Privacy policy
Datenschutzerklärung under the General Data Protection Regulation (EU) 2016/679, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG).
Last updated: 12 August 2026
Who is responsible
The controller for the processing described here is:
HMT Lederwaren Import GmbH
Eichenstraße 56
65933 Frankfurt am Main
Germany
Email: support@hmtlederwaren.shop
Telephone: +49 1796986554
Company register and representation details are published on the Impressum, as German law requires. We have not appointed a data protection officer, because we are not required to under Art. 37 GDPR or §38 BDSG. Data protection requests are handled by the address above and are answered within one month.
What we collect, at a glance
| Situation | Data | Legal basis |
|---|---|---|
| You browse the site | IP address, request data, technical logs | Art. 6(1)(f) — legitimate interest in operating a secure site |
| You add something to the bag | Item and quantity, in your own browser only | Art. 6(1)(f) / §25(2) TDDDG — strictly necessary |
| You place an order | Name, email, telephone, delivery address, order lines | Art. 6(1)(b) — performance of a contract |
| You order embossing | The text you type (a name or initials) | Art. 6(1)(b) — performance of a contract |
| We invoice and account for the order | Invoice data | Art. 6(1)(c) — legal obligation (HGB, AO) |
| You use a contact or advice form | Name, email, optional telephone, your message | Art. 6(1)(a) — consent |
| We screen an order for fraud | Order and payment metadata | Art. 6(1)(f) — legitimate interest in preventing fraud |
| You accept optional cookies | Aggregate usage statistics | Art. 6(1)(a) + §25(1) TDDDG — consent |
We do not sell personal data. We do not share it for advertising. We do not build profiles, and no decision about you is taken by automated means within the meaning of Art. 22 GDPR.
Orders and delivery
To fulfil an order we need your name, email address, telephone number and delivery address, together with the items ordered. Providing this is not a statutory requirement, but without it a contract cannot be performed — we cannot post a parcel to an address we do not have.
The telephone number is passed to the carrier and is used only if a delivery cannot be completed. The email address is used for the order confirmation, the dispatch notice with tracking, the invoice, and one single email after delivery asking what you thought of the product. That last email is sent once and never repeated, and it contains an unsubscribe link. It is sent on the basis of §7(3) UWG, which permits a trader to contact an existing customer about similar goods.
Embossing text
We treat what you type as personal data
If you order blind embossing, the text you enter is treated as personal data. It is used for one purpose only — making the item — and is limited by design to 12 characters of Latin letters and spaces.
Our system rejects any entry containing a digit, on both the browser side and again on the server. This is deliberate: it prevents a telephone number, a document number, a date of birth or a code from being pressed permanently into a leather object that will then travel through public places.
We do not print, emboss or otherwise process personal data on your behalf beyond a name or set of initials, under any circumstances, even on request.
Embossing text is deleted from the production record once the statutory retention period for the associated order documentation has expired.
Contact and advice forms
The contact form and the packing advice form collect your name, email address, optionally a telephone number, and what you write. Both require an explicit, separately ticked consent before they can be submitted; neither box is pre-ticked.
The advice form also records the four trip characteristics you select. These describe a trip, not a person, and are not used to profile you or to send you marketing. Answering the advice form does not subscribe you to anything.
You may withdraw consent at any time by emailing us; withdrawal does not affect the lawfulness of processing carried out before it.
The Trip Planner
The Trip Planner is a fixed rule table evaluated in your own browser. It asks four questions about the trip — its type, its length, whether a bag is checked, and who is travelling — and maps the answers onto products.
No account, no name, no email address and no identifier is involved, and no record of your answers is created on our servers. The result page carries your four answers in the web address itself, which is what makes the link shareable. That link therefore contains nothing about you: sending it to whoever you are travelling with sends them four words about a trip and nothing else.
Server logs and hosting
This website is hosted by Vercel Inc. Serving a page necessarily involves the host processing your IP address, the address requested, the time, the referring page and your browser identification. This is technically unavoidable and is done on the basis of Art. 6(1)(f) GDPR — our legitimate interest in delivering and securing the site. Logs are retained for a short period for security and troubleshooting and are not combined with any other data.
Where our host processes data on our behalf, this is governed by a data processing agreement under Art. 28 GDPR.
Cookies and local storage
We set no optional cookie before you agree to it. The consent banner presents “Accept all” and “Reject optional” as two equally prominent buttons of the same size, as §25 TDDDG requires — rejecting is exactly as easy as accepting, and closing the banner never counts as agreement.
Two items of strictly necessary local storage are used and require no consent under §25(2) TDDDG: one holds the contents of your bag so it survives a page reload, and one records your cookie choice so we stop asking. Both live in your own browser, are never transmitted to us, and can be cleared at any time through your browser settings. Full detail is on the cookie policy page.
Who receives your data
- The carrier handling your parcel receives the delivery address, your name and your telephone number.
- The payment service provider receives what it needs to take the payment. Card details go directly to it and never reach us — see payment and security.
- Our hosting and email providers process data on our instructions under Art. 28 GDPR agreements.
- Our tax adviser and the tax authorities receive invoice data where the law requires it.
That is the complete list. No advertising network, data broker or analytics partner receives personal data from this site.
Transfers outside the EU
Our hosting provider is a company established in the United States and processing may take place on infrastructure located outside the European Economic Area. Such transfers are safeguarded by the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR, supplemented where applicable by the EU–US Data Privacy Framework.
Deliveries to a destination outside the EU necessarily require the address to be transmitted to a carrier and to the customs authorities of that country, on the basis of Art. 49(1)(b) GDPR — necessary for the performance of a contract you requested.
How long we keep it
| Data | Retention | Why |
|---|---|---|
| Invoices and order accounting records | 10 years from the end of the calendar year | §147 AO, §257 HGB |
| Commercial letters, including order correspondence | 6 years from the end of the calendar year | §257 HGB |
| Embossing text in the production record | Deleted with the associated order documentation | Purpose exhausted |
| Contact and advice form messages | 24 months after the matter is closed | Follow-up questions, then deleted |
| Consent records | For as long as the consent is relied on, plus 3 years | Art. 7(1) GDPR — proving consent |
| Server logs | Short-term, as set by our host | Security and troubleshooting |
Your rights
You have the right to:
- Access (Art. 15) — a copy of the personal data we hold about you.
- Rectification (Art. 16) — correction of anything inaccurate.
- Erasure (Art. 17) — deletion, unless a statutory retention period applies.
- Restriction (Art. 18) — processing paused while a dispute is resolved.
- Portability (Art. 20) — your data in a structured, machine-readable format.
- Objection (Art. 21) — to processing based on legitimate interest, including at any time and without reason to direct marketing.
- Withdrawal of consent (Art. 7(3)) — at any time, without affecting processing already carried out.
Write to support@hmtlederwaren.shop with the subject “Data protection request”. We answer within one month, free of charge. We may ask one question to confirm you are the person the data belongs to; we will not demand a copy of an identity document as a matter of routine.
Complaints
You may lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority competent for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Wiesbaden.
We would rather you told us first, but the right is yours either way.