Privacy Policy

Pursuant to Art. 13, 14 EU General Data Protection Regulation (GDPR)

1. Controller and Contact Information

The controller responsible for data processing on this website is:

Guillaume Karpowicz

Registered address: Marwitzer Str. 54a
13589 Berlin
Germany

Email: info@diabolofocus.com Phone: +49 163 636 3431

A Data Protection Officer is not required as we regularly employ fewer than 20 persons involved in automated data processing (§ 38 BDSG).

2. Supervisory Authority

The competent data protection supervisory authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI) Friedrichstr. 219, 10969 Berlin, Germany Email: mailbox@datenschutz-berlin.de Website: www.datenschutz-berlin.de

You have the right to lodge a complaint with this supervisory authority at any time (Art. 77 GDPR).

3. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us at info@diabolofocus.com.

Deleting your account yourself. If you have an account, you can also delete it at the bottom of your account settings page. We send a confirmation link to your login email; after you confirm, the account and the data tied to it are deleted 14 days later, and you can cancel until then. The deletion is refused while an order is still open, a parcel sent in the last 30 days can still be returned, or a wholesale account is attached; in those cases write to us. Orders stay as our sales record without your name or email, invoices are kept unchanged for the periods tax law requires (§ 147 AO), and our backups expire within 35 days. Reviews you wrote stay published as anonymous verified reviews, without your name, Instagram handle or photos.

4. Data Processing Activities

4.1 Website Hosting and Content Delivery (Cloudflare)

The website is hosted on and delivered through the global network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you visit our website, Cloudflare automatically processes technical data, including your IP address, browser type and version, operating system, referrer URL, date and time of access, and pages visited. Cloudflare also uses this data to protect the site against attacks and abuse (e.g. DDoS mitigation and security filtering).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable, secure and fast website operation).

Cloudflare acts as our data processor under a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. Transfers to the United States are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses (Art. 46(2)(c) GDPR).

In addition, Cloudflare Web Analytics, a measurement script Cloudflare adds at the level of our domain, measures page-load performance on every visit without setting cookies or using identifiers. Cloudflare, Inc. acts as our processor for this as well, under the Data Processing Agreement named above; transfers to the United States are covered in the same way. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a fast-loading website).

4.2 Online Store, Cart, and Checkout

Our product catalogue is managed using Wix.com Ltd. (40 Namal Tel Aviv St., Tel Aviv 6350671, Israel). Our website reads a catalogue replica hosted with Cloudflare. The basket, sign-in and customer accounts, checkout, order processing and loyalty programme run on our website and in our Cloudflare-hosted database. Payments are processed by Stripe as described in section 4.4. Wix also retains legacy order and customer records from our former shop.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

Wix acts as our data processor for the catalogue and legacy order and customer records under a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. Transfers to Israel are covered by the EU Commission’s adequacy decision (Art. 45 GDPR). Transfers to the United States are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4.3 Customer Account and Order Processing

When you place an order, we collect and process: name, email address, billing and shipping address, phone number (if provided), order details, payment method, and payment status. Card or bank-account details are entered directly in Stripe’s payment form and do not pass through our server.

Legal basis: Art. 6(1)(b) GDPR (contract performance). Retention period: Order data is retained for 8 years from the end of the calendar year in which the transaction occurred, as required by German tax and commercial law (§ 147 AO, § 257 HGB).

We also keep a copy of your customer record in our own database, hosted with Cloudflare (see 4.1): your contact details, addresses, account status, newsletter status and loyalty points balance. This copy is what we answer your requests from (see section 3). Sign-in, checkout, orders and the loyalty programme are processed in our own Cloudflare-hosted database. A deletion request is carried out in both places.

Signing in. We run the sign-in to your account ourselves. When you ask to sign in, we send a one-time link and a 6-digit code to the email address you entered, from login@diabolofocus.com through Cloudflare’s email service. We store only a hashed form of the link and code; they expire after 15 minutes and are deleted a day later. Once you are signed in, a session cookie (df_auth) and a session record in our database keep you signed in for 90 days from your last visit, and never longer than a year; signing out deletes the record. For security we log sign-in events with a keyed hash of your email address (never the address itself), a coarse browser, operating-system and device type, and your country; no IP address is stored, and the log is kept for 180 days. If you already had an email-verified Wix member account, we link it through its verified email address so your orders, points and profile stay with you. A guest checkout contact alone does not establish ownership of an account.

Sign in with Google (optional). If you choose it, you are sent to Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to sign in, and Google tells us your name, your email address, whether Google has verified it, and your Google account ID. Google processes your sign-in as an independent controller under its own privacy policy.

