1. Who is responsible
The controller for this shop is baseballfanhaven.com, Seebener Str. 69, 06118 Halle (Saale), Sachsen-Anhalt, Germany, operating Baseball Fan Haven at baseballfanhaven.com. For privacy questions or rights requests, contact [email protected]. Applicable registration details are stated in the shop details.
2. Information we process
We process information you provide for purchases and support: name, email, billing and delivery details, telephone number when supplied, selected products, order records and correspondence. Accounts add login identifiers, a protected password record and account preferences. Order lookup processes the entered email, CAPTCHA response, session/security information, order status and tracking references. Hosting and security services process technical information such as IP address, request time, device/browser information and error or security records.
Payment information depends on the method actually selected; do not send card credentials by email.
3. Purposes and lawful bases
We use order, account and support information to take requested pre-contract steps and perform the purchase contract (GDPR Article 6(1)(b), where applicable). Required invoicing, tax records and lawful disclosures rely on legal obligations (Article 6(1)(c)). Necessary site operation, proportionate security and prevention of misuse rely on legitimate interests (Article 6(1)(f)), balanced against your rights. Any optional processing requiring consent must use a valid consent mechanism (Article 6(1)(a)); consent can be withdrawn without affecting earlier lawful processing. We do not treat acceptance of sales terms as blanket consent to marketing.
4. Service providers and disclosures
Information necessary for the service may be handled by hosting and technical support providers, Cloudflare delivery/security services, the shop’s order-management services, the payment service actually selected, carriers and professional advisers. They receive information relevant to their functions and applicable responsibilities. We may disclose information where legally required or necessary to handle a dispute. We do not provide customer lists to unrelated advertisers as part of these shop functions. Customer correspondence is routed through Cloudflare Email Routing to the shop’s staff and email service for handling.
5. Cookies and order lookup security
Necessary technologies support the basket, checkout, login and security. Depending on the action, these include WooCommerce basket/session cookies, WordPress authentication cookies and the session-only __Host-sot_session cookie for protected order lookup. CAPTCHA records expire after 5 minutes and a successful lookup proof after 10 minutes; this does not set a retention period for underlying orders. Optional WooCommerce order-source attribution is disabled. Cloudflare may use necessary security cookies when its protection features require them; no separate advertising tracker is enabled by this policy.
Browser settings can remove cookies; blocking essential cookies can impair shopping or login.
6. Retention and international processing
Account information is needed while an account remains in use; order and correspondence records may remain for fulfilment, accounting, tax, complaints and legal claims. Retention is determined by the operator’s applicable obligations, limitation periods and the nature of the record. Completed orders and inactive accounts are not currently subject to a fixed automatic expiry in the shop; deletion or anonymisation requests are assessed against these requirements. Data no longer necessary is to be deleted or anonymised, subject to lawful preservation. Hosting, order processing and Cloudflare can involve processing outside your country.
International deliveries can involve carriers in the destination country, and Cloudflare operates a global network. Applicable rules on international transfers remain relevant; request details of the processing locations and the legal mechanism or safeguards applicable to your data from our privacy contact. Contact [email protected] for information about relevant processing locations and a copy or explanation of the applicable transfer safeguards.
7. Your rights
Subject to the applicable law and lawful exceptions, you can request access, correction, erasure, restriction and a portable copy of relevant information. You can object to processing based on legitimate interests, and object to direct marketing at any time. Where processing relies on consent, you may withdraw it. Contact [email protected]; we may request proportionate verification of identity and will respond within the applicable legal deadline. You may complain to your local data protection authority; UK residents can contact the ICO. Erasure is not absolute where records must lawfully be preserved.
8. Security, children and decisions
We use access controls, HTTPS and the site’s security checks; no internet service can promise absolute security. The shop is intended for buyers able to enter into a contract. If a child’s information has been provided improperly, contact us so that we can assess removal and any legal obligations. We have not identified a shop feature making solely automated decisions with legal or similarly significant effects; automated traffic-security checks may still protect the site.
9. Contact and updates
Questions and rights requests can be sent to [email protected]. The date above identifies this version. Material changes must be reflected in an updated notice and any further information or consent required by law. This notice describes data processing; it does not waive your rights.