Privacy Policy

Last Updated: September 11, 2026

1. Data Controller Information

The responsible controller for data processing on this website in accordance with the European General Data Protection Regulation (GDPR / DSGVO) and the German Federal Data Protection Act (BDSG) is:

Daniel Borges Einzelunternehmen
trading as Sparki Studio
Mathildenstraße 44
64285 Darmstadt
Germany
Email: contact@sparki.studio
VAT ID (USt-IdNr.): DE348443419

2. General Principles and Legal Bases

We process personal data only when permitted by law. In accordance with Art. 6 (1) GDPR, the legal grounds for our processing activities include:

  • Consent (Art. 6 (1)(a) GDPR; § 25 (1) TDDDG): When you give explicit permission for a specific processing activity, such as non-essential cookies, analytics, social media embeds, or our newsletter.

  • Contract Performance & Pre-Contractual Inquiries (Art. 6 (1)(b) GDPR): When processing is necessary to execute an agreement with you, such as fulfilling orders in our online shop, creating customer accounts, or delivering physical goods.

  • Compliance with Legal Obligations (Art. 6 (1)(c) GDPR): When we must retain or process data to comply with statutory commercial and tax regulations under the German Commercial Code (HGB) and Fiscal Code (AO).

  • Legitimate Interests (Art. 6 (1)(f) GDPR): When processing is necessary to secure, operate, and maintain our web infrastructure, protect against fraudulent transactions, and manage our business operations, provided your fundamental rights do not take precedence.

3. Hosting and Server Infrastructure (Squarespace)

Our website is hosted on the platform provided by Squarespace (Squarespace Ireland Ltd., Le Pole House, Ship Street Great, Dublin 8, Ireland; parent company: Squarespace, Inc., 225 Varick Street, 12th Floor, New York, NY 10014, USA).

When accessing our web pages, Squarespace automatically collects technical server log files transmitted by your browser:

  • Browser type, build, and version

  • Operating system used

  • Referrer URL (previously visited page)

  • Hostname and IP address of the accessing device

  • Time and date of the server request

This data processing is based on Art. 6 (1)(f) GDPR (our legitimate interest in ensuring system security, technical stability, and uninterrupted website delivery). Data transfers to Squarespace's US entity are safeguarded under the EU-U.S. Data Privacy Framework (DPF) and European Commission Standard Contractual Clauses (SCCs).

4. Fonts and Typography

To maintain consistent and appealing visual styling, this website utilizes fonts provided natively by Squarespace or uploaded directly to our local web storage.

These font files are delivered directly from Squarespace’s content delivery network or our web server. Your browser connects to our hosting server rather than external third-party font libraries (such as external Google-hosted servers), preventing your IP address from being transmitted to third parties for typography purposes. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in appealing, uniform, and privacy-compliant web design).

5. Online Store, Order Processing, and Shipping

A. Order Data

When you purchase physical goods through our online shop, we collect the details required to fulfill and invoice your purchase:

  • First and last name

  • Billing address and shipping address

  • Email address

  • Purchased items and payment transaction confirmation

The legal basis is Art. 6 (1)(b) GDPR (contract performance). In compliance with German tax and commercial laws (§ 147 AO, § 257 HGB), purchase invoices and associated transaction records are retained for statutory retention periods of up to 10 years.

B. Shipping and Fulfillment Carriers (DHL / Deutsche Post & Others)

To deliver your physical goods, we transmit your name and shipping address (and, where required for tracking updates and permitted by you, your email address) to selected logistics and transport providers:

  • DHL / Deutsche Post (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany)

  • Other licensed parcel delivery or logistics services selected during checkout.

This transmission is carried out pursuant to Art. 6 (1)(b) GDPR for the express purpose of contract delivery.

C. Payment Methods and Processors

We do not directly collect or store your full credit card or sensitive bank details on our servers. All transactions are securely routed through certified payment gateways:

  • Squarespace Payments / Stripe:
    When using Squarespace Payments, transaction data is processed via integrated payment infrastructure provided by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA). Stripe processes payment details, fraud prevention indicators, and transaction data under Art. 6 (1)(b) GDPR. Transatlantic data transfers are protected under the EU-U.S. Data Privacy Framework.

  • PayPal:
    If you select PayPal at checkout, payment is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal collects your payment details, account login data, and transaction information to authorize payment. The legal basis is Art. 6 (1)(b) GDPR. For further details, consult PayPal's Privacy Statement.

6. Customer and User Accounts

You have the option to register for a customer account on our website. This account allows you to review active and historical orders, monitor delivery statuses, and maintain your addresses for simplified future checkout.

  • Registration requires your name, email address, and a self-selected secure password.

  • Processing is conducted pursuant to Art. 6 (1)(b) GDPR (fulfilling the user account agreement).