Legal basis: Art. 6(1)(b) GDPR (providing your account); Art. 6(1)(f) GDPR for the security log (legitimate interest in protecting accounts from misuse).

Shared basket lists. When you share a basket, we store its product identifiers, quantities, title and optional note, and link it to your account if you are signed in. Anyone with the link can read the list. It expires 90 days after its most recent opening; every opening starts that period again, so a repeatedly opened list can remain available longer than 90 days. Expired lists are removed by our regular cleanup.

4.4 Payment Processing

We use the following payment service providers:

4.5 Shipping and Delivery

To fulfill your order, we share your name, delivery address, and (if provided) phone number and email address with our shipping providers, primarily Deutsche Post / DHL Paket GmbH.

Before you have chosen a delivery country yourself, we preselect one from the country your internet connection is in, so that the shipping cost and the delivery dates shown on the page are the ones that apply to you. Cloudflare derives that country from your IP address at the moment your browser asks for it; we receive the country alone, never the IP address, and nothing about it is stored on our side. Your own choice always takes precedence over ours, and the delivery address you enter at checkout is what actually decides the shipping cost and the VAT.

Legal basis: Art. 6(1)(b) GDPR (contract performance); Art. 6(1)(c) GDPR (legal obligation for customs declarations); Art. 6(1)(f) GDPR (legitimate interest in showing you the shipping cost and delivery dates that apply where you are).

4.6 Email Communication

We use your email address to send order confirmations, shipping notifications, and responses to inquiries. If you subscribe to our newsletter, we process your email address based on your consent. Legal basis: Art. 6(1)(b) GDPR (transactional emails); Art. 6(1)(a) GDPR (newsletter).

Newsletter sign-ups in the footer and in Account settings use double opt-in: we first send you a confirmation email and only add your address once you confirm it. We store your address together with the time you signed up and confirmed, to document your consent, and every newsletter email lets you unsubscribe.

You can subscribe to or unsubscribe from the newsletter in Account settings. Signing in by email or Google does not subscribe you automatically. Selecting Subscribe sends a separate confirmation email to your account address. For this choice we store the version of the consent wording shown, together with the time and source of your request.

Customer groups. To choose which newsletter content is relevant to you, we sort customers into groups from what we already hold: how many orders you placed and when, how much you spent, your delivery country, and account activity (signing in, your wishlist, reviews, and clicks on links in our emails). Opened emails are not tracked. The groups are recalculated every night and used only to select newsletter recipients; an email goes only to addresses with newsletter consent. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in sending relevant rather than generic newsletters). You can object at any time (Art. 21 GDPR), after which we no longer use these groups for you.

After an order has been delivered, we may send you one email asking for a review of the products you bought. We use the email address you gave us at checkout, as permitted by Section 7(3) of the German Unfair Competition Act (UWG) for customers of similar goods; we record whether the email was sent and whether its links were opened, but no tracking pixel. You can object at any time, free of charge, through the unsubscribe link in that email or by replying to it; we then keep only a one-way hash of your address so that we do not ask again. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in customer feedback on our products).

On the same basis, we may also email you about similar products from our shop. You can object at any time through the link in each email.

When you add photos to a review, you can also tick “Show my photos in the product page gallery” and give your Instagram handle. Both are optional and the box starts unticked. If you tick it, we may show those photos in a gallery on the product page, credited with your handle if you gave one; we do not load anything from Instagram, the handle is only text and a link. We keep both with your review and you can withdraw the consent at any time by writing to us, after which the photos leave the gallery. Legal basis: Art. 6(1)(a) GDPR (consent).

Basket reminders. With your consent to “Basket reminders by email” in Privacy settings, DiaboloFocus can send you one reminder after 24 hours without meaningful basket or checkout activity, using your verified account email. Accept all includes this purpose when disclosed in the new notice; earlier marketing-cookie consent, statistics consent and newsletter subscriptions do not qualify. This purpose can be accepted independently of advertising cookies. We use your account email, basket contents and language to send the reminder through Cloudflare’s email service (see section 4.1). Disable the purpose in Privacy settings or use the unsubscribe confirmation in an email to stop pending and future reminders. After an email unsubscribe, Accept all or unrelated cookie choices do not renew permission; deliberately enabling the basket-reminder switch can. Withdrawal from the same browser also works after signing out. Legal basis: Art. 6(1)(a) GDPR (consent).

