Privacy policy

The German version of this privacy policy is authoritative. This English text is provided for convenience.

1. Controller

The controller responsible for data processing on this website is:

Fantastisch — Ana Belen Alvarez Ramirez (freelance artist), Gehestr. 8, 01127 Dresden, Germany. Email: info@fantastisch.mx.

2. General information

We take the protection of your personal data seriously and process it only in accordance with the GDPR and this policy. We follow the principle of data minimisation: we collect only what is necessary to run this website and to respond to your requests. This site shows no cookie banner, because no consent-requiring technology runs on a normal page load — see section 5.

3. Hosting (Cloudflare)

This website is hosted on Cloudflare Pages, and Cloudflare also provides our DNS and CDN. Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (with an EU establishment, Cloudflare Germany GmbH). When you visit the site, Cloudflare processes access data in server log files (see section 4). The legal basis is our legitimate interest in a secure, stable and efficient presentation of our website (Art. 6 (1) (f) GDPR). A data processing agreement is in place; transfers to the USA are safeguarded by the EU–US Data Privacy Framework and, additionally, EU Standard Contractual Clauses (see section 17). Privacy policy: cloudflare.com/privacypolicy.

4. Server log files

Our host automatically collects and stores information in server log files that your browser transmits: browser type and version, operating system, referrer URL, host name of the accessing device, time of the request, and IP address. This data is not merged with other data sources, and we use it only to deliver the site and to ensure its security and stability. The legal basis is Art. 6 (1) (f) GDPR. Cloudflare typically retains this data for about 30 days.

5. Cookies and similar technologies

We keep on-device storage to the strict minimum:

• fantastisch.lang — first-party localStorage, remembers your language preference. Strictly necessary for the function you requested; no consent required.
• __cf_bm — a Cloudflare cookie for bot management, lifetime approx. 30 minutes; a security measure exempt from consent.
• Stripe loads its script (Stripe.js) only on our own checkout page /checkout, which you reach only by deliberately clicking "Continue to checkout". Once that page loads, Stripe sets the __stripe_mid and __stripe_sid cookies on fantastisch.mx for fraud detection during payment. The legal basis is the consent given by that click (Art. 6 (1) (a) GDPR), the same approach used for the map (section 10).

Because no consent-requiring technology runs on the default page load, we do not display a consent banner (§ 25 (2) TDDDG). Third-party interactive content (maps, any future videos) is loaded only after an explicit click — see sections 10 and 11.

6. Web analytics (Cloudflare Web Analytics)

We use Cloudflare Web Analytics to count page views. It is cookieless, does not use fingerprinting, stores no personal data and no cross-site or cross-device identifiers, and reports only aggregated figures; technical data such as your IP address is processed only transiently to deliver the measurement. The legal basis is our legitimate interest in understanding site usage in a privacy-preserving way (Art. 6 (1) (f) GDPR).

7. Bot protection (Cloudflare Turnstile)

On the contact page and in our withdrawal and cancellation forms (section 18) we use Cloudflare Turnstile in "managed" mode to protect those forms against automated abuse. Turnstile is not loaded on any other page. On the withdrawal and cancellation forms it loads only when JavaScript is active; without JavaScript the form stays usable without it. Turnstile does not set cookies unless a challenge is triggered and does not use tracking cookies. Processing serves our legitimate interest in security and the integrity of these form channels (Art. 6 (1) (f) GDPR); where it protects a service-related enquiry it also supports Art. 6 (1) (b). Transfers to the USA are covered by the EU–US Data Privacy Framework and, additionally, Standard Contractual Clauses (see section 17).

8. Contact form

When you use our contact form we process the fields you enter — name, email address, chosen subject, message — together with the site language. The submission travels from your browser to a Cloudflare Pages Function, then to our own mail server (see section 13), which forwards it via Zoho SMTP to a mailbox of the form info+<subject>@fantastisch.mx. We use this data only to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR for enquiries relating to a contract or its initiation, otherwise our legitimate interest in responding to your message (Art. 6 (1) (f) GDPR). The Pages Function does not log the message content. Your message remains in the mailbox until your request is dealt with, subject to any statutory retention periods.

