Privacy

Controller

Trackside Studio

Responsible person: Linus Keller

Talstraße 10, 36039 Fulda-Dietershan, Deutschland

Email: support@tracksidestudio.de

Phone: 0151 44622542

Hosting and website operation

The website is hosted and delivered through Netlify. Technically necessary data such as IP address, time of access, requested page, and error and security information may be processed. The purpose is the secure and reliable operation of the website. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is operating and protecting the website. Netlify acts as the technical service provider. Technical logs are processed only as long as necessary for this purpose.

Contact form and email

When you send a contact enquiry, we process your name, email address, organisation or team (if provided), enquiry type, subject and message. The details are validated server-side and sent via Resend to hello@tracksidestudio.de; the mailbox is hosted by IONOS. The contact form is not stored in Supabase and does not automatically create a support ticket. The purpose is handling your enquiry; the legal basis is Article 6(1)(b) GDPR where the enquiry concerns pre-contractual steps, otherwise Article 6(1)(f) GDPR. The data are deleted when they are no longer required for handling the enquiry and no legal retention obligation applies.

Account, authentication and customer area

We use Supabase for registration, login, email verification, password reset, profile, addresses and orders. This may include authentication and contact data, technical session data, and the details you provide in your profile or addresses. The processing provides the account functions you request and, where applicable, prepares a contractual relationship; the legal basis is Article 6(1)(b) GDPR and, for security measures, Article 6(1)(f) GDPR. Optional details are processed only when you provide them. These functions do not subscribe you to a newsletter.

Orders and support

Where order or account support is used, contact email, support enquiry, message history, processing status and the link to the relevant order may be processed. Internal admin notes are kept separately. Support emails are sent via Resend and received through IONOS. The processing serves to handle your enquiry and, where applicable, to perform or prepare a contract (Article 6(1)(b) GDPR) and to organise support securely (Article 6(1)(f) GDPR).

Service providers and possible third-country transfers

For the purposes described, we use Netlify (hosting and server functions), Supabase (authentication, protected areas and data storage), Resend (contact, account, order and support emails), and IONOS (domain, DNS and email mailboxes). Processing outside the EU or EEA cannot be ruled out depending on the provider. The specific data-processing and transfer arrangements must be reviewed organisationally before a later commercial launch; this notice does not claim unverified transfer safeguards.

Cookies and local storage

We use functional Supabase session cookies for sign-in and a temporary cookie for password recovery. In addition, the browser may store the language choice and, when the relevant functions are used, cart and checkout state in localStorage. sessionStorage is used for temporary authentication or registration values. These storage mechanisms serve only the requested function and are not used for marketing or profiling.

Analytics and external content

When enabled in the production configuration, we may use optional first-party analytics. Collection begins only after you explicitly select “Allow analytics”. You can reject analytics and withdraw consent at any time through “Analytics settings” in the footer. Your choice is stored in a functional first-party cookie for up to 180 days. Analytics uses pseudonymous, tab-bound sessions with a random UUID in sessionStorage; it is not anonymous. After 30 minutes of inactivity, a new session is created when you next use the site. Withdrawing consent removes the browser-side session identifier and prevents further analytics events from being collected. Stored data comprise session and event identifiers, timestamps of session start, last activity and events, event types (page view, product view and checkout start), page paths, product identifiers and product slugs, and for checkout events the checkout attempt identifier and product quantities, a coarse device category, a referrer category and, where applicable, UTM source, medium and campaign; IP addresses, raw User-Agent values and referrer URLs are not stored. The data are stored with Supabase. The implemented retention rule provides for deletion of a session’s raw data after 180 days without further activity. For aggregated conversion reporting, the pseudonymous session may be linked server-side to a checkout or order and its associated product information; names, email addresses, customer, Auth and Stripe IDs are not copied into the analytics tables. Do Not Track and Global Privacy Control prevent collection even if consent was previously granted. We do not use Google Analytics, Meta Pixel, marketing cookies, external tracking pixels or externally loaded web fonts. Instagram is not embedded; the service is contacted only when you choose the external link.

Purposes, retention and legal bases

We process personal data only to provide the website and requested functions, respond to enquiries, manage account, order and support matters, and secure the service. Data are retained for as long as necessary for the respective purpose or as required by statutory retention obligations. Where consent is the legal basis, it may be withdrawn at any time with effect for the future.

Your rights

Subject to the statutory requirements, you have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You may withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority. To exercise your rights, email hello@tracksidestudio.de.