Julie Mahlberg | Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

Julie Mahlberg
Matthiasstr. 45
50354 Huerth · Germany
Email: contact.juliemahlberg@gmail.com

2. General information & legal bases

We process personal data only where permitted by law. Depending on the purpose, the legal basis is Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (performance of a contract or pre-contractual measures), or Article 6(1)(f) GDPR (our legitimate interests in operating a secure, functional website and shop). The specific basis for each activity is named below.

3. Hosting and server log files

This website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (technical operation by Neue Medien Münnich GmbH). The hosting provider acts as our processor on the basis of a data processing agreement (Art. 28 GDPR) and operates its servers in Germany (EU); no transfer to a third country takes place.

With every request, the server automatically collects and stores information in log files that your browser transmits: anonymised/abbreviated IP address, date and time of the request, the requested resource, referrer URL, browser type and version, and the amount of data transferred. This is necessary for the secure and stable operation of the website and the prevention of abuse. Legal basis: Art. 6(1)(f) GDPR. Log files are deleted within seven days.

Provider privacy information: https://all-inkl.com/datenschutzinformationen/

4. Encryption (SSL/TLS)

This site uses TLS encryption (HTTPS) for security and to protect the transmission of confidential content, such as the data you enter during checkout. You can recognise an encrypted connection by the "https://" prefix and the lock icon in your browser.

5. Cookies and local storage

We do not use any tracking or advertising cookies. We only use:

A strictly necessary session cookie (PHP session), set only during the checkout process to secure the form (e.g. CSRF protection). It is a session cookie (deleted when you close the browser) and is set with the flags HttpOnly, Secure and SameSite=Lax.
Local storage ("divineCart"), used to remember the contents of your shopping cart in your browser. It is stored only on your device, is not transmitted for tracking, and is cleared after your order is completed.

These technologies are strictly necessary to provide the shop you requested; therefore no consent is required (§ 25(2) TTDSG). Legal basis: Art. 6(1)(f) GDPR.

6. Web analytics (Umami, self-hosted)

To understand how our website is used, we operate Umami, an open-source analytics tool, on our own server (stats.juliemahlberg.com). Umami is privacy-friendly by design: it does not use cookies, does not collect personally identifiable information, and anonymises the data it records. Visitors cannot be identified and are not tracked across websites. Because the tool is fully self-hosted, no data is shared with Umami or any other third party, and there is no transfer to a third country.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in the needs-based design and statistical evaluation of our website). As no information is stored on or read from your device, no consent is required. You can object to this processing at any time (see Section 14).

7. Spam protection (ALTCHA, self-hosted)

Our order form is protected against automated abuse by ALTCHA, a self-hosted proof-of-work CAPTCHA. ALTCHA runs entirely on our own server, uses no cookies, performs no fingerprinting, and sends no data to third parties. Legal basis: Art. 6(1)(f) GDPR (prevention of spam and abuse).

8. Book preview (pdf.js, self-hosted)

Our book preview ("flipbook") uses the JavaScript library pdf.js, which we host on our own server. The library is loaded only when you actively open the preview, and it is served directly from this website. No data is transmitted to any third party or content delivery network in the process, and there is no transfer to a third country. Legal basis: Art. 6(1)(f) GDPR (provision of the preview feature).

9. Ordering process and order data

When you place an order, we process the data you provide in the order form: name, email address, shipping address (street, postal code, city, country), optional notes, and the contents of your order. We use this data exclusively to process and fulfil your order and to communicate with you about it. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

For security and fraud prevention, we also store the IP address used to place the order and apply rate limiting to detect abuse. Legal basis: Art. 6(1)(f) GDPR.

We retain order and invoice-related data for as long as required to fulfil the contract and to comply with statutory retention obligations (under German commercial and tax law, generally up to 6 to 10 years).

10. Database hosting

Order data is stored in a database (SQLite) hosted directly on our own web server at our hosting provider ALL-INKL.COM in Germany (see Section 3). The data is not shared with any external database provider and is not transferred to a third country. The database file is technically protected and is not publicly accessible. Legal basis: Art. 6(1)(b) GDPR.

11. Order confirmation emails (Resend)

We send order confirmation emails using the transactional email service Resend (Plus Five Five, Inc., USA), acting as our processor. For this purpose, your name, email address and order details are transmitted to Resend solely to deliver the confirmation. Emails are processed and delivered within the European Union (Amazon Web Services, Europe / Ireland region, eu-west-1), so the data is handled in the EU. As the provider is a US company with possible administrative access from the USA, the EU Standard Contractual Clauses (and, where applicable, the EU-U.S. Data Privacy Framework) apply as safeguards. Legal basis: Art. 6(1)(b) GDPR.

Resend privacy policy: https://resend.com/legal/privacy-policy · DPA: https://resend.com/legal/dpa

12. Payment by bank transfer

Orders are paid by bank transfer. You will receive our bank details by email after ordering. The payment itself is processed by the banks involved; in this context the data necessary for the transfer (e.g. name, reference, amount) is processed by your and our bank. Legal basis: Art. 6(1)(b) GDPR.

13. Contacting us

If you contact us by email, the data you provide will be processed to handle your request. Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR (our interest in responding to enquiries).

14. Social media link

This website contains a simple link to our Instagram profile. No content is embedded; data is only transmitted to Meta Platforms Ireland Ltd. if you actively click the link and visit Instagram, where Instagram's own privacy policy then applies.

15. Your rights

Under the GDPR you have the right to:

access your personal data (Art. 15);
rectification of inaccurate data (Art. 16);
erasure (Art. 17) and restriction of processing (Art. 18);
data portability (Art. 20);
object to processing based on legitimate interests (Art. 21);
withdraw consent at any time with effect for the future (Art. 7(3)).

To exercise any of these rights, please contact us at contact.juliemahlberg@gmail.com. You also have the right to lodge a complaint with a data protection supervisory authority.

16. Right to object (Art. 21 GDPR)

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to such processing.

17. Changes to this policy

We may update this privacy policy to reflect changes to our website or to legal requirements. The current version is always available on this page.