Privacy Policy
This policy explains what happens to your data when you visit this site or place an order. It replaces the previous version of 12 December 2019, which referred to a store domain that no longer exists.
Controller
Merchism — Ismail Tüfekci und Jens Moelle GbR, Elebeken 4, 22299 Hamburg, Germany. Contact: merchism@thedigitalism.com
What we process, and why
| Purpose | Data | Legal basis |
|---|---|---|
| Delivering the website | IP address, browser, time of request | Art. 6 (1) (f) GDPR — legitimate interest in a working, secure site |
| Order processing | Name, email, delivery address, order contents | Art. 6 (1) (b) GDPR — performance of a contract |
| Payment | Payment data, processed by the payment provider | Art. 6 (1) (b) GDPR |
| Newsletter and city alerts | Email address, city of interest | Art. 6 (1) (a) GDPR — consent, double opt-in |
| Statutory retention | Invoice data | Art. 6 (1) (c) GDPR — §§ 147 AO, 257 HGB |
Processors and recipients
| Service | Role | Location |
|---|---|---|
| Vercel Inc. | Hosting and delivery of this site | EU / USA |
| Grafko-Caspar d.o.o. (CasparCreate) | Production and dispatch, EU and rest of world | Croatia |
| Fourthwall Inc. | Store, payment and dispatch for US, CA, MX, JP, AU — acting as merchant of record, i.e. as an independent controller for those orders | USA |
| Stripe Payments Europe Ltd. | Payment processing for EU orders | Ireland / USA |
| Intuit Mailchimp | Newsletter and city alerts | USA |
| Spotify AB | Embedded player on the listen and city pages | Sweden / USA |
Where a processor is located outside the EU, the transfer is based on the EU standard contractual clauses or, where applicable, an adequacy decision of the European Commission.
The mailing list
When you sign up for tour alerts, your email address goes directly from your browser to Mailchimp. We also send the city you picked and the two-letter country code of your request, so we can tell you about shows near you instead of all of them. Nothing else is transmitted, and we do not store the address anywhere but Mailchimp.
Sign-up uses double opt-in: Mailchimp sends you one confirmation email and you are only added once you click the link in it. Until you do, nothing is sent to you. The legal basis is your consent under Art. 6 (1) (a) GDPR, and you can withdraw it at any time — every email carries an unsubscribe link, and withdrawal has no consequences beyond ending the emails.
Mailchimp measures whether emails are opened and which links are clicked, which is how we know what is worth sending. If you would rather not be measured, do not sign up — we have no way to switch it off for a single address.
Fonts and embeds
All webfonts are served from this domain. No connection to Google Fonts is opened.
The Spotify player is an embed. It only loads when the page is opened and can set cookies on Spotify's side once you interact with it. Spotify is the controller for that processing; see Spotify's privacy policy.
Storage on your device
We set no tracking cookies and run no analytics. The store keeps your basket in your browser's local storage so it survives a trip to the shipping or withdrawal page. It holds only colour, size and quantity, never a name or an address, it stays on your device, and it expires after 30 minutes. This is storage strictly necessary to provide the service you asked for and therefore requires no consent under § 25 (2) no. 2 TTDSG. Clearing your browser data removes it.
The store asks a function on this domain which country your request came from, so it can show the right currency and the right size chart. The answer is the two-letter country code and nothing else. It is not stored and not logged.
Retention
Order and invoice data are retained for the statutory periods of six and ten years. Newsletter data are deleted when you unsubscribe. Server logs are deleted after seven days.
Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future.
You also have the right to lodge a complaint with a supervisory authority, for example Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit.