1. Controller
The controller responsible for processing personal data when you use this shop is:
Sebastian Paul Schuchmann, trading as buzzerworld Stresemannallee 11, 60596 Frankfurt am Main, Germany Email: schuchmannsebastian@gmail.com Telephone: +49 173 2706148
2. Accessing the website and hosting
When you access the website, the server processes connection data required to deliver it. This includes in particular your IP address, time of access, requested address, HTTP status, amount of data transferred and browser information and, where applicable, referrer information transmitted by your browser.
Processing takes place to provide the website, troubleshoot problems and protect against misuse on the basis of Article 6(1)(f) GDPR. Our legitimate interest is in secure and reliable operation. The website cannot be delivered without the technically necessary connection data.
We use Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, for hosting. Hetzner processes hosting data on our behalf. Provider information is available in Hetzner’s privacy policy.
Access logs are generally deleted no later than after 14 days. In specific security incidents, relevant logs may be retained separately until the matter is clarified and, where necessary, to assert or defend legal claims.
3. Cart and browser storage
The shop uses your browser’s Session Storage to retain your cart, an entered coupon, your checkout entries and the access key to your order overview during the browser session. A technical order key to prevent duplicate orders and the scroll position may also be stored there. These data are not used for advertising or to create usage profiles. You can delete session storage using your browser’s functions; this may cause your cart and access to the current order overview to be lost. Browsers may make session data available again when restoring a session.
The Bluetooth configurator also stores locally that you have dismissed the introductory notice. This entry contains no customer or order data and remains until the browser’s local storage is deleted.
Insofar as storage is required for expressly requested functions, access to browser storage is based on section 25(2), no. 2 TDDDG. Related processing of personal data takes place to carry out pre-contractual measures or the contract under Article 6(1)(b) GDPR, or for technically necessary convenience and operational functions based on our legitimate interest under Article 6(1)(f) GDPR.
We do not use analytics, advertising or tracking services on this website. Product images, videos and font files are delivered by the shop itself; no external fonts or video players are embedded.
We store your manually selected language (German or English) in the first-party cookie “bw-language” for one year. The cookie uses SameSite=Lax and serves only your language preference, not tracking. Automatic detection of your browser language does not set a new cookie; it is stored only when you make a manual selection.
4. Orders and processing
When you place an order, we process your name, email address, delivery address, any different billing address and optional company details, together with ordered products, variants, quantities, prices, coupons, order number and payment status.
These data are necessary for order processing, delivery, invoicing and customer service. The legal basis is Article 6(1)(b) GDPR. Where statutory retention or documentation obligations apply, processing is also based on Article 6(1)(c) GDPR. We cannot process an order without the information marked as required; optional company details are not a prerequisite for a contract.
Orders are stored on the shop server and transferred to our BuzzerDashboard for internal processing. Only authorized persons can access the internal dashboard. It is used for order processing and manual confirmation of incoming payments, not to create advertising profiles.
5. Online payments, bank transfer and payment confirmation
We use Stripe for online payments. Loading payment fields or express checkout buttons connects your browser to Stripe. Stripe processes technical connection and device data, together with the order, contact, billing and delivery details required for payment. Full card numbers and security codes are processed directly by Stripe through its payment fields and are not stored on our shop server. We receive payment status and payment identifiers to match the payment to your order.
When you select Apple Pay, Google Pay, PayPal or Klarna, that provider also processes data required for payment under its own privacy information. Express checkout can transmit the contact and address details you confirm in the payment dialogue to us. Processing serves contract performance under Article 6(1)(b) GDPR and necessary record-keeping duties under point (c). Stripe also processes data for fraud prevention and its own legal obligations, and international transfers may occur. The Stripe privacy policy explains the responsible Stripe entities, processing, legal bases and transfer safeguards.
If you select bank transfer, payment is made by your bank transfer to our business account with Qonto. We receive the payment information required for allocation, in particular the payer’s name, amount, booking date, payment reference and account details transmitted by the banks involved. We manually match incoming payments to your order. The shop does not automatically access the Qonto API.
The legal bases are Article 6(1)(b) GDPR for contract performance and Article 6(1)(c) GDPR for statutory documentation obligations. The banks involved also process payment data under their own responsibility. Qonto publishes its current privacy provisions in its Legal Center.
The bank transfer QR code shown in the shop is generated locally in the browser from our recipient details, the amount and the payment reference. No external QR code service is contacted for this. When you scan it in your banking app, that app’s privacy policy also applies.
6. Shipping and other recipients
For delivery, we share your name and delivery address with the commissioned parcel service. Further necessary information is transmitted only insofar as required for the selected delivery. The legal basis is Article 6(1)(b) GDPR.
