Privacy Policy

The controller for data processing on this website is:

Company

EXTRA Group GmbH

Address

Mathes-Deutsch-Weg 24B, D-84036 Landshut

Telephone

+49 871 97 40 734 - 0

Email

service@college-fashion.de

This privacy policy applies to college-fashion.de, including our meaning moments service at reel.college-fashion.de.

Each time our website is accessed, our hosting provider Vercel (section 9) automatically processes technical access data: your IP address, the date and time, the address requested, the response status code and your browser identifier (user agent). We use this data to deliver the pages, to detect and defend against faults and attacks and to fix errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website. We do not analyse this data for advertising or analytics purposes. Vercel stores our website’s runtime logs for one day.

The meaning moments pages (reel.college-fashion.de) are delivered by our own server in Germany (section 9). The same purpose and legal basis apply to its access logs. We have not yet set a fixed deletion period for these logs.

You also have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)

You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

When you place an order, we collect the following data: salutation, first and last name, delivery address, email address, telephone number, and where applicable billing address and payment information. This data is required to perform the contract (Art. 6(1)(b) GDPR).

If you order a memory book, we pass the data required for printing and shipping to our print service (section 6). We retain invoices and accounting records for eight years and business correspondence for six years, in each case from the end of the calendar year (Section 257 German Commercial Code, Section 147 German Fiscal Code; Art. 6(1)(c) GDPR).

Registrations via a university’s order page (for example for a graduation ceremony): there we additionally collect the information the university needs to hold the ceremony (programme of study, gown size, number of guests). We transmit this information together with your first and last name and email address as a participant list to the organising university or faculty. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); where the university provides for consent in the order process, the transmission is based on that consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time with effect for the future. The university’s own privacy policy applies to its further processing.

For orders placed up to 2 October 2026, names and email addresses for notification emails planned at the time are also held on our own server in Germany. We do not send these emails; the entries expire automatically no later than 90 days after the respective order.

If you write to us using the contact form or send us a measurement sheet, we process your details – for the contact form, your name, email address, telephone number, subject and message – in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns an order or its preparation, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your enquiry. Your enquiry is sent as an email to our mailbox at IONOS and stored in our form database at Supabase in Frankfurt. Only if both fail at the same time do we write it, as a fallback, to the runtime log of our hosting provider Vercel, which Vercel stores for one day. Our team also receives an instant notification via Telegram – without your name, contact details or message (section 9).

Via our withdrawal function we record the details of your withdrawal and the date and time of receipt so that we can confirm receipt and process the withdrawal (Art. 6(1)(c) GDPR in conjunction with Section 356a German Civil Code).

For the contact form and the withdrawal function we also store the IP address and browser identifier (user agent) of the sending device in order to prevent misuse and to be able to prove receipt (Art. 6(1)(f) GDPR).

Storage period: no fixed deletion period currently applies to these submissions. We keep them, including the IP address and browser identifier, and delete them at your request unless a statutory retention obligation applies. Where an enquiry relates to a contract, and for every withdrawal, the six-year retention obligation for business correspondence applies, starting at the end of the calendar year (Section 257 German Commercial Code, Section 147 German Fiscal Code).

What we process. For your graduation card or reel (reel.college-fashion.de) you upload photos or videos and provide your email address. For your memory book (college-fashion.de/moments/gestalten) you design the pages in your browser; when you order, we transfer the photos used and the design to our server. We use this content only to create the keepsake you have requested, to send you the link to it and – for the memory book – to have it printed and delivered. The legal basis is Art. 6(1)(b) GDPR. Without photos we cannot create the keepsake. For reel uploads made before 2 October 2026, your consent was the legal basis; you may withdraw it at any time, most easily via the deletion link in your email.

Other people in your photos. If your photos show other people – such as fellow students or family – we also process their images, solely for your keepsake. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is yours and ours in producing the private keepsake you have requested. Anyone who recognises themselves in a photo and wishes it to be deleted can write to service@college-fashion.de; we will then delete the photo from our systems without undue delay. A book that has already been printed and delivered is in the possession of the person who ordered it. This paragraph is also addressed expressly to the people shown, whom we cannot inform individually (Art. 14(5)(b) GDPR).

