Imprint & Privacy Policy

Last updated: 31 August 2026

Imprint

Information pursuant to Section 5 DDG (German Digital Services Act)

Atelier Zajfert
Owner: Przemek Zajfert
Schillerstraße 7
71065 Sindelfingen
Germany

Phone: +49 157 35 39 8830
Email: post@the-7th-day.de

Responsible for journalistic and editorial content pursuant to Section 18(2) MStV

Przemek Zajfert
Schillerstraße 7
71065 Sindelfingen
Germany

Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:

Atelier Zajfert
Przemek Zajfert
Schillerstraße 7
71065 Sindelfingen
Germany

Phone: +49 157 35 39 8830
Email: post@the-7th-day.de

This Privacy Policy applies to The 7th Day website and online shop as well as to the digital image archive operated under the same domain using Piwigo.

2. General information on data processing

We process personal data only insofar as this is necessary to provide our website, process orders, enable participation in The 7th Day project, communicate with you or where you have given us your consent.

Depending on the processing activity, we rely in particular on the following legal bases:

  • Article 6(1)(a) GDPR – consent,
  • Article 6(1)(b) GDPR – performance of a contract and pre-contractual measures,
  • Article 6(1)(c) GDPR – compliance with a legal obligation,
  • Article 6(1)(f) GDPR – legitimate interests.

Where information is stored on or accessed from your device, the requirements of Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) also apply. Cookies and similar technologies that are not strictly necessary are used only with your consent.

3. Hosting by STRATO

Our website and related systems are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

When you access our website, the hosting provider processes technical data that may include:

  • IP address,
  • date and time of access,
  • requested page or file,
  • amount of data transferred,
  • browser and operating system,
  • referrer URL,
  • HTTP status code.

This processing is necessary to provide the website securely, reliably and without technical errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of our online services.

Where STRATO processes personal data on our behalf, such processing is carried out under a data processing agreement.

4. WordPress, WooCommerce and customer accounts

Our website is based on WordPress. We use WooCommerce and Germanized for WooCommerce for our online shop.

When you place an order, we may process in particular:

  • first and last name,
  • billing and delivery address,
  • email address,
  • telephone number where provided,
  • products, quantities and prices,
  • selected shipping and payment method,
  • order number, date and status,
  • payment and transaction-related information,
  • messages relating to your order.

The processing is necessary to process and perform your order and is based on Article 6(1)(b) GDPR.

If you create a customer account, we process the information you provide in order to provide the account functions. You may request deletion of your account unless statutory retention obligations require us to retain certain information.

5. Invoices and statutory retention obligations

Order, invoice and payment data are also processed and retained where required by German commercial or tax law.

Accounting records are retained for the legally required period. Business correspondence may also be subject to statutory retention periods.

The legal basis is Article 6(1)(c) GDPR in conjunction with the applicable commercial and tax laws.

6. Payment processing through Stripe

We use Stripe to process payments. Depending on the payment methods available at checkout, Stripe may enable payments by credit or debit card, Apple Pay, Google Pay, PayPal or other payment methods supported by Stripe.

In connection with a payment, the following data may in particular be transmitted to Stripe and, where applicable, to the payment method provider selected by you:

  • name,
  • email address,
  • billing and, where applicable, shipping address,
  • payment information,
  • transaction amount and currency,
  • order and transaction information,
  • IP address and device information,
  • fraud-prevention information.

Stripe processes information in particular to complete payments, authenticate transactions, prevent fraud and comply with legal obligations.

The legal basis for payment processing is Article 6(1)(b) GDPR. Processing for fraud prevention may additionally be based on Article 6(1)(f) GDPR.

If you select a third-party payment method offered through Stripe, data may additionally be transferred to the relevant payment provider. The provider’s own privacy rules also apply to its subsequent processing.

7. Shipping with DHL and Shiptastic

We use DHL and Shiptastic for WooCommerce to process shipments.

We transmit the data required to deliver your order to DHL. This may include in particular:

  • name,
  • delivery address,
  • telephone number where required,
  • shipment and parcel information.

The legal basis is Article 6(1)(b) GDPR because the transfer is necessary to deliver your order.

DHL shipment notifications

During checkout, you may voluntarily consent to the transfer of your email address to DHL so that DHL can send you shipment notifications and information about the expected delivery status.

Your email address is transferred for this purpose only if you actively select the corresponding voluntary checkbox. The legal basis is Article 6(1)(a) GDPR.

Your consent is voluntary and is not required to place an order. If you do not consent, you will still receive the regular shipping information and tracking link through our shop.

8. Contacting us

If you contact us by email, telephone or using the contact details provided on our contact page, we process the information you provide in order to handle your enquiry.

