Privacy Policy:

1. Controller

The data controller responsible for processing personal data on this website is:

Uwe SörensenMarionettenbau[Anschrift vollständig einsetzen]85077 ManchingDeutschland

Phone: 08459 9390707Email: info@marionettenbau.deWebsite: https://www.marionettenbau.de

No data protection officer has been appointed, as the legal requirements for mandatory appointment of a data protection officer are not met.

2. General Information on Data Processing

Protecting your personal data is important to me.

I process personal data exclusively in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

Personal data means any information relating to an identified or identifiable natural person, such as a name, address, email address, telephone number or other details that can be attributed to a person.

As a rule, I collect and process personal data only to the extent necessary to operate this website, respond to enquiries, prepare for and fulfil orders, and meet legal obligations.

3. Website access and server log files

When you visit my website, the web server may automatically collect information as part of its technical operation.

This may include in particular:

• IP address of the device accessing the website,
• Date and time of access,
• web pages accessed,
• amount of data transferred,
• browser used,
• operating system used,
• referrer URL,
• technical information about access.

Processing is carried out to make the website technically available, ensure stable and secure operation, and detect and prevent potential attacks.

The legal basis is Art. 6(1)(f) GDPR. My legitimate interest is ensuring the website operates securely and properly.

Log data will be deleted as soon as it is no longer needed for the purposes stated, unless statutory retention obligations or legitimate reasons require it to be stored for longer.

Note: The specific retention period for server log files also depends on the settings of my web hosting provider.

4. Contact by email, telephone or other message

If you contact me by email, phone or other means, the personal data you provide will be processed.

These may include, in particular:

• name,
• Email address,
• Telephone number,
• address,
• Content of your inquiry,
• Details of the puppet you would like,
• other information provided voluntarily.

Processing is carried out solely to handle your inquiry, provide advice, prepare a quote and—if an order is placed—perform the contract.

Depending on the circumstances, the legal basis is Art. 6(1)(b) GDPR, where processing is necessary to take steps prior to entering into a contract or to perform a contract, and Art. 6(1)(f) GDPR, where processing is necessary to protect legitimate interests.

Where statutory retention obligations apply, data is stored on the basis of Art. 6(1)(c) GDPR.

5. Custom Puppets Made to Order

As my marionettes are made to order as unique, individual pieces, it may be necessary to process customers’ personal data.

These may include, for example:

• Name and contact details,
• Details of height, appearance or distinguishing features,
• Preferences for the design of the marionette,
• other information required for the custom order.

This information will be used solely to the extent necessary to advise on, plan, make arrangements for, manufacture or fulfil the relevant order.

The legal basis is Art. 6(1)(b) GDPR.

6. Processing of Photos for Portrait and Custom Orders

Customers may submit photos or other image references to have marionettes made from photos.

Such photos may contain personal data. In particular, a person shown in a photo may be identifiable.

The photos provided will be used solely to the extent necessary to advise on, plan and create the custom puppet commissioned.

The legal basis for processing is generally Art. 6(1)(b) GDPR, where processing is necessary for pre-contractual measures or the performance of an existing order.

Photos of other people

If a customer submits photos of another person, the customer is responsible for ensuring that they are authorised to submit and use those photos for the agreed purpose.

As a rule, I do not use such photos for any other purpose.

Photos provided by customers will not be published on my website, on social media, in promotional materials or for any other advertising purposes without a separate legal basis or consent where required.

7. Storage and deletion of customer photos

Photos and image references provided solely for the creation of a custom marionette are generally stored only for as long as necessary to process the order, consult with the customer or fulfil statutory or legal obligations.

Once the relevant purpose no longer applies, the photos will be deleted unless statutory retention obligations or legitimate reasons require them to be stored for longer.

If photos form part of business records or are required as evidence, they may need to be stored for longer.

8. Disclosure of personal data

As a rule, personal data is disclosed to third parties only where necessary to fulfil an order, where required by law, or where permitted by another legal basis under data protection law.

