Europe: Your legal guarantee rights
Responsible for data processing on this website:
Michael Mangelsdorf
Hödlerstraße 25
79183 Waldkirch
Germany
Phone: +49 7681 493 4704
Email: admin@picwok.com
This website does not use cookies. No tracking or analytics tools are used either.
Each time this website is accessed, our web server (nginx) automatically stores information in log files: your IP address, the date and time of access, the page requested, the HTTP status code, the amount of data transferred, the previously visited page (referrer), and information about your browser and operating system (user agent).
We use this data solely to ensure the secure and stable operation of the website and to prevent abuse, such as automated attacks (among other things by slowing down suspicious requests). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the security and functioning of the website. The log files are archived weekly, and each archive is deleted automatically after 26 weeks, so entries are deleted after 27 weeks (about six months) at the latest, unless individual entries are needed for longer to investigate a specific security incident.
To make the website easier to use, your browser stores a few settings locally on your own device (so-called "local storage"), for example: the contents of your cart, your chosen language and currency, your light/dark mode preference, whether your order ships within Germany or internationally or is picked up in person (Germany is preselected when you arrive via picwok.de; all changeable in the cart), the page you last viewed (so that switching the language can return you to it), and the matting color you last previewed. This data stays exclusively in your browser and is not transmitted to our server, except when needed to calculate a price or to place your order. You can delete this data at any time through your browser's settings.
The picture pages offer a "Share" function. It uses no plugins or scripts from other services and transmits nothing until you choose a service; the address of the page is then passed only to the service you chose (for example Pinterest or WhatsApp - on phones and tablets via your device's own share menu), whose own privacy policy applies from then on. "Copy link" happens entirely in your browser.
When you order, the website gives your order a randomly generated order reference (for example PW-260926-K7QM), made up of the date and a short random code. It is passed to PayPal with your order and printed on your order summary, and only serves to identify your order. It contains no personal data.
When you click the order button at checkout, our server sends the contents of your order (items, prices and the order reference) to PayPal and forwards you to PayPal's website. There you log in, choose your delivery address and approve the payment. These details are entered directly with PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, and processed by PayPal under its own privacy policy. Our website does not ask PayPal for your name, your e-mail address or your delivery address. PayPal notifies our server when you approve a payment (a so-called webhook); this notification may contain those details, but our server only uses the order number from it and neither stores nor logs the rest.
We see these details in our PayPal account, and use them, in particular your name, e-mail address and delivery address, solely to process and fulfill your order, such as confirming it by e-mail and shipping your print. We do not share this data with third parties except where necessary for shipping (e.g. with a delivery company and, for shipments outside the EU, with customs authorities).
When you place your order, our server creates a summary of it as a PDF file, which the website offers you for download once you have approved the payment, and which is also sent to us by e-mail for our order records. Until then, and for up to 30 days afterwards (so that you can still download it), our server keeps this PDF together with a short record of your order (the items, amounts, order reference, PayPal's order number and the shipping option: international, Germany or pickup); orders whose payment is never approved are deleted after 3 days. Neither contains your name, e-mail address or delivery address.
The legal basis for processing your order data is Art. 6(1)(b) GDPR (concluding and performing the contract) and, for keeping it once the order is complete, Art. 6(1)(c) GDPR (statutory retention obligations, for example under § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB)).
We keep this data for as long as necessary to process your order and to comply with legal retention obligations (for example, under tax law).
When you use the form on our withdrawal page, our server sends the details you entered (name, order reference, the items concerned if any, and your e-mail address) together with the date and time of receipt by e-mail to our order mailbox, and sends you a confirmation of receipt to the e-mail address you entered. The form data itself is not stored on our server. We use this data to process your withdrawal and to meet our legal obligation to confirm its receipt (Art. 6(1)(b) and (c) GDPR), and keep it as long as required for processing and by legal retention obligations.
Our e-mails are sent and stored by our e-mail provider, IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, on our behalf (data processing agreement under Art. 28 GDPR).
To prevent misuse of the form (for example, to send unwanted e-mails to third parties), the number of withdrawals sent from one IP address and to one e-mail address is limited. For this purpose, your IP address and e-mail address are kept only in the server's working memory, and only as an irreversible pseudonymised value (hash), never on disk; they are deleted after 30 days without further use, or at the latest when the server restarts (Art. 6(1)(f) GDPR, our legitimate interest in preventing misuse).
Under the General Data Protection Regulation (GDPR), you have in particular the following rights:
To exercise these rights, you can contact us at any time using the contact details above. You also have the right to lodge a complaint with a data protection supervisory authority.
Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR – here, the server log files and the withdrawal form's abuse limit), you have the right to object to this processing at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process your data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can send your objection informally to the contact details above.