Privacy

1. Controller

The controller for data processing on this website is Johnna Golly, Wentruper Weg 17, 48268 Greven, Germany, email: info@golly-software.de. Full details are in the imprint.

2. In short

We only process the data we need for the shop. There are no tracking, analytics or advertising services and no social media plugins. Fonts and all other content are loaded from our own server; visiting the site creates no connection to Google or other providers. We use service providers for hosting (Hetzner), for sending emails and our mailbox (IONOS) and, once sales start, for payment (Stripe).

3. Hosting and logs

The website, database and files are hosted on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the Nuremberg data centre. A data processing agreement (Art. 28 GDPR) is in place with the provider.

We do not log visits to the website: the server stores neither your IP address nor the page requested or your browser. When you visit, the server uses your IP address to deliver the page. To prevent abuse, it counts requests and failed sign-ins per IP address in working memory, not in a file or database; these counters expire after 24 hours at the latest. For troubleshooting there are technical logs without IP addresses: the web server log is deleted after seven days, the application log is limited in size and older entries are overwritten. This is necessary for secure and stable operation (Art. 6(1)(f) GDPR).

Before every update of the website we create a backup copy of the database and files on the same server so that we can return to the previous state if something goes wrong (Art. 6(1)(f) GDPR). These copies contain the same data as the shop. Copies older than 30 days are deleted automatically; only the two most recent are always kept until newer ones are created.

4. Orders and payment

For an order we process your email address, the patterns ordered, prices, payment status and invoice number (Art. 6(1)(b) GDPR, performance of a contract). We also ask for the country where you live, because we only sell to certain countries and VAT depends on it (Art. 6(1)(b) and (c) GDPR). We keep invoices for eight years due to legal obligations (§ 147 AO, § 14b UStG; Art. 6(1)(c) GDPR), counted from the end of the calendar year in which the invoice was issued. After that we automatically delete the order with all related details. Orders that were not paid (for example cancelled payments) are deleted after 30 days.

We use Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland, to process your payment (Art. 6(1)(b) GDPR). To pay, you move to Stripe Checkout; the privacy information for Stripe and your chosen payment method also applies there. You enter card or bank details in the provider's payment flow. We receive the payment status and transaction reference. Stripe may also process data for its own purposes, for example to meet its legal obligations. For transfers to Stripe, LLC in the US that are covered by the EU-US Data Privacy Framework, Stripe relies on the European Commission's adequacy decision. More: https://stripe.com/privacy

As long as all patterns are marked “coming soon”, they cannot be bought and we do not process any payments through Stripe.

After payment you receive the download link by email. We store which files you have bought so that you can download them again, for as long as we keep the order (see above).

As evidence relating to your right of withdrawal, we store with your order when you agreed to the two declarations in the checkout and in which text version, when we sent you the order confirmation and when you first downloaded a file. We do not store an IP address for this (Art. 6(1)(c) and (f) GDPR). We keep this information together with the order.

We need your email address to process and deliver your order and your country of residence. Without them, you cannot complete your purchase. For a made-to-measure pattern, we also need the measurements and figure details requested. An account, saving details for later orders and subscribing to the newsletter are optional.

When you use “Withdraw from contract here”, we process your name, contract details, notice, time of receipt and email address to receive and acknowledge your withdrawal (Art. 6(1)(c) GDPR and section 356a of the German Civil Code). We process the order and payment details required for your refund. We keep this information together with the order.

5. Customer account

A customer account is optional; you can also order without one. For the account we store your email address, password (only as a password hash), language, and the time of registration and last sign-in (Art. 6(1)(b) GDPR). You confirm your email address via a link. You can delete your account yourself at any time under “Account”; we keep orders and invoices for as long as we are legally required to. If you don't sign in for three years, we remind you by email; if you then don't sign in within 30 days, we delete the account and the measurements saved in it.

6. Made to measure: body measurements

When you order a made-to-measure pattern, we process the body measurements you enter to calculate your personal pattern (Art. 6(1)(b) GDPR). The calculation runs on our own server, and the measurements are not passed on to third parties. They are stored with the order and deleted two years after the order so that we can recalculate the pattern if there is an error. The finished made-to-measure pattern remains available in your download.

With a customer account you can also save your measurements to reuse them for further made-to-measure patterns (Art. 6(1)(a) GDPR, consent). You can change or delete them at any time under “My measurements”; deleting them withdraws your consent for this measurement profile. Measurements in an existing order follow the two-year period above.

7. Pattern testing

By applying as a pattern tester, you ask us to consider you for a call. For this we process your name, email address and the details about sewing experience and clothing size needed for selection (the size you usually buy; we do not ask for body measurements or details about your figure). If you take part, we process your feedback and administer your discount under the testing terms (Art. 6(1)(b) GDPR). We only use optional details such as your Instagram name or a message for selection. Our hosting and email providers (sections 3 and 11) support this; we do not otherwise share the data.

You send us your feedback and, if you like, up to 6 photos via your personal page, which you reach through a link in the email we send when we unlock the pattern for you (no customer account needed). Anyone who has the link can open the page, so please don't share it. Feedback and photos are stored on our server at Hetzner (section 3); for new feedback we only receive a notice by email without its content. We process the feedback to carry out the pattern testing (Art. 6(1)(b) GDPR).

