CHRISTMAS: THE GIFT FOR PEOPLE WHO HAVE EVERYTHING. EXCEPT PEACE AND QUIET.PICK A SLOGAN →

PRIVACY POLICY

1. CONTROLLER

Controller within the meaning of the EU General Data Protection Regulation (GDPR):

OnlineBuilders LLC
c/o Legalinc Corporate Services Inc.
131 Continental Dr, Suite 305
Newark, DE 19713, USA
Registered in the State of Delaware, USA · File No. 10291236

German contact address:
Bad Jungbrunnen · Viet Vuong Bui
Karl-Marx-Allee 70a
10243 Berlin, Germany

E-mail: [email protected]

“Bad Jungbrunnen” is a project of OnlineBuilders LLC. Please send privacy requests by e-mail or by post to the German contact address.

2. REPRESENTATIVE IN THE EU (ART. 27 GDPR)

As the controller is based in the USA, it has designated a representative in the European Union:

Viet Vuong Bui
Karl-Marx-Allee 70a
10243 Berlin, Germany
Email: [email protected]

You can contact the representative with any data protection question. He is also the contact person for supervisory authorities.

3. THE SHORT VERSION

We take the protection of your data seriously — same policy as our bath salt: 100% pure. This website uses no tracking or marketing cookies, no analytics or advertising services, and does not share data for advertising purposes. Fonts are hosted locally. We only process the data that is technically required to run the website and, if you place an order, to handle the order, payment and shipping.

4. HOSTING & SERVER LOG FILES

This website is hosted on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre located in Germany. When you visit the website, the server automatically processes technical access data (server log files): IP address, date and time of access, requested page or file, transferred data volume, referrer URL, browser type and version, and operating system.

This processing ensures the reliable operation, stability and security of the website (legal basis: Art. 6(1)(f) GDPR — legitimate interest). Log data is not merged with other data sources and is deleted once it is no longer required for these purposes.

5. CONTENT DELIVERY & PROTECTION SERVICE (CLOUDFLARE)

We use Cloudflare, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as a DNS, proxy and security service. For technical reasons, all requests to this website are routed through Cloudflare's infrastructure; in doing so, Cloudflare processes connection data such as your IP address and technical request headers in order to deliver the website faster and protect it against attacks (e.g. DDoS).

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, high-performance operation). Cloudflare is certified under the EU-U.S. Data Privacy Framework; in addition, EU standard contractual clauses are in place. More information: www.cloudflare.com/privacypolicy/

6. COOKIES

This website sets no tracking, analytics or marketing cookies. It only uses one technically required cookie (“NEXT_LOCALE”) that stores your language preference (German/English). This cookie is necessary for the function you request (Section 25(2) no. 2 of the German TDDDG, Art. 6(1)(f) GDPR) and contains no personal profiles. In addition, your browser stores locally (localStorage, not transmitted to us) your cart (“bj-cart”), the selected delivery country (“bj-country”) and whether you closed the notice on the home page (“bj_cookie_ok”). This is also necessary for the functions you request (Section 25(2) no. 2 TDDDG). A cookie banner is therefore not required.

7. FONTS

The fonts used on this site (Bebas Neue, Archivo, Space Mono) are hosted locally on our server. No connection to Google or other font providers is established when you visit this website, and no data is transferred to third parties in this respect.

8. CONTACT BY E-MAIL

If you contact us by e-mail or via the contact form on our customer service page, we process the information you provide (name, e-mail address, order number if given, topic and content of your message; the form is sent to us by e-mail via Mailgun) to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a (prospective) contract, and otherwise Art. 6(1)(f) GDPR. The data is deleted once your enquiry has been dealt with conclusively, unless statutory retention obligations apply.

9. ORDERS IN THE ONLINE SHOP

When you place an order, we process the data needed for the purchase contract, payment and delivery: name, email address, shipping address, items ordered, amounts, order number and payment status. We do not receive your card details or bank account details; only the payment provider does.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and, for retention, Art. 6(1)(c) GDPR. Under commercial and tax law (Section 257 HGB, Section 147 AO) we keep order and invoice data for up to ten years. We send you the order confirmation by email (see “Sending emails”).

