Last updated: October 2026
1. Who is responsible
Marek Ehrenfeuchter, Merfs Art, Edith-Stein-Straße 10, 67354 Römerberg, Germany. Email: info@merfs-art.com
This policy explains which personal data we process when you visit merfs-art.com, design a poster or place an order, why we do it and what rights you have under the EU General Data Protection Regulation (GDPR).
2. Hosting and server log files
Our website is hosted by a professional web hosting provider in the European Union, which processes data on our behalf under a data processing agreement (Art. 28 GDPR). When you open a page, the server automatically records technical data: IP address, date and time, page requested, referrer, browser and operating system. We need this to deliver the website securely and to detect attacks (Art. 6(1)(f) GDPR, legitimate interest). Log files are kept only for a short period and then deleted automatically, unless they are needed to investigate a specific security incident.
3. Cookies
We only use cookies that are technically necessary: to remember your cart and checkout progress (WooCommerce), to keep you logged in if you have a customer account, and to protect payments against fraud (Stripe, only on the checkout). These cookies are allowed without consent under § 25(2) TDDDG and Art. 6(1)(b) and (f) GDPR. We do not use tracking or advertising cookies.
4. Fonts
All fonts are loaded from our own server. No connection to Google or other font providers is made.
5. Poster studio
The poster studio runs entirely in your browser. If you add your own photo, it is processed on your device and is not uploaded while you design. Free downloads are created in your browser too; nothing is sent to us. If you use the microphone or an audio file to shape a design, the sound is analysed only in your browser; no recording is uploaded or stored. Only the resulting list of notes becomes part of the design settings. The microphone is used only after you start a recording and your browser asks for permission.
Only when you add a printed poster to your cart do we receive the finished print file, a small preview image and the design settings. We need them to fulfil your order (Art. 6(1)(b) GDPR). Designs that are not ordered are deleted automatically after 3 days. Print files of ordered posters are deleted 60 days after the order.
6. Orders
To process your order we collect your name, billing and shipping address, email address, phone number (optional) and order details. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal obligations). We keep order and invoice data for the periods required by German commercial and tax law (generally 6 to 10 years, § 147 AO, § 257 HGB).
7. Print and shipping partner: Prodigi
Posters are printed and shipped by Prodigi Group Ltd, United Kingdom, which works with production labs in the EU, the UK, the USA and Australia. To print and deliver your poster we pass on the print file, your name, shipping address and, if provided, phone number (Art. 6(1)(b) GDPR). Prodigi keeps print files for up to 30 days. Data is transferred to the United Kingdom on the basis of the EU adequacy decision for the UK (Art. 45 GDPR); for labs outside the EU/UK, Prodigi uses EU standard contractual clauses (Art. 46 GDPR). Prodigi processes this data on our behalf and only for fulfilling your order.
8. Payment
WooPayments / Stripe. Card payments, Apple Pay, Google Pay, Klarna and Amazon Pay are processed by WooPayments, a service of Automattic Inc., which uses Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, as payment processor. When you pay, your payment details are sent directly to Stripe; we never see or store your full card number. To prevent fraud, Stripe also collects technical information about your device and browser on the checkout page (Art. 6(1)(f) GDPR). Payment itself is processed to fulfil the contract (Art. 6(1)(b) GDPR). Stripe may transfer data to the USA under the EU-U.S. Data Privacy Framework or standard contractual clauses. More: stripe.com/privacy and automattic.com/privacy.
Klarna and Amazon Pay. If you choose Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden) or Amazon Pay (Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg), the data needed for the payment is passed to that provider, who may also carry out an identity or credit check under its own privacy policy.
PayPal. If you pay with PayPal, you are redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, which processes your payment under its own privacy policy: paypal.com privacy.
9. Contact by email
If you contact us, we process the information you provide to answer your request (Art. 6(1)(b) or (f) GDPR) and delete it when it is no longer needed, unless legal retention periods apply.
10. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Write to info@merfs-art.com.
You can also complain to a data protection authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.
11. Security
Our website uses TLS encryption (https). Print files are stored in a protected folder and are only accessible through expiring, signed links.