Storage location and storage period. Photos, videos, design and print files are held on our own server in Germany (section 9). You can delete your reel, including its photos and videos, yourself at any time via the link in your email. We store the page design of your memory book for 30 days and the link to your order for 60 days. No automatic deletion period currently applies to uploaded photos, videos and print files: they remain stored until you delete them yourself or ask us to do so (service@college-fashion.de). Your reel cannot be found publicly.

Printing the memory book. The memory book is printed and shipped by Prodigi Group Ltd, 20 Caker Stream Road, Alton GU34 2QA, United Kingdom, as our processor (Art. 28 GDPR). For this purpose Prodigi receives the print file containing your photos as well as the name, email address and delivery address of the recipient. The European Commission has found that the United Kingdom ensures an adequate level of data protection (Art. 45 GDPR). Depending on the production site, Prodigi may also process the data at partner facilities outside the United Kingdom and the EEA, for example in the USA or Australia; for these cases Prodigi’s data processing agreement provides for EU Standard Contractual Clauses (Art. 46(2)(c) GDPR; prodigi.com/dpa). Prodigi retains the print file for production, quality control, reprints and support and deletes it afterwards. The legal basis is Art. 6(1)(b) GDPR.

We do not set any cookies when you visit college-fashion.de. We create two entries in your browser’s local storage: “college-fashion-cart” for your shopping cart and “cfChatSessionId” as the identifier for our advisory chat, once you open the chat. They are strictly necessary for these functions; no consent is required for them (Section 25(2) no. 2 TDDDG). The entries remain in your browser until you delete them. In the memory book designer, your browser saves your draft including the photos locally (IndexedDB) so that your work is preserved; it leaves your device only when you order. On product and basket pages, PayPal’s script for the instalment notice additionally creates an entry (“__paypal_storage__”) in local storage (section 8). We do not use analytics cookies.

We use external payment service providers (PayPal, Stripe/Shopify Payments, Klarna) through whose platforms our users can make their payments. The data is transmitted in encrypted form. You can find the privacy policies of the respective providers on their websites.

On product and basket pages we display PayPal’s own notice about paying later or in instalments. To show it, your browser loads a script from paypal.com and transmits your IP address to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. This happens while you are browsing — before and independently of any payment. The script also creates an entry (“__paypal_storage__”) in your browser’s local storage. Legal basis for the transmission is our legitimate interest in informing you about available payment options (Art. 6 (1) (f) GDPR). Details: paypal.com/privacy.

The front end of this website is hosted by Vercel Inc. (USA). When the pages are accessed, server log files (see section 2) are processed. The transfer to the USA is safeguarded by the EU Standard Contractual Clauses.

To operate our shop we use the following service providers. Where they process personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR:

• Shopify International Ltd. (Ireland) – shop system, shopping cart, order processing and checkout.
• 1&1 IONOS SE (Germany) – sending and receiving emails, e.g. receipt and order confirmations as well as contact enquiries.
• Supabase (hosted in the EU/Frankfurt) – storage of form submissions (contact, measurement-sheet and withdrawal enquiries).
• Anthropic PBC (548 Market St, San Francisco, CA 94104, USA) – answering the enquiries in our advisory chat with the help of an AI language model; your messages and the previous course of the conversation are transmitted for this purpose. If Anthropic is unavailable, OpenAI (USA) answers instead. The transfer to the USA is safeguarded by the EU Standard Contractual Clauses.
• Prodigi Group Ltd (United Kingdom) – printing and shipping of the memory book (details in section 6).

Our own server for meaning moments (photos, videos, design and print files) is located in a data centre of Hetzner Online GmbH in Germany.

We also notify our team of new enquiries and orders via Telegram (Telegram Messenger Inc., British Virgin Islands). These notifications contain only the type of event, an internal reference and, where applicable, the order number – no name, contact details, address, message text or file names. No one can be identified from them without access to our own systems. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is handling your request promptly.

The legal basis for the processing is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (legitimate interest in secure, functional operation).

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or in order to implement changes to our services. The new privacy policy will then apply to your next visit.