Only the German version of this text is legally binding. This English translation is provided for convenience.
Here you can find out which personal data I process when you visit this website and when you shop here, why I process it and on what legal basis, and what rights you have. Last updated: 10/12/2026.
1. Controller
Jan Schaumann, Fishwish Racing – NASCAR Model Kits
Breite Str. 5
13187 Berlin
Germany
Phone: +49 30 8866 3866, Email: info@fishwishracing.com
As a sole proprietor, I am not required to appoint a data protection officer. If you have any questions about data protection, please contact me directly.
2. The most important points up front
- No tracking, no web analytics, no advertising cookies, no social media plugins, no newsletter.
- Fonts and all content are served from my own server. No data is transmitted to third parties when you load the pages. The only exception is YouTube videos, and only if you consent (Section 5).
- The connection is encrypted via TLS (https).
3. Hosting and server log files
The website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. ALL-INKL processes the data on my behalf (Art. 28 GDPR) on servers in Germany. This also includes the emails you send me or that the shop sends you.
Each time a page is accessed, the server automatically stores access data: IP address, date and time, page requested, amount of data transferred, browser and operating system, and the previously visited page. I need this data to operate the website securely and reliably and to fend off attacks. The legal basis is my legitimate interest under Art. 6(1)(f) GDPR. The log files are automatically deleted after a short time, unless a specific security incident needs to be investigated.
4. Cookies and similar technologies
I only use cookies that are technically necessary for the shop. No consent is required for these (Section 25(2) No. 2 TDDDG). The legal basis for the processing is Art. 6(1)(b) or (f) GDPR.
- Shopping cart and session: remember your shopping cart. They are deleted at the end of the session or after 48 hours at the latest.
- Login: only if you log in to your customer account. They remain valid until you log out, or up to 14 days with “Stay logged in.”
- Language: remembers whether you want to view the site in German or English, for 12 months.
- Cookie choice: stores your decision in the cookie notice, for 12 months.
As proof of your decision in the cookie notice, I store a random identifier, the time, the version and your choice on the server, without an IP address (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). This record is deleted after 3 years. You can change or withdraw your choice at any time via “Cookie Settings” at the bottom of every page.
5. YouTube videos
Some product and knowledge pages contain videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The video is only loaded once you allow “External Media” in the cookie notice or click on the video. I use the enhanced privacy mode (youtube-nocookie.com). Once the video is loaded, Google receives, among other things, your IP address, the page you visited and information about your device. Google may use cookies or similar technologies and may also transfer data to the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR).
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via “Cookie Settings.” For more information, see Google’s privacy policy: policies.google.com/privacy.
6. Orders and contract processing
When you place an order, I process the data you enter at checkout: name, billing and shipping address, email address, phone number, items ordered, payment method and, if applicable, your message. I need this data to conclude and perform the contract, that is, for confirmation, invoicing, shipping and any follow-up questions (Art. 6(1)(b) GDPR). Required fields are marked. Without this information, I cannot fulfill the order.
Payment in advance (bank transfer): You transfer the money to my business account. In doing so, my bank receives the details from your transfer.
Payment with PayPal: If you choose PayPal, you will be redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, to pay. For this purpose, I transmit your name, address, email address, order number and order amount (Art. 6(1)(b) GDPR). PayPal processes the data as an independent controller and may carry out fraud prevention checks. Details can be found in PayPal’s privacy policy. The PayPal button is only loaded at checkout.
Shipping: For delivery, I pass on your name and shipping address to the shipping provider, i.e. DHL Paket GmbH or Deutsche Post AG (Charles-de-Gaulle-Straße 20, 53113 Bonn) (Art. 6(1)(b) GDPR). For deliveries to Switzerland, the details of the customs declaration (contents, value, weight) are added. These go to the customs authorities (Art. 6(1)(b) and (c) GDPR). I do not pass your email address on to the shipping provider. I send you the tracking number myself.
Retention: I retain invoices and accounting records for 8 years and business correspondence for 6 years (Section 147 AO, Section 257 HGB, Section 14b UStG; Art. 6(1)(c) GDPR). After that, the data is deleted or the orders are anonymized. I delete unpaid or abandoned orders after 30 days.
Accounting: I handle my bookkeeping and the preparation of tax returns using my own software on this server. Records may be transmitted to my tax advisor or to the tax office (Art. 6(1)(c) GDPR).
7. Customer account
A customer account is optional; you can also order without an account. In the account, I store your contact details, addresses and orders, as well as your password in encrypted form (Art. 6(1)(b) GDPR). You must confirm new accounts via an email link. Unconfirmed accounts are deleted after 7 days, and accounts without an order after 24 months without a login. You can have your account deleted at any time. A short message to me is enough. Data that I am required to retain (Section 6) remains stored with restricted access until the retention period expires.
8. Contact form and email
When you write to me via the contact form or by email, I process your name, email address and message in order to respond to your inquiry (Art. 6(1)(b) GDPR for questions about an order, otherwise (f)). The form does not store anything in the website database; the message only reaches me as an email. To guard against spam, I use a hidden field and a time lock, without external services. I delete inquiries once they have been resolved and there is no retention obligation.
9. “Notify me when back in stock”
For sold-out items, you can sign up to be notified by email. For this purpose, I store your email address, the item, the time of your confirmation and a truncated, non-traceable value of your IP address as protection against abuse. You must confirm the sign-up via an email link (double opt-in). The legal basis is your consent (Art. 6(1)(a) GDPR). The data is deleted as soon as I have notified you, you unsubscribe (link in every email), or the sign-up is not confirmed within 7 days.
10. Review request
Only if you tick the optional checkbox at checkout, I will send you a one-time email about 10 days after shipping asking you to review the shop on Google (Art. 6(1)(a) GDPR). For this purpose, I store your consent, including the time and wording, with the order. You can withdraw it at any time, via the link in the email or by sending me a message. You only get to Google once you click the review link in the email. Google’s privacy policy applies there.
11. AI services in administration
I use AI services for some administrative tasks. They create product descriptions from box photos, translate texts and read purchase receipts. The services used are Anthropic (Anthropic PBC, USA) and Abacus.AI (Abacus.AI, Inc., USA). Customer data from orders is not transmitted in the process. Purchase receipts from suppliers may contain names and addresses of business partners. The legal basis is my legitimate interest in efficient administration (Art. 6(1)(f) GDPR). The transfer to the USA is based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses (Art. 45, 46 GDPR).
12. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)). A message to the address above is sufficient.
Right to object (Art. 21 GDPR): Where I process data on the basis of my legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.
Automated decision-making, including profiling (Art. 22 GDPR), does not take place.