  • You can request the termination and deletion of your customer account at any time by contacting contact@sparki.studio. Upon account termination, your data will be erased, provided no active contracts or statutory commercial/tax retention obligations require continued preservation.

7. Email Newsletter and Marketing Communications

If you subscribe to our newsletter, your email address (and any voluntary name fields) will be used to send updates, store news, and product announcements.

  • Double Opt-In Procedure: Subscription uses a verified double opt-in mechanism. After entering your address, you receive a confirmation email containing a verification link. Only once clicked is your subscription activated.

  • Legal Basis: Processing is based entirely on your freely given consent under Art. 6 (1)(a) GDPR.

  • Newsletter Service Providers: We may use professional newsletter management tools (such as Squarespace Email Campaigns or third-party email marketing platforms) acting as data processors under an Art. 28 GDPR Data Processing Agreement.

  • Unsubscribing / Withdrawal of Consent: You can revoke your consent and unsubscribe at any time by clicking the "Unsubscribe" link included in every newsletter footer or by emailing contact@sparki.studio.

8. Web Analytics (Google Analytics)

Our website intends to use Google Analytics, a web analysis service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"; parent: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Google Analytics uses cookies and similar identifiers to measure traffic and evaluate user interaction with our web pages:

  • Consent Requirement: Google Analytics is blocked by default and activated only if you provide explicit prior opt-in consent through our cookie banner (Art. 6 (1)(a) GDPR and § 25 (1) TDDDG).

  • IP Anonymization: We implement Google Analytics with active IP anonymization. Your IP address is shortened by Google within the EU/EEA prior to transmission to servers outside the European Economic Area.

  • Data Privacy Framework: Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF), assuring an adequate data protection standard for US transfers.

  • Opt-Out: You can withdraw your consent at any time via the cookie settings link in our website footer or by installing the official Google Analytics Opt-out Browser Add-on.

9. Social Media Profiles, Feeds, and Embedded Widgets

Our website links to our official social media channels (e.g., Instagram, Meta) and may feature social feeds or interactive widgets.

  • Social Links: Standard social media buttons are embedded as simple hyperlinks rather than tracking scripts. Clicking a link directs you to the respective platform; no personal tracking data is shared with the social network while you merely browse our website.

  • Interactive Widgets & Feeds (e.g., Instagram Feed): When third-party interactive feeds are displayed directly on our pages, external servers receive technical connection data (such as your IP address). Where such embeds set third-party cookies or scripts, they are integrated subject to prior consent (Art. 6 (1)(a) GDPR; § 25 (1) TDDDG) via our cookie consent banner.

  • Providers include:

    • Instagram / Meta: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (certified under the EU-U.S. Data Privacy Framework).

    • Other social platforms: Subject to their respective privacy terms and applicable consent configurations.

10. Contact Inquiries

When you reach out to us via email or our website contact form, the details you enter (name, contact email, and message text) are stored to process and respond to your inquiry.

  • Legal Basis: Art. 6 (1)(b) GDPR for pre-contractual and contract-related inquiries; Art. 6 (1)(f) GDPR for general correspondence based on our legitimate interest in customer care.

  • Inquiries are deleted once the matter is conclusively resolved, provided statutory retention obligations do not apply.

11. Data Subject Rights Under the GDPR

As an affected individual, you are entitled to comprehensive statutory rights under Chapter III of the GDPR:

  • Right of Access (Art. 15 GDPR): Obtain confirmation and comprehensive details regarding your personal data processed by us.

  • Right to Rectification (Art. 16 GDPR): Correct inaccurate or complete incomplete personal data without undue delay.

  • Right to Erasure ("Right to be Forgotten", Art. 17 GDPR): Request the deletion of your personal data, subject to statutory retention exceptions.

  • Right to Restriction of Processing (Art. 18 GDPR): Demand that processing be restricted under specific statutory conditions.

  • Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, standard, and machine-readable format.

  • Right to Withdraw Consent (Art. 7 (3) GDPR): Revoke any previously granted consent at any time with effect for the future.

  • Right to Object (Art. 21 GDPR): Object at any time, on grounds relating to your particular situation, to data processing based on legitimate interests (Art. 6 (1)(f) GDPR).

To exercise any of these rights, contact us at: contact@sparki.studio.

Supervisory Authority

Under Art. 77 GDPR, you also have the right to lodge a formal complaint with a data protection supervisory authority. The competent supervisory authority for our registered location in Hesse, Germany is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
Website: datenschutz.hessen.de

12. Security and SSL/TLS Encryption

To safeguard data transmissions (such as orders, account credentials, and contact inquiries) against unauthorized interception, our site operates using mandatory SSL/TLS encryption. You can confirm an active encrypted connection by looking for the lock icon and https:// in your browser address bar.