Little Magic Co.

Privacy policy

This is a translation for convenience. The German version (Datenschutzerklärung) is the legally binding one.

Last updated: October 2026

1. Controller

The controller responsible for processing data on this website under the General Data Protection Regulation (GDPR) is:

[Please add: full name]
Little Magic Co.
Andromedastr. 5
85055 Ingolstadt
Germany

Email: [Please add: email address]

2. The short version

3. Hosting and delivery of the website

Our website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”) and delivered through its network. When you visit the website, Cloudflare processes technically necessary data that your browser sends automatically (server log files):

Purpose: delivering the website, keeping it stable and secure, and defending against attacks (e.g. DDoS).
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, fast and reliable website.
Data processing agreement: Cloudflare processes this data on our behalf under a data processing agreement (Art. 28 GDPR).
Transfer to the USA: Cloudflare is certified under the EU-US Data Privacy Framework, so an adequacy decision of the European Commission applies (Art. 45 GDPR); EU standard contractual clauses apply in addition.
Storage period: Cloudflare keeps log data only as long as needed for these purposes and then deletes or anonymises it.

More information: Cloudflare privacy policy.

4. Cookies

We do not set any cookies ourselves. In individual cases, Cloudflare may set technically necessary cookies for security reasons, for example to detect automated attacks. These serve only to keep the website secure and do not require consent (§ 25(2) no. 2 TDDDG; legal basis for processing: Art. 6(1)(f) GDPR).

5. Links to Etsy, Instagram and other platforms

Our website contains simple links to our Etsy shop and our social media profiles. These are not embedded content or plugins: simply visiting our site sends no data to these providers. Only when you click a link do you leave our website, and from then on the provider processes your data under its own responsibility:

6. Contacting us via Instagram, Etsy or email

If you contact us via Instagram, Etsy or email, we process your message and the details it contains (e.g. name, username) to answer your request. The legal basis is Art. 6(1)(b) GDPR where it concerns an order or contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). We delete the data once it is no longer needed, unless legal retention obligations apply. Please note that for messages sent via Instagram and Etsy, the platform operators also process your data under their own privacy policies.

7. Orders via Etsy

Purchase contracts are concluded via the Etsy platform. To fulfil your order, Etsy gives us the data needed for this (e.g. name, delivery address, items ordered). The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (retention obligations under commercial and tax law, usually up to ten years).

8. Your rights

You have the right at any time to:

Right to object (Art. 21 GDPR)

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation.

Right to complain

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

For any request about your rights, simply message us using the contact details above.

9. Encryption

This website is only delivered over an encrypted connection (HTTPS/TLS).

10. No automated decision-making

We do not use automated decision-making or profiling.

11. Changes to this privacy policy

We update this privacy policy when the website or legal requirements change. The version published here always applies.