Privacy policy

This is a translation for your convenience. The German version of this document is the legally binding one. Read the German version →

1. Overview

With this privacy policy we inform you which personal data we process when you visit our website merchmyday.de and use our enquiry forms, for what purposes this happens and what rights you have. The basis is the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the TDDDG.

The most important point first: our website works without tracking or analytics services and without advertising cookies. Fonts, images and videos are hosted on our own server and are not loaded from third-party servers. The exceptions are our consent banner (Cookiebot, see section 4), through which you control whether services that are not technically necessary may be loaded in future, and the protection of our forms against misuse by Google reCAPTCHA, which is only loaded once you use a form (see section 5). We process personal data essentially only when you send us an enquiry through one of our forms.

2. Controller

The controller for data processing on this website is:

Merch my Day GmbH
Justus Stroetmann
Nürnberger Str. 38
10777 Berlin, Germany

Email: info@merchmyday.de
Phone: +49 163 4823314

3. Hosting and server log files

Our website is operated by an external hosting provider; processing takes place on servers within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with that provider. On request we will gladly name the current provider.

When the website is called up, the web server automatically processes information transmitted by your browser (server log files): IP address, date and time of access, page called up, browser and operating system used, and the previously visited page (referrer).

This data is technically necessary in order to deliver the website and additionally serves the security and stability of operations (e.g. defending against attacks, error analysis). The legal basis is our legitimate interest in the secure and functional operation of the website (Art. 6 (1) (f) GDPR). The log files are not merged with other data sources and are deleted automatically according to the periods customary at the hosting provider.

4. Cookies, consent management and local storage

We set technically necessary cookies without your consent — they are required for the operation of the website:

• A session cookie required for the technical function of the website (e.g. to process forms correctly and display success messages). It expires after two hours at the latest.

• A CSRF token cookie that protects our forms against abusive submissions by third parties.

• The “CookieConsent” cookie of our consent banner, in which your choice is stored so that we can respect it on future visits. It expires after twelve months.

These cookies contain no tracking identifiers and are not used to analyse your behaviour. The legal basis is § 25 (2) no. 2 TDDDG in conjunction with our legitimate interest in the technical provision of the website (Art. 6 (1) (f) GDPR).

All cookies and services beyond these are loaded only once you have consented in the banner (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). As long as no consent has been given, the banner blocks such scripts automatically. Google reCAPTCHA is an exception: to protect our forms against misuse it is loaded without consent as soon as you use a form, and it may set a cookie from Google (e.g. “_GRECAPTCHA”); for details and the legal basis see section 5.

To obtain and document this consent we use Cookiebot, a service of Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark. A data processing agreement pursuant to Art. 28 GDPR is in place with Cybot; processing takes place within the EU. When the website is called up, the banner script is loaded from Cookiebot's servers; in doing so your IP address (anonymised by Cookiebot), date and time, browser and device information, the page called up and an anonymous random key are processed. Together with the status of your choice, this operation is logged for twelve months so that we can demonstrate consent (Art. 7 (1) GDPR). The legal basis for using Cookiebot is our legal obligation to manage and evidence consent (Art. 6 (1) (c) GDPR) and our legitimate interest in operating the website in a legally compliant manner (Art. 6 (1) (f) GDPR).

You can change or withdraw your choice at any time with effect for the future — via the “Cookie settings” link at the bottom of every page. Further information can be found in Cookiebot's privacy policy at www.cookiebot.com/en/privacy-policy/.

If you add items to your enquiry list on the products page, your browser stores that list locally on your device (local storage). This data remains on your device and is transmitted to us only once you actually send the enquiry. You can clear local storage at any time through your browser settings.

The following overview lists all cookies used on this website with their purpose and lifetime; it is kept up to date automatically:

5. Project and contact enquiries

You can send us project enquiries through our enquiry form. In doing so we process the data you enter: name of the contact person, email address and — depending on the form and on your voluntary disclosure — telephone number, artist, brand, club or company name, social media profiles, details of the project (e.g. occasion, quantity) and your message.

We use this data exclusively to process and answer your enquiry and to prepare the subsequent quote. Your enquiry is stored in our system and forwarded internally by email to the responsible staff; you receive an acknowledgement of receipt by email.

The legal basis is Art. 6 (1) (b) GDPR (steps taken prior to entering into a contract at your request) or Art. 6 (1) (f) GDPR (legitimate interest in answering general enquiries).

We delete enquiry data as soon as it is no longer required for processing and no statutory retention obligations (in particular under commercial and tax law, § 257 HGB, § 147 AO) stand in the way. If a business relationship comes about, we store the data for its duration and for the statutory retention periods.

Protection of our forms against misuse (Google reCAPTCHA). To protect our enquiry, order and registration forms against automated input — in particular against being misused to send unwanted emails to third parties — we use Google reCAPTCHA v3, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA is only loaded once you use one of our forms and checks, based on your behaviour, whether the input comes from a human. In the process, in particular your IP address, browser and device information, date and time, the page visited and interaction data (e.g. time spent, mouse and keyboard input) are transmitted to Google; Google may use cookies or comparable technologies. A transfer to Google LLC in the USA is possible; Google is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). If reCAPTCHA rates an input as probably automated, we store it for manual review and do not send an email to the address provided; for an order with payment you receive the order confirmation only once payment has been received.

