PRIVACY POLICY

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Melissa Dornblut
trading as “Coastal Island Studio”

An der Brücke 3
04178 Leipzig
Germany

Email: contact@coastalislandstudio.com

2. General Information on Data Processing

The protection of your personal data is important to us. We treat your personal data confidentially and in accordance with the applicable data protection regulations and this Privacy Policy.

Personal data means any information relating to an identified or identifiable natural person.

In principle, this website can be used without providing personal data. Where personal data is collected, this is done exclusively within the framework of the applicable legal provisions and insofar as this is necessary to provide the website, process enquiries or perform a contract.

3. Hosting and Shop System Provided by Shopify

This website is operated via Shopify International Ltd., 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland.

Shopify provides the technical infrastructure for this website and processes personal data in particular for:

  • providing and displaying the website,
  • providing the shop functions,
  • the technical processing of orders,
  • ensuring security and stability,
  • error analysis and prevention of misuse.

In particular, the following data may be processed:

  • IP address,
  • date and time of access,
  • browser type and browser version,
  • operating system used,
  • referrer URL,
  • pages and files accessed,
  • technical device information.

The processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and efficient provision of our website and online services.

A data processing agreement pursuant to Art. 28 GDPR has been concluded with Shopify.

Further information on data processing by Shopify can be found in Shopify’s privacy policy.

4. Server Log Files

When this website is accessed, information is automatically collected in so-called server log files.

In particular, the following data may be processed:

  • IP address,
  • date and time of access,
  • browser type and browser version,
  • operating system used,
  • referrer URL,
  • pages and files accessed.

This data is used exclusively for the technical provision, security, stability and error analysis of the website.

This data is not combined with other data sources.

The legal basis is Art. 6(1)(f) GDPR.

5. Cookies and Technically Necessary Technologies

This website uses only technically necessary cookies and comparable technologies that are required for the operation and provision of the website.

These are used in particular for:

  • the technical provision of the website,
  • system security,
  • shopping cart and checkout functions,
  • error prevention and stability,
  • the correct display of content.

Analytics, tracking or marketing cookies are currently not used.

The legal basis for accessing information stored on the end device is Section 25(2) No. 2 TDDDG.

The subsequent processing of personal data is carried out on the basis of Art. 6(1)(f) GDPR.

6. Contact

If you contact us by email or via a contact form, we process the personal data you provide in order to handle your enquiry.

In particular, the following data may be processed:

  • name,
  • email address,
  • content of your message,
  • other information provided voluntarily.

Mandatory information is limited to the information required to process your enquiry.

The provision of certain personal data may be necessary in order to process your enquiry. Without the required information, it may not be possible to process your enquiry.

The processing is carried out on the basis of Art. 6(1)(b) GDPR insofar as your enquiry relates to the initiation or performance of a contract.

In all other cases, processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper processing of incoming enquiries.

7. Purchase of Digital Products

When purchasing our digital products, we process personal data insofar as this is necessary to carry out the ordering process, perform the contract and provide the digital content.

In particular, the following data may be processed:

  • first and last name,
  • email address,
  • billing address,
  • payment information,
  • order data,
  • information relating to the purchased product.

The provision of the personal data required for the order is necessary for the conclusion and performance of the contract. Without this data, the contract cannot be performed.

The processing is carried out on the basis of Art. 6(1)(b) GDPR.

Where statutory retention obligations apply, processing is additionally carried out on the basis of Art. 6(1)(c) GDPR.

8. Payment Processing and Sales via Lemon Squeezy

The sale of our digital products and payment processing are handled by Lemon Squeezy LLC as Merchant of Record.

Lemon Squeezy is responsible in particular for:

  • payment processing,
  • invoicing,
  • tax processing,
  • the technical provision of the purchasing process.

As part of the order processing, personal data is transmitted to Lemon Squeezy insofar as this is necessary for the performance of the contract.

In particular, the following data may be processed:

  • name,
  • email address,
  • billing address,
  • payment data,
  • order data,
  • information relating to the purchased product.

Lemon Squeezy processes the personal data required for these purposes partly under its own responsibility under data protection law.

The processing is carried out on the basis of Art. 6(1)(b) GDPR.

Further information can be found in Lemon Squeezy’s privacy policy.

9. Instagram Link

This website contains a link to our Instagram profile.

Merely visiting this website does not result in any personal data being transmitted to Instagram through this link.

Only when you click on the link do you leave our website and are redirected to the Instagram platform.

The respective platform operator is solely responsible for the data processing carried out there.

10. International Data Transfers

When using Shopify and Lemon Squeezy, personal data may be processed outside the European Union or the European Economic Area, particularly in Canada and the United States of America.

Personal data is transferred to third countries only in compliance with the legal requirements of Art. 44 et seq. GDPR.

In particular, the following safeguards may be used:

  • adequacy decisions of the European Commission,
  • EU Standard Contractual Clauses,
  • certifications under the EU-US Data Privacy Framework.

We have no influence over any further processing of the data by the respective providers after the data has been transferred.

11. Storage Period

Personal data is stored only for as long as necessary for the respective processing purposes or for as long as statutory retention obligations apply.

Data from contact enquiries is deleted once the enquiry has been fully processed, unless statutory retention obligations or legitimate interests prevent deletion.

Contract, invoice and payment data is generally stored for six or ten years in accordance with statutory commercial and tax retention requirements.

12. Data Subject Rights

Within the scope of the statutory provisions, you have the right to:

  • access pursuant to Art. 15 GDPR,
  • rectification pursuant to Art. 16 GDPR,
  • erasure pursuant to Art. 17 GDPR,
  • restriction of processing pursuant to Art. 18 GDPR,
  • data portability pursuant to Art. 20 GDPR,
  • object pursuant to Art. 21 GDPR.

Where processing is based on consent, you have the right to withdraw that consent at any time with effect for the future.

13. Right to Object pursuant to Art. 21 GDPR

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.

14. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

The competent supervisory authority in Saxony is:

Saxon Commissioner for Data Protection and Transparency

Maternistraße 17
01067 Dresden
Germany

15. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy where this becomes necessary due to changes in legal, technical or business circumstances.

The version published on this website at the time of your visit shall apply.

16. SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption.

You can recognise an encrypted connection by the fact that the address bar of your browser begins with “https://” and a lock symbol is displayed in your browser.

Last updated: June 2026