Where necessary for statutory obligations or to assert or defend legal claims, data may be disclosed to tax authorities, tax or legal advisers and courts. The legal bases are Article 6(1)(c) or (f) GDPR. Data are not shared for third-party advertising purposes.
7. Email communication and notifications
When you email us, we process your email address, the contact details you provide and the content of your message to respond to your enquiry. For enquiries relating to a contract or prior to its conclusion, the legal basis is Article 6(1)(b) GDPR; for other enquiries it is Article 6(1)(f) GDPR, based on our interest in handling your enquiry.
We use Microsoft 365, obtained through GoDaddy, for business emails and transactional messages such as order and withdrawal confirmations. Recipient addresses, message content and technical sending data are processed. The legal basis is Article 6(1)(b) GDPR and, for legally required confirmations, also point (c). Providers may also process data outside the European Economic Area. Information about contractual safeguards, including standard contractual clauses, is available in the Microsoft Data Protection Addendum and the GoDaddy Data Processing Addendum. Microsoft’s EU Data Boundary includes exceptions for certain transfers; exclusively European processing is not guaranteed here.
The published contact address and internal notification address are also a Google Gmail mailbox. For order processing, this internal mailbox receives copies of transactional customer emails, which can include order details, contact and address data, and invoices. Messages and metadata are therefore processed by Google, which may involve processing outside the European Economic Area. Information about Google, processing locations and intended transfer mechanisms is available in Google’s privacy policy and its data transfer frameworks.
8. Buzzer configurator and external links
The configurator accesses the connected buzzer only after you select a device and grant permission in your browser. Configuration commands and device responses are processed between the browser and the device. The configurator does not send them to our shop server for storage. The device stores your selected configuration. You can disconnect at any time. Access serves the configuration you expressly requested; insofar as personal data are concerned, processing is based on Article 6(1)(b) GDPR.
References to Etsy, GitHub or GitHub Pages are ordinary links. Only when you follow them do you leave our shop and connect to the respective provider. Their own privacy policies apply to those services.
9. Retention periods
We retain personal data only for as long as necessary for the stated purposes or as required by law. Once an enquiry is concluded, the related data are deleted unless still required for the contract, statutory retention, or asserting or defending legal claims.
Tax-relevant documents are subject to statutory periods depending on the document, in particular generally eight years for accounting records and invoices and six years for relevant business correspondence; certain records are retained for ten years. The start of these periods, statutory extensions and other special provisions are governed by the applicable rules. Once their original purpose has been fulfilled, data that must be retained by law are restricted to the processing necessary for that retention.
10. Your rights
Subject to statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.
Right to object: Where we process data on the basis of Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then stop processing the data unless compelling legitimate grounds or grounds for establishing, exercising or defending legal claims override the objection.
You may contact us using the details above. You also have the right to lodge a complaint with a data protection supervisory authority, in particular where you habitually reside, work or where the alleged infringement occurred. The authority responsible for our registered location is the Hessian Commissioner for Data Protection and Freedom of Information.
No automated decision-making, including profiling, with legal or similarly significant effects takes place.
Audience measurement and IP-based session statistics
We compile our own statistics about page requests, referring websites, approximate countries and broad device categories. We use connection information automatically sent with ordinary page requests. We use no analytics cookies or browser storage and read no additional device information. Private order pages are excluded. Referrers are reduced to their hostname; URL parameters and full browser identifiers are not stored. Country estimates use a local IP-to-country database without sending visitor IP addresses to a geolocation service.
We store the full IP address, the first and most recent recorded visit, and the number of page views and estimated sessions per IP address. These IP records have no automatic deletion deadline. We use them to recognise recurring IP addresses and analyse use of our own website. Visits from the same IP address count as one estimated session until there has been 30 minutes of inactivity. Multiple people may share an IP address, and one person may use different IP addresses. We do not store a chronological list of individual pages visited per IP address or link the data to orders or other websites.
Daily visitors are estimated using the IP address and a random daily key. These daily identifiers and keys are deleted after the day changes, on the next request or by an hourly cleanup. Stored full IP addresses are unaffected by that cleanup. Aggregate daily and session statistics are kept for at most 90 days. Statistics are accessible only through the authenticated internal administration interface.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is measuring and improving our own website and recognising recurring visits. You may object on grounds relating to your particular situation and exercise applicable data protection rights by contacting us using the details above.
To identify suspected automated traffic, we also associate IP addresses with network operators. This may involve a DNS query to the Team Cymru IP-to-ASN service; the queried IP address forms part of the DNS name and is visible to the DNS services involved. Results are temporarily cached. Known crawlers, selected hosting networks and unusually frequent page requests are counted separately in our internal statistics. This classification is an estimate and does not block access to the website.