Privacy policy

Last updated: September 28, 2026

This policy explains which personal data we process when you visit 1daworks.com, buy from us or contact us, why we do it and what rights you have. It is based on the General Data Protection Regulation (GDPR) and the German TDDDG and applies to all visitors and customers.

1. Who is responsible

1DAWORKS, Niclas Hellmuth, Theodor-Otte-Straße 59, 45897 Gelsenkirchen, Germany · phone +49 176 80440096 · info@1daworks.com. For privacy requests you can also write to support@1daworks.com.

2. Legal bases

We process personal data only where the law allows it: to conclude and perform a contract with you or answer your requests before one (Art. 6(1)(b) GDPR), to meet legal obligations such as tax record keeping or confirming a withdrawal (Art. 6(1)(c) GDPR), on the basis of our legitimate interests in a secure, working store, fraud prevention and answering enquiries (Art. 6(1)(f) GDPR), or with your consent (Art. 6(1)(a) GDPR). Storing information on your device or reading it from there requires your consent (§ 25(1) TDDDG), unless it is strictly necessary for a service you asked for (§ 25(2) no. 2 TDDDG).

3. Store platform and hosting (Shopify)

Our store runs on Shopify. The provider for us is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify hosts the store, processes orders and acts as our processor under a data processing agreement. Our store data is stored at rest in Europe; Shopify still accesses it from other countries: it transfers data to its parent company Shopify Inc. in Canada (EU adequacy decision) and to other Shopify companies and subprocessors in other countries, including the USA and Singapore. These transfers are protected by Shopify's Binding Corporate Rules and the EU standard contractual clauses.

When you visit the store, Shopify's servers process technical data such as your IP address, date and time, browser, device and the pages you open. This is necessary to deliver the store, keep it secure and prevent abuse (Art. 6(1)(f) GDPR).

For some services Shopify is an independent controller, for example the Shop app, Shop Pay and fraud prevention. If you have a Shop account, Shopify can recognise you on our store, even if you are not logged in with us, and send you emails and push notifications about products you viewed, carts you left, price drops and items back in stock; Shopify is the controller for this, and you can turn it off in the Shop app. With "Shopify Network Intelligence", Shopify uses store data together with other Shopify data to improve its products; Shopify uses your data for ads based on your activity with other stores only with your consent. You can withdraw that consent or object to Shopify's processing at privacy.shopify.com. Details: shopify.com/legal/privacy/customers. US residents can opt out of the sharing of their data for targeted advertising on our Your Privacy Choices page.

4. Orders, delivery and customer account

When you order, we process your name, email address, billing address, the items you buy, the texts and files you give us for your cover (for example artist name, title or logo), the record of your consent in the cart, payment status and your IP address. We use this data to conclude and perform the contract, deliver your files and send you order emails (Art. 6(1)(b) GDPR).

Instant downloads are delivered with Shopify's "Digital Products" app, which emails you a download link. Covers made by hand for you are sent by email. Files you upload are used only to make your cover.

You can create a customer account (login with a one-time code by email) to see your orders. The account is optional; we keep its data until you delete it or ask us to delete it. If you have a customer account, we manage loyalty points with the app "Essential Loyalty" (Essential Apps, Vilnius, Lithuania) as our processor: name, email, orders and points balance (Art. 6(1)(b) GDPR); this data is deleted with your account.

We keep order and accounting records for as long as tax law requires: 10 years for books and records, 8 years for invoices and other accounting records, 6 years for business letters (§ 147 AO). Other order data is deleted when it is no longer needed.

5. Payment

Payment data is processed by the payment provider you choose, not by us; we only receive the payment status and limited details (for example the card brand).

Shopify Payments (cards, Google Pay, Shop Pay, Klarna and other methods shown at checkout), provided by Shopify International Limited (section 3). Depending on the method, the payment is processed by Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland; Adyen N.V., Simon Carmiggeltstraat 6, 1011 DJ Amsterdam, Netherlands; or PayPal (see below).
PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, if you choose Klarna. Klarna may check your identity and creditworthiness and may use automated decisions for this; details are in Klarna's privacy notice shown when you choose Klarna.
Crypto payments (USDC) are processed through Shopify Payments by Bridge, a Stripe company (in the EEA: Bridge Building S.A., Luxembourg). USDC payments run on public blockchains (for example Base or Ethereum); your wallet address and the transaction are publicly visible there and cannot be deleted by us or Shopify.

Legal basis: Art. 6(1)(b) GDPR and, for fraud prevention, Art. 6(1)(f) GDPR. The payment providers are partly independent controllers.

