Privacy Policy
Last updated: August 2026
1. Privacy at a Glance
The protection of your personal data is important to me. Personal data is processed on this website only where necessary for operating the website, communicating with you, processing orders and payments, or sending my newsletter.
Personal data means any information that can be used to identify you personally, such as your name, address, email address, telephone number or IP address.
This Privacy Policy explains which personal data is processed on this website, for what purposes, and what rights you have.
2. Controller
Doris Joa
Freelance Artist
Mühlenauel 48 a
53506 Ahrbrück
Germany
Phone: 0160 2992041
Email: doris(at)dorisjoa.de
3. Hosting
This website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany.
When you visit this website, technically necessary data may be processed. This may include your IP address, date and time of access, pages or files accessed, transferred data volume, referrer URL, browser, operating system and access status.
This processing is necessary to provide the website technically and to ensure secure and stable operation.
The legal basis is Art. 6(1)(f) GDPR. My legitimate interest lies in the secure and technically reliable operation of this website.
Where the hosting provider processes personal data on my behalf, this is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.
4. SSL / TLS Encryption
This website uses SSL or TLS encryption for security reasons. This helps protect data that you transmit through this website from being read by third parties.
You can recognize an encrypted connection, among other things, by the fact that the address bar of your browser begins with “https://”.
5. Cookies and Technically Necessary Functions
This website may use cookies or similar technologies that are necessary for the technical operation of the website, its security, or the use of the online shop.
Technically necessary cookies may, for example, be used to store shopping cart contents, maintain sessions or enable the ordering process.
Where the storage of information on your device or access to such information is strictly necessary in order to provide a service expressly requested by you, this is carried out on the basis of Section 25(2) TDDDG.
Where non-essential cookies or similar technologies are used, the processing takes place only on the basis of the applicable legal requirements.
6. Contact
Contact Form
A contact form is available on this website.
If you use the contact form, the data you enter will be processed. This may include in particular:
- Name
- Email address
- Subject
- Content of your message
The data is used solely to process your request and to communicate with you.
If your request relates to an existing or potential contract, the processing is carried out on the basis of Art. 6(1)(b) GDPR.
In all other cases, processing is carried out on the basis of Art. 6(1)(f) GDPR. My legitimate interest lies in being able to respond to enquiries from interested persons and website visitors.
Contact by Email or Telephone
If you contact me by email or telephone, the data you provide will be processed for the purpose of handling your enquiry.
Website emails are sent via the mail server provided by my hosting provider.
7. Protection Against Spam and Misuse
A local CAPTCHA solution is used to protect the contact form. Google reCAPTCHA is not used.
Additional technical security measures are used to limit abusive login attempts and attacks on the website. In this context, IP addresses and technical information may be processed.
The processing is carried out on the basis of Art. 6(1)(f) GDPR. My legitimate interest lies in the security of my website and protection against misuse or unauthorized access.
8. Online Shop and Orders
This website operates an online shop based on WooCommerce.
If you place an order, the personal data necessary to conclude and perform the contract will be processed. This may include in particular:
- First and last name
- Billing and shipping address
- Email address
- Telephone number, where provided
- Products or services ordered
- Billing and payment information
- Date and time of the order
- Technical order data
The processing takes place in order to handle your order, process payment, deliver the goods and communicate with you about your order.
The legal basis is Art. 6(1)(b) GDPR.
Where statutory retention obligations apply, processing is additionally based on Art. 6(1)(c) GDPR.
9. Shipping of Orders
Where necessary for the delivery of an order, your name, delivery address and any other required information will be transmitted to the shipping service provider used for the respective delivery.
The transmission is carried out solely for the purpose of delivering the ordered goods and is based on Art. 6(1)(b) GDPR.
10. Payment Processing
PayPal
If you choose to pay via PayPal, the data required for payment processing will be transmitted to PayPal.
This may include identification, contact, device, transaction and payment data.
The processing is carried out for the purpose of completing the payment selected by you and is based on Art. 6(1)(b) GDPR.
PayPal may also process data under its own legal obligations, in particular for fraud prevention, risk assessment and compliance with financial regulations.
Stripe / Credit Card Payments
Credit card payments are processed using the payment service provider Stripe.
In connection with a payment, Stripe may process in particular:
- Name
- Email address
- Billing and, where applicable, shipping address
- Payment and card details
- Purchase amount
- Date and transaction information
- IP address
- Technical device information
Stripe uses this data in particular for payment processing, authentication and the prevention of fraud and misuse.
