Last updated 9 October 2026

Privacy policy

Which personal data this shop processes, for what purpose, and which rights you have.

01

Controller

Aaron Püttmann
Alt-Praunheim 53, 60488 Frankfurt am Main, Germany
Phone +49 176 8060 1340 · Email hello@pilotstories.art

02

Hosting and shop system

This shop runs on Shopify, a service of Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify hosts the website, processes orders and stores customer data on our behalf. We have a data processing agreement with Shopify.

When you visit the website, Shopify’s servers automatically record technical data: IP address, date and time, the page requested, the referring page, browser and operating system. This is necessary to provide the website securely and to detect misuse. Legal basis: Art. 6(1)(f) GDPR.

Shopify may transfer data to Canada and the USA. For Canada there is an adequacy decision of the European Commission. For other third countries, Shopify uses the EU standard contractual clauses.

For some purposes, Shopify processes data as a separate controller and not on our behalf: to prevent fraud across all Shopify shops, for Shop Pay and the Shop app, and to improve its own services. For this processing, Shopify is responsible, including for answering your requests. Legal basis for passing the data on: Art. 6(1)(f) GDPR (a secure shop and fraud prevention). Details and your rights: privacy.shopify.com.

03

Cookies and consent

Technically necessary cookies make the cart, the checkout and your cookie choice work. They do not require consent (Section 25(2) TDDDG, Art. 6(1)(f) GDPR).

We only use the analytics and marketing services in sections 08 to 10 if you agree in the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time under “Cookie settings” in the footer.

The website also stores small entries in your browser that are not sent to anyone: your language choice (English or German) for the legal pages and, until you close the tab, your name and email address after you send the contact or withdrawal form, so the confirmation can greet you. Also until you close the tab, it notes that you closed the newsletter box or signed up with it, so the box does not come back during your visit. These entries are strictly necessary for functions you use (Section 25(2) TDDDG). If you allow marketing cookies, the website keeps this note longer: 30 days after you close the box, and after you sign up until you withdraw that consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

04

Orders

To process your order, we use your name, billing and delivery address, email address, phone number if you give one, the order details and payment information. Legal basis: Art. 6(1)(b) GDPR. Without this data we cannot conclude the contract.

We keep invoices and accounting records for the statutory retention periods of up to 10 years (Section 147 AO, Section 257 HGB). Legal basis: Art. 6(1)(c) GDPR.

You can sign in to a customer account to see your orders. You sign in with a one-time code that we send to your email address; there is no password. Your account holds your name, email address, addresses and orders. Legal basis: Art. 6(1)(b) GDPR. You can ask us to delete your account at any time; invoices stay stored for the statutory periods.

05

Production and delivery

Your prints are produced and shipped by Saal Digital Fotoservice GmbH, Zeppelinstraße 36, 91187 Röttenbach, Germany, or by WhiteWall Media GmbH, Europaallee 59, 50226 Frechen, Germany. For this we pass on your name, delivery address and the order details to the lab that produces your order. The lab passes your name and delivery address to the carrier it uses (Deutsche Post, DHL, DPD, UPS, Transoflex or TNT/FedEx). For deliveries outside the EU, customs authorities and carriers in the destination country also receive this data (Art. 49(1)(b) GDPR). Legal basis: Art. 6(1)(b) GDPR.

Your wall calendar is printed and shipped by Saal Digital Fotoservice GmbH, Zeppelinstraße 36, 91187 Röttenbach, Germany. For this we pass on your name, delivery address and the order details. Saal Digital passes your name and delivery address to the carrier it uses (Deutsche Post, DHL, Transoflex or UPS). Outside the EU, we post the wall calendar ourselves with DHL (Deutsche Post AG, Bonn, Germany), which receives your name, delivery address and, for the customs declaration and delivery notices, your phone number or email address. Customs authorities and carriers in the destination country also receive this data (Art. 49(1)(b) GDPR). Legal basis: Art. 6(1)(b) GDPR.

06

Payment

Payments are processed by Shopify Payments. The payment service provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe receives the data required for the payment and checks payments to prevent fraud. Stripe may transfer data to the USA; Stripe, Inc. is certified under the EU–US Data Privacy Framework. If you pay with Apple Pay or Google Pay, Apple or Google also process data under their own privacy policies. Legal basis: Art. 6(1)(b) and (f) GDPR.