6. Contact and support

If you email us, we process your email address, name and message to answer you (Art. 6(1)(b) or (f) GDPR). Our mailboxes are hosted by ALL-INKL.COM - Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, as our processor. We delete messages when your request is settled, unless we must keep them (6 years for business letters, 8 years if they are accounting records, § 147 AO).

7. Withdrawal function

Our online withdrawal form is provided by the app "Revoq - EU Withdrawal Button" of BuschBytes, Jonas Busch, Cologne, Germany, as our processor. It processes your name (optional), order number (optional), email address, the items and message you enter and the date and time of receipt, and sends you a confirmation of receipt from confirmation@consumer-withdrawal.eu. Data is processed in the EU (servers in Frankfurt, Amsterdam and Ireland). Legal basis: Art. 6(1)(c) GDPR together with § 356a BGB, and Art. 6(1)(b) GDPR. The app deletes the data after 90 days; we keep the notification in our mailbox as proof for as long as claims can arise.

8. Newsletter

We send you news and offers by email only if you have agreed, for example with the box in checkout, and confirmed your address by clicking the link in our confirmation email (double opt-in). We store the time of sign-up and confirmation as proof. Emails are sent with Shopify Messaging, which records whether you open our emails and which links you click, so we can measure our newsletter; this is covered by your consent. Legal basis: Art. 6(1)(a) GDPR. You can unsubscribe at any time with the link in every email; we keep your data until you unsubscribe. After that we keep your address in a block list so we do not write to you again (Art. 6(1)(f) GDPR).

9. Cookies, local storage and consent

Our store uses cookies and similar technologies. Necessary ones keep your cart, checkout, login, security, language and your cookie choice working and are used without consent (§ 25(2) no. 2 TDDDG). Our store also saves some settings only on your device, for example your saved picks from "Keep or skip", your catalog filters and the grid size; they stay in your browser and are not sent to us.

Analytics and marketing technologies (section 10) run only after you agree in the cookie banner, which we show to visitors in all countries. You can change or withdraw your choice at any time with "Cookie preferences" at the bottom of every page; withdrawing does not affect processing before it. Cookies set with your consent are stored until you withdraw consent or they expire.

10. Analytics and marketing (only with your consent)

Shopify analytics: statistics about visits and purchases in our store (Shopify, see section 3).
Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): shows us how visitors use the store with heatmaps and session recordings, so we can fix problems. Entries in form fields are masked. Microsoft also uses this data for its own purposes, including improving its products and advertising (privacy.microsoft.com/privacystatement). Clarity sets cookies such as _clck and _clsk and Microsoft cookies such as MUID. Recordings are kept for up to 30 days. Data may be transferred to the USA (EU-US Data Privacy Framework).
Meta Pixel and Conversions API (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland): measures the success of ads on Facebook and Instagram and shows ads to people who visited our store. Meta receives events (page views, add to cart, checkout, purchase), your IP address, browser data, the _fbp cookie and, from our server, hashed contact data (name, email, phone, location). For collecting and transferring this data we and Meta are joint controllers (Art. 26 GDPR); Meta is responsible for its further processing. Essence of the agreement: facebook.com/legal/controller_addendum; you can also exercise your rights with Meta: facebook.com/privacy/policy. Data may be transferred to the USA (EU-US Data Privacy Framework).
Pinterest Tag and Conversions API (Pinterest Europe Ltd., 3rd Floor, Waterloo Exchange, Waterloo Road, Dublin 4, Ireland): measures the success of ads on Pinterest. For collecting and transferring this data we and Pinterest Europe are joint controllers (Art. 26 GDPR, Pinterest Joint Controller Addendum); Pinterest is responsible for its further processing. Data may be transferred to the USA (EU-US Data Privacy Framework).

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

11. Fonts and images

Fonts and images are loaded from Shopify's servers; we do not use Google Fonts. The services in section 10 load their scripts from their own servers, and only after your consent.

12. Recipients

Besides the providers named above, we pass on data only where the law requires it, for example to our tax advisor and to tax authorities.

13. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20) and to withdraw any consent with effect for the future (Art. 7(3)). Just write to info@1daworks.com.

Right to object (Art. 21 GDPR)
You may object at any time to processing based on our legitimate interests for reasons arising from your particular situation. You may also object at any time to any use of your data for direct marketing; we will then no longer use it for this purpose.

You can also complain to a data protection authority, for example the one where you live or the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

14. Do you have to provide data?

For an order we need your email address, name and billing address; without them we cannot conclude the contract. Everything else is voluntary. We ourselves do not make decisions based solely on automated processing that have legal effects for you (Art. 22 GDPR); Klarna may do so for its credit check (section 5).