Legal Notice
Information pursuant to Section 5 of the German Digital Services Act (DDG)
TierConnect UG (haftungsbeschränkt)
Friedrich-Stroh-Str. 16
71522 Backnang
Germany
Represented by
Managing Director: Qing Ji
Contact
Email: service@craftmypaw.com
Commercial register
Registered with: Local Court (Amtsgericht) Stuttgart
Registration number: HRB 804178
VAT identification number
VAT identification number pursuant to Section 27a of the German VAT Act: DE461850660
Consumer dispute resolution
We are neither willing nor obliged to participate in dispute-resolution proceedings before a consumer arbitration board.
Privacy Notice
Last updated: 14 August 2026
This Privacy Notice explains how personal data is processed when you visit this website, contact us, create an account, configure a personalised product, or place an order.
1. Controller
TierConnect UG (haftungsbeschränkt)
Friedrich-Stroh-Str. 16
71522 Backnang, Germany
Email: service@craftmypaw.com
Data-protection contact: service@craftmypaw.com
Data Protection Officer: No data protection officer has been appointed because the controller is not legally required to appoint one.
2. Data we process, purposes, and legal bases
Website access and server logs
When the website is accessed, technical data such as IP address, date and time, requested page, referrer URL, browser, operating system, device information, and response status may be recorded. We use this data to deliver the website, maintain security, investigate faults, and prevent misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of the website. Log data is generally retained for seven days, unless a security incident, suspected misuse, or a legal obligation requires longer retention.
Orders and contract performance
We process contact, billing and delivery details, order contents, communications, payment status, and transaction identifiers to process orders, deliver products, manage returns, and provide customer service. The legal bases are Article 6(1)(b) GDPR (contract performance and pre-contractual steps) and Article 6(1)(c) GDPR (tax, accounting, and other legal obligations).
Personalised-product files
If you create a personalised product, we process the photographs, pet names, text, design choices, previews, and other files you submit. This is necessary to create and manufacture the requested product and is based on Article 6(1)(b) GDPR. We share the uploaded pet photograph, the selected colours and accessories, and an internal order reference with a contracted design and manufacturing provider located in China for the sole purpose of creating the 3D preview and manufacturing the personalised product. That provider does not receive the customer’s name, email address, telephone number, payment details, or delivery address. We do not send customisation files to any other external AI or online image-processing service. Customisation files are generally deleted 12 months after completion of the order, subject to legal retention duties and the handling of claims.
Customer accounts
If you create an account, we process your login details, contact details, saved addresses, and order history to provide and secure the account. The legal basis is Article 6(1)(b) GDPR. Account data is retained until the account is deleted, except where legal retention duties or unresolved claims require continued storage.
Payments
Payment data is processed by the payment method selected at checkout. We generally receive only confirmation, status, and transaction identifiers rather than complete card or bank credentials. The legal bases are Article 6(1)(b) GDPR and, for fraud prevention and payment security, Article 6(1)(f) GDPR. The planned payment providers are Stripe and PayPal. Only payment methods enabled at checkout are used.
Shipping and fulfilment
We share the name, delivery address, contact details where required for delivery, and shipment information with contracted postal and delivery service providers selected for the destination. The legal basis is Article 6(1)(b) GDPR. The specific carrier will be identified in the shipment notification where available.
Contact and customer support
When you contact us, we process your contact details, message, and related order information to respond. The legal basis is Article 6(1)(b) GDPR where the request concerns a contract or possible order, and otherwise Article 6(1)(f) GDPR. Our legitimate interest is efficient customer communication. Requests are generally retained for up to three years after the request or case has been resolved, subject to longer legal retention duties and the handling of claims.
Newsletter and marketing
If you subscribe to marketing communications, we process your email address and consent record on the basis of Article 6(1)(a) GDPR. Subscriptions are confirmed using a double opt-in process. We use Hostinger Reach to send the newsletter. You may withdraw consent at any time using the unsubscribe link or by contacting us. The withdrawal does not affect processing carried out before it. Your email address and consent record are retained while you remain subscribed. After you unsubscribe, your address is removed from the active marketing list; a minimal suppression record may be retained to ensure that no further marketing messages are sent.
3. Cookies and similar technologies
Technically necessary cookies and local-storage items are used to provide functions expressly requested by you, such as the shopping cart, checkout, security, consent storage, and account login. Where Section 25(2) TDDDG applies, no consent is required for that device access; the subsequent processing is based on Article 6(1)(b) or (f) GDPR, as applicable.
Non-essential technologies, including analytics, advertising, or external-media technologies, are used only after consent. Device access is then based on Section 25(1) TDDDG and the related personal-data processing on Article 6(1)(a) GDPR. Consent can be withdrawn at any time through the cookie settings. A current list of technologies, providers, purposes, durations, and third-country transfers must be provided in the cookie settings or Cookie Policy.
4. Fonts and third-party content
The fonts used for the website’s visual presentation are hosted on our own web server. A connection to Google is not made solely to load these fonts. If other third-party content is added later, this notice and the consent configuration must be updated before that content is activated.
5. Recipients and processors
Depending on the service used, recipients may include Hostinger for hosting and newsletter delivery through Hostinger Reach; Stripe and PayPal for payments and payment security; a contracted design and manufacturing provider located in China for personalised-product production; contracted postal and delivery service providers; professional advisers; and public authorities where legally required. We use processors under Article 28 GDPR where applicable.
6. International transfers
The contracted design and manufacturing provider is located in China. Before personalisation files are transferred to that provider, TierConnect UG will enter into a data processing agreement under Article 28 GDPR and the European Commission’s Standard Contractual Clauses under Article 46 GDPR, assess the transfer, and implement any necessary supplementary safeguards. Personalisation files must not be transferred until these measures are in place. Stripe, PayPal, and Hostinger may also process data outside the European Economic Area as described in their privacy notices; the applicable provider is responsible for using a lawful transfer mechanism, such as an adequacy decision or appropriate safeguards.
7. Retention
We retain personal data only for as long as needed for the purpose for which it was collected and to comply with statutory retention periods. In particular, transaction, invoice, tax, and business correspondence records may need to be retained under German commercial and tax law. After the relevant period expires, data is deleted or anonymised unless it is still needed for claims or another lawful purpose. The specific operational retention periods are described above; longer statutory periods remain unaffected.
8. Is providing data required?
Information marked as required during checkout is necessary to enter into and perform the purchase contract or to meet legal obligations. Without it, we may be unable to accept or fulfil the order. Other information is voluntary unless stated otherwise. The shop currently offers sales and delivery only to customers in the 27 member states of the European Union.
9. Automated decision-making
Stripe and PayPal may use automated systems for fraud prevention, payment security, and transaction-risk checks as described in their privacy notices. TierConnect UG does not otherwise make decisions based solely on automated processing that produce legal effects or similarly significantly affect customers.
10. Your rights
Subject to the legal requirements, you may request access to your personal data, rectification, erasure, restriction of processing, and data portability. You may also withdraw consent at any time with future effect.
Right to object: Where processing is based on Article 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation. Where personal data is processed for direct marketing, you may object at any time without giving reasons. We will then stop processing for direct marketing.
To exercise a right, contact service@craftmypaw.com. We may request information necessary to verify your identity.
11. Complaints
You have the right to lodge a complaint with a data-protection supervisory authority. The supervisory authority responsible for our establishment is:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart, Germany
Email: poststelle@lfdi.bwl.de
Website: www.baden-wuerttemberg.datenschutz.de
12. Security and changes to this notice
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, or access. We may update this notice when our services, providers, or legal obligations change. The version published on this page applies.