Privacy Policy

Last updated: 19 July 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Fabian Gruß Digital Solutions Owner: Fabian Gruß Engelbosteler Damm 77A 30167 Hannover, Germany Email: hello@heckblick.com

2. Overview of Processing Activities

We process personal data of visitors and customers only to the extent necessary to provide a functional website and to process orders:

• Website access (server log data, hosting)
• Configuration and ordering of personalized posters (order and personalization data)
• Payment processing via Shopify
• Production and shipping via our print partner Gelato
• Sending transactional emails

3. Hosting (Vercel)

Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the website, Vercel automatically processes connection data including IP address, date and time of access, page visited, browser type, and operating system (server log files). This processing is technically necessary for the delivery and security of the website.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable website operation). Vercel may transfer data to the USA based on the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses. We have entered into a data processing agreement with Vercel.

We use Vercel Speed Insights to measure loading performance. Only technical performance data (e.g. load times) is collected; no cookies are set and no persistent user profiles are created.

4. Orders and Personalization

When you order a poster through our configurator, we process the following data:

• Your configuration (model, colors, year of manufacture) and personalization data you enter (e.g. VIN, personal dedication, first registration date, ownership date)
• Upon completion of the order: name, billing and shipping address, email address, order and payment information (transmitted by Shopify, see section 5)

This data is processed for the performance of a contract (Art. 6(1)(b) GDPR): to create your personalized poster (generate the print file), to handle production and shipping, and to respond to inquiries.

Order data and generated print files (PDF/SVG containing your personalization data) are stored in Google Cloud infrastructure (Firebase, see section 6). Please note: the VIN you enter will be printed on the poster — only enter data you wish to have printed.

Order and invoice data are retained in accordance with statutory commercial and tax retention obligations (Art. 6(1)(c) GDPR, up to 10 years). Print files are deleted once they are no longer needed for order fulfillment and potential claims.

5. Payment Processing (Shopify)

The ordering and payment process is handled by Shopify (Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). When you click "Order" in the configurator, you are redirected to the Shopify checkout, where Shopify collects the data required for the order (name, address, email, payment details) and sets technically necessary cookies.

The legal basis is Art. 6(1)(b) GDPR. Shopify may transfer data to affiliated companies in third countries (including Canada and the USA) based on adequacy decisions or EU Standard Contractual Clauses.

Payment data (e.g. credit card numbers) is processed exclusively by Shopify and the connected payment providers and is not transmitted to us.

Where Shopify processes data for its own purposes (e.g. fraud prevention, Shop Pay, personalized advertising), Shopify is the independent data controller. You can object to the use of your data for personalized advertising at: https://privacy.shopify.com

Details: https://www.shopify.com/legal/privacy

If you opt in to receive news and offers during checkout, we process your email address to send such communications via Shopify (Art. 6(1)(a) GDPR). You can withdraw this consent at any time, e.g. via the unsubscribe link in any email.

6. Data Storage (Google Firebase)

We use Google Firebase (Cloud Firestore and Cloud Storage) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to store order status and print files. Transfer to Google LLC in the USA is possible based on the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses. We have entered into a data processing agreement with Google.

The legal basis is Art. 6(1)(b) GDPR. Client-side access to this data is technically prevented; all processing occurs server-side only.

7. Printing and Shipping (Gelato)

To produce and ship your poster, we transmit the print file along with your name and delivery address to our print-on-demand partner Gelato ASA, Wilhelm Wilhelmsen plass 1, 1366 Lysaker, Norway. Production typically takes place at a print facility within the EU near you.

The legal basis is Art. 6(1)(b) GDPR. Norway benefits from an adequacy decision by the European Commission. Details: https://www.gelato.com/legal/privacy-policy

8. Transactional Emails (Shopify / Resend)

Order and shipping confirmations are sent by Shopify (see section 5). For internal notifications (e.g. new order alerts to ourselves), we use the email service Resend (Resend, Inc., USA). Transfer to the USA is based on EU Standard Contractual Clauses. The legal basis is Art. 6(1)(b) and (f) GDPR.

9. Cookies

We do not use any cookies for analytics or marketing purposes on the public website, and we do not use any third-party tracking services.

Technically necessary cookies are used in the Shopify checkout (cart and session management) and in the password-protected admin area used exclusively by the operator. No consent is required for technically necessary cookies.

10. Fonts

All fonts used on the website are hosted locally on our server. No connection is made to Google Fonts or any other external font provider.

11. Your Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)

To exercise your rights, please send an email to hello@heckblick.com.

Supervisory authority: Die Landesbeauftragte für den Datenschutz Niedersachsen Prinzenstraße 5, 30159 Hannover, Germany https://lfd.niedersachsen.de

12. Changes

We will update this privacy policy whenever changes to our processing activities require it.