Privacy Policy

01Data Controller

NOWHOW STUDIO (Inh. Masafumi Miyasaka)
Büschingstraße 3, 10249 Berlin, Germany
Email: hello@nowhowstudio.com

02Personal Data We Collect

When you place an order through this Buyers Hub, we collect:

• Company name, business address (billing and shipping)
• Contact person's name, email address, and phone number
• Order details (selected items, quantities, special requests)
• Technical data: IP address, browser type, login timestamps (for security purposes only)

03Purpose and Legal Basis

• Order fulfillment (confirmation, production, invoicing, shipping): Performance of a contract — GDPR Art. 6(1)(b)
• Tax and accounting records: Legal obligation under German law (HGB §257, AO §147) — GDPR Art. 6(1)(c)
• Security logs and fraud prevention: Legitimate interest — GDPR Art. 6(1)(f)

04Third-Party Recipients

Your data is processed by the following service providers acting on our behalf:

• Vercel Inc. (United States) — Web hosting and serverless functions
• Notion Labs Inc. (United States) — Customer database (read-only, used to validate your login email against the invited-buyer list)
• Resend Inc. (United States) — Transactional email delivery
• Adobe Inc. (United States) — Font delivery via Adobe Fonts CDN (your IP address is transmitted when fonts load; no other personal data is shared)
• DHL Express / FedEx — International shipping (when applicable)

All US-based processors operate under either the EU-US Data Privacy Framework (where self-certified) or Standard Contractual Clauses (SCC) approved by the European Commission, ensuring an adequate level of data protection. Specific certifications can be verified on the EU-US Data Privacy Framework website.

05Data Retention Periods

• Order records and invoices: 10 years (HGB §257, AO §147)
• Customer company information: 10 years after the end of the business relationship
• Personal contact details (name, email): 1 year after the end of the business relationship
• Order drafts stored in your browser: 20 days
• Security logs (IP, login history): 1 year
• Incident records: 5 years

06Your Rights as a Data Subject

Under GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data, where legally permitted (Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interest (Art. 21)

To exercise any of these rights, contact us at hello@nowhowstudio.com. We will respond within one month.

07Right to Lodge a Complaint

If you believe your data has been processed unlawfully, you may file a complaint with the supervisory authority:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstraße 219, 10969 Berlin, Germany
Website: www.datenschutz-berlin.de

08Cookies and Local Storage

This Buyers Hub uses the following storage mechanisms, all of which are strictly necessary for the operation of the service:

• Session cookie (nowhow_session): A secure, HttpOnly cookie holding your authenticated session, valid for 7 days. Required to keep you logged in after using a Magic Link.
• Browser local storage: Stores your in-progress order drafts so they survive accidental browser closure. Retained for up to 20 days, then cleared automatically.
• Session storage: Temporarily holds order details and buyer information while you complete the order flow. Cleared when you close the browser tab or submit your order.

Because all storage is strictly necessary under §25(2) TTDSG, no cookie consent banner is required. We do not use tracking cookies, analytics scripts, or third-party advertising.

09Authentication, Sessions, and Account Security

We use a passwordless email-based authentication system ("Magic Link"). A one-time login link valid for 24 hours is sent to your registered business email address. Login sessions remain valid for 7 days.

You are responsible for keeping your registered email account secure. If you suspect that your account or Magic Link has been compromised, please notify us at hello@nowhowstudio.com without undue delay.

10Data Protection Officer

We do not have a designated Data Protection Officer. NOWHOW STUDIO does not meet the criteria for mandatory DPO appointment under §38 BDSG (fewer than 20 employees regularly processing personal data; no large-scale processing of special categories).

For all data protection matters, please contact us directly at hello@nowhowstudio.com.

11Provision of Data and Automated Decisions

Providing your business contact details and order information is necessary to enter into and perform a wholesale contract with us. Without this information, we cannot accept or fulfill your order. There is no statutory obligation on your side to provide this data; the requirement is contractual.

We do not engage in automated decision-making or profiling within the meaning of GDPR Art. 22.

12Children's Data

The Buyers Hub is intended exclusively for use by commercial buyers acting on behalf of a business. We do not knowingly collect personal data from minors. If you become aware of any minor's data being processed, please notify us so we can delete it.

13Changes to This Policy

We may update this Privacy Policy from time to time. The most recent version is always available at this URL with the "Last updated" date at the top.