collection, Processing and Transfer of Personal Data in Orders
When ordering, we collect and process your personal data only insofar as this is necessary for the fulfillment and processing of your order and for processing your inquiries. The provision of data is necessary for the conclusion of the contract. Failure to provide the data means that no contract can be concluded. The processing is based on Art. 6 (1) lit. b GDPR and is necessary for the performance of a contract with you. 
Your data will be passed on, for example, to shipping companies, dropshipping and/or fulfillment providers, payment service providers, service providers for order processing and IT service providers. In all cases, we strictly observe the legal requirements. The scope of data transmission is limited to a minimum.
 
Advertising      


Use of Email Address for Sending Direct Advertising
We use your email address, which we received in the context of the sale of goods or services, for the electronic transmission of advertising for our own goods or services that are similar to those you have already purchased from us, insofar as you have not objected to this use. The provision of the email address is necessary for the conclusion of the contract. Failure to provide the data means that no contract can be concluded. The processing is based on Art. 6 (1) lit. f GDPR from our overriding legitimate interest in direct advertising. You can object to this use of your email address at any time by notifying us. You can find the contact details for exercising your objection in the legal notice. You can also use the link provided for this purpose in the advertising email. This will not incur any costs other than the transmission costs according to the basic rates.


Use of Mailchimp
We use the service of Rocket Science Group LLC (675 Ponce de Leon Ave NE, Suite 5000 Atlanta, GA 30308, USA; "Mailchimp") for sending newsletters within the framework of order processing.
We pass on the information you provide during newsletter registration (email address, if applicable first and last name) to Mailchimp. The data processing serves the purpose of sending newsletters and their statistical evaluation.
To evaluate newsletter campaigns, the sent newsletters contain a 1x1 pixel graphic (tracking pixel) or a tracking link. This allows us to determine whether you have opened the newsletter and whether you have clicked on any integrated links. In this context, we collect your personal data such as IP address, browser type and device, and the time. Usage profiles can be created from this data under a pseudonym. The collected data will not be used to identify you personally. The collected data is only used for statistical evaluation to improve newsletter campaigns.
Your data is usually transmitted to Mailchimp servers in the USA and stored there. For the USA, there is an adequacy decision of the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Mailchimp is not certified under TADPF. The data transfer takes place, among other things, on the basis of standard contractual clauses as appropriate guarantees for the protection of personal data, viewable at: 
https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_de.
The processing of your personal data is based on Art. 6 (1) lit. f GDPR from our overriding legitimate interest in a targeted, effective and user-friendly newsletter system. You have the right to object at any time to these processing operations of personal data concerning you for reasons arising from your particular situation.
You can find more information and MailChimp's privacy policy at: https://mailchimp.com/de/legal/data-processing-addendum/ and https://www.intuit.com/privacy/statement/


Payment Service Providers      

Use of PayPal Check-Out
We use the payment service PayPal Check-Out of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. The data processing serves the purpose of being able to offer you payment via the payment service. When selecting and using payment via PayPal, credit card via PayPal, direct debit via PayPal or "Pay Later" via PayPal, the data required for payment processing is transmitted to PayPal to fulfill the contract with you with the selected payment method. This processing is based on Art. 6 (1) lit. b GDPR.

Cookies may be stored here that enable the recognition of your browser. The data processing that takes place is based on Art. 6 (1) lit. f GDPR from our overriding legitimate interest in a customer-oriented offer of various payment methods. You have the right to object at any time to this processing of personal data concerning you for reasons arising from your particular situation.

Credit Card via PayPal, Direct Debit via PayPal & "Pay Later" via PayPal 
For certain payment methods such as credit card via PayPal, direct debit via PayPal or "Pay Later" via PayPal, PayPal reserves the right to obtain a credit report on the basis of mathematical-statistical procedures using credit agencies if necessary. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of a payment default for a balanced decision on the establishment, implementation or termination of the contractual relationship. The credit report may include probability values (score values) that are calculated on the basis of scientifically recognized mathematical-statistical procedures and in the calculation of which address data, among other things, is included. Your legitimate interests are taken into account in accordance with the legal provisions. The data processing serves the purpose of credit assessment for the initiation of a contract. The processing is based on Art. 6 (1) lit. f GDPR from our overriding legitimate interest in protection against payment default when PayPal makes advance payments. 
You have the right to object at any time to this processing of personal data concerning you based on Art. 6 (1) lit. f GDPR for reasons arising from your particular situation by notifying PayPal. The provision of data is necessary for the conclusion of the contract with your desired payment method. Failure to provide the data means that the contract cannot be concluded with your chosen payment method.

Third Party Providers
When paying via a third-party payment method, the data required for payment processing is transmitted to PayPal. This processing is based on Art. 6 (1) lit. b GDPR. To carry out this payment method, the data may then be passed on by PayPal to the respective provider. This processing is based on Art. 6 (1) lit. b GDPR. Local third-party providers may include:

  • Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
  • Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)

Invoice Purchase via PayPal 
When paying via the payment method invoice purchase, the data required for payment processing is first transmitted to PayPal. To carry out this payment method, the data is then passed on by PayPal to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") to fulfill the contract with you with the selected payment method. This processing is based on Art. 6 (1) lit. b GDPR. Ratepay may carry out a credit check on the basis of mathematical-statistical procedures (probability or score values) using credit agencies according to the process already described above. The data processing serves the purpose of credit assessment for the initiation of a contract. The processing is based on Art. 6 (1) lit. f GDPR from our overriding legitimate interest in protection against payment default when Ratepay  makes advance payments. You can find more information about data protection and which credit agencies Ratepay uses at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/

You can find more information about data processing when using PayPal in the associated privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.


Use of the Payment Service Provider Stripe
We use the payment service Stripe of Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) on our website. The data processing serves the purpose of being able to offer you payment via the payment service. When selecting and using Stripe, the data required for payment processing is transmitted to Stripe to fulfill the contract with you with the selected payment method. This processing is based on Art. 6 (1) lit. b GDPR. 
Stripe reserves the right to obtain a credit report on the basis of mathematical-statistical procedures using credit agencies if necessary. For this purpose, Stripe transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of a payment default for a balanced decision on the establishment, implementation or termination of the contractual relationship. The credit report may include probability values (score values) that are calculated on the basis of scientifically recognized mathematical-statistical procedures and in the calculation of which address data, among other things, is included. Your legitimate interests are taken into account in accordance with the legal provisions. The data processing serves the purpose of credit assessment for the initiation of a contract. The processing is based on Art. 6 (1) lit. f GDPR from our overriding legitimate interest in protection against payment default when Stripe makes advance payments. 
You have the right to object at any time to this processing of personal data concerning you based on Art. 6 (1) lit. f GDPR for reasons arising from your particular situation by notifying Stripe. The provision of data is necessary for the conclusion of the contract with your desired payment method. Failure to provide the data means that the contract cannot be concluded with your chosen payment method.
All Stripe transactions are subject to the Stripe Privacy Policy. You can find this at https://stripe.com/de/privacy 
 
Use of the Payment Method Link
We use the payment service Link of Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; "Stripe").
The data processing serves the purpose of being able to offer you quick and easy payment via the payment service if you have a customer account with Link.
To integrate this payment service, it is necessary for Stripe to collect, store and analyze data (e.g., IP address, device type, operating system, browser type, location of your device, language settings, date and time of page access) when accessing the website and using the payment service. For this purpose, cookies may also be used that enable the recognition of your browser.
The use of cookies or similar technologies takes place with your consent on the basis of § 25 (1) sentence 1 TDDDG  in conjunction with Art. 6 (1) lit. a GDPR. The processing of your personal data takes place with your consent on the basis of Art. 6 (1) lit. a GDPR. You can revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until revocation.
When selecting and using Link, the data required for payment processing is transmitted to Stripe to fulfill the contract with you with the selected payment method. This processing takes place for the fulfillment of the contract concluded between you and us on the basis of Art. 6 (1) lit. b GDPR.
You can find more information about data processing when using the payment service Link at https://link.co/de/privacy and at https://link.co/de/privacy-center
 

Plug-ins and Other

Integration of the Händlerbund Member Logo
The Händlerbund member logo (Händlerbund e.V., Kohlgartenstraße 11 - 13, 04315 Leipzig) is integrated on our website. When accessing our website, information is automatically sent to the Händlerbund e.V. server by the browser used on your end device. This information is temporarily stored in a so-called server log file for 7 days. The following information is collected and stored until automated deletion without your intervention:
  • IP address of the requesting computer,
  • Date and time of access,
  • Name and URL of the retrieved file,
  • Website from which the access was made (referrer URL),
  • Browser used and, if applicable, the operating system of your computer and the name of your access provider. 
The temporary storage of the IP address by the system is necessary to enable delivery of the website. For this purpose, the IP address must remain stored for the duration of the session. Storage in log files takes place to ensure the functionality of the website. In addition, the data serves to optimize the website and to ensure the security of our information technology systems. These data are not stored together with other personal data. The legal basis for data processing is Art. 6 (1) sentence 1 lit. f GDPR.

Data Subject Rights and Storage Duration

Storage Duration
After complete contract processing, the data will initially be stored for the duration of the warranty period, then taking into account statutory, in particular tax and commercial law retention periods, and then deleted after expiry of the period, unless you have consented to further processing and use.


Rights of the Data Subject
If the legal requirements are met, you have the following rights pursuant to Art. 15 to 20 GDPR: Right to information, correction, deletion, restriction of processing, data portability.
In addition, you have the right to object to processing based on Art. 6 (1) f GDPR pursuant to Art. 21 (1) GDPR, as well as to processing for the purpose of direct advertising.


Right to Lodge a Complaint with the Supervisory Authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you consider that the processing of your personal data is not lawful.


You can lodge a complaint, among other things, with the supervisory authority responsible for us, which you can reach at the following contact details:

Hessian Commissioner for Data Protection and Freedom of Information
P.O. Box 3163
65021 Wiesbaden
Tel.: +49 611 14080
Fax: +49 611 1408900 or +49 611 1408901
E-Mail: poststelle@datenschutz.hessen.de


Right to Object
If the personal data processing listed here is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, you have the right to object to these processing operations at any time with effect for the future for reasons arising from your particular situation.
After an objection has been raised, the processing of the data concerned will be terminated, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if the processing serves the purpose of asserting, exercising or defending legal claims.


If personal data is processed for the purposes of direct advertising, you can object to this processing at any time by notifying us. After an objection has been raised, we will stop processing the data concerned for the purpose of direct advertising.