Privacy Policy

Protecting your personal data is of the utmost importance to us.
This Privacy Policy informs you, in accordance with the provisions of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other applicable data protection laws, about what personal data we collect on this website, for what purposes we process it, and what rights you have in this context.

1. Data Controller

Christian Winkler E‑Commerce e.U.
trading under the business name “Arclane”
Wildenfelser Straße 15
81249 Munich
Germany

Email: [email protected]

The controller within the meaning of Art. 4 (7) GDPR is Mr. Christian Winkler.
A data protection officer has not been appointed, as the legal requirements for such an appointment are not met.

2. Principles of Data Processing

2.1 Purposes of Processing

We process personal data exclusively for the following purposes:

• to provide and optimize this website,

• to respond to inquiries,

• to fulfil contractual obligations in connection with the provision of digital products,

• to comply with legal obligations (in particular accounting, commercial and tax regulations),

• for administrative purposes and to ensure the security and stability of our IT systems.

2.2 Legal Bases

The processing of personal data is carried out on the following legal bases:

• Art. 6 (1) (a) GDPR (consent),

• Art. 6 (1) (b) GDPR (performance of a contract or pre-contractual measures),

• Art. 6 (1) (c) GDPR (legal obligation, in particular retention obligations),

• Art. 6 (1) (f) GDPR (legitimate interests, such as the stability and security of our online offering).

3. Data Collection When Visiting the Website

When you access our website, certain data is automatically collected and stored by our hosting provider (Kajabi) in log files:

• IP address of the device,

• date and time of access,

• browser type and version,

• operating system used,

• referrer URL.

These data are processed exclusively for system security and technical functionality.
There is no merging of these data with other data sources.
Legal basis: Art. 6 (1) (f) GDPR.

4. Contact by Email

If you contact us by email, the data you provide (e.g., name, email address, message content) will be processed solely for the purpose of handling your request.
The data will be erased once your inquiry has been fully resolved, unless legal retention obligations require otherwise.
Legal basis: Art. 6 (1) (b) GDPR.

5. Processing of Personal Data in the Context of Orders

5.1 Order Processing and Payment Services

When purchasing digital products via our platform, the following categories of personal data are regularly collected and processed:

• Name,

• Email address,

• Billing address,

• Order details (product, price, date, time of order, transaction reference),

• Payment information.

Order and payment processing is carried out via the platform provider Kajabi LLC (USA). Depending on the selected payment method, payments are processed through the following payment service providers:

• Stripe Payments Europe Ltd. (Ireland/USA) – for credit card and comparable payment methods,

• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) – for payments via PayPal.

Payment data (e.g., credit card numbers or bank account details) are processed exclusively by the respective payment service providers and are not stored by us.
The legal basis is Art. 6 (1) (b) GDPR (performance of a contract).

5.2 Automated Processing and Data Management

For efficient processing and administration of orders, we use the automation service Zapier Inc. (USA). Through Zapier, order data is transmitted to the following systems:

• Airtable Inc. (USA) – for storing, structuring, and managing order and customer data,

• Fastbill GmbH (Germany) – for generating and archiving invoices and related customer data,

• Haufe-Lexware GmbH & Co. KG (Germany) – for bookkeeping and management of accounting-related data.

Processing within these systems is carried out exclusively for the purpose of fulfilling contractual obligations and complying with statutory requirements.

5.3 Accounting, Invoicing, and Statutory Retention

All accounting and tax-relevant data are documented and stored in accordance with statutory provisions.
This specifically includes the creation, archiving, and accounting management performed by the above-mentioned service providers (Fastbill and Haufe-Lexware).

Disclosure to external tax advisors takes place only insofar as this is required for compliance with commercial or tax law obligations.
The legal basis is Art. 6 (1) (c) GDPR (legal obligation).

The retention period is 10 years pursuant to Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code (HGB).

6. Newsletter / Email Marketing

If you subscribe to our newsletter, we will store your email address exclusively for this purpose.
Subscription is carried out via a single opt-in procedure; you will only receive emails from us once you have actively agreed to receive them.
You can revoke your consent at any time with effect for the future (e.g., via the unsubscribe link in any newsletter or by contacting us directly).
Legal basis: Art. 6 (1) (a) GDPR.

7. Cookies and Tracking

We currently do not use any tracking, analytics or marketing tools.
Only strictly necessary cookies are set by our platform provider Kajabi to ensure the technical functionality of the website (e.g., session cookies).

Should we in future implement analytics or marketing technologies, this Privacy Policy will be updated and a cookie consent banner with corresponding selection options will be displayed on your first visit to our website at www.arclane.co, allowing you to grant or refuse consent.

8. Data Disclosure to Third Parties

Your personal data will only be disclosed to third parties insofar as this is necessary for the performance of the contract, the implementation of pre-contractual measures, or compliance with legal obligations. Recipients in particular include:

• Kajabi LLC (USA) – for the provision and technical operation of the platform,

• Stripe Payments Europe Ltd. (Ireland/USA) – for processing credit card payments and comparable payment methods,

• PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) – for processing payments via PayPal,

• Zapier Inc. (USA) – for the automated transfer of order and customer data between the systems used,

• Airtable Inc. (USA) – for storing, structuring, and managing order and customer data,

• Fastbill GmbH (Germany) – for generating and archiving invoices and related customer data,

• Haufe-Lexware GmbH & Co. KG (Germany) – for bookkeeping and the management of accounting-relevant data,

• external tax advisors – insofar as necessary for compliance with commercial or tax law obligations,

• government authorities and public bodies – where we are legally obliged to do so.

No further disclosure of personal data to third parties takes place.

9. International Data Transfers

In the course of using certain services, personal data may be transferred to recipients in third countries outside the European Union (EU) or the European Economic Area (EEA), in particular to the United States. This concerns the following providers:

• Kajabi LLC (USA) – platform provision and order processing,

• Stripe, Inc. (USA) – payment processing for credit card transactions,

• Zapier Inc. (USA) – automation and integration services,

• Airtable Inc. (USA) – storage and management of order and customer data.

Transfers are carried out on the basis of the Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Art. 46 GDPR, supplemented where necessary by additional technical and organizational measures to ensure an adequate level of data protection.

For all users, the processing of personal data is carried out in accordance with the standards and requirements of the GDPR.

10. Data Retention and Deletion

Personal data will be erased once the purpose of processing ceases to apply and there are no statutory retention obligations.
For invoices and accounting documents, a statutory retention period of 10 years applies.

11. Rights of Data Subjects

Under the GDPR, you have the following rights:

• the right of access to your personal data (Art. 15 GDPR),

• the right to rectification (Art. 16 GDPR),

• the right to erasure (Art. 17 GDPR),

• the right to restriction of processing (Art. 18 GDPR),

• the right to data portability (Art. 20 GDPR),

• the right to object to processing (Art. 21 GDPR).

You also have the right to lodge a complaint with a competent data protection supervisory authority.

12. Data Security

We use appropriate technical and organizational security measures to protect personal data against loss, misuse or unauthorized access.
Data transmissions are protected using SSL/TLS encryption.

13. Updates to This Privacy Policy

This Privacy Policy is regularly reviewed and updated as required by changes in law, regulatory requirements, or technical developments.

International Users

This website is governed by German and European data protection law.
Users outside the EU are transparently informed about the processing of their data.
If additional region-specific provisions become applicable in the future, this policy will be supplemented accordingly.

Version: July 2025