We keep the minimum needed to ship an order and answer a question, and we never sell it. Last reviewed 21 August 2026.
Controller
The controller for the purposes of the General Data Protection Regulation (EU) 2016/679 is the operator of this shop, whose registered details are set out in the Impressum. For any privacy question, write to info@deadheadchemist.de.
What we collect
- Order information — name, email, phone, shipping address, and what you bought.
- Payment information — a Paysafecard PIN is passed straight to the issuer and never stored; a Revolut reference and a Bitcoin transaction identifier are kept against the order so the payment can be matched and, if necessary, refunded.
- Support correspondence — the messages you send us and our replies.
- Site usage — aggregate page and product views, so we know what to stock and what to fix.
- Local storage — your cart, wishlist and age confirmation live in your browser, on your device, not on our servers.
Why we collect it, and the legal basis
- To fulfil your order — performance of a contract, Article 6(1)(b) GDPR.
- To answer support messages — performance of a contract where it concerns an order, otherwise our legitimate interest in running a shop people can talk to, Article 6(1)(f).
- To keep tax and commercial records — a legal obligation under §§ 147 AO and 257 HGB, Article 6(1)(c).
- To confirm you are 18 or over — a legal obligation, and our legitimate interest in not selling to minors.
- To send the newsletter — your consent, Article 6(1)(a), withdrawable at any time with no effect on what came before.
- To understand aggregate site usage — our legitimate interest in knowing what to stock and what to fix, Article 6(1)(f).
What we never do
- We do not sell, rent or trade personal information.
- We do not build advertising profiles or share data with ad networks.
- We do not put product names on the outside of a parcel or on a payment descriptor.
Who else sees it
Only the processors we need to operate: our payment providers, the carrier delivering your parcel, our hosting provider and an email provider for receipts. Each receives the minimum required, each is bound by a data processing agreement under Article 28 GDPR, and none of them are permitted to use it for their own purposes.
All of our processing takes place inside the EU or the EEA. Where a processor would involve a transfer to a third country we rely on an adequacy decision or on the Commission's standard contractual clauses, and we will name the processor here before doing so.
How long we keep it
Order and invoice records for ten years, the retention period German tax and commercial law imposes on us. Support correspondence for two years. Newsletter addresses until you unsubscribe. Anything else, no longer than it is useful.
Your rights
Under the GDPR you have the right to:
- Access a copy of the personal data we hold about you (Article 15).
- Rectification of anything inaccurate or incomplete (Article 16).
- Erasure of anything we are not legally required to keep (Article 17).
- Restriction of processing while a dispute about accuracy or lawfulness is resolved (Article 18).
- Portability — the data you gave us, in a structured machine-readable format (Article 20).
- Objection to any processing based on legitimate interest, on grounds relating to your particular situation (Article 21).
- Withdrawal of consent at any time, where consent is the basis (Article 7(3)).
Write to info@deadheadchemist.de or use the contact form. We answer within one month, as Article 12(3) requires, and we do not charge for it.
Complaints
You have the right to lodge a complaint with a supervisory authority, in the member state of your residence, your place of work or where you think an infringement occurred. In Germany, the competent authority is the data protection officer of the federal state in which the controller is established; the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit maintains the current list at bfdi.bund.de. We would rather you told us first, but you do not have to.
Automated decision-making
We do not carry out automated decision-making or profiling within the meaning of Article 22 GDPR.
Cookies and storage
This site sets no advertising or analytics cookies, so there is no consent banner to click past. Your cart, wishlist, recent searches and age
confirmation are held in your browser's own local storage, on your device, under the key dhc.v1 — they are never transmitted to us.
Storage strictly necessary to provide a service you asked for does not require consent under § 25(2) TDDDG. Clearing your browser storage
clears all of it, including the age confirmation.
Changes
If this policy changes materially we will say so on this page and date the change. Continuing to use the site after that means you accept the revised policy.