Skip to content
Both In Time

Privacy notice

Last reviewed: May 11, 2026

The German-language version of this notice (/de/datenschutz) is the legally binding version. This English version is provided for convenience.

1. Controller

Both In Time Jan Zajfert Gutenbergstraße 96 70197 Stuttgart hello@bothintime.com

2. Supervisory authority

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Lautenschlagerstraße 20, 70173 Stuttgart, Germany baden-wuerttemberg.datenschutz.de

3. What we process — at a glance

We process personal data only as needed to operate the website, fulfil contracts with you, or meet statutory obligations. We share data only with the processors listed below, all of whom we have data-processing agreements with.

Tax-relevant order data (invoices, line items, shipping records) we retain for ten years under § 257 HGB and § 147 AO. This statutory minimum overrides any shorter "delete on contract end" rule.

4. Hosting & CDN — Cloudflare Pages and Workers

The site is hosted on Cloudflare Pages; API calls (checkout, contact form, newsletter, Mollie webhook) run on Cloudflare Workers.

  • Data processed: IP address, HTTP method, path, timestamp, status code, user-agent. API endpoints additionally process request bodies (order data, form input).
  • Purpose: Serving the site; protecting against abuse; contract preparation and performance.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in availability and security); Art. 6(1)(b) GDPR (contract performance) for order endpoints.
  • Retention: 24–72 hours in Cloudflare edge logs; aggregated afterwards.
  • Third-country transfers: Cloudflare Inc. is US-based. Transfers rely on EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. DPA: cloudflare.com/cloudflare-customer-dpa.

5. Order database — Cloudflare D1

Orders are stored in Cloudflare D1.

  • Data processed: Name, shipping address, email, line items, payment status, timestamps.
  • Purpose: Contract performance, returns handling, statutory retention.
  • Legal basis: Art. 6(1)(b) GDPR (contract performance); Art. 6(1)(c) GDPR (statutory retention).
  • Retention: Invoice and order data for ten years (§ 257 HGB, § 147 AO).

6. Bot protection — Cloudflare Turnstile

Contact and order forms use Cloudflare Turnstile to block spam and automated requests.

  • Data processed: IP address, TLS fingerprint, browser signals, page origin. In the default configuration Turnstile sets no cookies and does not require consent under the TDDDG.
  • Purpose: Protection against bots and spam.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
  • Retention: Transient processing; aggregated signals feed Cloudflare's bot-detection model.
  • Third-country transfers: Cloudflare Inc., USA — as in section 4.

7. Reach measurement — Cloudflare Web Analytics

We measure reach via Cloudflare Web Analytics. The tool is cookieless, writes nothing to browser storage, and does not individualise visitors.

  • Data processed: Anonymous aggregate metrics (page views, top paths, source countries, referrers). No per-visitor tracking.
  • Purpose: Understanding which content is being read.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest). No consent required — no device identifiers are set.
  • Retention: 30 days at Cloudflare.

8. Payments — Mollie

Payments are processed by Mollie B.V.

  • Data processed: Name, email, IP address, billing and shipping address, payment-method data, transaction amount.
  • Purpose: Payment processing, fraud prevention, anti-money-laundering compliance.
  • Legal basis: Art. 6(1)(b) GDPR (contract performance); Art. 6(1)(c) GDPR (AML obligations); Art. 6(1)(f) GDPR (fraud prevention).
  • Location: Netherlands (EU). Privacy notice: mollie.com/en/privacy.
  • Retention: Typically five to seven years under Dutch AML law.

9. Workshop bookings

You book a workshop seat through a form on this website — not through an external booking service. The participation fee is paid at the time of booking (since 4 August 2026); the payment itself is handled by Mollie (section 8). We store your details in our Cloudflare D1 database (section 5). Once payment arrives we send you a booking confirmation with an invoice, and notify our own mailbox (section 12). No external booking provider receives this data; consent in the cookie banner is neither required nor possible for it.

  • Data processed: Name, email, chosen workshop, number of seats, amount paid and Mollie's payment reference; optionally phone number and a message.
  • Purpose: Reserving and running the workshop, processing payment, issuing the invoice.
  • Legal basis: Art. 6(1)(b) GDPR (performance of the participation contract); Art. 6(1)(c) GDPR (statutory duty to issue and retain invoices, § 14 UStG, § 147 AO).
  • Third-country transfers: None for storage — the database sits with Cloudflare (section 5). Section 8 covers the payment, section 12 the email delivery.
  • Retention: Invoice and booking data for ten years (§ 257 HGB, § 147 AO). Unpaid booking attempts are deleted once they are no longer needed for follow-up questions.

10. Error monitoring — Sentry

We use Sentry to detect software errors. PII in error payloads is scrubbed server-side (beforeSend): email, phone number, first and last name, address lines are stripped before the event reaches Sentry.

  • Data processed: Error stack trace, URL, browser and OS metadata. No form data, no order data and no order numbers.
  • Your IP address is not stored: we have not enabled the transmission of personal data in the Sentry SDK (sendDefaultPii), so Sentry neither infers nor stores your IP address. Server-side error monitoring sends no IP address in any case, because it assembles the report payload itself.
  • Purpose: Application reliability.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working application).
  • Third-country transfers: Sentry (Functional Software, Inc.) is US-based; transfers rely on EU SCCs and the EU-U.S. DPF. If our Sentry organisation is set to the EU region, data stays within the EU.
  • Retention: 90 days.
  • DPA: sentry.io/legal/dpa.

