Table of contents
01Controller
The controller responsible for data processing on this website within the meaning of the GDPR is:
- Owner
- Sven Gauditz (PixAgentur)
- Address
- Ringstr. 3, 24321 Behrensdorf, Germany
- hallo@pixagentur.com
A statutory data protection officer has not been appointed, as the legal requirements for this are not met.
02Processing principles
We process personal data only insofar as this is necessary to provide a functional website as well as our content and services. As a rule, processing only takes place with your consent or on the basis of a statutory permission. Personal data is any information relating to an identified or identifiable natural person.
The relevant legal bases are in particular: Art. 6 (1)(a) GDPR (consent), (b) (performance of a contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interests).
03Your rights as a data subject
With regard to your personal data, you have the following rights against us:
- Access to the data processed (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing (Art. 21 GDPR)
- Withdrawal of a given consent with effect for the future, e.g. for Google Analytics or the newsletter (Art. 7 (3) GDPR)
Right to object: Insofar as we process data on the basis of legitimate interests (Art. 6 (1)(f) GDPR), you have the right to object at any time for reasons arising from your particular situation.
An informal message to hallo@pixagentur.com is sufficient to exercise these rights.
Right to lodge a complaint: Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, www.datenschutzzentrum.de
04Hosting
This website is operated on servers within the European Union at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes data arising when you visit the website on our behalf. The legal basis is our legitimate interest in the secure and efficient provision of our offering (Art. 6 (1)(f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with the provider.
05Server log files
When you access the website, the server automatically collects and stores information in so-called server log files that your browser transmits: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and the IP address.
This data is not merged with other data sources. Processing is based on Art. 6 (1)(f) GDPR; we have a legitimate interest in the technically error-free presentation and security of our offering. For security reasons, log files are stored for a maximum of 14 days and then deleted, unless they are required to investigate a specific security incident.
06Google Analytics
Where you have given your consent, we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (measurement ID G-YMB9ZSNKVV). Google Analytics uses cookies or comparable device identifiers that allow an analysis of the use of this website (e.g. pages visited, time spent, origin of visits).
Data is collected only if you have previously consented via our cookie notice. In that case, the legal basis is Art. 6 (1)(a) GDPR in conjunction with § 25 (1) TDDDG (consent to accessing information on end devices). Without your consent, Google Analytics is not activated.
In this context, personal data may be transferred to Google LLC in the USA. This transfer is safeguarded by appropriate guarantees: Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses of the EU Commission (Art. 46 GDPR) apply in addition. Google provides a copy of the guarantees on request.
You can withdraw your consent at any time with effect for the future, e.g. via this website’s cookie settings or via your browser’s privacy settings. Alternatively, Google offers a browser add-on to disable Google Analytics (tools.google.com/dlpage/gaoptout). Analytics data is stored by us or by Google for a maximum of 14 months and is then automatically deleted.
08Account & registration
You can create a user account to purchase software subscriptions, licenses and services. We process your name, e-mail address, an encrypted password and your preferred language. The legal basis is Art. 6 (1)(b) GDPR (establishment and performance of the usage relationship).
You can have your account deleted at any time. Statutory retention obligations (e.g. for completed purchases) remain unaffected; the data concerned will be blocked from further use.
09Orders & contract performance
As part of an order, we process the data required to perform the contract: booked subscriptions, purchased licenses and add-on modules, commissioned services, order and invoice data including the billing address, and issued license keys together with associated activation information. For evidence purposes we also store your express consent to immediate performance given during the order process, together with its timestamp, where you have given such consent (§ 356 (4) or (5) BGB). The legal basis is Art. 6 (1)(b) GDPR.
10Invoicing & statutory retention
We retain invoices and accounting records in accordance with statutory periods, in particular pursuant to § 147 of the German Fiscal Code (AO) and § 14b of the German VAT Act (UStG), generally for up to 10 years. The legal basis for this retention is Art. 6 (1)(c) GDPR (legal obligation) in conjunction with the aforementioned commercial and tax law provisions.
11Payment processing via Stripe
To process payments we use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; for certain processing also Stripe, Inc., USA). When you initiate a payment, we transmit to Stripe the order data required for processing (in particular the order reference, line items and invoice amount). Name, e-mail address and means of payment are entered by you directly on the payment page operated by Stripe; we do not receive these complete payment details.
Complete payment data such as credit card numbers is entered and processed exclusively by Stripe (PCI-DSS certified); we do not receive or store it. The legal basis is Art. 6 (1)(b) GDPR (performance of a contract) and our legitimate interest in secure payment processing (Art. 6 (1)(f) GDPR). Details can be found in Stripe’s privacy policy at stripe.com/privacy.
12E-mail delivery via netcup
Transactional e-mails (e.g. order and invoice confirmations, license keys, account notifications) as well as the newsletter are sent via the mail infrastructure of netcup GmbH, Daimlerstraße 25, 90441 Nuremberg, Germany. netcup processes the data required for delivery on our behalf (including recipient address, subject, content, delivery status). The legal basis is – depending on the e-mail – Art. 6 (1)(b) GDPR (contract performance) or Art. 6 (1)(a) GDPR (newsletter consent). A data processing agreement (Art. 28 GDPR) is in place with netcup.
13License validation
Purchased software licenses contain a license client that communicates with our license interface (api.shop.pixagentur.com or shop.pixagentur.com/api) for activation and update checks. The following are transmitted: the license key, an installation identifier (derived from the domain/URL of the installation) and the software’s version information. For technical reasons we additionally process the IP address of the requesting server; when retrieving signed update downloads, also the time and user agent. For self-hosted licenses, this connection is made by the software installed on your own server; for subscriptions hosted by us, the check runs internally.
The purpose is to enforce the licensing terms (activation limits per license type), to deliver signed updates and to protect against misuse. The legal basis is Art. 6 (1)(b) GDPR (performance of the license agreement) and Art. 6 (1)(f) GDPR (protection against misuse). Responses from the interface are cryptographically signed (Ed25519); no profiling beyond the stated purposes takes place.
15Contacting us
If you contact us by e-mail, we process the data you provide in order to handle your enquiry and in case of follow-up questions. The legal basis is Art. 6 (1)(b) GDPR insofar as the enquiry relates to a contract, otherwise Art. 6 (1)(f) GDPR (interest in answering enquiries). We delete this data as soon as it is no longer required and no retention obligations prevent deletion.
16Transfers to third countries
Within the scope of payment processing (Stripe) and – where you have given your consent – Google Analytics, processing outside the EU/EEA, in particular in the USA, may take place. This is safeguarded by appropriate guarantees: the EU Commission’s standard contractual clauses (Art. 46 GDPR) and, where applicable, certification of the respective recipient under the EU-US Data Privacy Framework. We or the respective provider will provide a copy of the safeguards on request.
17Retention periods
We store personal data only for as long as is necessary for the respective purposes or as provided for by statutory retention periods. Once the purpose no longer applies and any retention periods have expired, the data is deleted or anonymised.
18Data security
We take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access. Data is transmitted exclusively in encrypted form via TLS (HTTPS). Passwords are stored only as a cryptographic hash. Our measures are continuously adapted in line with technological developments.
19Validity & changes
This privacy policy is currently valid and has the status indicated above. As our offering develops or due to changes in legal or regulatory requirements, it may become necessary to amend this policy. The current version can be accessed at any time on this page.