Privacy Policy

Last updated: 26 August 2026

1. Controller

Spielzeugfabrik Penzing GmbH
Steinbachstr. 6
85250 Altomünster, Germany
Email: mail@spielzeugfabrik-penzing.de

2. Hosting and server logs

Our website, online shop and email services are hosted by STRATO AG, Pascalstr. 10, 10587 Berlin, Germany. We use Odoo as the shop software on the hosting infrastructure provided to us. When pages are accessed, technical log data may be processed, in particular IP address, date and time, requested page, referrer, browser, operating system and device information. Processing is necessary to provide the website securely and reliably (Art. 6(1)(f) GDPR). Where a service provider acts as a processor, it is engaged on the basis of Art. 28 GDPR.

3. Enquiries, quote requests and business accounts

When you contact us, request access to the B2B shop or submit a 3D print quote request, we process the information you provide, such as company and project name, contact persons, email address, message, material and production details, and uploaded files. For approved accounts we also process access data, order history and project-related contacts. Passwords are stored only in hashed form. Mandatory information is required to review and process the request; without it we cannot handle the request. The legal basis is Art. 6(1)(b) GDPR and, for security and B2B access control, Art. 6(1)(f) GDPR.

4. Orders, payments and shipping

For orders we process company, billing, delivery, order and communication data. If PayPal is selected, the data necessary for payment is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. For delivery, the required recipient and shipment data is transmitted to the selected carrier, in particular DHL, UPS or GO! Express. For international shipments, customs authorities and other logistics providers may also receive the data required by law. The legal basis is Art. 6(1)(b) and, where applicable, Art. 6(1)(c) GDPR.

5. Cookies, analytics, maps and videos

Essential cookies are used for login, language selection, security and the shopping cart. Their storage is necessary under Section 25(2) TDDDG. Optional cookies and services are activated only after consent (Section 25(1) TDDDG and Art. 6(1)(a) GDPR). This applies in particular to Google Analytics and to content from Google Maps and YouTube, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When enabled, data may also be processed by Google companies in the United States. You can change or withdraw your choice at any time for the future on the Cookie Policy page.

6. Recipients and international transfers

Data is disclosed only where necessary for the purposes described above, to service providers acting on our instructions, or where required by law. If data is transferred outside the European Economic Area, the transfer is based on an adequacy decision or appropriate safeguards under Art. 44 et seq. GDPR, where required.

7. Retention

We retain personal data only for as long as necessary for the relevant purpose. Enquiry and project data is deleted when it is no longer required, unless contractual, evidentiary or statutory retention obligations apply. Account data is retained for the duration of the account and thereafter only where required. Commercial and tax records are retained for the applicable statutory periods, generally six, eight or ten years depending on the type of document. Uploaded production files are deleted after project completion when no further storage has been agreed and no retention obligation applies.

8. Security

We use appropriate technical and organisational measures, including encrypted transmission, access restrictions and role-based permissions, to protect personal data.

9. Your rights

Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time for the future. You also have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

10. Changes

We update this Privacy Policy when legal requirements, services or processing operations change.