Last updated: October 2026
This English version is a translation provided for your convenience. In case of any discrepancy, the German version shall prevail.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
E-Commerce Istvan Sahin
Owner: Istvan Sahin
Tuttlinger Str. 28 UG
70619 Stuttgart, Germany
Email: support@bandfactory.eu
Phone: +49 711 25284541
2. General information on data processing
We only process personal data insofar as this is necessary to provide the website, to process orders or to fulfil legal obligations, or if you have given your consent. The legal bases are in particular Art. 6 (1) (a) GDPR (consent), Art. 6 (1) (b) GDPR (performance of a contract), Art. 6 (1) (c) GDPR (legal obligation) and Art. 6 (1) (f) GDPR (legitimate interest).
3. Hosting and server log files
When you visit our website, the web server automatically processes data transmitted by your browser: IP address, date and time of access, page accessed, referrer URL, browser type and operating system. This data is used to deliver the website, to ensure its operation and to defend against attacks (Art. 6 (1) (f) GDPR). Log data is deleted after 14 days at the latest unless it is needed to investigate a security incident.
4. SSL/TLS encryption
For security reasons and to protect the transmission of confidential content (e.g. orders), this website uses SSL/TLS encryption. You can recognise this by the padlock symbol in the browser bar and by “https://” in the address.
5. Cookies, consent, web analytics and online advertising
Technically necessary cookies
We use technically necessary cookies for the shopping cart and session (WooCommerce), the language setting (Polylang) and for storing your cookie choice. They are strictly necessary for the operation of the website and do not require consent (Section 25 (2) No. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); the legal basis for the processing is Art. 6 (1) (b) or (f) GDPR.
Consent management (CookieYes)
On your first visit, we ask you via a banner whether you allow cookies and similar technologies for analytics and advertising. For this we use the WordPress plugin “CookieYes” in a version that runs entirely on our server; no data is transmitted to the provider of CookieYes. We store your choice in the cookie “cookieyes-consent” (lifetime 1 year); the plugin “WP Consent API” passes it on to the other functions of the website (cookies “wp_consent_…”, lifetime 30 days). The legal basis is Art. 6 (1) (c) GDPR in conjunction with Section 25 (1) TDDDG and Art. 7 (1) GDPR (proof of consent).
You can change or withdraw your consent at any time with effect for the future – via the cookie symbol at the bottom of the screen or here in the cookie settings.
Google Analytics 4 and Google Ads
We use Google Analytics 4 (web analytics) and Google Ads (online advertising) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Both are integrated via the Google tag (gtag.js) using the WordPress plugin “Site Kit by Google”.
Purposes: With Google Analytics 4 we analyse how our website is used (e.g. pages viewed, time spent, origin of the visit, device type, approximate location at city or country level) in order to improve it. With Google Ads we place advertisements and measure their success (conversion tracking for enquiries, shopping cart, checkout visits and purchases including order value and items ordered – without name, address or email address). If you have consented to the “Advertisement” category, we also use the data to show visitors to our website ads again on other websites and in Google Search (remarketing) and to personalise ads.
Data processed: online identifiers (e.g. cookie IDs), device and browser information, pages viewed and referrers, time and interactions (e.g. clicks, enquiries, purchases). Google Analytics 4 does not store IP addresses; they are only used briefly to determine location and then discarded.
Cookies: “_ga” and “_ga_…” (Google Analytics, lifetime 2 years) and – with consent to “Advertisement” – Google Ads cookies such as “_gcl_au” (90 days) and cookies on Google domains.
Consent and Google Consent Mode: We only set Google cookies if you have consented to the “Analytics” or “Advertisement” category (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). We use Google Consent Mode: without your consent, the Google tag does load, but it neither sets nor reads cookies and only transmits cookieless signals (e.g. page view, consent status, time, browser and device information; for technical reasons your IP address is visible to Google in the process). According to Google, it uses these signals without personal reference for the statistical estimation (modelling) of visit and conversion numbers. The legal basis for this cookieless transmission is our legitimate interest in data-minimising measurement of the reach and success of our advertising (Art. 6 (1) (f) GDPR). You can object to this at any time (Art. 21 GDPR), e.g. by email to us or by blocking scripts from googletagmanager.com in your browser.
Recipients and transfer to third countries: We have concluded a data processing agreement with Google (Art. 28 GDPR) or – for Google Ads – the Google Ads Controller-Controller Data Protection Terms. A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework, so an adequacy decision of the EU Commission exists (Art. 45 GDPR). In addition, the EU Standard Contractual Clauses apply.
Storage period: Analytics data in Google Analytics is automatically deleted after 14 months. Remarketing lists in Google Ads exist for a maximum of 540 days.
