Privacy Policy (GDPR / DSGVO)

We take the protection of your personal data very seriously. We handle your personal data confidentially and in accordance with statutory data protection regulations (EU General Data Protection Regulation - GDPR).

1. Data Controller

Joshua Schulz-Andres Modding
Lessingstraße 2 D, 42499 Hückeswagen, Germany
Email: shop@mrjsa.com

2. Data Collection During Checkout

When placing an order, we collect:

Full Name and Email Address

Shipping and Billing Addresses

Payment transaction references (processed directly by certified PCI-DSS Level 1 compliant processors: Stripe, PayPal, Apple Pay, Google Pay, Amazon Pay). We do not store raw credit card numbers on our servers.

3. Purpose of Processing

Your data is processed strictly for contract execution (Art. 6 Para. 1 lit. b GDPR), parcel delivery, and compliance with statutory fiscal retention obligations (Art. 6 Para. 1 lit. c GDPR).

4. Your Rights

You have the right to request information, rectification, deletion, or restriction of processing of your stored data at any time by contacting shop@mrjsa.com.

Payment Providers

To process your payment we pass the data required for it (name, email address, billing address, order amount and order number) to the payment provider you choose (Art. 6 Para. 1 lit. b GDPR):

PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg).

Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland) for card, wallet and bank payments.

Emails

We send order confirmations, invoices, shipping and account emails to the email address you provide (Art. 6 Para. 1 lit. b GDPR). The emails are delivered through our email provider.

Withdrawal Function

If you withdraw from a contract using the withdrawal function of this shop, we process the details you enter (name, email address, order number, message) to handle your withdrawal and confirm its receipt (Art. 6 Para. 1 lit. c GDPR).

Backups

To protect your data against loss we store backups of our shop database in a private repository at GitHub (GitHub B.V., Netherlands / GitHub, Inc., USA). GitHub is certified under the EU-U.S. Data Privacy Framework. The legal basis is our legitimate interest in data security (Art. 6 Para. 1 lit. f, Art. 32 GDPR).

Storage Duration

We store order and invoice data for as long as commercial and tax law requires (invoices and accounting records 8 years, business letters 6 years, § 147 AO, § 257 HGB). Customer account data is stored until you delete your account or ask us to delete it; data without a retention obligation is deleted as soon as it is no longer needed.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).