Privacy policy
1. Controller
The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Handmade by Matima
Owner: Saskia Taheri
Am Mühlenfließ 39
15234 Frankfurt (Oder)
Germany
Email: saskia.taheri@web.de
2. General information on data processing
Personal data is any information relating to an identified or identifiable natural person. This includes, for example, name, address, telephone number, email address and IP address.
I process personal data only to the extent necessary to provide this website, handle enquiries, carry out and process orders and meet legal obligations, or where you have consented to the processing.
Depending on the purpose, processing is based in particular on Article 6(1)(a), (b), (c) or (f) GDPR.
3. Website, order server and shop services
This website is provided through ChatGPT Sites by OpenAI. For users in the European Economic Area, the contracting party is OpenAI Ireland Ltd. When you visit the site, technical connection data such as your IP address, browser, time of access and the address accessed are processed to deliver and secure the website. Information about this processing on our behalf: Sites Data Processing Addendum and subprocessors.
For price checks, reservations and order processing, we use a server provided by Cloudflare, Inc. It processes the order and contact details you submit and technical connection data. Cloudflare operates an international network; processing outside the European Economic Area is possible. The Cloudflare Data Processing Addendum describes the processing and safeguards for international transfers.
Reservations, personalisation requests, delivery details and order status are stored in our Supabase database and processed in the Matima order cockpit. The provider is Supabase Pte. Ltd. Information about processing, subprocessors and transfer safeguards is set out in the Supabase Data Processing Addendum. Payment details such as card numbers are not recorded in this database.
Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel, continues to provide product, shipping and tax data as well as order and payment functions. The required order details are sent to Wix at checkout. Payment takes place on a page provided by Wix through the selected payment service provider. Further information: Wix privacy policy.
Processing to provide and secure the website is based on Article 6(1)(f) GDPR. Price checks, reservations and order processing are based on Article 6(1)(b) GDPR. International transfers are governed by the applicable adequacy decisions or by the standard contractual clauses and supplementary measures described by the providers. Information about the safeguards used for our processing is available through the links provided or on request from Matima.
4. Server log files
When you visit this website, technical information is automatically collected and stored in server log files. This may include the following data in particular:
• IP address
• Date and time of access
• Browser type and version
• Operating system
• Pages accessed
• Referrer URL
• Volume of data transferred
• Server status code
This data is processed to ensure the smooth and secure operation of the website and to detect and prevent attacks.
The legal basis is Article 6(1)(f) GDPR.
Server log files are stored only for as long as necessary for these purposes and are then deleted unless statutory retention requirements prevent this.
5. SSL or TLS encryption
For security reasons, this website uses SSL or TLS encryption. This encrypts the data transferred between your browser and this website and protects it against unauthorised access.
You can recognise an encrypted connection, among other things, by the browser's address bar beginning with “https://”.
6. Necessary browser storage and cookies
This website stores your basket and a random access identifier for your order status in local browser storage. This allows you to retrieve your selection and a payment process you have started. This data remains on your device until removed by the website or until you delete your browser data. Storage for the functions you request is based on Section 25(2), no. 2 TDDDG; the associated processing serves to take steps prior to entering into a contract or to perform the contract under Article 6(1)(b) GDPR.
We do not use advertising pixels or optional analytics services on this website. The separate Wix payment page and the selected payment provider may use necessary security and payment cookies. Their privacy notices and any consent settings offered there apply in addition. Details of local storage can be found in our Cookie policy.
7. Contact by contact form or email
If you contact me through the contact form or by email, I process the personal data you provide to handle your enquiry. This may include, in particular, your name, email address, a telephone number provided voluntarily, the content of your message and any files you send.
For enquiries about delivery to other countries, I also process information about the requested product and destination insofar as this is necessary to check delivery availability, shipping costs and delivery time and prepare an individual offer.
Where your enquiry concerns entering into or performing a contract, processing is based on Article 6(1)(b) GDPR. In other cases, it is based on Article 6(1)(f) GDPR. My legitimate interest is in handling and responding to your enquiry.
