← Back to home page

Privacy Policy

Convenience translation. This English version is provided for information only. Only the German version is legally binding: Datenschutzerklärung.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Echo Studios GbR
represented by its partners Liam Sielaff, Felix Fischer and Alois Sandmaier
Eschenweg 10
88376 Königseggwald
Germany
Email: business@echo-studios.de
Phone: +49 174 8596209

2. General information on data processing

We only process personal data of our users to the extent necessary to provide a functional website and our content and services. As a rule, processing only takes place with the user’s consent or where permitted by law (in particular Art. 6 GDPR).

3. Hosting and server log files

This website is operated by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). The server functions that process your request run in the Frankfurt am Main data centre. When you visit the website, the hosting provider automatically collects information that your browser transmits (server log files):

The legal basis is Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically error-free presentation and security of our website. This data is not merged with other data sources and is automatically deleted after a short time. Processing by Vercel is based on the data processing addendum that forms part of Vercel’s terms of use (Art. 28 GDPR).

4. Request form, product configurator and file uploads

If you contact us via the request form, we process the information you provide: first and last name, organisation, email address, optionally phone number, address and delivery country, product of interest, desired quantity, your description and the language of the page from which you send the request (German or English), so that we can reply in that language. If you upload logo or design files, we also process these files. Mandatory fields are first and last name, organisation, email address, product and quantity; all other information is voluntary. Without the mandatory information we cannot prepare a quote. Our offer is aimed exclusively at businesses, clubs and organisations.

On the product pages you can put your product together in the configurator (colour, quantity, sizes, print areas, finishing) and place a logo on the product photo. As long as you do not send the request, your logo and configuration remain exclusively in your browser; nothing is transmitted to us. Only when you send the request do we receive your configuration, the uploaded logo files and a preview image generated from them (your design on the product photo). The price shown in the configurator is a non-binding guide price; no automated decision within the meaning of Art. 22 GDPR takes place.

In the form you can voluntarily tell us how you found us. When you send the request, we also transmit, if present, the campaign identifier from the address you opened (e.g. “utm_source”) and the name of the website from which you came to us (e.g. google.com). This information is only read when you send the request. No cookies are set for this and no information is stored in your browser. We store it together with your request and use it to evaluate through which channels requests reach us. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is to align our advertising and our website economically. The information is deleted together with the request.

This information is stored in a database of Supabase Inc. (server location Ireland, EU) and created as a request in our internal order management so that we can send you a quote with a mockup. We send the notification to our mailbox and the confirmation of receipt to you via the email delivery service Resend (see section 6).

Uploaded files are kept in a storage area that is not publicly accessible. They can only be accessed via time-limited, signed links that we generate to process your request.

AI-assisted preparation of our reply. So that we can answer your request within the promised 48 hours, we have a draft of our reply email prepared by the AI service Claude of Anthropic, PBC (USA); the contracting party for businesses in the European Economic Area is Anthropic Ireland, Limited. For this purpose we transmit only the product, colour, quantity, sizes, print areas, the price we have calculated, the language of the request and your description. We do not transmit your name, organisation, email address, phone number, address, links or uploaded files; before transmission we automatically replace the names from your form entries as well as email addresses, phone numbers, links and addresses in your description with placeholders; other names you write into the description may remain. The service does not calculate prices. Every draft is checked by us, changed where necessary and only then sent by us; the service sends nothing and decides nothing. Anthropic processes the data as a processor (Art. 28 GDPR) under its data processing terms, does not use it to train its models and, under its current terms, deletes it after no more than 30 days. The transfer to the USA is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in handling requests quickly and consistently. You may object to this processing at any time (Art. 21 GDPR), most simply by email to business@echo-studios.de; we will then handle your requests without AI assistance.

Emails and messages sent to us directly. If you send us a request or a message about an ongoing quote or order by email or through another channel (for example messengers or social networks), we transfer it to our order system. So that we can prepare the quote, a mockup draft and our reply promptly, we send the full text of your message, including any names and contact details it contains, to the AI service Claude named above; incoming business emails are first categorised for this purpose (for example request, question, change, order), and we exclude automatically sent messages beforehand. The service extracts your contact details and your requirements (for example product, colour, quantity, sizes, print position and design wishes) and prepares a draft reply. We do not send attached files such as logos to the service; we use them only in our own systems for the mockup. The service does not calculate prices. We review every proposal, change it if necessary and only then use it; the service sends nothing and decides nothing. The previous paragraph applies to processing on our behalf, training, retention by the service and the transfer to the USA. The legal basis is Art. 6(1)(b) GDPR (handling your request as a pre-contractual step) and Art. 6(1)(f) GDPR (prompt, consistent handling). You can object to processing by the AI service at any time (Art. 21 GDPR), most easily by email to business@echo-studios.de; we will then handle your requests without AI support.

