Privacy Policy

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. Detailed information on the subject of data protection can be found in our privacy policy set out below.

Data collection on this website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. Their contact details can be found in the section "Notice concerning the responsible party" in this privacy policy.

How do we collect your data?
Your data is collected in part when you provide it to us, for example via our contact form. Other data is collected automatically by our hosting provider when you visit the website, primarily technical data (e.g. IP address, browser type, access time) in server log files. This data is collected automatically as soon as you enter this website.

What do we use your data for?
We use the data submitted via the contact form exclusively to process your enquiry and to get in touch with you. The server log data is used to ensure error-free and secure operation of the website.

What rights do you have regarding your data?
You have the right at any time to receive free information about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction, blocking or deletion of this data. You can contact us at any time using the address given in the legal notice for this or any other questions on the subject of data protection. You also have the right to lodge a complaint with the competent supervisory authority.

2. Hosting and Content Delivery Networks (CDNs)

This website does not embed any external font services or third-party CDNs. Fonts (Anton, Inter) are served locally from our own server; no connection is made to Google Fonts, and no IP address is transmitted to third parties when the fonts are loaded. The only external service we use, exclusively after your consent via the cookie banner, is Google Analytics 4 (details in section 5).

3. General information and mandatory information

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Notice concerning the responsible party

The party responsible for data processing on this website is:

420BRANDS UG (haftungsbeschränkt)
Bornheimer Straße 127, 1st floor
53119 Bonn
Germany

Phone: +49 155 60454454
Email: inhale@420brands.de

The responsible party is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).

Storage duration

Unless a more specific storage period has been specified within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You may revoke any consent you have already given at any time. An informal email to us is sufficient. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as enquiries you send to us as the site operator, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

4. Data collection on this website

Server log files

The provider of these pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. The collection of this data is based on Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website. The server log files must be recorded for this purpose.

This website is hosted by:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

The servers are located in Germany. We have concluded a data processing agreement (DPA) with the hosting provider in accordance with Art. 28 GDPR, ensuring that the data collected via this website is processed in compliance with data protection law.

Contact form

If you send us enquiries via the contact form, the information you provide in the enquiry form, including the contact details you provide there (name, email address, phone number, website, topic and message as mandatory fields, plus optionally company and timeline), will be stored by us for the purpose of processing your enquiry and in case of follow-up questions. We do not share this data without your consent.

Submission takes place via a server script that we operate ourselves on our own webspace. No external third-party form or email service provider is used. After submitting the form, you automatically receive a confirmation email at the address you provided; at the same time, we receive an internal notification.

The processing of this data is based on Art. 6 (1) (b) GDPR, provided your enquiry relates to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR), if this was requested.

The data you enter in the contact form will remain with us until you ask us to delete it, revoke your consent to storage, or the purpose for storing the data no longer applies (e.g. after your enquiry has been fully processed). Mandatory statutory provisions, in particular retention periods under commercial and tax law, remain unaffected.

No-obligation B2B custom-merch enquiry

The B2B custom-merch form lets companies and creators submit a no-obligation enquiry about individually produced merchandise. This form is not an online shop: submitting it does not conclude a purchase contract, no payment is made and no payment data is collected. We process name, business email address, company and business address as mandatory fields; optionally phone number, creator/contact, social-media profile, website and notes, plus selected items and mockup settings. Uploaded logos and the visual mockup file remain locally in your browser and are not transmitted to us. Processing serves to handle your enquiry and take pre-contractual steps on the basis of Art. 6 (1) (b) GDPR. Where an enquiry does not relate to a potential contract, the legal basis described for the contact form applies.

Binding consumer orders in the Artist Shop (B2C)

Unlike the no-obligation B2B enquiry, the Artist Shop enables consumers to place an order that carries an obligation to pay. To initiate, perform and administer the purchase contract, we process in particular your name, email address, billing and delivery address, any phone number provided voluntarily, the products ordered including variants, sizes and quantities, unit prices, discounts, shipping costs, total amount and currency, as well as the order number and order, payment, dispatch, delivery, withdrawal, return and refund status. For advance payment by bank transfer, we also process the payment reference, amount and time of receipt needed to allocate and record the payment. We do not request card or other payment details that are not necessary for an advance bank transfer.

Processing is necessary to handle the order, conclude the contract, allocate payment, deliver the goods, communicate with you and administer withdrawals, returns, warranty claims and refunds. The legal basis is Art. 6 (1) (b) GDPR. Where we process order, invoice and payment records to comply with commercial, tax or other statutory documentation and retention duties, the legal basis is Art. 6 (1) (c) GDPR.