The data is deleted as soon as it is no longer required to handle your enquiry, unless statutory retention requirements or other legal grounds require continued storage. If your enquiry leads to an order, the information on the processing and storage of order data also applies.
8. Communication via WhatsApp
You can contact me via WhatsApp. If you use this channel, I process the personal data you provide to handle your enquiry. This may include, in particular, your telephone number, your name or the name stored in WhatsApp, message contents and any files and images you send.
The provider of WhatsApp is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
When you use WhatsApp, personal data may be processed by WhatsApp. Data may also be transferred to third countries.
Where your enquiry concerns entering into or performing a contract, my processing is based on Article 6(1)(b) GDPR. In other cases, it is based on Article 6(1)(f) GDPR due to my legitimate interest in simple and prompt communication.
Further information about WhatsApp's processing of personal data can be found in WhatsApp's privacy policy.
9. Orders through our online shop or following an individual enquiry
If you order through my online shop or by email following a prior enquiry, I process the personal data required for the order and performance of the contract. This may include, in particular:
-
First and last name;
-
Billing and delivery address, including the destination country;
-
Email address;
-
Telephone number, where required for processing or provided voluntarily;
-
Order and product details, including your personalisation requests;
-
Payment and shipping information;
-
Information required for customs clearance for cross-border deliveries.
Processing is carried out to handle your order, make the ordered products, process payments and issue invoices, arrange shipping and handle any queries or complaints. The legal basis is Article 6(1)(b) GDPR.
Where statutory retention, documentation or reporting obligations exist, the processing required for these purposes is based on Article 6(1)(c) GDPR.
The payment and shipping service providers used receive the data necessary to perform the contract. For international deliveries, customs service providers and relevant authorities may also receive necessary data. Further information is provided in the sections on payment processing and shipping and delivery.
The order details marked as required are necessary to conclude and perform the contract. Without these details, the order cannot be processed or cannot be processed in full.
10. Ordering without a customer account
No customer account is required to order on this website. Your order status can be accessed on the same device using a random access identifier stored locally. Existing order data remains in the previous shop system. If you have questions about an earlier customer account or an order, please contact Matima.
11. Performance of the contract
I process the personal data required to carry out and perform the contract. This includes, in particular, handling your order, payment, invoicing, shipping and handling complaints and queries.
Where necessary, personal data may be transferred to payment service providers, shipping providers or other service providers involved in performing the contract.
The legal basis for processing is Article 6(1)(b) GDPR. Where statutory retention or documentation obligations exist, processing is additionally based on Article 6(1)(c) GDPR.
12. Storage of order data
I store personal data from orders for as long as required to perform the contract or to meet statutory retention requirements.
After the statutory retention periods have expired, the data is deleted unless it is still required to perform the contract or to establish, exercise or defend legal claims.
Where storage is required to meet statutory retention requirements, it is based on Article 6(1)(c) GDPR.
13. Payment processing
Various payment options are available for your orders. Depending on the payment method you choose, the personal data necessary to process the payment is transferred to the respective payment service provider.
This may include the following data in particular:
• First and last name
• Billing address
• Email address
• Order and invoice details
• Payment amount
• Payment information
• Transaction data
• Other information necessary to process the respective payment
Processing is carried out to perform the purchase contract concluded with you, on the basis of Article 6(1)(b) GDPR.
Where payment service providers process data for their own purposes, particularly fraud prevention, identity verification or credit checks, they do so as independent controllers responsible for their own data processing.
13.1 PayPal
If you select PayPal, your payment is processed through PayPal. The provider for customers in the European Economic Area is:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg
The personal data required to process the payment is transferred to PayPal. PayPal may also process personal data as an independent controller, particularly for fraud prevention, risk assessment and compliance with legal obligations.
The transfer of data required for payment processing is based on Article 6(1)(b) GDPR.
Further information about the processing of personal data can be found in PayPal's privacy policy.
13.2 Klarna
If you select a payment method offered through Klarna, the personal data required to process the payment is transferred to Klarna.
The provider is:
Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden
Depending on the payment method selected, Klarna may process personal data for purposes including payment processing, identity verification, fraud prevention and, where applicable, credit checks.
The transfer of data required for payment processing is based on Article 6(1)(b) GDPR.
