Privacy Policy

1. Controller

theseodirect, Lukas Reinhardt, Engelbertstraße 12, 55276 Oppenheim, Germany. Email: support@theseodirect.com

2. What data we collect

• Contact form: name, email, phone (optional), company name, website URL, message.
• Checkout: name, email, phone (optional), company name, website URL, billing address (street, postcode, city, country), and — only if you enable the EU reverse-charge option — your VAT ID.
• We do not collect a postal address for anything other than the billing address entered at checkout, and we never collect one for the contact form.
• Automatically, if you consent: analytics data via Google Analytics 4 (see §5).
• Automatically, always: basic technical data needed to serve the site and cart (see §6).

3. Why we process it and the legal basis

• To respond to your contact-form message — Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) (legitimate interest in answering enquiries).
• To process your order through the cart and checkout, and to fulfil the resulting contract — Art. 6(1)(b) GDPR.
• To measure site usage via Analytics, only after you actively consent — Art. 6(1)(a) GDPR.
• To meet German commercial and tax record-keeping obligations (§147 AO, §257 HGB) for order and invoice data — Art. 6(1)(c) GDPR.

4. The cart and checkout

Cart contents are stored in your browser (local storage) and are not transmitted to us until you complete checkout. At checkout, we process the fields listed in §2 to create your order. Payment on this site currently runs in a clearly labelled demo mode: no card data is collected, stored, or transmitted by us or any payment processor.

5. Analytics — Google Analytics 4

We use Google Analytics 4 to understand which pages are useful, and only load it after you actively accept the "Analytics" category in the cookie banner or cookie settings. IP addresses are anonymised before storage. If you don't consent, no Analytics script loads and no Analytics data is collected. You can withdraw consent at any time via "Cookie settings" in the footer. Data processed by Google may be transferred to the United States; Google is self-certified under the EU-U.S. Data Privacy Framework where applicable.

6. Hosting and technical data

This site is hosted on shared infrastructure that, in the ordinary course of serving any web page, processes technical data such as IP address, browser type, and request timestamps in server logs, on the basis of our legitimate interest in operating a secure, functioning site (Art. 6(1)(f) GDPR). This data is not combined with the contact or checkout data described above.

7. Retention

• Contact-form submissions: retained for as long as needed to handle the enquiry, then deleted, unless a longer period is required by law.
• Order and billing data: retained for the statutory German retention periods (generally 10 years for accounting records under §147 AO / §257 HGB).
• Analytics data: retained per Google Analytics' standard retention settings, applied only if you've consented.

8. Your rights

Under the GDPR, you have the right to access, rectify, erase, or restrict processing of your personal data, to data portability, and to object to processing based on legitimate interest. To exercise any of these, contact support@theseodirect.com. You also have the right to lodge a complaint with a supervisory authority — in Rhineland-Palatinate, the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

9. Data recipients

We do not sell personal data. Data is shared only with processors necessary to run the site (hosting provider, Google Analytics once consented to) under data-processing agreements where required by Art. 28 GDPR.

10. Changes to this policy

We'll update this page if what we collect or why changes, and update the "Last updated" date accordingly.