Privacy Policy

1. Data Controller

RAW Facilitation GbR
Partners: Felix Bruns, Cora Niemeier, Jonas Baumgart
Friemer Straße 17, 37284 Waldkappel, Germany
Email: contact@raw-facilitation.guide

2. General Information on Data Processing

Scope of processing of personal data

We process personal data only to the extent necessary to operate our website, accept and fulfil orders for the Handbook, deliver the Handbook as a PDF, communicate with you, process payments where applicable, and manage newsletter consent. Depending on the order route, the order form may collect your name, email address, chosen amount, and whether you gave newsletter consent.

Legal bases

For accepting and fulfilling a Handbook order, including a €0 order, we rely on Art. 6(1)(b) GDPR where processing is necessary for the contract or for pre-contractual measures. For newsletter processing, we rely on your consent under Art. 6(1)(a) GDPR. We rely on Art. 6(1)(c) GDPR where processing is necessary to comply with legal obligations and on Art. 6(1)(f) GDPR where processing is necessary for our legitimate interests, including secure website operation and, where legally permitted, privacy-conscious statistical analysis.

Storage periods

We retain personal data only for as long as necessary for the relevant purpose. Website and server-log data is retained for the period needed to maintain security, investigate technical incidents, and operate the service. Completed order and payment records are retained for the applicable commercial and tax retention periods. Data from failed, abandoned, or pending orders is not retained longer than necessary for technical operation, security, legal obligations, or the establishment, exercise, or defence of legal claims. Newsletter data is retained until you withdraw consent or request deletion, subject to any necessary proof of consent or legal retention obligation.

3. Website Hosting and Server Log Files

Our website, backend, database, order processing, and download-link generation are hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. When you access our website, server log files may include your IP address, browser type and version, operating system, referrer URL, host name, and the time of the request.

We process this data on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is the secure and technically reliable operation of the website and its services. Hostinger processes personal data on our behalf where it acts as our processor. We use the applicable data-processing agreement and the safeguards described in the current Hostinger privacy information. Further information: Hostinger Privacy Policy and Hostinger Data Processing Addendum.

4. Email Services

We use email services provided by Porkbun, LLC, 21370 SW Langer Farms Parkway, Suite 142-432, Sherwood, OR 97140, United States, for our contact address and automated order emails, including confirmation and download emails. Porkbun may process email addresses, message content, delivery information, and technical metadata.

The processing is based on Art. 6(1)(b) GDPR where it is necessary to communicate with you in connection with an order and on Art. 6(1)(f) GDPR for other necessary business communication. Transfers to the United States are carried out only on the basis of applicable safeguards under data-protection law. Further information about the provider’s processing and safeguards is available here: Porkbun Privacy Policy.

5. Cookies

We do not currently use non-essential cookies. Our current Umami implementation operates without cookies. If this changes, or if another processing activity requires consent under applicable law, we will update this Privacy Policy and obtain consent where required before starting that processing.

6. Handbook Orders

You can order the Handbook as a PDF for a freely chosen amount, including €0. The order form currently collects your name, email address, chosen amount, and whether you gave newsletter consent. We use this data to process and document your order and to send you the Handbook.

All orders are completed through Stripe Checkout as described in Section 7. For a paid order, Stripe processes the payment and we deliver the Handbook only after Stripe has confirmed successful payment. For a €0 order, Stripe is still used to complete the checkout, but no charge or payment transaction is made. We deliver the Handbook only after Stripe has confirmed successful completion of the checkout. A pending, failed, or abandoned Stripe Checkout session does not trigger delivery.

The legal basis for order processing is Art. 6(1)(b) GDPR where processing is necessary for the order contract or pre-contractual measures. Newsletter processing is based separately on consent under Section 8.

7. Checkout and Payment Processing via Stripe

Stripe is used for the checkout process for all Handbook orders. For orders where an amount greater than €0 is chosen, payment is processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”). For €0 orders, Stripe is used to complete the Checkout process, but no payment is collected.

Stripe receives the data necessary to provide the Checkout and payment services, including the name, email address, chosen amount, order information, and payment details required by Stripe. Stripe may process data as an independent controller for purposes such as checkout and payment processing, fraud prevention, and legal compliance. Stripe may also use affiliates and subprocessors outside the EU/EEA.

We use verified Stripe status to decide whether to fulfil an order. Returning to our website after Stripe Checkout does not itself establish successful completion of the Checkout process or successful payment. A pending, failed, or abandoned Stripe Checkout session does not trigger delivery.

The legal basis for payment processing is Art. 6(1)(b) GDPR. Further information: Stripe Privacy Policy, Stripe DPA, and Stripe Data Transfers Addendum.

8. Newsletter

We send our newsletter only if you have separately and voluntarily given newsletter consent. Consent is not required to order or receive the Handbook. We use Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany ("Brevo"), as our processor within the meaning of Art. 28 GDPR to manage the newsletter list and send newsletters.

If you select the newsletter option, we transfer the name, email address, and consent information to Brevo after a paid order has been successfully paid and accepted or after a €0 order has been accepted. We do not transfer newsletter data to Brevo for failed, abandoned, or still-pending paid orders under this process. Every newsletter contains an unsubscribe link. You may also withdraw consent by contacting us at contact@raw-facilitation.guide. Access to the newsletter address list is restricted to Felix Bruns, Cora Niemeier, and Jonas Baumgart.

Brevo may process data through subprocessors outside the EU/EEA, including in the United States. We use the applicable contractual and other safeguards required by data-protection law. Further information: Brevo Privacy Policy and Data Processing Agreement. The legal basis is consent under Art. 6(1)(a) GDPR. Consent is voluntary and is not required to order or receive the Handbook.

9. Web Analytics with Umami Cloud

We use the cloud-hosted version of the open-source web analytics tool Umami to evaluate visits to our website. The Umami account used for this website is configured with the data region EU. This setting indicates that the analytics data is assigned to Umami's EU data region. It does not, by itself, establish that all access or processing takes place exclusively within the EU/EEA.

The service provider is: Umami Software, Inc. 28 Geary St, Suite 650 #243, San Francisco, California, United States.

Umami acts as our processor within the meaning of Art. 28 GDPR. Umami's DPA applies to our use of the service. Umami's company is based in the United States, and access to or transfers of data outside the EU/EEA may therefore be possible under the applicable contractual safeguards. Further information: Umami DPA, Umami Privacy Policy, and Umami FAQ.

In our current implementation, Umami operates without cookies. It is used for statistical information such as page views, referring sources, device and browser information, and general geographic and time-based trends. We do not use Umami to create personal profiles.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to understand general use of the website and improve our offering.

10. Your Rights

Within the scope of applicable law, you have the right to access, rectify, erase, or restrict the processing of your personal data. You may also have a right to data portability and a right to object to processing based on Art. 6(1)(f) GDPR. To exercise your rights, contact us at contact@raw-facilitation.guide.

11. Withdrawal of Consent

Where processing is based on consent, including newsletter consent, you may withdraw your consent at any time with effect for the future. You can use the unsubscribe link in a newsletter to do so. The lawfulness of processing before withdrawal remains unaffected.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for our registered office is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany

13. Changes to this Privacy Policy

We may amend this Privacy Policy where necessary to comply with legal requirements or to reflect changes to our services, for example a change of newsletter tool, hosting provider, payment provider, or analytics configuration. We will publish the updated version on this page and update the date shown at the beginning of the policy.