As explained beside the opt-in, we measure whether the reminder link was followed, whether you signed in and returned to that basket, and whether a purchase followed within seven days. The link does not sign you in or give another person access to your basket. Email-security services can follow links, so a redirect is reported separately from an authenticated return. There is no email-open tracking pixel. We keep individual reminder and attribution records for 90 days after the episode ends, then retain only anonymous daily totals. Proof of grants and withdrawals is kept for three years; current permission is kept while your account exists. Account deletion removes the associated reminder records and permission. Legal basis for individual measurement: Art. 6(1)(a) GDPR (consent).

4.7 Contact Form and Email Inquiries

When you contact us, we process the data you provide (name, email, message content) to respond to your inquiry.

Messages sent through our contact form, including any files you attach, and declarations sent through our withdrawal form are stored with our hosting provider Cloudflare, Inc. (see section 4.1). Cloudflare also delivers the emails we send about them, such as the confirmation of receipt of a withdrawal.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Retention: Inquiry data is retained for 3 years from the last contact, unless longer retention is required by law.

4.8 AI Help Assistant (Help Center)

Our help center offers an “ask us anything” box that answers questions with an AI language model. Answers are labelled as AI-generated in the interface (Art. 50(1) EU AI Act). Using the box is entirely voluntary: the same information is available in the written FAQ, and you can always write to us at info@diabolofocus.com instead.

What is processed. The question you type, the earlier questions and answers of the same conversation, your language, and your IP address (for bot protection and rate limiting). Please do not enter personal data into the box: no names, addresses, order numbers or payment details. It has no access to your customer account, your orders or your cart and cannot look anything up about you.

How it works. Your question is matched against our own help texts (FAQ, shipping and withdrawal information, legal documents, product catalogue), which are stored with Cloudflare, Inc. Your question and the matching passages are then sent to a Claude language model operated by Anthropic PBC (548 Market St, PMB 90375, San Francisco, CA 94104, USA), reached through Cloudflare’s AI Gateway, which generates the answer text. Cloudflare may log the request and the answer for diagnostic purposes. Bot protection is provided by Cloudflare Turnstile, which processes your IP address and browser information and may store a short-lived token in your browser; it is strictly necessary for this feature to work (§ 25 Abs. 2 TDDDG).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering visitor questions quickly and in improving our help center).

Processors and transfers. Cloudflare, Inc. and Anthropic PBC act as our data processors under Data Processing Agreements in accordance with Art. 28 GDPR. Transfers to the United States are covered by Standard Contractual Clauses (Art. 46(2)(c) GDPR). Neither provider uses your question or the answer to train AI models; they are retained only for the limited period each provider needs for the delivery of the service and for abuse prevention.

Our own log. We record the questions asked so we can turn the ones the help center answered badly into new FAQ entries. Before a question and its answer are written to that log, email addresses, IBANs and any run of five or more digits are automatically replaced with placeholders. The entry carries no IP address, session, account or other identifier that could link it to you. Entries are deleted after 25 months at the latest.

Accuracy. The model can be wrong. Its answers are not legally binding; prices, availability, delivery times and policies are authoritative only as stated on the relevant product page and in our General Terms and Conditions.

4.9 Error Reporting (Sentry)

When something on the site breaks, on our server or in your browser, a technical error report is sent to Sentry so we can fix it. In the browser this happens only at the moment an error occurs: no reporting code is loaded before that. A report contains the error message and the code location, the page address (with credentials such as invoice links removed), your browser and operating system versions, and the last few interactions with the site in the same anonymous vocabulary as our usage measurement (for example “search” or “added to cart”). Your IP address is not stored, and no name, email address, account or order number is included. For a visit that is being recorded as a session replay (see the Cookie Policy below), the report carries the replay’s identifier so we can watch what went wrong; without that consent it carries none.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working, secure website).

Provider: Functional Software, Inc. (Sentry), 45 Fremont Street, San Francisco, CA 94105, USA, acting as our data processor under a Data Processing Agreement (Art. 28 GDPR). Reports are stored in Sentry’s European Union data region (Germany) and deleted after 90 days. Transfers to the United States, where they occur, are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4.10 Embedded Videos (YouTube)

Our video pages and the video player elsewhere on the site (for example on product, profile and blog pages) show videos hosted on YouTube. We embed them in YouTube’s privacy-enhanced mode (youtube-nocookie.com). On a video page (/video/…) the player loads when you open the page; everywhere else it loads only when you click a video to play it. Preview images of videos are loaded from YouTube’s image server (i.ytimg.com) wherever a video is listed.