For enquiries relating to a contract, the legal basis is Article 6(1)(b) GDPR. Other enquiries are processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest is to process and respond to your enquiry.

We currently do not use a public contact form.

9. Participation in the project and image archive

Participants in The 7th Day art project may submit exposed photographic paper or transmit images that they have digitised themselves.

In this context, we may in particular process:

  • name or stated photographer/author name,
  • email address or other contact details,
  • the submitted or digitally transmitted image,
  • image number,
  • exposure period,
  • location and other voluntarily provided image information.

The data are processed in particular for attribution, digitisation, project organisation, archiving and publication of the image as part of the project.

The terms governing participation, digitisation, publication and the granting of rights of use are additionally set out in our General Terms and Conditions and Participation Terms.

Processing is carried out in particular for the performance of the voluntary participation arrangement pursuant to Article 6(1)(b) GDPR. Where consent is required for a specific processing activity, the legal basis is Article 6(1)(a) GDPR.

10. Piwigo image archive

Our digital image archive is operated using the open-source software Piwigo.

Visitors may register and create a user account in the archive. In this context, usernames, email addresses, login credentials and technical session information may in particular be processed.

Piwigo uses technically necessary session information to authenticate users and maintain their current session.

Registered visitors are currently not able to upload their own images to the archive and cannot post public comments on images.

Account information is processed to provide the requested user account and archive access pursuant to Article 6(1)(b) GDPR.

11. Cookies and consent management using CookieYes

We use CookieYes to manage cookie and tracking consent.

When you first visit our website, you can choose which categories of cookies and similar technologies you wish to allow. You can change or withdraw your choice at any time using the cookie settings available on the website.

We distinguish in particular between:

  • Necessary cookies: required for the secure and technically necessary operation of the website, shop, payment process, language selection and login,
  • Functional cookies: used for optional functions and external content,
  • Analytics cookies: used for statistical analysis of website use,
  • Advertising cookies: used for conversion measurement, marketing and interest-based advertising.

Non-essential cookies and comparable technologies are only used after you have given your consent.

CookieYes records information about your consent decision and may process a consent ID, timestamps and technically required information, including a shortened or masked IP address, for the purpose of documenting consent.

The legal basis for storing and documenting the consent decision is Article 6(1)(c) GDPR and/or Article 6(1)(f) GDPR. Where cookies or similar technologies are used based on your consent, Section 25(1) TDDDG and Article 6(1)(a) GDPR apply.

12. Google Analytics 4

We use Google Analytics 4 to analyse the use of our website.

The service may process information relating in particular to:

  • pages viewed,
  • source of the visit,
  • duration and interactions,
  • approximate geographic information,
  • browser, device and operating system information,
  • conversion and event data.

Google Analytics is used only after you have consented to the relevant cookie category.

The legal basis is Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR.

We additionally use Google Consent Mode to communicate the consent status selected by you to Google services. Non-essential Google tags are configured not to be activated for analytics or advertising purposes without the required consent.

13. Google Ads, Google Merchant Center and Google for WooCommerce

We use Google services to display our products and to measure advertising performance and shop conversions. These services include in particular Google for WooCommerce, Google Merchant Center and, where used, Google Ads and Google Conversion Tracking.

Product information may be transferred to Google Merchant Center so that our products can be displayed in Google services. Product information itself generally does not constitute personal data.

Where advertising and conversion measurement is used, usage, device, event and transaction information may be transferred to Google after you have given your consent.

The legal basis for personal analytics and advertising tracking is Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR.

14. WP Statistics and WooCommerce attribution

We use WP Statistics and WooCommerce functions for statistical analysis and to attribute visits or orders to their source.

Technical usage information such as pages viewed, referrers, browser and device information, times of visits and information concerning the source of a visit may be processed.

WooCommerce may in particular use Sourcebuster or sbjs information to attribute an order to its source.

Where this processing uses cookies or other information on your device that is not strictly necessary, or creates personal usage profiles, it is carried out only with your consent. The legal basis is then Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR.

Where exclusively anonymous or sufficiently anonymised statistical information is processed without accessing non-essential information on your device, processing is based on our legitimate interest in analysing and improving our services pursuant to Article 6(1)(f) GDPR.

15. Meta Pixel and Meta Conversions API

With your consent, we use services provided by Meta Platforms, in particular Meta Pixel and the Meta Conversions API.

These services help us measure the effectiveness of advertising on Facebook and Instagram, attribute conversions and create audiences for advertising campaigns.

Depending on the event and configuration, the following information may in particular be processed and transferred to Meta:

  • pages and products viewed,
  • shopping cart and purchase events,
  • order value and currency,
  • browser and device information,
  • IP address,
  • cookie and event identifiers,
  • where applicable, hashed contact information for improved event matching.