The processing of data required for the payment is carried out on the basis of Art. 6(1)(b) GDPR.
Depending on the selected payment method, additional banks, credit card companies or payment service providers may be involved in the transaction.
11. Newsletter via rapidmail
You can subscribe to my newsletter on this website.
I use the service rapidmail, provided by rapidmail GmbH, Freiburg im Breisgau, Germany, to send the newsletter.
At least your email address is required for registration. If you voluntarily provide your first name, it may be used for personal addressing.
Subscription takes place using a double opt-in procedure. After registering, you will receive an email asking you to confirm your subscription.
In connection with registration, the following data may in particular be processed:
- Email address
- Voluntarily provided name
- Date and time of registration
- Date and time of confirmation
- IP address
- Technical information required to document the registration
The legal basis for sending the newsletter is your consent pursuant to Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future, in particular by using the unsubscribe link contained in each newsletter.
After unsubscribing, your email address will be removed from the active newsletter distribution list. Data required to demonstrate that consent was properly obtained may continue to be stored for a limited period in accordance with statutory limitation and documentation requirements.
rapidmail processes personal data as part of the newsletter service on the basis of a data processing agreement pursuant to Art. 28 GDPR.
12. Embedded YouTube Videos
This website contains embedded videos provided by YouTube, a service of Google.
The videos can be viewed directly on this website.
When a page containing an embedded YouTube video is accessed, a connection to servers operated by Google or YouTube may be established.
In this context, information such as your IP address, browser and device information and details about the page you accessed may be transmitted.
If you are logged into your Google or YouTube account at the same time, Google may be able to associate your use of the video with your user account.
Google may also process personal data outside the European Union or the European Economic Area.
13. Embedded Vimeo Videos
This website contains embedded videos provided by Vimeo.
The videos are hosted by Vimeo but can be viewed directly on this website.
When a page containing an embedded Vimeo player is accessed, a connection to Vimeo servers may be established.
In this context, information such as your IP address, browser and device information and details about the page you accessed may be transmitted.
Vimeo may also process personal data outside the European Union or the European Economic Area.
Change Video Settings
If you have previously allowed YouTube or Vimeo videos to load on this website, you can withdraw this choice at any time.
After resetting your choice, embedded YouTube and Vimeo videos will only be loaded again after you allow the respective provider.
14. Links to Social Networks and External Platforms
This website contains links to external platforms, in particular Instagram, Pinterest and YouTube.
These are simple links. Merely visiting this website does not generally cause content from the respective social networks to be embedded through these links.
Only when you click such a link do you leave this website and access the service offered by the respective third-party provider. From that point onward, the processing of personal data is governed by the privacy policy of the respective provider.
15. Recipients of Personal Data
Personal data is only disclosed where this is necessary for the purposes described above, where there is a legal obligation to do so, or where you have given the corresponding consent.
Possible recipients may include in particular:
- Hosting and technical service providers
- Newsletter service providers
- Payment service providers
- Banks and credit card companies
- Shipping service providers
- Tax and financial authorities, where required by law
16. Transfers to Third Countries
Some of the services used, in particular YouTube/Google, Vimeo and international payment service providers, may process personal data in countries outside the European Union or the European Economic Area.
Where the European Commission has adopted an adequacy decision for the respective country, or where other safeguards permitted under the GDPR apply, the transfer may be based on those safeguards.
17. Storage Period
Unless a specific storage period is stated in this Privacy Policy, personal data will only be stored for as long as necessary for the respective purpose of processing.
Where statutory retention obligations apply, the relevant data will be retained for the duration of those obligations and deleted afterwards.
18. Your Rights
Subject to the applicable legal requirements, you have in particular the following rights:
- Right of access pursuant to Art. 15 GDPR
- Right to rectification pursuant to Art. 16 GDPR
- Right to erasure pursuant to Art. 17 GDPR
- Right to restriction of processing pursuant to Art. 18 GDPR
- Right to data portability pursuant to Art. 20 GDPR
- Right to object pursuant to Art. 21 GDPR
- Right to withdraw consent at any time with effect for the future
To exercise your rights, you may contact the controller named above at any time.
19. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority.
For my place of establishment, the competent authority is in particular:
The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate
Hintere Bleiche 34
55116 Mainz
Germany
20. Changes to this Privacy Policy
I reserve the right to amend this Privacy Policy if the website, the services used or legal requirements change.
The current version published on this website shall apply.