Skip to content
Heckblick

Privacy Policy

This English translation is provided for convenience only. The German version is legally authoritative.

Last updated: 28 September 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Fabian Gruß Digital Solutions Owner: Fabian Gruß Engelbosteler Damm 77A 30167 Hannover, Germany Email: hello@heckblick.com

2. Overview of Processing Activities

We process personal data of visitors and customers only to the extent necessary to provide a functional website and to process orders:

  • Website access (server log data, hosting)
  • Configuration and ordering of personalized posters (order and personalization data)
  • Payment processing via Shopify
  • Production and shipping via a print service provider in Germany
  • Sending transactional emails
  • Waitlist for new models (email notification after double opt-in)

3. Hosting (Vercel)

Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the website, Vercel automatically processes connection data including IP address, date and time of access, page visited, browser type, and operating system (server log files). This processing is technically necessary for the delivery and security of the website.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable website operation). Vercel may transfer data to the USA based on the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses. We have entered into a data processing agreement with Vercel.

We use Vercel Speed Insights to measure loading performance. Only technical performance data (e.g. load times) is collected; no cookies are set and no persistent user profiles are created.

4. Orders and Personalization

When you order a poster through our configurator, we process the following data:

  • Your configuration (model, colors, year of manufacture) and personalization data you enter (VIN or personal dedication, and build year or first registration)
  • Upon completion of the order: name, billing and shipping address, email address, order and payment information (transmitted by Shopify, see section 5)

This data is processed for the performance of a contract (Art. 6(1)(b) GDPR): to create your personalized poster (generate the print file), to handle production and shipping, and to respond to inquiries.

Order data and generated print files (PDF/SVG containing your personalization data) are stored in Google Cloud infrastructure (Firebase, see section 6). Please note: the VIN you enter will be printed on the poster — only enter data you wish to have printed.

Order and invoice data are retained in accordance with statutory commercial and tax retention obligations (Art. 6(1)(c) GDPR, up to 10 years). Print files are deleted once they are no longer needed for order fulfillment and potential claims.

5. Payment Processing (Shopify)

The ordering and payment process is handled by Shopify (Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). When you click "Order" in the configurator, you are redirected to the Shopify checkout, where Shopify collects the data required for the order (name, address, email, payment details) and sets technically necessary cookies.

The legal basis is Art. 6(1)(b) GDPR. Shopify may transfer data to affiliated companies in third countries (including Canada and the USA) based on adequacy decisions or EU Standard Contractual Clauses.

Payment data (e.g. credit card numbers) is processed exclusively by Shopify and the connected payment providers and is not transmitted to us.

Where Shopify processes data for its own purposes (e.g. fraud prevention, Shop Pay, personalized advertising), Shopify is the independent data controller. You can object to the use of your data for personalized advertising at: https://privacy.shopify.com

Details: https://www.shopify.com/legal/privacy

If you opt in to receive news and offers during checkout, we process your email address to send such communications via Shopify (Art. 6(1)(a) GDPR). You can withdraw this consent at any time, e.g. via the unsubscribe link in any email.

6. Data Storage (Google Firebase)

We use Google Firebase (Cloud Firestore and Cloud Storage) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to store order status and print files. Transfer to Google LLC in the USA is possible based on the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses. We have entered into a data processing agreement with Google.

The legal basis is Art. 6(1)(b) GDPR. Client-side access to this data is technically prevented; all processing occurs server-side only.

7. Printing and Shipping

To produce and ship your poster, we transmit the print file along with your name and delivery address to a print service provider based in Germany that we have commissioned. The print service provider uses this data solely to produce and ship your order.

The legal basis is Art. 6(1)(b) GDPR. No data is transferred to third countries in this context.

8. Transactional Emails (Shopify / Resend)

Order and shipping confirmations are sent by Shopify (see section 5). For internal notifications (e.g. new order alerts to ourselves), we use the email service Resend (Resend, Inc., USA). Transfer to the USA is based on EU Standard Contractual Clauses. The legal basis is Art. 6(1)(b) and (f) GDPR.

9. Waitlist for New Models (Email Notification)

On our website you can join a waitlist to be notified by email as soon as a specific Porsche model is available as a poster. For this we process your email address, the selected model (for "Other", your free text), the website language, and the times of signup and confirmation.

Purpose: We use this data solely to inform you when the selected model becomes available and, occasionally, about other new Heckblick models. We also use the aggregated number of signups per model to decide which models to add next.

Double opt-in: After submitting the form, you receive an email with a confirmation link that is valid for seven days. Your signup is only stored once you click this link. If you don't click it, we store no data; only technical delivery logs remain with our email provider Resend. To prevent abuse, we briefly process your IP address when you submit the form (limiting signup attempts); it is kept in memory only and not stored permanently. As proof of your consent, we log the times of signup and confirmation, the selected model, and the version of the consent text.

Legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 German Unfair Competition Act, UWG). Logging the proof of consent is based on our legitimate interest in being able to demonstrate your consent (Art. 6(1)(f) GDPR).

Providers:

  • We send the confirmation email via Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Transfer to the USA is based on EU Standard Contractual Clauses.
  • After your confirmation, we store your email address, the model, and your consent as a customer contact with Shopify (Shopify International Limited, Ireland; see section 5) and send the notification via Shopify Email. Shopify Email records whether an email was delivered and opened and whether a link in it was clicked; we only use this information in aggregate.
  • We store the proof of consent in Google Firebase (see section 6), where your email address is kept only as an irreversible hash.

Retention: We store your data until you unsubscribe or withdraw your consent. After withdrawal, we keep the proof of consent for up to three years (standard limitation period, Section 195 German Civil Code) to be able to demonstrate the earlier consent; we no longer use the address for marketing.

Withdrawal: You can withdraw your consent at any time with effect for the future — via the unsubscribe link in every email or with a short message to hello@heckblick.com.

10. Cookies

We do not use any cookies for analytics or marketing purposes on the public website, and we do not use any third-party tracking services.

Technically necessary cookies are used in the Shopify checkout (cart and session management) and in the password-protected admin area used exclusively by the operator. No consent is required for technically necessary cookies.

11. Fonts

All fonts used on the website are hosted locally on our server. No connection is made to Google Fonts or any other external font provider.

12. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)

To exercise your rights, please send an email to hello@heckblick.com.

Supervisory authority: Die Landesbeauftragte für den Datenschutz Niedersachsen Prinzenstraße 5, 30159 Hannover, Germany https://lfd.niedersachsen.de

13. Changes

We will update this privacy policy whenever changes to our processing activities require it.