9. Payments (Stripe Checkout)

Our shop uses Stripe Checkout with on-page payment on our own checkout page (/checkout, "Stripe Elements"). Product prices are loaded from our own /api/prices endpoint, so no request reaches Stripe while you browse. When you click "Continue to checkout" on a product, you land on our checkout page; there Stripe.js loads (see section 5), and our own /api/checkout endpoint creates a Stripe Checkout Session on the server. You enter payment and any shipping details directly on this page — inside embedded iframes provided by Stripe (the Payment Element and the Address Element), which Stripe operates technically isolated from our website; when you pay by card, there is no redirect to a Stripe domain. We never see your card data — it goes to Stripe only. With the PayPal, Klarna and iDEAL payment methods you are redirected to an external site to complete the payment and then brought back to us (see below). After you confirm payment, our server asks Stripe whether it succeeded, and you are then taken back to the page you started the purchase from, where a confirmation is shown. Providers: Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA); the US transfer is covered by the EU–US Data Privacy Framework and, additionally, Standard Contractual Clauses (see section 17). The legal basis is the performance of a contract (Art. 6 (1) (b) GDPR).

If you choose Klarna, you are redirected to Klarna's site to complete the payment. The provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. The data needed for the payment — your name, email address, billing and, where applicable, delivery address, the order total and the order details — is transmitted to Klarna via Stripe; the redirect also gives Klarna your IP address. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). Which payment options Klarna shows you — for example paying now or paying later — is decided by Klarna itself, based on country, amount and order; we can neither set nor restrict them. Where Klarna advances the money, it carries out its own identity and credit checks to prevent fraud and manage risk, and may involve credit reference agencies for that purpose. Klarna acts as its own controller for those checks; the legal basis is the legitimate interest in payment security and protection against non-payment (Art. 6 (1) (f) GDPR). For details, see Klarna's privacy policy: klarna.com/de/datenschutz.

If you choose iDEAL, you select your bank and are redirected to your bank's site to authorise the payment; the payment itself is processed by Stripe. The details needed for the transfer are transmitted, in particular the amount and a payment reference; from your bank, Stripe receives a payment confirmation containing your name and the last digits of your IBAN. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR).

If you choose PayPal, you are redirected to PayPal's site to complete the payment and log in to your PayPal account there. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The data needed for the payment — your name, email address, billing and, where applicable, delivery address, the order total and the order details — is transmitted to PayPal via Stripe; the redirect also gives PayPal your IP address. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). Beyond that, PayPal processes your data as its own controller, in particular for fraud prevention, to meet its own legal obligations and under PayPal Buyer Protection; we have no influence over this. As PayPal is established in Luxembourg, no third-country transfer arises in this respect. For details, see PayPal's privacy policy: paypal.com/de/webapps/mpp/ua/privacy-full.

In line with § 19 UStG, no VAT is shown at checkout. Workshop bookings collect only the payer's details; we do not collect separate attendee data online, including no data about any children who may attend. When you book, you can optionally leave us a short message in a free-text field. It is voluntary and not required for the booking; you decide what you write, and we ask you to share only what is relevant to it. Your message is stored with the booking at Stripe and reaches the same order mailbox as the rest of the order data. After a successful payment, Stripe's webhook also notifies our own systems of the order — product, price, quantity, any fulfilment option you selected, any message you left us, your name and email address, and, for items that are shipped, your delivery address — which we relay through our own mail server (see section 13) to an order-processing mailbox at fantastisch.mx so we can fulfil your order. That copy is retained under the rules in section 16. Stripe's privacy policy: stripe.com/privacy.

After a successful payment we also send you an order confirmation, to the email address you entered at checkout. We are legally required to: § 312f Abs. 2 BGB requires confirmation of the contract on a durable medium. The email contains your order data and the consumer information required by law, including the withdrawal notice, and it is written in the language in which you used the shop. It is sent through our own mail server (section 13) and Zoho (section 12); there are no other recipients. The legal basis is compliance with that legal obligation (Art. 6 (1) (c) GDPR).

10. Embedded maps (OpenStreetMap)

On event pages we offer an interactive map that is loaded only on click ("click-to-load"). Until you click, no connection to any map provider is made. When you do, map tiles are loaded from tile.openstreetmap.org, and your IP address is transmitted to the OpenStreetMap Foundation (United Kingdom) as a technical necessity. The legal basis is your consent, given by clicking (Art. 6 (1) (a) GDPR). Privacy policy: osmfoundation.org/wiki/Privacy_Policy.