Further information: business.safety.google/privacy and policies.google.com/privacy. You can also switch off personalised advertising by Google at adssettings.google.com.
Origin of your visit (cookie “bf_src”)
If you have consented to the “Analytics” category (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), we store in our own cookie “bf_src” (lifetime 90 days from the last change) how you came to our website (e.g. search engine, advertisement or referring website), the first page you accessed, the date of your first visit and the number of days on which you have visited us. If you have also consented to the “Advertisement” category, we also store the identifier of a Google ad you clicked. The cookie is only read by our website and is not transmitted to third parties; we do not record visits to other websites with it. If you send us an enquiry (configurator, contact form) or place an order, we store this information together with your enquiry or order in order to assess the success of our advertising. If you withdraw your consent, we delete the cookie the next time you load a page.
6. Order and contract processing
To process your order, we process the data you provide: name, delivery and billing address, email address and your order and design data (e.g. text, logo, colour choice of your wristband). The legal basis is Art. 6 (1) (b) GDPR. We retain invoice and accounting data in accordance with commercial and tax law requirements (Section 147 of the German Fiscal Code, AO; Section 257 of the German Commercial Code, HGB: up to 10 years) and delete it afterwards.
7. Disclosure to production and shipping partners (third country)
Our wristbands are custom-made and shipped to you directly from the production facility. The production facilities are located in the People’s Republic of China. To perform the contract, we transmit the data required for this purpose there: your name, the delivery address and the design data of the wristband. The legal basis for the transfer to this third country is Art. 49 (1) (b) GDPR (necessity for the performance of the contract between you and us). Any further use of your data by the partners is contractually excluded.
For deliveries to another EU member state with a value of goods of more than €150, we transmit your name, delivery address, telephone number and, where applicable, tax or EORI number to our shipping service provider and the competent customs authorities so that the goods can be cleared through customs in your name (Art. 6 (1) (b) and (c) GDPR).
8. Payment service providers
PayPal
If you pay with PayPal, you will be redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. We transmit the data required for payment processing (name, amount, order number) to PayPal (Art. 6 (1) (b) GDPR). PayPal’s privacy notice also applies: paypal.com/de/legalhub/privacy-full.
Payment in advance (bank transfer)
If you pay in advance, we receive the usual transfer data from our bank (name, IBAN, payment reference). We use this exclusively to allocate and process your order (Art. 6 (1) (b) GDPR).
9. Location detection for tax calculation
To correctly preset the country-specific VAT and to display the appropriate final price in the configurator (including import charges where applicable), we determine the country from which you access the shop from your IP address. The assignment is made via a geo database stored locally on our server (MaxMind GeoLite2); your IP address is not transmitted to third parties in the process. The legal bases are Art. 6 (1) (c) GDPR (correct taxation) and Art. 6 (1) (f) GDPR.
10. Contacting us
Email and contact form
If you contact us by email or form, we process your details to handle your enquiry (Art. 6 (1) (b) or (f) GDPR). We delete the data as soon as the enquiry has been dealt with conclusively and no statutory retention obligations prevent this.
Phone
If you call us, we process your phone number and the information you give us during the call to handle your request (Art. 6 (1) (b) or (f) GDPR). Calls are not recorded. For telephony we use a provider of internet telephony (VoIP), which processes the connection data generated on our behalf (Art. 28 GDPR); telecommunications secrecy also applies. We delete notes on your request as soon as the enquiry has been dealt with conclusively and no statutory retention obligations prevent this.
On our website we offer the option of contacting us via WhatsApp with a click. Only when you click does WhatsApp open (provider: WhatsApp Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland); WhatsApp’s privacy policy, over which we have no influence, applies. Merely visiting our website does not transmit any data to WhatsApp. Use is voluntary — you can also reach us by email at any time. If you have consented to the “Analytics” category, the prepared message contains a short, visible note on the origin of your visit at the end (“Ref: …”, see section 5); you can delete it before sending.
11. Customer account
You can optionally create a customer account to view orders and save address data (Art. 6 (1) (b) GDPR). The account can be deleted at any time by sending us an email; statutory retention obligations for order data remain unaffected.
12. Fonts (Google Fonts)
For a uniform display we use fonts from the Google Fonts library. The font files are loaded locally from our own server; no connection to Google servers takes place.
13. Your rights
You have the following rights with regard to your personal data: right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). You can withdraw any consent you have given at any time with effect for the future. An email to support@bandfactory.eu is sufficient to exercise these rights.
14. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.
15. No automated decision-making
There is no automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. The selection of personalised advertising by Google described in section 5 only takes place with your consent.