Privacy policy

The controller responsible for data processing on this website is Darius Hofman, TOTES SIGNAL, c/o Smarvo 279, Südstraße 31, 47475 Kamp-Lintfort, Germany. Email: hello@totersignal.de.

We are not required to appoint a data protection officer. If you have questions about data protection, just write to the address above.

This website runs on a server that we operate with IONOS SE, Montabaur (Germany); it is located in a data center in the EU. The database with your request and order data and the files you upload or that we deliver to you are stored there as well. IONOS processes this data only on our behalf and on our instructions (data processing agreement under Art. 28 GDPR).

The legal basis is Art. 6(1)(f) GDPR – our legitimate interest in a secure, fast and reliable website – and, where requests and orders are concerned, Art. 6(1)(b) GDPR.

Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) sits between your browser and our server as a content delivery network and security service. Every visit to this website passes through Cloudflare’s servers. Cloudflare processes the connection data that every visit generates – in particular your IP address, date and time, the address requested, your browser identifier (user agent) and technical system information – to deliver the website quickly and to fend off attacks such as overload attacks or mass automated access. Because Cloudflare receives the encrypted connection, content you send us (for example requests and photos) also passes through Cloudflare technically.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and reliably available website. Cloudflare processes the data as our processor (Art. 28 GDPR). Data may be transferred to the USA in the process. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR); EU Standard Contractual Clauses apply in addition (Art. 46(2)(c) GDPR).

Cookies: Our public pages set no cookies of their own; only after you log in do we set a session cookie (section 8). To protect against attacks, Cloudflare may in individual cases set strictly necessary security cookies, such as “__cf_bm” to detect automated access (valid for 30 minutes) or “cf_clearance” after a security check has been passed. They serve security only, not analytics or advertising. The legal basis for storing them is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); for further processing, Art. 6(1)(f) GDPR.

Our web server logs every request with the IP address, date and time, the address requested, status code, amount of data transferred, referring page and browser identifier. For requests via Cloudflare, this is your IP address as passed on to us by Cloudflare. We need these logs to find errors and to detect and fend off attacks. The legal basis is Art. 6(1)(f) GDPR.

The log files are rotated daily and deleted after 15 days at the latest. We do not use them for statistics and do not combine them with other data.

To see which pages are used, our server counts visits to our public pages – without cookies and without storing anything in your browser. All we store are daily totals: the page visited, the language and, where present, the domain of the referring website (without the path) or the campaign tag “utm_source” from the link.

We store no IP address, browser identifier or any other feature that would make you recognizable; no profile is created. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to shape our offer around how it is actually used.

Two features remember information in your browser. That information stays on your device; we cannot read it there.

• Shot list: The styles you heart (up to 12 codes such as “S05”) are stored by your browser in localStorage under “ts.shotlist.v1”. They stay there until you empty the list or clear this website’s data in your browser.
• Request draft: What you type into the request wizard or the website form is kept by your browser in sessionStorage (“ts.anfrage.v1” or “ts.website.v1”) so that nothing is lost if you reload. Files are not part of it. The draft disappears as soon as you close the tab. Photos, however, are uploaded by the wizard directly to our server (section 7).

This information only reaches us when you send it yourself – with your request or by opening a shot list link. The legal basis for storing it is § 25(2) no. 2 TDDDG: storage is strictly necessary to provide the feature you are expressly using. No consent is needed for this – which is why this website has no cookie banner.

When you send a request via the request wizard or the website form, we process:

• contact details: email address, name, company or brand and country;
• order details: package, product name and optionally a link, marketplaces, category, chosen styles and your notes – for website requests, the details of your project;
• your photos and files;
• your confirmations that you are acting for your business and have read this privacy policy, each with the time and version.

The purpose is to review your request and to carry out an order. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract and performance of a contract). Without an email address, name, company and country we cannot accept a request.

The wizard uploads photos as soon as you add them so that sending is quick. Until you confirm the request with the code from our email, your details and photos are kept on our server as a draft; if you don’t confirm within 24 hours, we delete the draft including the photos. For previews we create smaller copies of your photos and remove embedded metadata such as GPS location data.

To prevent abuse, the form contains a field that is invisible to people and a minimum time to fill it in, and we limit the number of requests and codes per email address and per IP address. For this we store the IP address only as a keyed hash (HMAC with a server-side secret) and delete these entries after 24 hours at the latest. We use no CAPTCHA or other third-party services for this. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against spam and attacks.

When you confirm your first request, we create a customer account. It stores your master data (email address, name, company, country, language and – once you provide them – billing address and VAT ID), your orders with their history and your messages to us. The legal basis is Art. 6(1)(b) GDPR.

You log in without a password: we email you a 6-digit code that is valid for 10 minutes. We store it only as a keyed hash (HMAC with a server-side secret).

Only after you log in do we set a single cookie: the session cookie “__Secure-ts_sitzung”. It contains a random identifier, is only sent over encrypted connections, cannot be read by scripts and expires after 60 days or as soon as you log out. It is strictly necessary to keep you logged in (§ 25(2) no. 2 TDDDG); we base the processing on Art. 6(1)(b) GDPR. Our administrators additionally need a second factor (one-time code from an authenticator app) and have a session length of 12 hours.