Photos are optional; you can take part and receive the discount without them. You may photograph the garment without wearing it and pixelate or cover yourself. When uploading, you confirm that you took the photos yourself or are allowed to pass them on. We re-save every photo and remove all embedded metadata such as location, time of capture and camera model. We only use uploaded photos with your consent (in the application form or on your page) and only internally to assess fit and improve the pattern (Art. 6(1)(a) GDPR). You withdraw this consent by deleting the photos on your page or by writing to us.

We only show a photo on the publicly accessible product page of the pattern if you have released that specific photo on your page (Art. 6(1)(a) GDPR), and only without your name. The release is voluntary and has no effect on your participation or your discount. As evidence, we store which photo you released, when and with which wording. We choose which released photos we show. You can withdraw the release for each photo individually at any time with effect for the future by unticking it on your page or deleting the photo; the photo then disappears from the website immediately, including at its direct image address. For publication on Instagram or other channels we will ask you separately.

Photos we don't show on the product page and your feedback are deleted automatically once the pattern has been released and your test is completed, at the latest 12 months after upload or after your feedback. Photos we show with your release remain stored until you withdraw the release or we permanently withdraw the pattern from our range; for that period we also keep the evidence of the release as well as your name, email address and the link to your page, so that you can withdraw the release at any time (Art. 6(1)(c) and (f) GDPR). If feedback or photos exceptionally arrive by email, they are kept in our mailbox at IONOS (section 11) and deleted under the same periods.

Three months after a call ends (application deadline, feedback deadline or closing of the call, whichever is later) we delete the application record automatically, subject to the following exceptions for ongoing tests and discounts. Feedback and photos follow the separate periods stated above. If you are a tester with a valid discount, we only keep your name, email address and the date until which the discount applies (Art. 6(1)(b) GDPR); all other details of the application record are deleted. Once the discount has expired, we delete these details as well. If you have been selected and your test is not yet completed, we likewise only keep your name and email address so that your claim to the discount is preserved, for at most 12 months after the call ends. On request we delete your size details immediately at any time; your discount is not affected.

8. Reviews

If you have bought a pattern, you can review it with a customer account. Stars, text and the display name you choose are publicly visible; your email address is not (Art. 6(1)(a) GDPR). You can edit or delete your review yourself at any time, which withdraws your consent to publication. It stays public until you delete it or your account is deleted; deleting the account also deletes your reviews.

9. Contact form and email

If you write to us via the contact form or by email, we process your name, email address and the content of your message in order to reply. We use enquiries about a contract or a contract you are considering to deal with that request (Art. 6(1)(b) GDPR). For other correspondence we rely on our legitimate interest in responding (Art. 6(1)(f) GDPR). We delete the message once the request is resolved and no retention obligations apply.

10. Newsletter

We send the newsletter with your consent (Art. 6(1)(a) GDPR). Sign-up uses a double opt-in: you only receive the newsletter after clicking the confirmation link. You can unsubscribe using the link in every message. We record the wording you agreed to, your email address and when you signed up and confirmed. Once you unsubscribe, we stop sending the newsletter. We keep the record for another three years so that we can demonstrate lawful sign-up if a dispute arises (Art. 6(1)(f) GDPR). We delete unconfirmed sign-ups after 30 days.

11. Sending emails

We send order confirmations, download links, account emails and the newsletter via IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Our mailbox, where messages to us arrive, is also hosted there. A data processing agreement (Art. 28 GDPR) is in place with the provider.

12. Cookies and browser storage

We do not use tracking or advertising cookies and no consent banner. On your device we only store what is strictly necessary for a function you request (§ 25(2) no. 2 TDDDG), and “keep me signed in” only if you choose it (§ 25(1) TDDDG):

When you add a pattern to the cart, we store the cart “linje.cart” on your device for this session only (session storage); for a made-to-measure pattern it includes the measurements you enter. The page address determines the language; if you switch it, we also remember it as “linje.lang” for the session only. Signing in sets the session cookie “linje.customer”. If you select “Keep me signed in on this device for up to 60 days”, you consent to a longer-lasting sign-in cookie; signing out ends this storage. “linje.admin” is only set when signing in to the shop administration (up to 14 days); the administration sign-in page also sets a security cookie against forged form requests (“.AspNetCore.Antiforgery…”, session only). The shop pages themselves set no cookies unless you sign in. Related personal data is processed under Art. 6(1)(b) GDPR, “keep me signed in” under (a).

13. Recipients

We only share data where necessary for the purposes described: with our hosting provider Hetzner, with IONOS for sending emails and our mailbox (which also holds messages sent to us by email) and, once sales start, with Stripe for payment. Only reviews (section 8) and pattern-testing photos you have released for the product page and that we show there, without your name (section 7), are publicly visible. We do not sell data and do not use it for third-party advertising.

14. Your right to object

Where we rely on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop unless we show compelling overriding grounds or need the data for legal claims. You may object to direct marketing at any time without giving reasons. Contact info@golly-software.de.

15. Your other rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR), and the right to withdraw consent at any time (Art. 7(3) GDPR). This does not affect the lawfulness of processing before withdrawal. Just write to us at info@golly-software.de.

You may also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Postfach 20 04 44, 40102 Düsseldorf, Germany.

16. Last updated

This privacy policy applies from 2 November 2026.