Recipients of the data required for their respective tasks may include shipping and logistics providers used by us, the banks involved in the advance bank transfer and our tax advisers. Data is disclosed to tax, supervisory, law-enforcement or other competent authorities only where we are legally required to do so or where this is necessary for the establishment, exercise or defence of legal claims. Service providers receive only the data required for their particular task.

Order data is stored for the performance of the contract and subsequently to the extent required by applicable statutory commercial and tax retention duties. Depending on the type of record, these periods may in particular be six, eight or ten years. Data not subject to such duties is deleted once the contract, withdrawal, warranty and potential legal-defence periods have ended and no other legal basis remains.

We do not require consent to data protection as a condition for processing data necessary for an order. Mandatory fields are required to conclude and perform the contract; without this information we cannot process the order. Any consent to newsletters or advertising is requested separately, voluntarily and may be withdrawn at any time.

Artist portal, commissions and manual payouts

For participating artists and creators, we process portal access and session data, assigned tracking links, discount codes, sales, refunds, commission bases, revenue-share rates, payout periods and payment references. For manual payouts by bank transfer, we additionally process the account holder, IBAN and, where provided, BIC of the payout account specified by the artist. This data is necessary to perform and settle the artist relationship; the legal basis is Art. 6 (1) (b) GDPR. We process legally required settlement and payment records on the basis of Art. 6 (1) (c) GDPR.

Payout account data is stored encrypted in the backend and is displayed only in masked form in the artist portal. Authorised administrators can reveal it to verify and execute a transfer; reveals, changes and approvals are logged. A change by the artist removes any previous approval. The account version used is stored in encrypted form with the payout record. Recipients of data required for a transfer include the banks involved; tax advisers or competent authorities receive data only where and to the extent required.

Data is stored for the duration of the collaboration and thereafter to the extent required for contractual or statutory documentation, retention and legal-defence purposes. Portal access that is no longer required is revoked or deleted; payout records are not removed before applicable obligations have expired.

5. Cookies, local storage and consent

On your first visit to this website, a cookie banner appears through which you can choose whether, in addition to technically necessary storage, Google Analytics and artist-referral measurement may be used. Without your consent ("Essential only"), no analytics or tracking service is loaded. You can change your choice at any time via "Cookie settings" in the footer.

Technically necessary local storage

Regardless of your consent, we use technically necessary local storage (local storage in your browser): your choice in the cookie banner, so that the banner is not shown to you again on every visit, and your language choice (German/English) so that the website is shown in your preferred language on future visits; the initial assessment is based on the language configured in your browser. No location or IP analysis takes place for this. In addition, the website guide ("BUDDY", a rule-based chat assistant without any AI connection) remembers in session storage for the duration of your session whether the chat window is open; your chat input is processed exclusively locally in your browser and is never transmitted to us or to third parties. This storage contains no personal data and is not transmitted to third parties. The legal basis is our legitimate interest in a user-friendly presentation (Art. 6 (1) (f) GDPR) and § 25 (2) TDDDG (formerly TTDSG).

Anonymous link visits and artist attribution

Links and embedded product cards of participating artists contain a random link identifier. When such a link is opened, the server increases only an anonymous aggregate counter for that link. No IP address, browser identifier, cookie, referrer or visitor profile is stored for this counter. It is used solely to understand the basic reach of our collaborations. A separate click record and a tamper-protected attribution cookie valid for 30 days are created only after you select "Accept all". For this consent-based attribution, we store the link identifier, time and a non-reversible HMAC pseudonym derived from the IP address and browser identifier; the full IP address, referrer URL and entered content are not stored. The pseudonym is erased after 90 days and unassigned click records after 13 months. The legal basis for pseudonymous attribution is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

Google Analytics 4 (only with consent)

If you have given your consent via our cookie banner, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies or comparable technologies that enable an analysis of your use of the website (e.g. pages visited, time spent, device used, approximate region of origin). We use this information to understand which content is used most and to improve our offering. Google Analytics 4 does not store full IP addresses; IP anonymisation is active by default.

Data may be transferred to servers of Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework; in addition, we have concluded a data processing agreement with Google (Google Ads Data Processing Terms). The legal basis for the use is exclusively your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw your consent at any time with effect for the future by selecting "Essential only" via the "Cookie settings" link in the footer. Further information on data protection at Google can be found at policies.google.com/privacy.

6. Your rights

Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of the data processing, and, if applicable, a right to correction, blocking or deletion of this data. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data, as well as a right to data portability. You can contact us at any time using the address given in the legal notice for this or any other questions on the subject of personal data.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information, who is responsible for Bonn / North Rhine-Westphalia.

Last updated: July 2026