Your browser stores the shopping cart locally (localStorage, key “bj-cart”). It only contains product and quantity, is not sent to us until you click “Buy now”, and is deleted after your purchase.

10. PAYMENT PROCESSING (STRIPE)

Payments are processed by Stripe (Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA; for customers in the EEA possibly together with Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). After you click “Buy now”, you are taken to a checkout page operated by Stripe. There, Stripe processes your email address, shipping and billing address, payment details, order details, IP address and device information to carry out the payment, prevent fraud and meet legal obligations (e.g. anti-money-laundering rules). Stripe acts partly as our processor and partly as an independent controller.

If you choose a payment method such as Klarna, Apple Pay or Google Pay, Stripe passes the necessary data to that provider, whose privacy policy then also applies.

Legal bases: Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (legal obligations) and Art. 6(1)(f) GDPR (fraud prevention). Stripe is certified under the EU-U.S. Data Privacy Framework. Stripe's privacy policy: stripe.com/privacy

11. SHIPPING

To deliver your order we pass your name and shipping address to the shipping company we use (e.g. DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany). We only pass on your email address or phone number if you have separately agreed to this. The legal basis is Art. 6(1)(b) GDPR.

12. SENDING EMAILS (MAILGUN)

We send order confirmations, confirmations of receipt for withdrawals and waiting-list emails via Mailgun (Mailgun Technologies, Inc., 112 E Pecan St #1135, San Antonio, TX 78205, USA; processing on servers in the EU). This involves your email address, your name and the content of the message. Mailgun is our processor and is certified under the EU-U.S. Data Privacy Framework. The legal basis is Art. 6(1)(b) and (c) GDPR.

13. WAITING LIST (“NOTIFY ME”)

While sales are paused, you can join a waiting list on the product pages. For this we process your email address, the selected product, your language and the time of sign-up and confirmation. We use double opt-in: after submitting you receive an email with a confirmation link; only after you click it is your address added to the list at Mailgun (EU servers, see above). Without confirmation nothing is stored. We will email you once as soon as the product can be ordered and use the address for nothing else. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future by emailing [email protected] or via the unsubscribe link in our emails. We delete the address after sending the notification, at the latest after 12 months.

14. WITHDRAWAL VIA THE WEBSITE

If you use our “Withdraw from contract” function, we process your name, email address, order details, your optional message and the time of receipt in order to handle the withdrawal and confirm its receipt (Art. 6(1)(c) GDPR in conjunction with Section 356a BGB). We keep this information as long as claims arising from the contract can be asserted and within the statutory retention periods.

15. DATA TRANSFERS TO THIRD COUNTRIES

The website itself is hosted on servers in Germany. As the controller is based in the USA and Cloudflare, Stripe and Mailgun, US providers, are used, data may be transferred to the USA. Such transfers are based on the EU-U.S. Data Privacy Framework and/or the EU Commission's standard contractual clauses (Art. 44 et seq. GDPR).

16. STORAGE PERIOD

Personal data is stored only for as long as necessary for the purposes stated above or as required by statutory retention obligations. It is then deleted or anonymised.

17. YOUR RIGHTS

Under the GDPR you have the following rights:

· Access to your stored data (Art. 15 GDPR)
· Rectification of inaccurate data (Art. 16 GDPR)
· Erasure (“right to be forgotten”, Art. 17 GDPR)
· Restriction of processing (Art. 18 GDPR)
· Data portability (Art. 20 GDPR)
· Objection to processing based on legitimate interests (Art. 21 GDPR)
· Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An informal e-mail to [email protected] is sufficient to exercise these rights.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — for example the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), Alt-Moabit 59–61, 10555 Berlin, Germany, or the supervisory authority of your habitual residence.

18. RIGHT TO OBJECT (ART. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR. We will then no longer process the data unless there are compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

19. VERSION & CHANGES

This privacy policy is effective as of September 2026. We will update it whenever the website or the legal situation changes.