Recipients may include, in particular:

• Web hosting providers,
• Email service providers,
• tax advisors or other service providers bound by confidentiality,
• Payment service provider,
• shipping and logistics companies,
• public authorities or other entities legally entitled to receive the data.

Customer photos are generally not shared with third parties unless this is necessary to fulfil the specific order or there is an applicable legal basis.

9. Web hosting

This website is operated by an external technical service provider (web host).

Personal data may be processed as part of hosting, in particular IP addresses, technical access data and information submitted by users through the website.

Processing is carried out to provide the website securely and reliably.

The legal basis is Art. 6(1)(f) GDPR.

Where required by law, a data processing agreement pursuant to Art. 28 GDPR is in place with the hosting service provider.

Important:Before publishing this Privacy Policy, the actual hosting provider and its privacy information must still be added or linked here.

10. Cookies

This website may use technically necessary cookies or comparable technical methods.

Technically necessary cookies are used, for example, to provide basic website functions or ensure technical security.

Where only technically necessary cookies are used, consent is generally not required, provided the statutory conditions are met.

If analytics, marketing or tracking technologies are also used on this website, the necessary consent will be obtained and the relevant information added to this Privacy Policy.

11. No Analytics or Advertising Profiles

If no analytics or marketing services are used on this website, no personal user profiles are created for advertising or analytics purposes.

Personal data is not disclosed for advertising purposes unless an appropriate legal basis exists.

12. Embedded Content and External Services

If this website embeds external content, services, fonts, maps, videos, social media content or other third-party services, personal data, in particular the IP address, may be transmitted to the respective provider.

Such services are used only where an appropriate legal basis under data protection law exists.

Before publication, check whether the website actually uses external services such as Google Fonts, YouTube, Google Maps, Instagram, Facebook, reCAPTCHA or comparable services.

13. Storage period

As a rule, personal data is stored only for as long as necessary for the relevant purpose.

In addition, statutory retention obligations may apply.

Business records and documents relevant for tax purposes may be retained for several years, particularly to comply with statutory retention obligations.

Once the applicable retention periods have expired, the data will be deleted unless it is still required for other lawful purposes.

14. Your rights

In principle, you have the following rights against the data controller:

Right of access

Pursuant to Art. 15 GDPR, you may request information about whether personal data concerning you is being processed and which data is involved.

Right to rectification

Under Art. 16 GDPR, you may request the rectification of inaccurate personal data.

Right to erasure

Under the conditions provided by law, you may request the deletion of your personal data pursuant to Art. 17 GDPR.

Right to restriction of processing

Under the conditions set out by law, you may request the restriction of the processing of your personal data pursuant to Art. 18 GDPR.

Right to data portability

Under Art. 20 GDPR and subject to the statutory requirements, you have the right to receive personal data in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller.

Right to object

Under Art. 21 GDPR, you may object to the processing of personal data on grounds relating to your particular situation, where the processing is based on Art. 6(1)(e) or (f) GDPR.

15. Withdrawal of consent

If the processing of personal data is based on consent, you may withdraw your consent at any time with effect for the future.

The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

To withdraw your consent, simply send an informal notice to:

Email: info@marionettenbau.de

16. Right to lodge a complaint with a data protection supervisory authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

The supervisory authority responsible is generally the data protection authority at your usual place of residence, your place of work or the place of the alleged infringement.

The competent data protection supervisory authority in Bavaria is particularly relevant for the company’s registered office.

17. Data security

I take appropriate technical and organisational measures to protect personal data against loss, destruction, manipulation, unauthorised access or any other unauthorised processing.

Security measures are adapted in line with technological developments and existing risks.

18. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

19. Changes to this Privacy Policy

I reserve the right to amend this Privacy Policy if necessary due to technological developments, changes to the website, legal requirements or changes to the services offered.

The current Privacy Policy published on this website shall apply in each case.

Last updated: October 2026