Further information about the processing of personal data can be found in Klarna's privacy policy.
13.3 Google Pay
When you use Google Pay, the Google Pay service is involved in payment processing.
The provider for users in the European Economic Area is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
When using Google Pay, device, account, payment and transaction information may be processed in particular. The actual payment may additionally be processed by the respective payment service provider or through the payment method stored in your account.
The transfer of data required for payment processing is based on Article 6(1)(b) GDPR.
Further information about the processing of personal data can be found in Google's privacy policy.
13.4 Apple Pay
When you use Apple Pay, the Apple Pay service is involved in payment processing.
The provider is:
Apple Distribution International Ltd.
Hollyhill Industrial Estate
Hollyhill, Cork
Ireland
When using Apple Pay, device, payment and transaction information may be processed in particular. The actual payment is processed through the payment card stored in Apple Pay and the payment service providers involved.
The transfer of data required for payment processing is based on Article 6(1)(b) GDPR.
Further information about the processing of personal data can be found in Apple's privacy policy.
13.5 Bank transfer / payment in advance
When you pay by bank transfer, I process the data necessary to identify and record your payment.
This may include, in particular:
• Account holder's name
• IBAN or account information provided by the bank involved
• Payment amount
• Payment reference
• Payment date
Processing is carried out to perform the purchase contract on the basis of Article 6(1)(b) GDPR.
Payment information may also be stored to meet statutory retention requirements. The legal basis for this is Article 6(1)(c) GDPR.
14. Shipping and delivery
To fulfil the purchase contract, I transfer the personal data required to deliver your order to the shipping provider I have commissioned.
This includes, in particular, your name and delivery address and, where necessary for delivery, other shipping information.
The transfer is carried out to perform the contract on the basis of Article 6(1)(b) GDPR.
14.1 DHL
I may use DHL to ship orders.
The provider is:
DHL Paket GmbH
Charles-de-Gaulle-Straße 20
53113 Bonn
Germany
The personal data required for delivery, particularly your name and delivery address, is transferred to DHL.
The transfer is carried out to perform the purchase contract on the basis of Article 6(1)(b) GDPR.
If your email address or telephone number is also transferred to DHL, for example for shipment notifications or to arrange delivery, this is done only where an appropriate data protection legal basis exists.
14.2 Hermes
I may also use Hermes to ship orders.
The personal data required for delivery, particularly your name and delivery address, is transferred to the Hermes shipping provider commissioned for the shipment.
The transfer is carried out to perform the purchase contract on the basis of Article 6(1)(b) GDPR.
If contact details are additionally used for shipment notifications or to arrange delivery, this is done only where an appropriate data protection legal basis exists.
14.2 International deliveries and customs clearance
I deliver to Germany, Austria, Switzerland, Norway and Luxembourg. Delivery to other countries worldwide is available following a prior enquiry and individual agreement.
For international deliveries, data required for transport and delivery may be shared with the shipping companies and delivery partners involved in the destination country. This includes, in particular, your name, delivery address and necessary shipment information.
Where customs clearance is required, information about the contents and value of the shipment, together with necessary order and invoice details, may also be transferred to service providers responsible for customs clearance and the relevant customs authorities.
Processing is carried out to perform the purchase contract on the basis of Article 6(1)(b) GDPR. Where I am legally obliged to process or transfer data, Article 6(1)(c) GDPR provides the legal basis.
Deliveries to Austria and Luxembourg take place within the European Union. Norway is part of the European Economic Area (EEA).
Where personal data is transferred to recipients in Switzerland as part of a delivery, the transfer is based on the European Commission's adequacy decision pursuant to Article 45 GDPR.
For individually agreed deliveries to other countries outside the EEA, the basis for a data transfer depends on the recipient and the destination country. Before such a transfer, I will provide additional information about the recipient country and the specific applicable transfer basis, together with any safeguards used and the possibility of obtaining a copy of them.
For occasional deliveries to a country without an applicable adequacy decision or appropriate safeguards, a transfer may be based on Article 49(1)(b) GDPR if it is actually necessary to perform your contract and the statutory conditions for this exception are met. Only the data necessary for this purpose is transferred.