The legal basis is our legitimate interest in protecting our forms and our email infrastructure against misuse and in protecting third parties from unwanted emails (Art. 6 (1) (f) GDPR). Insofar as information is stored on or read from your device in the process, this is strictly necessary for sending the form at your request (§ 25 (2) no. 2 TDDDG). Further information can be found in Google’s privacy policy at policies.google.com/privacy and in its terms of service at policies.google.com/terms.

6. Order enquiries and print file uploads

You can submit a non-binding order enquiry through our product library. In doing so we process: name of the contact person, email address, optionally company and telephone number, your message, the items enquired about (products, colours, quantities, finishing requests) and optionally uploaded files (e.g. logos and print files as PNG, JPG, WebP or PDF).

Uploaded files are stored access-protected outside the publicly reachable area of our server and are used exclusively to review and process your enquiry. Please do not upload files containing special categories of personal data (Art. 9 GDPR).

The legal basis is Art. 6 (1) (b) GDPR (steps taken prior to entering into a contract). Section 5 applies accordingly to the storage period.

AI design assistant ("D.AI") and AI chat: If you use the AI design assistant in the configurator, we transmit your artwork description (prompt) and any reference images you upload to Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Gemini API" service) in order to generate the image. The same applies to your messages to the AI chat assistant on our website. This may involve a transfer to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR). Please do not upload reference images showing identifiable persons or containing special categories of personal data, and do not share sensitive data in the chat. We only store generated designs once you add them to an enquiry or order; until then they reside exclusively in your browser's storage (section 4). The legal basis is Art. 6 (1) (b) GDPR (provision of the function you requested). Further information: policies.google.com/privacy.

Image generation via OpenAI: To generate artwork in the AI design assistant we transmit your artwork description (prompt) and any reference images you upload to OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. This may involve a transfer to OpenAI OpCo, LLC in the USA; the transfer is safeguarded by the EU Commission's standard contractual clauses (Art. 46 (2) (c) GDPR). OpenAI processes the content as a processor and, under the API terms, does not use it to train its own models. Here, too: please do not upload reference images showing identifiable persons or containing special categories of personal data. The legal basis is Art. 6 (1) (b) GDPR. Further information: openai.com/policies/privacy-policy.

7. Payment via Stripe

When you place a paid order in the configurator, payment is processed by our payment provider Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). You are redirected to a payment page hosted by Stripe for this purpose.

Stripe processes the data required for the payment — in particular your payment details (e.g. card number or chosen payment method), name, email address, billing and delivery address, the order amount and your IP address. Your full payment details are processed exclusively by Stripe and never reach our servers; we only receive confirmation of the payment with reference numbers and the details needed for receipts and accounting. Stripe also issues the invoice for your order on our behalf and delivers it to you by email.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Stripe acts partly as our processor and partly — for example for fraud prevention and to meet payment-law obligations — as an independent controller. Personal data may be transferred to Stripe, Inc. in the USA; Stripe is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR). Further information is available in Stripe’s privacy policy at stripe.com/en-de/privacy.

We retain payment and invoice data within the scope of our statutory commercial and tax retention obligations (§ 257 HGB, § 147 AO).

8. Email communication

For sending and receiving emails (acknowledgements of receipt, internal notifications, correspondence) we use Google Workspace of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A data processing agreement pursuant to Art. 28 GDPR is in place with Google. This may involve a transfer of personal data to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR).

If you contact us directly by email, we process your details in order to deal with your request (Art. 6 (1) (b) or (f) GDPR).

9. Data security

All data on our website is transmitted encrypted via HTTPS/TLS. Our systems are protected against loss, misuse and unauthorised access by technical and organisational measures. We create automatic daily backups of our database and of the access-protected uploads, which are overwritten automatically after seven days; the same protective measures apply to backups as to the original data.

10. Recipients and disclosure of data

As a matter of principle we do not pass your data on to third parties. The exceptions are: our processors (hosting, consent and email providers, see sections 3, 4, 7 and 8), Google as the provider of reCAPTCHA (see section 5), disclosure for the performance of the contract (e.g. an address to a transport company for a delivery) and cases in which we are legally obliged to disclose.

No transfer to third countries outside the EU/EEA takes place unless stated otherwise in this policy. We do not use automated decision-making or profiling.

11. External links, social media and job applications

Our website links to external offerings, among them our profiles on LinkedIn and Instagram, our job portal at join.com and the shop of our partner Everplain. Simply visiting our website transmits no data to these providers — these are plain links without embedded content or plugins. Only once you follow a link do the privacy provisions of the respective provider apply.

Job applications run exclusively through the join.com platform; Join Solutions AG is responsible for the data processing there jointly with us under their provisions. Application data reaching us via join.com is processed to carry out the application procedure (§ 26 BDSG, Art. 6 (1) (b) GDPR) and deleted at the latest six months after the procedure ends, unless consent to longer storage has been given.

12. Your rights

You have the following rights in relation to your personal data:

• Access to the data processed (Art. 15 GDPR)

• Rectification of inaccurate data (Art. 16 GDPR)

• Erasure (“right to be forgotten”, Art. 17 GDPR)

• Restriction of processing (Art. 18 GDPR)

• Data portability (Art. 20 GDPR)

• Objection to processing based on legitimate interests (Art. 21 GDPR)

• Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)

An informal message to info@merchmyday.de is enough to exercise your rights.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.

13. Currency of this policy

Version: October 2026. We adapt this privacy policy as soon as our data processing or the legal situation changes. The current version can always be found on this page.