When the player or a preview image loads, your browser connects to Google’s servers and transmits your IP address, browser information and the address of the page you are on. Once the player has loaded, and in particular when you play a video, YouTube may store cookies or similar identifiers in your browser and, if you are signed in to Google, link the viewing to your Google account. We have no influence over this processing; Google is responsible for it as an independent controller.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing diabolo videos from the community on our website). Information is stored in or read from your browser only for a player you opened or started yourself (§ 25 Abs. 2 TDDDG).

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework. More information: Google’s privacy policy, https://policies.google.com/privacy.

If you create a diabolist profile, you can link your equipment, videos and records to the products they use in our shop. A link is shown on those product pages, with your name and profile photo or the video, only if you tick the box for it, and a video’s link only after we have checked that the video is yours. For a video with other people in it, you also confirm that they agree. You can untick any of these boxes on your profile at any time; the link then disappears from the video, record and profile pages within an hour and from the product pages within 24 hours.

Legal basis: Art. 6(1)(a) GDPR (consent), which you can withdraw at any time (Art. 7(3) GDPR). We record when you gave or withdrew it.

4.12 Back-in-Stock Notification

If a product is sold out, you can ask us to tell you when it is available again. We store the email address or phone number you enter, the language of the page, and the product (and colour or size) you asked about, on our hosting provider Cloudflare (see section 4.1). When the product is back in stock, we send you one email about it; a phone number is answered by us personally, never automatically. Your address is used for nothing else, and it is not added to any mailing list.

Legal basis: Art. 6(1)(b) GDPR (a measure you request before a purchase).

Retention: We delete the request 30 days after we have answered it, and after one year if the product has not come back by then.

4.13 Gift Cards

When you buy a gift card for someone else, we store the recipient’s name and email address, your message and the delivery date you chose, on our hosting provider Cloudflare (see section 4.1), and send the recipient one email with the card’s code on that date. We store the code itself only until that email has gone out; after that we keep only a fingerprint of it and its last four characters, which is how the card is recognised at checkout.

Legal basis: Art. 6(1)(b) GDPR (performing your order) for your own data; Art. 6(1)(f) GDPR for the recipient’s, our legitimate interest being to deliver the gift you ordered for them.

Retention: We delete the recipient’s name, email address and your message 90 days after the card has been sent. The card’s value, balance and use are part of our accounting records and are kept for the periods required by law (§ 257 HGB, § 147 AO).

4.14 Community Profiles and the Community Map

A diabolist profile is public only if you switch on “Show my profile publicly”. It then shows, on our community pages, the name, country, photos, biography, badges, equipment, links and contact email you entered (the email field starts with your login email; you can change or empty it). A new profile starts hidden, and switching it off takes it off the site again within a few minutes. We keep the profile until you ask us to delete it (see section 3).

You can also put yourself on the map on our events page, with an optional short message, so that other diabolists near you can find you. The pin marks the centre of the city you pick from a list, never your address or exact location, and shows your name, profile photo, message and a link to your profile. It is shown only while your profile is public, only if you confirm you are 18 or older, and it is a separate choice from the profile itself. Removing it deletes it at once, and the map updates within a few minutes. The city list comes from GeoNames (CC BY 4.0) and is served from our own site; nothing you type is sent to anyone else.

Legal basis: Art. 6(1)(a) GDPR (consent), which you can withdraw at any time (Art. 7(3) GDPR). For the map we record when you gave your consent and which wording you agreed to.

5. Cookies and Tracking Technologies

Please refer to our separate Cookie Policy for detailed information about cookies used on this website.

Essential cookies (session management, shopping cart, CSRF protection, security) are set without consent as they are strictly necessary for the operation of the website (§ 25 Abs. 2 TDDDG).

Non-essential cookies (marketing, third-party services) are set only after you have provided explicit consent via our cookie consent banner (§ 25 Abs. 1 TDDDG; Art. 6(1)(a) GDPR).

6. International Data Transfers

Your data may be transferred to and processed in countries outside the European Economic Area (EEA):

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our website uses SSL/TLS encryption for all data transmission.

8. Automated Decision-Making

We do not use automated decision-making as defined by Art. 22 GDPR. The customer groups described in section 4.6 are a form of profiling, but they only decide which newsletter content you are offered and have no legal or similarly significant effect on you. The AI help assistant described in section 4.8 produces text answers only: it makes no decision about you, your account or your order, and no decision producing legal effects concerning you is taken automatically.

9. Obligation to Provide Data

The provision of personal data for the purpose of order processing is a contractual requirement. Without this data, we cannot process or fulfill your order. The provision of data for newsletter signup or contact inquiries is voluntary.

