Privacy Policy

1. Who we are

Eychgras is a slow-frequency editorial publication operated by Eychgras UG (haftungsbeschränkt), a limited-liability company registered in Berlin, Germany.

Registered office: Kreuzbergstraße 71, 10965 Berlin, Germany · Register: HRB 267,441 B (Amtsgericht Charlottenburg) · Managing director: Maren Solvik · VAT ID: DE 342 189 007 · Email: [email protected].

Under Article 4(7) of the General Data Protection Regulation (EU) 2016/679 (GDPR), Eychgras UG is the "controller" for personal data processed on this website and in the shop.

2. What data we collect and why

2.1 When you just read the site

Reading Eychgras does not require an account. We do not use tracking cookies for reading, we do not embed third-party social widgets on article pages, and we do not use fingerprinting. Your browser makes standard HTTP requests to our server, which are logged by our hosting provider for 14 days for security purposes. These logs contain: your IP address (truncated after 24 hours), the URL you requested, the timestamp, the HTTP response code, your user-agent string, and the referring page (if any).

Legal basis: Article 6(1)(f) GDPR — legitimate interest in operating and securing the website.

2.2 When you subscribe to the newsletter

We collect the email address you provide. We use a double opt-in flow: your email is only added to the list after you click a confirmation link. We store your email address, the date and IP address of your subscription (for compliance), and — if you tell us — your first name.

Legal basis: Article 6(1)(a) GDPR — your consent. You can withdraw consent at any time by clicking the "unsubscribe" link in any letter, or by writing to [email protected].

2.3 When you place an order

To ship a physical product, we need: your name, delivery address, email, and payment details. Payment details are handled by our payment processor (Stripe Payments Europe, Ltd.) and never touch our own servers. We store your order record (items, prices, addresses, order date) for the ten-year period required by German commercial and tax law (§ 147 AO, § 257 HGB).

Legal basis: Article 6(1)(b) GDPR — performance of a contract to which you are party; and Article 6(1)(c) GDPR — legal obligation to retain accounting records.

2.4 When you write to us

Your name, email, and the content of your message are stored in our support inbox for as long as needed to respond and, where relevant, to demonstrate that we did respond. Correspondence is retained for a maximum of three years unless it forms part of a contractual relationship.

Legal basis: Article 6(1)(b) or (f) GDPR — contract performance or legitimate interest in handling correspondence.

3. Cookies and local storage

We use exactly three categories of client-side storage:

• Strictly necessary — a single "eychgras_cart_v1" entry in localStorage that remembers what is in your cart between page loads. Deleted when you clear site data.
• Preference — an "eychgras_cookie" flag that records whether you accepted or declined the analytics banner, so we do not ask again.
• Analytics (optional) — a first-party aggregated counter for page views, only activated after you accept the banner. It does not use cross-site tracking and does not share data with any third party.

See the full Cookie policy for the technical details and a per-cookie list.

4. Who else touches your data

We use a short list of processors, all of them contracted under Article 28 GDPR:

• Hetzner Online GmbH (Gunzenhausen, Germany) — hosting our servers. Data stays in the EU.
• Stripe Payments Europe, Ltd. (Dublin, Ireland) — payment processing. See Stripe's privacy notice.
• DHL Paket GmbH (Bonn, Germany) — delivery. Receives your name, address, and (for parcel tracking) email.
• Fastmail Pty Ltd. (Melbourne, Australia) — email for [email protected]. Fastmail participates in the EU Standard Contractual Clauses framework.
• Buttondown (Portland, OR, USA) — newsletter delivery. Data transfer is governed by the EU–US Data Privacy Framework and by Standard Contractual Clauses.

We do not sell personal data. We do not "share" personal data with anyone else, in the sense used by any current privacy law.

5. Your rights

Under Articles 15–22 of the GDPR you have the right to:

• ask for a copy of the personal data we hold about you (Article 15);
• correct data that is wrong (Article 16);
• delete data that we do not have a legal obligation to keep (Article 17);
• restrict processing while we deal with a dispute (Article 18);
• receive your data in a portable format (Article 20);
• object to processing based on legitimate interest, including profiling (Article 21);
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3)).

To exercise any of these, write to [email protected]. We answer within 30 days. If you are not satisfied with our answer, you may complain to a supervisory authority — for us, that is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

6. Security

The website is served exclusively over HTTPS (TLS 1.3). Card details are tokenised by Stripe and never reach our systems. Backups are encrypted at rest with AES-256. Only two named individuals have production-database access, both under contractual confidentiality.

We keep our incident-response procedure simple: if a breach is likely to result in a risk to the rights or freedoms of natural persons, we notify the supervisory authority within 72 hours (Article 33 GDPR) and, where the risk is high, we notify affected users directly (Article 34).

7. Children

Eychgras is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided personal data, please contact us and we will delete it.

8. Changes to this policy

When we change this policy we update the "last updated" date at the top of the page and, for material changes, notify newsletter subscribers in a dedicated letter at least 14 days before the change takes effect.

9. Contact

For anything on this page:

Eychgras UG (haftungsbeschränkt)
Kreuzbergstraße 71
10965 Berlin, Germany
Email: [email protected]