15. Links to social networks
This website contains links to my social media pages, particularly Instagram, Facebook and TikTok.
These elements are links only. Merely visiting my website does not generally establish a connection to the respective social networks.
Only when you click a corresponding link are you redirected to the respective provider's website. From that point, the provider may process personal data in accordance with its own privacy policy.
I have no influence over the processing of data by the respective social networks.
15.1 Instagram and Facebook
This website contains links to my Instagram and Facebook profiles.
The provider of these services for users in the European Economic Area is:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
If you click one of these links, you will be redirected to Instagram or Facebook. Meta may process personal data in this context. If you are logged into an account there, Meta may be able to associate the visit with your account.
The nature, scope and purpose of further data processing are governed by Meta's privacy policies.
Further information can be found in the privacy policies of Instagram and Facebook.
15.2 TikTok
This website contains a link to my TikTok profile.
The provider of this service for users in the European Economic Area is:
TikTok Technology Limited
10 Earlsfort Terrace
Dublin, D02 T380
Ireland
If you click the link, you will be redirected to TikTok. TikTok may process personal data in this context. If you are logged into an account there, TikTok may be able to associate the visit with your account.
The nature, scope and purpose of further data processing are governed by TikTok's privacy policy.
Further information can be found in TikTok's privacy policy.
16. External links
This website may contain links to external providers' websites and services.
If you click such a link, you leave my website. From that point, the respective external provider may process personal data in accordance with its own privacy policy.
I have no influence over data processing by these external providers. Please therefore refer to the respective provider's privacy policy.
16a. Fabric selection from Oderlandstoffe
When you open the fabric selection or import a product link, your browser loads product information and images from Oderlandstoffe's public range and its Shopify infrastructure. In particular, the servers involved receive your IP address and technical request data. We use this feature to show you fabrics to choose from at your request (Article 6(1)(b) GDPR). Alternatively, you can enter a fabric request as text without loading the range. Further information is available from Oderlandstoffe.
17. Retention periods
I store personal data only for as long as necessary for the respective processing purpose or to meet statutory retention requirements.
Where statutory retention requirements exist, the relevant data is stored for the duration of the applicable statutory period.
Data required to establish, exercise or defend legal claims may also be stored until the applicable limitation periods have expired.
Once the respective processing purpose no longer applies or the applicable retention or limitation periods have expired, the data is deleted or anonymised unless there are legal grounds for continued storage.
18. Your rights as a data subject
Under the General Data Protection Regulation, you have the following rights in particular:
• Right of access under Article 15 GDPR
• Right to rectification under Article 16 GDPR
• Right to erasure under Article 17 GDPR
• Right to restriction of processing under Article 18 GDPR
• Right to data portability under Article 20 GDPR
• Right to object under Article 21 GDPR
• Right to withdraw consent with effect for the future under Article 7(3) GDPR
You can contact me at any time to exercise your rights:
Handmade by Matima
Owner: Saskia Taheri
Email: saskia.taheri@web.de
19. Right to object
Where I process personal data on the basis of a legitimate interest under Article 6(1)(f) GDPR, you have the right under Article 21 GDPR to object to the processing of your personal data at any time on grounds relating to your particular situation.
If you object, I will no longer process the personal data concerned unless there are compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
20. Withdrawal of consent
You may withdraw consent already given at any time with effect for the future.
This does not affect the lawfulness of processing based on consent before its withdrawal.
21. Right to lodge a complaint with a supervisory authority
If you believe that the processing of your personal data infringes the GDPR, you have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority.
In particular, you may contact the supervisory authority responsible for me:
The State Commissioner for Data Protection and the Right of Access to Files in Brandenburg (LDA Brandenburg)
Stahnsdorfer Damm 77
14532 Kleinmachnow
22. Data security
I take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access or other unlawful processing.
The security measures used are adapted appropriately to technological developments and the respective risks.
23. Changes to this privacy policy
I reserve the right to amend this privacy policy where necessary due to legal changes, technological developments or changes to the services used on this website.
The current version published on this website applies.
Last updated: 2 November 2026