Privacy policy

Updated: 6 November 2026

Controller and contact

Toile de Rêve, sole proprietorship, Herderstraße 2, 30625 Hannover, Germany. Email: info@toiledereve.de.

Incomplete controller information: The proprietor’s full legal name still needs to be added. The trading name does not replace this mandatory information. This policy describes the current shop with example artworks that are not for sale.

Providing the shop

This shop is hosted by Shopify. Visiting it involves processing IP addresses, device and browser information, pages viewed, time and technical usage data to deliver content, provide the cart and prevent misuse. Necessary processing relies on Article 6(1)(f) GDPR and our legitimate interest in a secure, functioning shop. Requested pre-contractual steps or a future contract rely on Article 6(1)(b) GDPR.

Our European service provider is Shopify International Limited, Victoria Buildings, 2nd floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes information under its processing terms and acts as an independent controller for certain services. See the Shopify Data Processing Addendum and Consumer Privacy Policy.

Contact forms and email

We process your email address, message and voluntary details such as your name to respond to enquiries. Your name and additional information are optional; an email address and message are needed for a response. Contract-related enquiries rely on Article 6(1)(b), other enquiries on our legitimate interest in responding under Article 6(1)(f) GDPR. Messages pass through Shopify and our email infrastructure. Do not send card credentials, account passwords or unnecessary sensitive information.

Cookies and similar technologies

Necessary technologies support sessions, cart functionality, language, security and privacy choices. Strictly necessary access to your device is based on section 25(2) of the German TDDDG. Subsequent personal-data processing follows the grounds described above.

Optional analytics, personalisation and marketing technologies are controlled through Shopify’s consent mechanism. Where consent is required, device access and processing rely on section 25(1) TDDDG and Article 6(1)(a) GDPR. You can reject, select or accept optional purposes in the banner. Reopen “Cookie preferences” in the footer to change or withdraw consent for the future. Withdrawal does not affect the lawfulness of prior processing. Basic shop functions remain available without optional consent.

After you select examples, the browser’s session storage uses “tdr-example-selection-v1” to remember their product identifiers. This is not an order. Remove selections in the cart. Session storage normally ends with the browser session, although session-restore features can retain it. See Shopify’s cookie information for its cookies and lifetimes.

Shopify Network Intelligence

Shopify Network Intelligence is enabled. Shopify may combine information about interactions with our shop, other merchants and Shopify to provide enhanced services, personalisation, analytics and advertising, subject to required consent choices. For Shopify’s own processing and withdrawal, objection or deletion requests, see its Consumer Privacy Policy and Privacy Portal.

Spam protection

Shopify forms use hCaptcha by Intuition Machines, Inc. IP addresses, device information and interaction data may be processed to detect automated access. Our basis is the legitimate interest in preventing spam and misuse under Article 6(1)(f) GDPR. Details, including possible international transfers, are in the hCaptcha privacy information.

Orders and payments

The current examples cannot be ordered. If real sales are enabled later, contact, billing, delivery and order details will be processed to fulfil contracts. Necessary information will go to the payment and delivery providers selected at checkout. Specific providers and terms must be added before sales begin. We do not currently display a final set of activated payment methods or request payment for examples.

Recipients and international processing

Authorised personnel and necessary IT, hosting, security and communications providers receive access. Information may also be disclosed where legally required. Shopify can process data outside the EEA, including Canada and the US, using applicable adequacy decisions or appropriate safeguards such as standard contractual clauses. Details and contacts for copies of safeguards appear in Shopify’s linked privacy information. EU hosting does not exclude all international processing.

Retention

We retain personal data for as long as needed for its purpose. Completed enquiries are deleted once no further handling, statutory retention or necessary legal defence requires them. Contract and tax records follow applicable statutory periods. Technical storage and cookies have purpose-specific lifetimes; example selections use the session storage described above. A single retention period for every type of data would be inaccurate.

Your rights

Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability. You can withdraw consent for the future. You may object to legitimate-interest processing for reasons relating to your particular situation and object to direct marketing at any time. Contact info@toiledereve.de. The current example gallery does not implement solely automated decisions by Toile de Rêve producing legal or similarly significant effects.

You may complain to a data protection authority, including where you live, work or believe an infringement occurred. The local authority is the Lower Saxony Data Protection Commissioner.

External links and updates

Journal source links take you to external websites only when clicked. Those providers’ privacy information then applies. We update this policy when actual functions, services or sales arrangements change.