Privacy Policy

Privacy Policy

Last updated: 10 September 2026

This Privacy Policy explains how we process personal data when you use our website eknitter.com, including our online shop, your customer account, and our contact and newsletter features.

Scope of this privacy policy

This privacy policy applies exclusively to the eKnitter website and its features. Any references to pattern features concern those available on this website.

The eKnitter WebApp is a separate application and is not covered by this website privacy policy.

Correction notice

An earlier version of this policy did not clearly distinguish between the eKnitter website and the eKnitter WebApp. We have removed the WebApp section and corrected the wording to make this distinction clear.

For clarity: the eKnitter WebApp runs locally in your browser. Patterns saved in the WebApp are stored locally on your computer and are not uploaded to the eKnitter website. This is separate from the website’s pattern-sharing feature, where customers could choose to upload patterns (in a forum) to share with others.

We apologise for any confusion caused by the previous wording.

1. Controller

DEngineer UG (haftungsbeschränkt)
Turmstraße 12a
58099 Hagen
Germany

Represented by Managing Director Jeanette Dicke
Email: mail@eknitter.com
Commercial register: HRB 12960, Local Court of Hagen

2. General information and legal bases

Personal data means any information relating to an identified or identifiable person. We process personal data only where a legal basis permits us to do so.

Depending on the particular processing activity, we rely mainly on the following legal bases:

  • Article 6(1)(a) GDPR – your consent;
  • Article 6(1)(b) GDPR – performance of a contract or steps taken before entering into a contract;
  • Article 6(1)(c) GDPR – compliance with a legal obligation;
  • Article 6(1)(f) GDPR – our legitimate interests, including the secure, functional and commercially reasonable operation of our website.

Where information is stored on or accessed from your device, we also comply with Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). We use non-essential cookies and similar technologies only with your consent.

3. Hosting by IONOS

Our website and the data stored through it are hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When you access our website, IONOS processes technical access data such as the requested page or file, date and time of access, browser type, operating system, referrer URL and IP address. According to IONOS, IP addresses are anonymised when collected and visitor data is generally retained for eight weeks.

The processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable provision of the website. Where required, we have concluded a data processing agreement with IONOS under Article 28 GDPR.

Further information: IONOS Privacy Policy.

4. Cookies and consent management with CookieYes

Our website uses cookies and similar technologies. Some are technically necessary, for example for the shopping cart, login, security features or the storage of your privacy choices. Other technologies are used for audience measurement, advertising or external content and are activated only with your consent.

We use CookieYes to manage consent. The provider is CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom. CookieYes may process your consent choice, the time of the choice, website, browser and device information and, where applicable, a shortened or hashed IP address. This processing is necessary to store your choice and demonstrate consent. The legal bases are Article 6(1)(c) and (f) GDPR and Section 25(2)(2) TDDDG.

You may change or withdraw consent at any time with effect for the future through the cookie settings available on our website. Withdrawal does not affect the lawfulness of processing before the withdrawal.

Further information: CookieYes Privacy Policy.

5. Online shop and orders

We use WooCommerce for our online shop. When you place an order, we process in particular:

  • your name and, where applicable, company name;
  • billing and shipping address;
  • email address and, where provided, telephone number;
  • VAT identification number, where provided;
  • products ordered, prices, payment method and shipping method;
  • order, invoice, transaction and communication data;
  • technical data such as IP address and order time where required for security and documentation.

Mandatory information is required to process your order and perform the contract. The legal basis is Article 6(1)(b) GDPR. We process data required by tax and commercial law under Article 6(1)(c) GDPR. Fraud and misuse prevention is based on Article 6(1)(f) GDPR.

We retain order and invoice records in accordance with statutory retention duties. Depending on the type of document, the relevant period is generally six, eight or ten years. We then delete the data unless another legal basis requires continued storage.

6. Customer account

You may create a permanent customer account. We process your name, email address, username and account information, saved billing and shipping addresses, order history and information about enabled content or downloads. Passwords are not stored in plain text.

The processing is necessary to provide the account and manage your orders under Article 6(1)(b) GDPR. You may request deletion of your account. Order, invoice and payment information subject to statutory retention duties remains stored until the relevant retention period expires.

Login with Facebook

As an alternative, you may register or sign in to your customer account using “Login with Facebook”. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you select this login method, you are redirected to Facebook, where you can confirm the sign-in. Depending on the information you authorise, we receive from Meta your Facebook user ID, name, email address and, where applicable, profile picture. We use this information only to create, associate and authenticate your eKnitter customer account.