11. Embedded videos

This website currently embeds no third-party videos. If we add them later, they will use the same click-to-load pattern and a no-cookie domain (e.g. youtube-nocookie.com or Vimeo), and this policy will be updated accordingly.

12. Email hosting (Zoho)

We use Zoho to operate our mailboxes. Provider: Zoho Corporation B.V. (EU). Email is processed on EU servers, and a data processing agreement is in place. Processing serves our legitimate interest in operating a functioning email channel and, for contract-related correspondence, the performance of a contract (Art. 6 (1) (f) and (b) GDPR). Privacy policy: zoho.com/privacy.

13. Self-operated mail server

Contact form submissions (section 8) and order notifications following a successful payment (section 9) are first processed by our own server (an Oracle Cloud virtual machine in an EU region) and then sent on via Zoho SMTP. No third-party email relay is involved. This is infrastructure we operate ourselves.

14. Self-hosted fonts

All fonts are served locally from our own server (via Fontsource). There is no connection to Google Fonts or any other third-party font service, and no data is transferred to third parties for typography.

15. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7 (3)). To exercise these rights, contact us at info@fantastisch.mx.

Right to object (Art. 21 GDPR): where we process your personal data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You also have the right to lodge a complaint with a supervisory authority; the authority responsible for us is the Saxon Commissioner for Data Protection (Der Sächsische Datenschutzbeauftragte), Dresden — datenschutz.sachsen.de.

We do not use your personal data for automated decision-making or profiling within the meaning of Art. 22 GDPR.

16. Retention

We keep personal data only as long as necessary for the purposes described here or as required by law. Server log files are retained for about 30 days. Contact enquiries are kept until your request is dealt with; where correspondence concerns a commercial or tax-relevant transaction, statutory retention periods may apply: six years for commercial correspondence (§ 147 (1) Nos. 2, 3, 5 AO) or eight years for accounting vouchers (§ 147 (1) No. 4 AO, as amended by BEG IV). Order notifications in our own mailbox (section 9) are kept for as long as we need them to fulfil and account for the order; as they concern a commercial transaction, the statutory retention periods above generally apply to them. Order and payment data held by Stripe are retained according to Stripe's requirements and applicable law.

17. Transfers to third countries

Some processors are based in, or transfer data to, the USA (Cloudflare and Stripe, Inc.). Such transfers take place on the basis of the EU–US Data Privacy Framework — under which both Cloudflare and Stripe are certified — and, additionally, EU Standard Contractual Clauses, to ensure an adequate level of protection. If you load the interactive map (section 10), your IP address is transmitted to the OpenStreetMap Foundation in the United Kingdom; this transfer is covered by the European Commission's adequacy decision for the UK.

18. Withdrawal form

When you use our online withdrawal function (the "Withdraw from contract" and workshop cancellation forms), we process the data you enter: an order or receipt number or, in its place, a description of the goods or service, the order and — for goods — receipt date or, for workshops, the event date, your name, for goods an optional postal address, your email address, and any free-text message. The submission travels from your browser to a Cloudflare Pages Function, which stores it in a database at Cloudflare (Cloudflare is our processor, see section 3) and, through our own mail server (section 13) and Zoho (section 12), sends an acknowledgment of receipt to your email address and an internal copy to our order mailbox. We use this data to process your withdrawal or cancellation and to meet our statutory duty to acknowledge receipt. The legal bases are the performance of, or withdrawal from, a contract (Art. 6 (1) (b) GDPR) and compliance with our legal obligations under § 356a BGB and tax law (Art. 6 (1) (c) GDPR). The three-year retention for the defence of possible claims (§§ 195, 199 BGB) rests on our legitimate interest in defending legal claims (Art. 6 (1) (f) GDPR).

We keep this record on two periods, applied on a manual schedule: the free text and the defence-of-claims data are deleted three years after the end of the year of the declaration (§§ 195, 199 BGB); the tax-relevant fields (name, contract identification, and the date and time of the declaration) are retained for six years (§ 147 (1) Nos. 2, 3, 5 AO). Any transfers to the USA resulting from Cloudflare's involvement are safeguarded as described in section 17. The mailbox copies are treated as correspondence under section 16.

19. Status of this policy

This policy is dated 6 September 2026. We review it regularly and update it when our processing or the services we use change.