1. Controller
Sunfield (Sunfield Studio is a brand of Sunfield), owner: Lukas-Domenik Sonnenfeld; postal address: see imprint; email: sunfieldsupport@gmail.com. No data protection officer is appointed because this is not legally required.
2. In brief
We use no analytics or tracking tools, no advertising cookies and no social media plugins, and we load no fonts, scripts, videos or maps from third-party servers. Some functions store settings and work states only in your browser; we do not receive this data.
3. Hosting
This website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Workers; delivery via the worldwide Cloudflare network, for requests from the EU usually through data centres in the EU). On each request the hosting service technically processes IP address, date and time, page or file requested, data volume and browser/device information. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in a secure and working website). A data processing agreement under Art. 28 GDPR exists with Cloudflare. Processing outside the EEA, in particular in the USA, is possible; Cloudflare takes part in the EU-US Data Privacy Framework. We ourselves set no cookies on this website. We ourselves do not store log data.
4. Storage in your browser
Some functions store settings or saved results in your browser's local storage. This data stays on your device and is not transmitted to us or to third parties. You can delete it through the function or your browser settings.
5. Links to other websites
Our pages contain links to other websites. Data is transferred to those sites only when you click a link; their privacy notices apply.
6. Contact
If you contact us by email, phone or our contact form, we process your details (such as name, contact data, content of the message) to answer your request (Art. 6 (1) (b) or (f) GDPR). The form works via Google Apps Script (Google Ireland Limited, Dublin, Ireland; parent company Google LLC, USA; transfers based on the EU-US Data Privacy Framework or standard contractual clauses); the data is processed there only to send the two emails and not stored permanently. You immediately receive an automatic confirmation by email. We delete enquiries once they are dealt with, unless statutory retention duties apply (at the latest after 6 months without an order).
7. Orders
For orders we process name, billing address, email address, phone number (only if provided), ordered services, prices, order and payment status, invoices and correspondence, to conclude and perform the contract and to meet accounting and tax duties (Art. 6 (1) (b) and (c) GDPR with § 147 AO and § 14b UStG). Records are kept for the statutory periods (invoices and accounting records eight years, books ten years, other tax-relevant business letters six years, from the end of the calendar year). Online payment: when you pay via a payment button you are forwarded to the payment page of Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Stripe processes the data you enter there (name, company, email, billing address, payment data), the amount and the service bought, plus technical device data, to process the payment, prevent fraud and meet legal duties. We do not receive card numbers or other full payment data; from Stripe we receive name, company, email, billing address, amount, service and payment status (Art. 6 (1) (b) and (c) GDPR). Stripe may transfer data to Stripe, Inc. (USA) on the basis of the EU-US Data Privacy Framework or standard contractual clauses. If you pay with PayPal, the payment is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”) as a separate controller under its own privacy notice. On its payment page Stripe uses cookies needed for secure payment; this website itself sets no cookies. Details: see the German privacy notice. Documents you give us for a set-up are used only for the order.
8. Your rights
You have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to lodge a complaint with a data protection supervisory authority. Providing data is only required to the extent needed for the contract; we make no automated decisions.
9. Changes
We update this notice when the offer or the legal situation changes. The German version is authoritative.
To protect against abuse (spam), the form service stores a non-reversible short value of your IP address for no more than 20 minutes when you submit a form and then deletes it automatically. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in operating the forms securely).
Information on similar offers (existing customers)
If you buy from us, we use the e-mail address from that purchase to occasionally (at most twice) inform you about similar offers of our own (Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Unfair Competition Act). We also point this out in the order confirmation. You can object at any time – in every such mail or simply by replying "Unsubscribe" – at no cost other than transmission costs at basic rates (Art. 21 GDPR). After an objection we only keep a non-reversible hash of your address on a block list. Service mails about your order are not affected.
Gift vouchers
If you buy a gift voucher, we process the purchase data from Stripe, your e-mail address to deliver the voucher PDF as well as value, remaining value, validity, redemptions and a non-reversible hash of the code (Art. 6(1)(b) GDPR; retention under statutory periods, Art. 6(1)(c) GDPR). An optional dedication and the recipient's name only appear in the PDF. Details: voucher terms (German).
Cookieless audience measurement
We count page views and clicks on the buy button without cookies, without storing IP addresses, device IDs or browser names and without profiles: only a daily number per page, rough source and event, stored at our host Cloudflare. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Nothing is stored on or read from your device, so no consent under Section 25 TDDDG is required.