The processing is based on Article 6(1)(b) GDPR because you select this method to create or use your customer account. Meta processes information relating to your Facebook account under its own responsibility and may transfer data to Meta Platforms, Inc. in the United States and other recipients. Where applicable, Meta relies on the EU-US Data Privacy Framework or other appropriate safeguards for such transfers.

Further information: Meta Privacy Policy.

7. Payment processing

When you make a payment, the information required for the selected payment method is transferred to the relevant payment service provider. This may include your name, billing address, email address, order number, order amount, currency, IP address and payment and transaction information. The legal basis is Article 6(1)(b) GDPR. Security and fraud checks may also be based on Article 6(1)(f) GDPR and on the payment provider’s legal obligations.

Card payments through WooPayments

Card payments are processed through WooPayments. WooPayments is provided by Automattic and uses Stripe as its technical payment provider. Card-entry fields are loaded from the payment provider’s secure environment. We do not store full card numbers or card verification codes on our web server.

Further information: Automattic Privacy Policy and Stripe Privacy Policy.

PayPal

If you select PayPal, your payment is processed by PayPal. PayPal may process your data as an independent controller and may perform identity, creditworthiness, security and fraud checks. PayPal components may be loaded on certain shop or checkout pages to display available payment options and prevent fraud.

Further information: PayPal Privacy Statement.

Trustly

Where Trustly is offered during checkout and you select it, the payment is processed by Trustly Group AB, Sweden. Trustly processes the bank account, identity and transaction information required for the payment as an independent controller.

Further information: Trustly Privacy Policy.

8. Shipping through Sendcloud, UPS and DHL

We use Sendcloud to prepare and manage shipments and transfer the required shipping information to the selected carrier, UPS or DHL. The processed data may include your name, shipping address, email address, telephone number, order number, parcel information and delivery status.

Recipients may include Sendcloud B.V., Stadhuisplein 10, 5611 EM Eindhoven, the Netherlands, United Parcel Service and companies of the DHL Group. Processing is necessary to perform the contract under Article 6(1)(b) GDPR. Where an email address or telephone number is disclosed solely for an optional delivery notification, it is disclosed only where an appropriate legal basis exists.

Further information: Sendcloud Privacy Policy.

9. Contact form and other enquiries

If you contact us by contact form or email, we process your email address, the content of your message and any other information you provide voluntarily. We use this information to respond to your enquiry. The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a contract or steps before entering into a contract. In other cases, the legal basis is Article 6(1)(f) GDPR, and our legitimate interest is responding appropriately to your enquiry.

We delete enquiries when they have been finally resolved and there are no statutory retention duties or legitimate reasons for further storage. Business correspondence may be retained for the applicable statutory period.

10. Google reCAPTCHA

We use Google reCAPTCHA to protect forms against automated submissions and misuse. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA may evaluate information such as your IP address, browser and device information, referrer URL, mouse movements, time spent on the page and existing Google cookies. Data may be transferred to Google LLC in the United States.

reCAPTCHA is loaded only with your consent. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw consent through the cookie settings at any time. Without consent, the use of a protected form may be restricted.

Further information: Google Privacy Policy.

11. Live chat with Chatway

Our website uses the Chatway live chat service. When the chat is loaded or used, the service may process your IP address, device and browser information, page visited, time, chat messages, name and email address where you provide this information.

The chat widget is loaded only with your consent. The legal bases for loading the external service are Article 6(1)(a) GDPR and Section 25(1) TDDDG. If you actively use the chat to contact us, the subsequent processing is also based on Article 6(1)(b) or (f) GDPR.

Further information: Chatway Privacy Policy.

12. Newsletter

If you subscribe to our newsletter, we process your email address and, where provided, your name. We may also store the time, source and technical evidence of your subscription. Newsletter details are managed through our WordPress installation and Noptin, and messages are delivered using IONOS email infrastructure.

We send the newsletter only with your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time through the unsubscribe link in each newsletter or by contacting mail@eknitter.com. After you unsubscribe, we remove your data from the active mailing list. Limited evidence of the previous consent may be retained until the applicable limitation period expires where necessary to defend legal claims, based on Article 6(1)(f) GDPR.

13. Product reviews

Logged-in customers may publish product reviews. We process the display name, rating, review text, relevant product, date and, where required, technical data for misuse prevention. Your selected display name and review content are publicly visible.