You can delete your account yourself in your profile once no order is open. We then delete your files and personal data and keep only what we must retain for invoices (section 16).

For an order we process the details from your request, the agreed price, the payment status, deadlines, revision requests, messages and the files we deliver to you. The legal basis is Art. 6(1)(b) GDPR. We never show your results publicly unless you have expressly agreed.

We send and receive our emails via the email service of a provider based in Ireland, which also hosts our mailbox. The provider processes the data on our behalf (Art. 28 GDPR). A transfer to the USA is possible; it is safeguarded by the EU-US Data Privacy Framework or standard contractual clauses (Art. 45, Art. 46(2)(c) GDPR). We only send you emails that belong to your request, your account or your order – such as codes, status updates and replies to your messages. We send no newsletter and no advertising. Our emails contain no tracking pixels and no tracked links.

The legal basis is Art. 6(1)(b) GDPR. If you write to us without an order, we process your message in order to reply (Art. 6(1)(f) GDPR).

Using our contact form you can write to us without placing an order. We process your name, your email address, optionally your company or brand and the topic you choose, your message, the language of the page and the time you sent it – so that we can read your message and reply to you by email. Without a name, an email address and a message we cannot reply.

The legal basis is Art. 6(1)(b) GDPR where your message concerns an order or the steps before one, otherwise Art. 6(1)(f) GDPR – our legitimate interest in answering enquiries.

We store your message in our database (section 2) and send it to our mailbox at the email service (section 10), with your address as the reply address so that we can answer you directly. We do not send you a confirmation email, we do not pass your message on to anyone else, and we do not add you to any mailing list.

To prevent abuse we use the same means as for requests (section 7): a field that is invisible to people, a minimum time to fill in the form and limits per IP address and per email address – no CAPTCHA and no third-party services. With your message we also store a keyed hash of your IP address (not the address itself) so that we can recognize repeated abuse; we delete it after 30 days. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest is protection against spam and attacks.

We delete your message from our database automatically 12 months after it arrives. We delete the email in our mailbox after the same period, unless it leads to an order or we have to keep it for legal reasons (section 16).

We work with AI tools and finish every result by hand. To create your images and videos, we transfer your product photos and our image instructions to AI image and video services of providers in the USA. We do not transfer your name, email address or other contact details.

The legal basis is Art. 6(1)(b) GDPR (performance of your order). Transfers to the USA are based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). We record which providers we actually use in our record of processing activities; we will tell you on request.

That’s why we ask: please don’t upload photos in which people can be recognized or that show personal data, such as address labels or receipts.

You pay in advance by bank transfer. We process the details that arrive with your payment (account holder’s name, IBAN, amount, payment reference, date) to match it to your order. The transfer is handled by the banks involved.

If we offer PayPal and you use it, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, is itself responsible for processing the payment; PayPal’s privacy policy applies to that.

For your invoice we process your billing details (name, company, address and, where applicable, VAT ID). The legal bases are Art. 6(1)(b) GDPR and, for retention, Art. 6(1)(c) GDPR in conjunction with the retention obligations under tax and commercial law.

Your data is only received by parties that need it for the purposes described:

• hosting: IONOS SE (server, database, files) – section 2;
• delivery and protection of the website: Cloudflare – section 3;
• email service of a provider based in Ireland – section 10 and section 11;
• AI image and video services of providers in the USA – section 12;
• banks and, if you use it, PayPal – section 13;
• tax advisers and tax authorities, where necessary for accounting and taxes or required by law.

We do not sell data and do not pass it on for advertising.

Data can leave the EU in only three cases: with Cloudflare (section 3), with the email service (section 10) and with the AI image and video services (section 12), each with the safeguards described there.

We store data only as long as we need it or are required to keep it:

• Unconfirmed request drafts including photos: after 24 hours.
• Photos and delivered files: 180 days after your order is complete – that is, after your approval or the automatic completion 14 days after the latest delivery. Download everything you need before then.
• Files of declined or canceled requests: after 30 days.
• Account, order data (without files) and messages: until you delete your account; after that, only what we are required to keep.
• Invoices and accounting records: as long as tax and commercial law require (in particular § 147 AO and § 14b UStG, currently eight years as a rule).
• Server logs: after 15 days at the latest (section 4).
• Messages from the contact form: 12 months after they arrive; the IP hash stored with them after 30 days (section 11).
• Login codes expire after 10 minutes, sessions after 60 days or when you log out.
• Backups: we back up the database and files every night and keep each backup for 7 days. Deleted data therefore also disappears from the backups 7 days later at the latest.

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). An informal email to hello@totersignal.de is all it takes.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work or where the alleged infringement took place. The authority responsible for us is the Thuringian State Commissioner for Data Protection and Freedom of Information (TLfDI): www.tlfdi.de.

We make no decisions based solely on automated processing (Art. 22 GDPR): a person reviews every request. We create no profiles and use no tracking or analytics tools.

If the way we process data changes, we update this policy. The version published here applies; its date is shown at the top.