Data protection

1. Controller & Scope The controller is Nostalgic GmbH & Co. KG, Balanstraße 73, 81541 Munich, Germany, phone +49 (0)89 5454060, e-mail info@nostalgic.de. This notice applies to all pages under our domain, including sub-pages and embedded services where we determine the purposes and means.

2. Data Categories, Purposes & Legal Bases We process (a) technically necessary usage data when you visit our site; (b) information you submit via forms/communication; (c) subject to your consent: analytics/marketing data. Legal bases: Art. 6(1)(b) GDPR (contract/pre-contract), Art. 6(1)(f) GDPR (legitimate interests in operation/security), and— for non-essential technologies—Art. 6(1)(a) GDPR in conjunction with local ePrivacy/TTDSG rules.

3. Recipients, Processors, International Transfers We use service providers under Art. 28 GDPR (hosting, analytics, newsletter, support). Where data is transferred outside the EU/EEA, we rely on EU Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework (DPF). See each provider’s privacy information for details.

4. Cookies & Consent (TTDSG/ePrivacy) Non-essential cookies/trackers (e.g., analytics/marketing) are set only with your consent; you can change/withdraw your choices anytime via our cookie settings. Essential cookies are used to ensure secure, functional operation.

5. Server Logs & Security (TLS) Our hosting provider processes server log data (e.g., IP address, date/time, URL, referrer, browser/OS) to ensure stability and IT security; legal basis: Art. 6(1)(f) GDPR; typical retention 7–30 days. Transmission is protected by TLS encryption (https).

6. Contact Forms & Registration We process data you submit to handle your request or provide features; legal basis Art. 6(1)(a/b) GDPR. Retention lasts until completion of your request or statutory retention periods; recipients may include our host/CRM.

7. Newsletter (Mailchimp/Intuit) We send newsletters via Mailchimp (The Rocket Science Group LLC d/b/a Intuit, USA). Processing occurs only with your consent (Art. 6(1)(a) GDPR); unsubscribe anytime via the link in each e-mail. Transfers to the USA rely on DPF and/or SCCs; Mailchimp records opens/clicks for statistics. Details: https://mailchimp.com/legal/.

8. Web Analytics (Google Analytics 4) We use Google Analytics 4 only with your consent; Google does not store IP addresses for EU users. Recipient: Google Ireland Ltd.; data may be transferred internationally (DPF/SCC). You can withdraw consent in the cookie settings; more: https://policies.google.com/privacy.

9. Advertising & Conversion (Google Ads/Remarketing) With consent we use Google Ads/Remarketing and conversion tracking; pseudonymous profiles may be used to deliver cross-device ads. Manage preferences: https://adssettings.google.com/; more info: https://policies.google.com/technologies/ads.

10. Hotjar With your consent we use Hotjar for UX analytics (heatmaps, clicks/scrolls, feedback). Opt-out and details: https://www.hotjar.com/legal/policies/privacy/; we honor browser Do-Not-Track where enabled.

11. Social Plugins (Facebook/Instagram/Pinterest) We use a two-click solution and/or load plugins only after consent. Only then is a connection to Meta (Facebook/Instagram) or Pinterest established; personal data (e.g., IP, page views) may be transmitted. Joint controllership with Meta under Art. 26 GDPR may apply. Policies: Meta https://www.facebook.com/privacy/policy/, Instagram https://privacycenter.instagram.com/policy/, Pinterest https://policy.pinterest.com/en/privacy-policy.

12. Web Fonts For consistent typography we use locally hosted fonts; this means no connection to Google Fonts servers is made.

13. Storage Duration We retain personal data only as long as necessary for the stated purposes, legal obligations (e.g., commercial/tax retention) or the establishment/defense of legal claims; afterwards data is deleted or anonymized.

14. Your Rights & Supervisory Authority You have the rights of access, rectification, erasure, restriction, objection, data portability, and to withdraw consent (Art. 7(3) GDPR). You may lodge a complaint with your data protection authority; for Bavaria: https://www.lda.bayern.de/. Contact for privacy inquiries: info@nostalgic.de.

15. Changes & Effective Date We will update this notice when laws, services or processes change. Effective date: 6 Aug 2025.