11. Audience measurement — PostHog

We use PostHog to understand how our shop is used — which pages are visited and where an order is abandoned. PostHog is loaded only after your explicit consent; if you decline or make no choice, the software is not even downloaded.

  • Data processed: pages visited, click events, referrer, browser and operating-system metadata, and a random device identifier in localStorage and a cookie (ph_*).
  • Your IP address is not stored: "Discard client IP data" is enabled in our PostHog project. Your IP is discarded server-side and never stored alongside the events; it is evaluated only transiently to derive the country of origin and to detect bots.
  • Purpose: audience measurement and improving the checkout flow.
  • Legal basis: Art. 6(1)(a) GDPR (consent), and § 25(1) TDDDG for the storage on your device. You can withdraw consent at any time via the privacy settings in the footer.
  • No session recording: session recording is disabled. We see no videos of your usage and no input into form fields.
  • No order numbers: order-status URLs are sanitised before transmission, so no order number reaches PostHog.
  • Third-country transfer: we use PostHog's EU region (Frankfurt); event data is processed within the European Union. Where PostHog, Inc. (USA) obtains access in the course of support, this is based on the EU standard contractual clauses.
  • Retention: twelve months at most.
  • DPA: posthog.com/dpa.

12. Transactional email — Resend

We use Resend to send order confirmations and shipping notifications, to forward messages from the contact form to our mailbox, to forward withdrawal declarations submitted through the withdrawal form, and to acknowledge workshop requests (section 9). We also use it for the newsletter confirmation email and the newsletter welcome email (section 13).

  • Data processed: Recipient email address, sending domain, email content (depending on the occasion this includes order details with name and address, the text of your contact enquiry, or the details of your withdrawal declaration including name, postal address and an optional reason), delivery metadata.
  • Purpose: Fulfilling the contractual duty to confirm the order, answering your enquiry, and processing your withdrawal.
  • Legal basis: Art. 6(1)(b) GDPR (contract performance). For the two newsletter emails: Art. 6(1)(a) GDPR (consent — see section 13).
  • Third-country transfers: Resend (Cypress, Inc.) is US-based; EU SCCs + EU-U.S. DPF. DPA: resend.com/legal/dpa. Subprocessors: resend.com/legal/subprocessors.
  • Retention: Customer data is deleted 90 days after contract termination.

13. Newsletter

If you subscribe to our newsletter, we store your details in our Cloudflare D1 database (see section 5).

We use the double opt-in procedure. After you submit the sign-up form we send you an email containing a confirmation link. Your consent counts as given, and you start receiving the newsletter, only once you click that link. If you do not click it, we send you no newsletter.

  • Data processed: Email address, chosen language, time of sign-up, time the confirmation email was sent, time of your confirmation, a random confirmation token and a random unsubscribe token.
  • Purpose: Sending the newsletter. The timestamps and tokens additionally serve as proof of your consent (Art. 7(1) GDPR) and operate the confirmation and unsubscribe links.
  • Legal basis: Art. 6(1)(a) GDPR (consent). You give that consent by ticking the checkbox on the sign-up form and then clicking the confirmation link in the confirmation email.
  • Withdrawing consent: You can withdraw at any time with effect for the future, via the unsubscribe link in every newsletter or informally by email to us.
  • Retention: Until you withdraw. We delete your details afterwards. Sign-ups that are never confirmed stay stored unused and receive no newsletter; you can ask us to delete them at any time (section 16).

14. Backups of the order database

The order database is backed up automatically once a day into Cloudflare R2 storage.

  • Data processed: The full contents of the orders table, meaning name, shipping and billing address, email address, optional phone number, order lines, payment status, and optional notes including gift messages.
  • Purpose: Being able to restore order data after a technical failure.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in working disaster recovery) together with Art. 32 GDPR (security of processing).
  • Place of processing: As for the other Cloudflare services, see section 4.
  • Retention: Backups are deleted automatically after 90 days. Tax-relevant order data is unaffected and remains subject to the periods in section 3.

15. Consent management — Klaro!

We manage your consent for PostHog and for error monitoring in your browser (section 10) using the open-source tool Klaro!.

Error monitoring on our server (Cloudflare Worker) does not require consent and is therefore not controlled by Klaro!: it processes only technical error data on the basis of Art. 6(1)(f) GDPR, and it runs even where no browser is involved at all — for example on a payment notification sent to us directly by the payment provider.

  • Data processed: Your consent choices are stored locally in your browser; nothing is transmitted to a server.
  • Purpose: Demonstrating consent under Art. 7 GDPR.
  • Legal basis: Art. 6(1)(c) GDPR (statutory obligation).

You can update your settings at any time via the "Cookie settings" link in the footer.

16. Your rights

You have the right to:

  • access the data we hold about you (Art. 15 GDPR),
  • have inaccurate data corrected (Art. 16 GDPR),
  • have data deleted (Art. 17 GDPR), unless statutory retention applies,
  • restrict processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • object to processing based on legitimate interest (Art. 21 GDPR),
  • withdraw consent at any time with effect for the future (Art. 7(3) GDPR),
  • lodge a complaint with a supervisory authority such as the Baden-Württemberg DPA named above (Art. 77 GDPR).

For any request, contact us at hello@bothintime.com.

17. Automated decisions and profiling

We do not use automated decision-making within the meaning of Art. 22 GDPR.

18. Version

This notice was last revised on 5 August 2026.