The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures taken at your request). We delete requests that do not lead to an order no later than twelve months after the last contact; we delete uploaded files at the same time. If an order is placed, we retain the order and invoice data in accordance with the retention periods of German commercial and tax law (§ 147 AO, § 14b UStG, § 257 HGB): invoices and other accounting records for eight years, quotes, order confirmations and business correspondence for six years, in each case calculated from the end of the calendar year in which they were created. The legal basis for this is Art. 6 (1) (c) GDPR. After these periods have expired, we delete the data unless it is required for ongoing tax proceedings (§ 147 (3) sentence 5 AO).

5. Order processing and production

If you place an order with us, we pass on the data required for production and shipping to our production partner, in particular the delivery address, recipient name, items, sizes and your print file. Currently these are Tapstitch, Inc. (USA) with production sites in the USA and China and, for individual products, Printful (Printful Latvia AS, Latvia, or Printful Inc., USA) with production sites in the European Union and in third countries; depending on the product we may use other production partners (such as PODpartner, China). The quote states which partner produces your order. Processing therefore also takes place outside the European Union, in particular in the USA and China.

The legal basis is Art. 6 (1) (b) GDPR. Where standard contractual clauses of the European Commission have been agreed with the respective production partner, the transfer to a third country is based on them (Art. 46 (2) (c) GDPR); otherwise on Art. 49 (1) (b) GDPR, as it is necessary for the performance of the contract concluded with you. Without this transfer we cannot produce and ship your order.

For deliveries to countries outside the European Union, we or our production partner transmit the information required for customs clearance (name and address of the recipient, contents, value of the goods and, where the carrier requires it for delivery, phone number or email address) to the carrier and the competent customs authorities. The legal basis is Art. 6 (1) (b) and (c) GDPR; the transfer to the country of destination is based on Art. 49 (1) (b) GDPR.

Incoming invoices from our suppliers. Invoices, credit notes and payment receipts that suppliers and service providers send us by e-mail are stored unchanged in our non-public file storage. So that we can record them quickly, we transmit these documents (PDF or image), together with the subject line and an excerpt of the e-mail with contact details removed, to the AI service Claude named in section 4; it reads the supplier, date, invoice number, amounts and tax rate. The documents may contain names and business contact details of the supplier's contact persons. Nothing is booked automatically: we check every suggestion before it is entered in our accounts. Section 4 applies to processing on our behalf, training, storage period at the service and the transfer to the USA. The legal basis is Art. 6(1)(c) GDPR (record-keeping and retention obligations under Section 147 of the German Fiscal Code) and Art. 6(1)(f) GDPR (fast and accurate recording). We keep the documents for eight years.

6. Recipients of your data

We only pass on your data to the extent necessary to provide our service. We currently use:

Where providers are based in the USA, data is transferred on the basis of the European Commission’s standard contractual clauses pursuant to Art. 46 (2) (c) GDPR and, where applicable, on the basis of certification under the EU-US Data Privacy Framework.

7. Cookies, browser storage and audience measurement

This website does not set cookies for advertising or tracking purposes and does not embed any third-party content. In particular, no fonts are loaded from external servers; the fonts used are delivered from our own server or the system font on your device is used.

For audience measurement we use Vercel Web Analytics by Vercel Inc. No cookies are set and no cross-device identifiers are created. Only aggregated information such as the page visited, the referring page, device type and country is recorded. It is not possible to identify individual persons. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in a data-minimising statistical evaluation of our website.

In your browser’s storage (localStorage) we only keep what you choose yourself: the light or dark design (“echo-theme”) and, if you switch the language or close the note about the other language version, that choice (“echo-lang”). This information stays on your device, is not transmitted to us and contains no personal data. You can delete it at any time in your browser settings. This storage is strictly necessary for the display you have requested; under § 25 (2) no. 2 TDDDG no consent is required. We only use other storage in the browser to the extent technically necessary to operate the site.

8. Data security

We take technical and organisational measures pursuant to Art. 32 GDPR to protect your data against unauthorised access, loss and alteration. These include end-to-end encrypted transmission, personal login for access to our order management, non-public file storage with time-limited access links and restriction of access to named, authorised persons.

9. No automated decision-making

We use technical tools to prepare quotes, designs and draft replies, including an AI service (section 4). No automated decision within the meaning of Art. 22 GDPR that has legal effect on you takes place; every reply and every quote is checked and approved by us before it is sent.

10. Your rights as a data subject

Under the GDPR you have the following rights:

Please contact business@echo-studios.de. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

11. SSL/TLS encryption

For security reasons this site uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

Last updated: 20 October 2026