The Conversions API may transmit corresponding event information to Meta on a server-to-server basis.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR and, insofar as information is stored on or accessed from your device, Section 25(1) TDDDG.

16. Pinterest

We use Pinterest for WooCommerce and/or the Pinterest Tag to measure the effectiveness of Pinterest advertising, attribute conversions and display our products on Pinterest.

After you have given your consent, information concerning page views, product views, cart actions, purchases, device information and cookie identifiers may be transferred to Pinterest.

The legal basis is Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR.

17. YouTube and Vimeo

Videos from YouTube and Vimeo may be embedded on our website.

When such external content is loaded, a connection to the servers of the relevant provider may be established. Your IP address, browser and device information, the page visited and information about your interaction with the video may in particular be transferred.

Where technically implemented, external video content is loaded only after you have given your consent. Before consent, a notice concerning the blocked content may be displayed instead of the video.

The legal basis is Article 6(1)(a) GDPR and, where cookies or similar technologies are used, Section 25(1) TDDDG.

18. Embedded content and social media services

Our website may contain embedded content or functions from social networks such as Instagram, Facebook, TikTok or Pinterest, and may also link to profiles on these platforms.

If a social media profile is only linked, data are generally transferred to the respective provider only when you follow the link.

Directly embedded content may establish a connection to the respective provider when it is loaded. Where technically implemented, non-essential embedded content is only loaded after you have given your consent.

The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG where consent is required.

19. OpenStreetMap

We use map material based on OpenStreetMap in our digital image archive.

When you open a map view, technical data such as your IP address, browser information, date and time and information relating to the requested map may be transmitted to servers from which the map data or map tiles are loaded.

The service is used to provide a geographic representation of locations documented in our image archive.

Where consent is required to load external map content, processing is based on Article 6(1)(a) GDPR. Where no consent-requiring technologies are used, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the clear geographic presentation of the images documented in the archive.

20. hCaptcha and security functions

Technical security services such as hCaptcha may be used on our website to prevent automated access, abusive requests, attempted fraud and other security threats.

This may involve processing IP addresses, browser and device information, interaction data and security or risk information.

The processing is carried out to protect our website, shop and payment processes. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting our systems and users against abuse and automated attacks.

Where strictly necessary information is stored on or accessed from your device for these purposes, Section 25(2) TDDDG applies.

21. Security and protection against unauthorised access

We use technical and organisational security measures and functions to protect our website and user accounts against unauthorised access. These may include login protection, limiting repeated login attempts and two-factor authentication.

IP addresses, timestamps and technical information relating to login attempts may be processed for these purposes.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting our systems and user accounts.

22. Transfers to third countries

Some providers used by us or their subcontractors are located outside the European Union or European Economic Area, in particular in the United States.

Where personal data are transferred to a third country, this is carried out only in accordance with the applicable legal requirements. Depending on the provider, transfers may in particular be based on an adequacy decision, certification under the EU-U.S. Data Privacy Framework, Standard Contractual Clauses adopted by the European Commission or other legally recognised safeguards.

Transfers in connection with non-essential analytics, advertising or external media services generally take place only where you have previously consented to the relevant processing.

23. Retention periods

We generally retain personal data only for as long as necessary for the relevant purpose.

After a contract has been completed, contractual information is deleted once there are no statutory retention requirements, warranty periods, limitation periods or other legitimate grounds requiring further retention.

Under German law currently in force, tax-relevant accounting documents are generally retained for eight years. Different statutory retention periods may apply to other documents.

Data processed solely on the basis of your consent will generally be deleted or no longer processed for the relevant purpose if you withdraw your consent, unless another legal basis permits continued processing.

24. Your rights

Subject to the applicable legal requirements, you have in particular the following rights:

  • right of access under Article 15 GDPR,
  • right to rectification under Article 16 GDPR,
  • right to erasure under Article 17 GDPR,
  • right to restriction of processing under Article 18 GDPR,
  • right to data portability under Article 20 GDPR,
  • right to object under Article 21 GDPR.

Withdrawal of consent

You may withdraw any consent you have given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

You can change or withdraw your cookie and tracking consent at any time using the cookie settings available on our website.

Right to object to processing based on legitimate interests

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation in accordance with Article 21 GDPR.

25. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority concerning the processing of your personal data.

Our competent supervisory authority is in particular:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany

26. Automated decision-making

We do not ourselves make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

27. Changes to this Privacy Policy

We may amend this Privacy Policy if our website, the services we use or legal requirements change.

The current version published on this website applies.