Privacy policy

Last updated: 23 May 2026

1. Controller

The controller responsible for the processing of personal data on this website is:

Merch-Forge
Sole proprietorship
Am Gießenbach 13
82496 Oberau
Germany
merch-forge@outlook.com
Email address for data protection inquiries: merch-forge@outlook.com

2. Data Protection Officer

We have not appointed a Data Protection Officer. Based on the current circumstances, there is no obligation to appoint a Data Protection Officer under Article 37 GDPR and Section 38(1) of the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).

If an obligation to appoint a Data Protection Officer arises in the future, this Privacy Policy will be updated accordingly.

3. General Information on Data Processing

We process personal data only to the extent necessary to provide this website, handle inquiries, take pre-contractual steps, fulfil contractual obligations or protect legitimate interests.

Personal data means any information relating to an identified or identifiable natural person. This may include, in particular, names, email addresses, IP addresses, communication content and technical access data.

Processing is carried out in particular on the basis of:

  • Article 6(1)(b) GDPR, where processing is necessary for handling inquiries, taking pre-contractual steps or performing a contract;
  • Article 6(1)(f) GDPR, where processing is necessary to protect our legitimate interests, for example in the secure and functional operation of the website;
  • Article 6(1)(c) GDPR, where statutory retention or documentation obligations apply.

Automated decision-making, including profiling, does not take place.

4. Hosting and Server Log Files

This website is hosted by The current server is located in the Netherlands.

When this website is accessed, the hosting provider may automatically process technical access data. This may include, in particular:

  • IP address of the requesting device
  • date and time of access
  • page or file accessed
  • amount of data transferred
  • referrer URL
  • browser type and browser version
  • operating system used
  • HTTP status code
  • technical connection data

This data is processed in order to make the website technically available, ensure system security, detect misuse and maintain the stability of the website.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional operation of the website.

Where the hosting provider processes personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Article 28(3) GDPR.

The retention period for server log files is 30 days.

5. Contact form

We provide a contact form on our website. Interested parties can use this form to contact us and submit a project inquiry.

The following data is collected through the contact form:

  • email address, mandatory field
  • message, mandatory field
  • name, optional field
  • brand name (Twitch username), optional field

The data entered is transmitted via EmailJS to our business email merch-forge@outlook.com. In addition, we store the email address and the information voluntarily provided by the user locally in order to process inquiries and document a potential business relationship.

The processing is carried out for the following purposes:

  • handling the inquiry
  • contacting the person making the inquiry
  • assessing a potential collaboration
  • preparing offers
  • taking pre-contractual steps
  • managing ongoing or potential business relationships

The legal basis is Article 6(1)(b) GDPR, where processing is necessary to handle the inquiry or take pre-contractual steps.

Where we store inquiries for the organisation, documentation and traceability of our business communication, processing is additionally carried out on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in maintaining orderly business communication and ensuring the traceability of inquiries.

If no business relationship is established, we delete the inquiry and the data stored in connection with it no later than 6 months after the communication has been completed, unless statutory retention obligations or legitimate reasons for longer storage apply.

If a business relationship is established, we store the data for the duration of the business relationship. After that, the data will be deleted unless statutory retention obligations apply. Statutory retention obligations may arise in particular from Section 147 of the German Fiscal Code (Abgabenordnung – AO) and, where applicable, Section 257 of the German Commercial Code (Handelsgesetzbuch – HGB).

6. Use of EmailJS

We use the service EmailJS for the technical transmission of contact form inquiries.

Provider:
EmailJS Pte. Ltd.

The data entered in the contact form is processed via EmailJS, in particular:

  • email address
  • message
  • name, if provided
  • brand name, if provided
  • technical metadata, where such data is generated during transmission

EmailJS states in its Privacy Policy that it stores inquiry data and request metadata. EmailJS also states that IP logs are not permanently stored by default, but that temporary IP logs may be used to combat abuse and fraud.

EmailJS is used for the purpose of technically transmitting contact form inquiries to us. The legal basis is Article 6(1)(b) GDPR, where transmission is necessary to handle an inquiry or take pre-contractual steps. Where processing serves the technical provision and security of the service, it is additionally based on Article 6(1)(f) GDPR.

EmailJS may process personal data outside the European Union or the European Economic Area. EmailJS states that personal data of users and end users may be transferred to the United States, including to AWS as the primary processing location. EmailJS also lists subprocessors with a registered office or location in the United States, including Amazon Web Services, Cloudflare, Sentry and others.

Where personal data is transferred to third countries, this is carried out in accordance with Articles 44 et seq. GDPR. EmailJS states that, for transfers to the United States, it uses either an adequate level of protection recognised by the European Commission or Standard Contractual Clauses.

Where EmailJS processes personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Article 28(3) GDPR.

7. Local Storage of Inquiries

When we receive an inquiry through the contact form, we additionally store the information transmitted by the person making the inquiry locally in an Excel file on a business-used computer.

This local storage is used to organise inquiries, track potential collaborations and document business communication in a traceable manner.

