Privacy Policy.

The short version.

We take what an order needs and nothing beyond it. No advertising pixels, no third-party trackers anywhere on this site — nothing here reports to Google, Meta or an ad network. Visits are counted by us, on our own server, with no cookie and nothing written to your device. The only cookies we set keep you signed in and remember your language. Your data is not sold or rented to anybody.

Who is responsible.

PRIMALFORM, shipping from within the European Union, is the controller for everything described here. Write to [email protected] about anything on this page.

What we take, and why.

• To fulfil an order — name, email, phone, delivery address and any note you add, plus the items, prices and payment method. Without them we cannot ship or confirm anything. Legal basis: performance of the contract.
• If you open an account — your email, your name and a hashed password (the password itself is never visible to us), so you can sign in and see your history.
• Payment — on a bank transfer we see whatever your bank shows on it; on crypto we store the invoice, the address, the amount and the transaction hash. Card details are never seen or stored, because we do not take cards.
• Server logs — the ordinary request records our server and Cloudflare keep, IP addresses included, used to keep the site up and to block abuse. Legal basis: legitimate interest in a working, non-abused shop.

Cookies.

One functional cookie set at sign-in, so the next page knows it is still you, and one that remembers the language you chose. It goes when you sign out or the session lapses. There is nothing to consent to because there is nothing else — no advertising or profiling cookies, and the visitor counting below needs no cookie at all.

How we count visits.

We keep our own basic statistics — which pages get read and for how long, which link brought someone here, roughly which country, phone or laptop. A shop that cannot see what people are looking for cannot get better at answering them. It all runs on the same server as the shop: nothing goes to Google Analytics or any other company, and none of it leaves the European Union.

It sets no cookie and writes nothing to your device, so there is nothing to consent to and nothing to clear. To tell one visit from another we store a one-way hash of your IP and browser mixed with a secret that changes every midnight — it cannot be turned back into your address, and the same visitor produces a different value tomorrow, so these records cannot follow anyone across days. They are deleted automatically after 180 days. Legal basis: legitimate interest in a working shop, by the least identifying method we could build.

Who else touches it.

• Contabo GmbH — hosts the server the shop and its database run on, in France, inside the EU.
• Cloudflare — stands in front of the site for security and speed, so every request passes through it.
• Resend — sends the order and account emails, and so processes your address and the contents of those emails.
• The carrier — gets the name and address printed on the carton, and nothing about the contents beyond what the label legally requires.

Cloudflare and Resend are US companies, so some data reaches the United States under the standard contractual clauses in their data-processing terms. There are no other processors, and your data never goes to advertisers or data brokers.

How long we keep it.

Orders and their invoices stay as long as accounting law requires. Account data stays until you ask for the account to be deleted. Server logs rotate away within weeks.

Your rights.

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable form. Write to [email protected] and you get an answer within one month. If you think we have handled it badly, you can complain to the data protection authority in your country.

One limit, stated plainly: closing an account does not wipe an order we are legally obliged to keep a record of.