Privacy policy.
Updated: 20 October 2026
Controller and contact
Newmatik GmbH, Am Markt 1, 55619 Hennweiler, operates the E-Modell shop. Send privacy enquiries to info@e-modell.de or the postal address above.
Visiting the shop
The website and its interfaces are provided through Cloudflare. Cloudflare processes technical connection data, particularly IP address, time, requested URL and browser information, to deliver content and defend against attacks. This processing serves our legitimate interest in an available and secure shop (Article 6(1)(f) GDPR). Further information: Cloudflare privacy policy.
Shopping cart on your device
The shop stores item identifiers, quantities and a random checkout reference in your browser's local storage. This preserves your selection when navigating between pages or restarting payment. We also store a SHA-256 fingerprint of your email address so that a repeated payment attempt for the same address can be associated with the existing checkout reference. This fingerprint is a pseudonymous identifier. Your email address itself, names, addresses and payment details are not stored in this cart storage. You can remove the saved selection by emptying the cart or deleting the website's data in your browser. The shop does not include analytics or advertising trackers.
Appearance
If you explicitly choose a light or dark appearance, we store that preference locally in your browser. The “System” option follows your device settings and removes the saved preference. This preference is not sent to an analytics service.
Orders, payment and delivery
You may order as a guest. A customer account is not required to place an order. For ordering, payment, delivery and enquiries, we process your contact details, billing and delivery addresses, ordered items, amounts, payment status and payment references. We also record acceptance of the terms and conditions, including the text version and timestamp. The legal bases are steps prior to entering into a contract and performance of the contract (Article 6(1)(b) GDPR), and Article 6(1)(c) GDPR for statutory retention requirements.
Payment takes place on a checkout page provided by Stripe. Stripe receives the information needed for the selected payment method and the order amount, and also processes data for payment security and fraud prevention. Full card details or bank access credentials are not stored in our shop database. Other payment service providers may be involved, depending on the payment method. The Stripe privacy policy also applies.
Customer and order data are stored with Supabase in the Frankfurt (EU) project region. The shop interfaces process these data on the server; the customer and order database is not publicly accessible. Further information: Supabase privacy policy. Delivery providers receive the delivery details necessary to fulfil the shipment.
Optional customer account
You can sign in to view your orders using your email address and a one-time code. Supabase Auth processes your address, verification and technical sign-in data. Previous and new orders are displayed only after verification of the same email address. The account does not use a password. The legal basis is the account functionality you request (Article 6(1)(b) GDPR).
Signing in uses necessary cookies protected against JavaScript access. The short-lived access cookie lasts for a maximum of one hour; the refresh cookie lasts for a maximum of 30 days unless the session ends sooner. Signing out removes both cookies. Sign-in codes and access tokens are not stored in the local cart storage.
Sign-in and order emails
We use Resend (Plus Five Five, Inc.) to send sign-in codes and order messages. Your email address, the relevant message content and technical delivery information are processed for this purpose. Order messages may contain ordered items, amounts and delivery details. This processing supports the requested sign-in and performance of the contract (Article 6(1)(b) GDPR). Ireland is selected as the region for our sending domain; this does not mean that Resend and its subprocessors process all data exclusively within the EU. Further information: Resend privacy policy.
Online withdrawal
When you submit an online withdrawal, we record your name, the email address supplied, contract reference, scope of the declaration and receipt time. We send an acknowledgement through Resend and then handle any return and reimbursement. The legal bases are our legal obligations and performance of the contract (Article 6(1)(c) and (b) GDPR). To prevent abuse, we also use an identifier derived from your IP address with a secret key. The IP address itself is not stored in the withdrawal record; the derived identifier is removed at the next processing run after 24 hours. This is based on our legitimate interest in keeping the form available and preventing misuse (Article 6(1)(f) GDPR).
Contact and retention
When you contact us, we process your message and contact details to handle your enquiry. Contract-related enquiries are processed under Article 6(1)(b) GDPR; other enquiries are processed based on our legitimate interest in responding under Article 6(1)(f) GDPR. We retain personal data for the relevant purpose, statutory retention requirements and handling possible legal claims. Data are then deleted or anonymised unless another permitted processing purpose exists.
International processing and your rights
The providers named above may use international group companies and subprocessors in addition to their European systems. Information about processing locations and the applicable transfer mechanisms is available in the providers' linked privacy policies. Selecting an EU database region does not mean that all processing by every provider takes place exclusively within the EU.
Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may withdraw consent with effect for the future. You may also lodge a complaint with a data protection supervisory authority. General Data Protection Regulation.