The legal basis is Article 6(1)(b) GDPR, where storage is necessary for taking pre-contractual steps or performing a contract. In addition, Article 6(1)(f) GDPR may apply. Our legitimate interest lies in the orderly management of business inquiries.

We take appropriate technical and organisational measures to protect the stored data. These include, in particular, access protection for the computer used and restricted access to the data.

8. Google Fonts

We currently use fonts from Google Fonts on our website. The fonts are integrated through external Google servers.

Provider for users in the European region:
Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

When our website is accessed, the user’s browser loads the required fonts from Google servers. In this process, Google may receive in particular the following data:

  • user’s IP address
  • requested URL on the Google server
  • HTTP headers, including the user agent
  • referrer, meaning the website on which the font is to be displayed

Google states that Google Fonts does not set or log cookies and that the information received through Google Fonts is not used to create user profiles or for targeted advertising.

Google Fonts is used for the purpose of providing a consistent and visually appealing presentation of our website. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the technically stable and visually consistent presentation of our online offering.

9. Cookies and Similar Technologies

According to the current status, we do not use our own analytics, tracking or marketing cookies.

According to the current status, our website does not contain any custom code that sets cookies for analytics, advertising or tracking purposes. The only functional integration concerns the contact form via EmailJS and the external integration of Google Fonts.

Where technically necessary cookies or comparable technologies are used by the hosting provider or by technically required services, this is done exclusively for the provision and security of the website.

For the storage of information on the user’s terminal equipment or access to information stored on the user’s terminal equipment, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG) is generally relevant. Consent is not required under Section 25(2) TDDDG if the storage or access is strictly necessary in order to provide a digital service expressly requested by the user.

If we use analytics, tracking, marketing or other non-essential cookies in the future, we will obtain the required consent in advance and update this Privacy Policy accordingly.

10. No Analytics or Marketing Services

According to the current status, we do not use analytics or marketing services such as:

  • Google Analytics
  • Meta Pixel
  • TikTok Pixel
  • Google Tag Manager
  • Hotjar
  • Microsoft Clarity
  • newsletter tracking
  • advertising retargeting

If such services are used in the future, this Privacy Policy will be updated accordingly and, where required, consent will be obtained.

11. Recipients of Personal Data

Depending on the use of the website, recipients of personal data may include:

  • 24Fire as hosting provider
  • EmailJS Pte. Ltd. for the transmission of contact form inquiries
  • Google Ireland Limited in connection with the external integration of Google Fonts
  • our own local storage on the business-used computer

Personal data is not transferred to other recipients unless this is necessary to handle the inquiry, perform a contract, fulfil legal obligations or protect legitimate interests.

12. Transfers to Third Countries

Personal data may be transferred to countries outside the European Union or the European Economic Area, in particular when EmailJS and Google Fonts are used.

Where personal data is transferred to a third country, this is carried out only in accordance with Articles 44 et seq. GDPR. A transfer to a third country is only permitted if the requirements of Chapter V GDPR are met.

According to the provider, EmailJS may transfer personal data to the United States. EmailJS states that it uses an adequate level of protection or Standard Contractual Clauses for this purpose.

When Google Fonts is integrated externally, a connection to Google servers may be established. According to Google, Google receives in particular the IP address, the requested URL and technical header data.

13. Retention Period

We store personal data only for as long as necessary for the respective purposes.

For contact inquiries, the following applies:

  • If no business relationship is established, we delete the inquiry and the data stored in connection with it no later than 6 months after the communication has been completed.
  • If a business relationship is established, we store the data for the duration of the business relationship.
  • After the end of the business relationship, we delete the data unless statutory retention obligations apply.

Where statutory retention obligations apply, data may be stored for a longer period. Such obligations may arise in particular from Section 147 AO and, where applicable, Section 257 HGB.

14. Data Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.

These measures include, in particular:

  • access restrictions for business data
  • local storage only on business-used devices
  • protection of the computer used through appropriate access safeguards
  • limitation of collected data to what is necessary
  • use of HTTPS, where provided by the hosting provider

The obligation to ensure appropriate security of processing arises from Article 32(1) GDPR. Under this provision, controllers and processors must ensure a level of security appropriate to the risk.

15. Rights of Data Subjects

Data subjects have the following rights under the GDPR:

  • right of access under Article 15 GDPR
  • right to rectification under Article 16 GDPR
  • right to erasure under Article 17 GDPR
  • right to restriction of processing under Article 18 GDPR
  • right to data portability under Article 20 GDPR
  • right to object under Article 21 GDPR
  • right to withdraw consent under Article 7(3) GDPR, where processing is based on consent
  • right to lodge a complaint with a supervisory authority under Article 77(1) GDPR

The right to lodge a complaint may be exercised in particular with a supervisory authority in the Member State of the data subject’s habitual residence, place of work or place of the alleged infringement.

To exercise these rights, a message may be sent to the following email address:
merch-forge@outlook.com

16. Obligation to Provide Personal Data

The provision of personal data through the contact form is neither legally nor contractually required.

However, in order to process an inquiry, we need at least an email address and a message. Without this information, we cannot process or respond to the inquiry.

17. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy if our website, the services used, the data processing activities or the legal requirements change.