Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is the operator named in our imprint. You can reach us at info@mymagcover.com. We have not appointed a data protection officer, as we are not legally required to.

2. Overview

We process personal data only as far as necessary to run this website, to make and deliver your cover and to answer your questions. We do not sell data. We do not use advertising or tracking cookies, analytics tools or social media plugins.

3. Hosting and server log files

This website is hosted by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (“AWS”), in data centres in the EU (Frankfurt and Ireland). When you visit our pages, the server automatically records technical data: IP address, date and time, page requested, referrer, browser and operating system. This is necessary to deliver the website securely (Art. 6 (1) (f) GDPR, our legitimate interest in a secure and stable website). Log files are deleted after 14 days at the latest. We have concluded a data processing agreement with AWS. Amazon is certified under the EU-U.S. Data Privacy Framework, so any access from the USA is covered by an adequacy decision (Art. 45 GDPR).

4. Fonts

Our font (Outfit) is stored on our own server. No connection to Google or other font providers is made when you visit our pages.

5. Cookies and consent

When you first visit, we ask which optional services you allow: Statistics (anonymous usage figures) and Marketing (measuring our ads). Without your consent, no such tools are loaded; at the moment we do not use any. If we add one, we will name it here with provider, purpose and storage period and load it only with your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page.

6. Local storage in your browser

Your bag, your cover designs (including the photo you upload) and your chosen delivery country are stored in your browser’s local storage, so that nothing is lost when you reload the page. This data stays on your device and is not sent to us until you order. Storing it is strictly necessary to provide the shop you requested (§ 25 (2) no. 2 TDDDG, Art. 6 (1) (b) GDPR). Your cookie choice is stored the same way. You can delete it at any time by emptying your bag or clearing your browser data.

7. Orders

When you order, we process your name, email address, delivery address, the ordered items, your cover design and uploaded photo, and the order and payment status. We need this data to perform the contract (Art. 6 (1) (b) GDPR). We keep invoices and accounting records for the periods required by German commercial and tax law (§ 147 AO, § 257 HGB: up to 8 or 10 years, Art. 6 (1) (c) GDPR).

We pass on data to the following recipients only as far as needed:

• Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland) processes your payment. Payment details such as card numbers are entered directly at Stripe; we never see them. Stripe may transfer data to the USA and is certified under the EU-U.S. Data Privacy Framework. For fraud prevention and its own legal obligations, Stripe acts as a separate controller. Privacy policy: stripe.com/privacy.
• Gelato (Gelato AS, Oslo, Norway) prints your cover in the production facility nearest to you and sends it. Gelato receives your print file, name, delivery address and, for delivery notifications, your email address. Norway is part of the European Economic Area. Production partners outside the EEA (for deliveries to the UK, USA, Canada or Australia) receive only the data needed for that order; the UK and Canada are covered by EU adequacy decisions, other transfers by EU standard contractual clauses.
• Shipping carriers (for example DHL, DPD, UPS, Royal Mail or national postal services) receive your name and delivery address and, where needed for delivery notifications, your email address.
• Amazon Web Services (see section 3) stores print files and sends our order emails.

8. Your photos and print files

Uploaded photos are used only to make your cover. We do not use them for advertising or show them publicly without your explicit permission. Photos and designs are stored in the EU. The print file is kept for 90 days after shipping, so we can replace a damaged delivery, and is then deleted. Files uploaded for an order that is never completed are deleted after 7 days. Photos and designs in your customer account stay there until you delete them or your account (see section 9). Gelato deletes print files according to its own retention rules.

9. Customer account

You can use a customer account without a password: you enter your email address and we send you a sign-in link that works once for 15 minutes. If you order, your orders are linked to the account with the same email address. In your account we store your email address, your orders, your saved designs (settings, photo and preview image), your newsletter choice and a sign-in cookie that keeps you signed in for up to 90 days. This cookie is strictly necessary for the account you asked for (§ 25 (2) no. 2 TDDDG). Legal basis is the performance of the contract and our pre-contractual relationship (Art. 6 (1) (b) GDPR).

You can delete saved designs at any time and delete your whole account under “Settings” in your account; designs and photos are then deleted immediately, orders are kept only as long as the law requires for invoices, without your account. If you neither sign in nor order for 24 months, we delete your account after notifying you by email 30 days in advance.

10. Emails about your order

We send you emails about your order: confirmation, invoice, production and shipping status with tracking. These emails are part of the contract (Art. 6 (1) (b) GDPR) and are sent via Amazon Simple Email Service (see section 3).

11. Newsletter

If you subscribe to our newsletter, we use your email address to send you news about editions and offers about once a month. We only send it after you confirm your subscription with a link in a confirmation email (double opt-in). Legal basis is your consent (Art. 6 (1) (a) GDPR). We log the time of subscription and confirmation to be able to prove it. You can unsubscribe at any time via the link in every newsletter or by email; your address is then removed from the mailing list. The newsletter is sent via Amazon Simple Email Service.

12. Contact

If you write to us by email or via the contact form, we process your details to answer your request (Art. 6 (1) (b) GDPR for questions about orders, otherwise Art. 6 (1) (f) GDPR). We delete your message once your request is fully settled, unless statutory retention periods apply.

13. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw your consent at any time with effect for the future (Art. 7 (3)). Just send an email to info@mymagcover.com.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or of our registered office.

14. Security

Our website is transmitted with TLS encryption. Access to order data and print files is restricted to the people who need it to process your order.

15. Changes

We update this policy when our services or the legal situation change. The current version is always available on this page.