Publication is based on your consent under Article 6(1)(a) GDPR. Security and misuse checks are based on Article 6(1)(f) GDPR. You may withdraw consent for the future and request deletion or anonymisation of your review unless overriding legal reasons prevent this.

14. Downloads and restricted content

When you download files or access restricted content, we may process customer account details, entitlement information, the requested file, date and time, IP address and technical log data. This is necessary to provide purchased or enabled content, protect our systems and prevent misuse. The legal bases are Article 6(1)(b) and (f) GDPR.

15. Embedded YouTube videos

We embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you activate a video, YouTube may process your IP address, device and browser information, the page visited and information about your use of the video. If you are signed in to Google, Google may associate this information with your account. Data may be transferred to Google LLC in the United States.

YouTube content is loaded only with your consent. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw consent at any time through the cookie settings.

Further information: Google Privacy Policy.

16. Google Analytics

With your consent, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand how our website is used. The service may process pages viewed, events, approximate region, device and browser information, referrer, session duration and cookie or device identifiers. According to Google, Google Analytics 4 does not log or store individual IP addresses.

The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. In our standard configuration, user-level and event-level data is retained for no more than 14 months; aggregated reports may remain available for longer. You may withdraw consent through the cookie settings at any time.

Data may be transferred to Google LLC in the United States. Where applicable, Google relies on the EU-US Data Privacy Framework or appropriate safeguards such as Standard Contractual Clauses.

Further information: Google Privacy Policy.

17. Google Ads conversion tracking

With your consent, we use a Google Ads tag provided by Google Ireland Limited. This allows us to determine whether users perform particular actions on our website after viewing or clicking an advertisement, for example visiting a product page or completing an order. Google may process cookie and device identifiers, IP address, browser information, pages visited, time, referrer and conversion information.

The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw consent through the cookie settings at any time. Data may be transferred to Google LLC in the United States and, where applicable, is protected through the EU-US Data Privacy Framework or Standard Contractual Clauses.

Further information: Google Privacy Policy.

18. Microsoft Clarity

With your consent, we use Microsoft Clarity, a web analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity generates usage statistics, session recordings and heatmaps. It may process mouse movements, clicks, scrolling behaviour, pages viewed, session duration, device and browser information, approximate location information and pseudonymous identifiers. Form entries and sensitive content should be excluded from recordings or masked.

The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. According to Microsoft, playback data is generally retained for 30 days, while certain labelled sessions, click data and heatmap data may be retained for up to nine months. You may withdraw consent through the cookie settings at any time.

Data may be transferred to Microsoft Corporation in the United States. Microsoft uses appropriate safeguards, including Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Further information: Microsoft Privacy Statement.

19. Recipients and international data transfers

We disclose personal data only where necessary to perform a contract, comply with legal obligations, act on your consent or pursue legitimate interests. Recipients may include hosting, IT, payment, shipping, communications, security and analytics providers, as well as tax advisers, banks and public authorities.

Some providers may process data outside the European Union or the European Economic Area. In such cases, transfers take place only where the requirements of Articles 44 et seq. GDPR are met, in particular on the basis of an adequacy decision, certification under the EU-US Data Privacy Framework or Standard Contractual Clauses. Despite these safeguards, international transfers may involve legal risks, including broader access powers of foreign authorities.

20. Retention periods

Unless a specific retention period is stated in this Privacy Policy, we retain personal data only for as long as necessary for the relevant purpose. We then delete or anonymise the data unless statutory retention duties, the establishment, exercise or defence of legal claims, or another legal basis requires longer storage.

21. Your rights

Subject to the applicable legal requirements, you have in particular the following rights:

  • access to your personal data (Article 15 GDPR);
  • rectification of inaccurate or completion of incomplete data (Article 16 GDPR);
  • erasure of your data (Article 17 GDPR);
  • restriction of processing (Article 18 GDPR);
  • data portability (Article 20 GDPR);
  • objection to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR);
  • withdrawal of consent with effect for the future (Article 7(3) GDPR).

To exercise your rights, contact mail@eknitter.com. To protect your information, we may request appropriate proof of identity.

22. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. Our competent authority is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Telephone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: www.ldi.nrw.de

You may also contact another data protection authority that is competent for you.

23. Data security

We use appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and disclosure. Our website uses TLS/SSL encryption. Nevertheless, no transmission of data over the internet can be protected against every possible risk.

24. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Payment providers may carry out automated security, creditworthiness or fraud checks under their own responsibility.

25. Changes to this Privacy Policy

We may update this Privacy Policy when our website, the services we use or legal requirements change. The current version published on this page applies.