If you pay with Shop Pay, Shopify processes your data as a separate controller and, if you choose, saves it so you can check out faster in other shops. Shopify’s privacy policy applies: privacy.shopify.com.

07

Contact

If you write to us by email or through the contact form, we use your details to answer your message. Legal basis: your consent (Art. 6(1)(a) GDPR) and, for questions about an order, Art. 6(1)(b) GDPR. We delete your message once the matter is settled, unless statutory retention periods apply.

08

Web analytics

With your consent, we use:

Shopify Analytics
Statistics about visits and purchases, based on cookies set by Shopify.
Google Analytics 4
A service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It uses cookies to analyse how the website is used. IP addresses are not stored. Data may be transferred to Google LLC in the USA, which is certified under the EU–US Data Privacy Framework. The data is deleted after 14 months.

Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

09

Meta Pixel

With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure the effect of ads on Facebook and Instagram and to show ads to people who visited this website. The pixel sends data about your visit to Meta, for example pages viewed, purchases, and device and browser data.

We and Meta are joint controllers for collecting and transmitting this data (Art. 26 GDPR); Meta’s controller addendum applies. Meta may transfer data to the USA; Meta Platforms, Inc. is certified under the EU–US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

10

Pinterest Tag

With your consent, we use the Pinterest Tag of Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland. Shopify’s Pinterest app adds it to the website. The tag shows us which visits and purchases come from Pinterest, and lets Pinterest show our pins and ads to people who visited this website. It sends data about your visit to Pinterest, for example pages viewed, products added to the cart, purchases, and device and browser data. With the same consent, the app also sends these events from Shopify’s servers to Pinterest (Pinterest API for Conversions), together with contact details such as your email address in hashed (pseudonymised) form, so that Pinterest can match them to a Pinterest account.

We and Pinterest Europe are joint controllers for collecting and transmitting this data (Art. 26 GDPR); Pinterest’s joint controller addendum applies. Pinterest may transfer data to Pinterest, Inc. in the USA, which is certified under the EU–US Data Privacy Framework. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

11

Newsletter

If you subscribe, you receive about two emails a month: new prints, signed editions and calendars when they are released, new stories and, once a month, wallpapers to download. We send the newsletter with Brevo, a service of Sendinblue SAS, France. After signing up, you receive an email to confirm your address (double opt-in). As proof, we store the time of sign-up and confirmation and your IP address.

The newsletter measures whether an email was opened and which links were clicked. Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time with the link in every email. We then delete your address; we keep the proof of consent for up to three years (Art. 6(1)(f) GDPR).

12

Reviews

If you send a review with the “Write a review” form, we receive your first name, your city, your email address and your review, and a photo if you send one by email. We check against our orders whether you bought from this shop; for this we compare your name and email address with our order data. With your consent, we publish the review with your first name, your city, the month, the size and finish you bought and, if you sent one, the photo. Your email address is never published. Legal basis: your consent (Art. 6(1)(a) GDPR) and, for the check, our legitimate interest in showing only genuine reviews (Art. 6(1)(f) GDPR). You can withdraw your consent at any time by email to hello@pilotstories.art; we then remove the review.

13

Review request

If you tick the box in the cart, we send you a single email about a week after delivery and ask for a review. For this we use your name, your email address, the product you bought and the delivery date. The email is sent with Brevo (see “Newsletter”). We store your consent with your order. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, for example by email to hello@pilotstories.art; we then do not send the email.

14

Withdrawal function

If you use the Withdraw from contract form, we process your name, the order number, the items concerned, your email address and the date and time of receipt. We use them to handle your withdrawal and to send you the confirmation of receipt required by law. Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 356a BGB. We keep this data for as long as needed to handle the withdrawal and for the statutory retention periods.

15

Social media

We link to our profiles on Instagram, Pinterest, Facebook and YouTube. These are plain links: no data is sent to the platforms until you click one. On our profiles, the privacy policy of the platform applies. For statistics about our Facebook and Instagram pages (Page Insights), we and Meta are joint controllers (Art. 26 GDPR).

16

Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7(3)). To exercise your rights, write to hello@pilotstories.art.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can object to processing for direct marketing at any time without giving reasons.

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

17

Security

The website uses TLS encryption. You can recognise it by “https://” in the address bar.