10. Children

Our shop is open to young diabolo players too, and we do not ask for your age. What a young person can agree to on their own depends on it:

The IN FOCUS contest has its own age rules, set out in its rules.

11. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in legal requirements or our data processing activities. The current version is always available on our website.

Pursuant to § 25 TDDDG and Art. 6(1)(a) GDPR

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They serve various purposes, from enabling essential website functions to analyzing user behavior.

These cookies are strictly necessary for the functioning of the website and cannot be deactivated.

CookiePurposeDuration
Session cookieMaintains your session while browsingSession
Sign-in (df_auth, df_logged_in)Keeps you signed in to your account, and tells the page header that you are90 days from your last visit, at most one year
Sign-in in progress (df_login_pending, df_google_flow)Links the sign-in link, code or Google return to the browser that asked for it15 minutes (10 for Google)
Shopping cartRemembers items in your cart6 months
CSRF tokenSecurity: prevents cross-site request forgerySession
Cookie consentRemembers your cookie preferences12 months
Language (df_lang)Remembers the language you chose, or the one your browser asked for on your first visit12 months
Personalization (df_aud)Set only when you are signed in. Remembers whether you have ordered from us before, so pages can skip what you no longer need. It holds a single letter and no products, dates or order details. Cleared when you sign out30 days
Measurement opt-out (df_no_stats)Saved only if you ask us to stop counting your visits, so that we can honour itUntil you clear your browser data
Delivery country (df_shipping_country)Remembers the delivery country you chose, so the shipping cost and delivery dates are right the next time you visit. A second entry holds the country we preselected for you before you chose oneUntil you clear your browser data; 30 days for a country we preselected
Checkout form (df_checkout_draft)Keeps what you typed in the checkout (never your card or bank-account details) if you reload the page or go back to the cartUntil you close the tab
Security cookiesFraud prevention and site securitySession
Turnstile (bot check)Confirms a person, not a bot, is paying at checkout, sending a form, or using the help center’s ask boxSession

We measure how the site is used with our own software, served from and received on our own domain (/stats/*), which is why you will not see a request to a third-party analytics host. It sets no cookies, stores nothing on your device, does not track you across websites and builds no profile of you. It reads no settings from your device: the language comes from the header your browser sends with every request, and the device class from the browser identification in the same request. The measurement script sends only the address of the page you opened, the referring page, the page title and, for clicks, the position on the page. Your IP address and browser signature are used only for a moment (to derive your country and a pseudonymous visitor hash that changes every day) and are then discarded; the IP address itself is never stored. There is no analytics provider and no third party involved: the measurements are written to our own database, which is hosted with Cloudflare, Inc. under the agreement described in section 4.1 above, and they are passed to no one else.

What we record: page views, the referring site, country, device class and browser, page performance timings, and how the site is used (searches typed into our search box, filters used, product clicks, items added to the cart, checkout starts, completed checkout steps, selected checkout options, broad error categories, active time on checkout, and completed purchases with the order amount and currency). What we never record: what you type into checkout fields, your name, email address, postal address, member ID or order number. The address of the order confirmation page does contain an internal reference to your order, so a visit can be connected to the order it led to on the same day; we use this only to see which parts of the shop lead to purchases.

How long: detailed records are kept for 13 months. After that the visitor hash, city, click positions and order reference are removed, and the rest is deleted after 25 months. Only anonymous totals (for example visitors per day and country) are kept longer.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving how our site is used). Nothing is stored on your device and no identifier is set. We do not ask for consent for this limited processing; we consider it permissible without consent under § 25 Abs. 2 TDDDG. This measurement runs regardless of your cookie choices.

If you would rather not be counted, you can stop it here: The same link sits in Privacy settings, under Usage measurement. Choosing it saves one setting in this browser, df_no_stats, which exists only to carry out your choice, so it applies to this browser on this device.

These are only saved to your browser after you accept them via our cookie banner or Privacy settings. You can change or withdraw your consent at any time.

Legal basis: § 25 Abs. 1 TDDDG; Art. 6(1)(a) GDPR (consent).

You can manage your cookie preferences at any time: open privacy settings here, or use the privacy settings link in the footer of our website.

You can also delete cookies through your browser settings.

You may withdraw your consent to non-essential cookies at any time with future effect by adjusting your privacy settings.

Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

For questions about our use of cookies, please contact: info@diabolofocus.com

Press Tab to accept the suggested completion.

    Language, delivery & currency

    Language

    Deliver to