LEGAL INFORMATION
Privacy Policy
Datenschutzerklärung · Updated 24 October 2026
1. Who operates this website
The controller is Robert Holts, trading as BAMBOLEILO, Einzelunternehmen, Britzer Straße 36, 16225 Eberswalde, Germany. Email: robgolz@yahoo.com. This policy covers our brand website, not the external stores linked from it.
2. Hosting and necessary technical processing
The website is hosted through ChatGPT Sites by OpenAI. For this German operator, the Sites contracting entity is OpenAI Ireland Ltd. OpenAI hosts website data on our behalf under the hosting provisions of the ChatGPT Sites Terms and the incorporated Data Processing Addendum, including its infrastructure providers. Technical delivery necessarily involves processing connection data such as IP address, request time, requested resource and HTTP headers.
The purpose is to deliver the pages, maintain availability and protect against abuse. Our legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure and functional business website. We do not keep identifiable access logs in the website application. Host-level processing is separate from our aggregate counters. Technical records are retained only as necessary for delivery, security, support and applicable legal duties under the hosting terms; we do not assert a fixed log period that the provider has not specified.
Hosting and support may involve processing outside the EEA. We do not promise EEA-only storage. The incorporated DPA provides for EEA transfers using the European Commission’s Standard Contractual Clauses or an applicable adequacy decision. You can request information about the applicable safeguards using our contact address above. OpenAI also explains its own processing in its EU Privacy Policy.
3. Minimal audience measurement
We count requests for our published pages and requests to open our store links. Before recording a counter, the application reduces an event to a day in the Europe/Berlin time zone, a known page or store-link code, a broad source category and an integer count. Source categories include Google, Bing, Pinterest, our stores, internal navigation and direct/other traffic. A referrer or campaign parameter, when present, is used only transiently to select a permitted category.
The counters do not store IP addresses, full referrer URLs, search terms, user-agent strings, names, email addresses, precise event times, user IDs or session IDs. We do not recognize returning visitors or join these records to store orders. Counts are page and link-request events, not a reliable number of unique people; reloads, bots and prefetching can affect them. Known crawler requests and requests with Do Not Track or Global Privacy Control signals are excluded where those signals are available.
We use this limited processing to understand which pages and storefront links are useful and improve the website. The legal basis for any personal data transiently processed for that purpose is Article 6(1)(f) GDPR. Aggregation, fixed categories, no persistent visitor recognition, access restriction and a short reporting window limit the impact on visitors. Statistics are available only to the operator. Daily aggregate objects are removed after 90 days by cleanup on subsequent website activity; reporting excludes older dates. No advertising audience or personal profile is created.
You can object by enabling your browser’s Do Not Track or Global Privacy Control signal, or by contacting us. The site remains usable when measurement is excluded.
4. Cookies and browser storage
The hosting security layer can set Cloudflare’s __cf_bm cookie for bot protection; this was observed during a technical request check. Cloudflare describes a lifetime of 30 minutes of continuous inactivity. It is a security cookie, separate from our aggregate measurement, and may involve international processing under the hosting safeguards above. See Cloudflare’s cookie information.
Our public website application sets no cookies. It stores only a manually selected language (EN or DE) in local storage on your device, so that your choice can be remembered. This value is not sent to the server, contains no visitor identifier, and can be removed through browser site-data settings. Storage is used only for the language preference explicitly selected by you (§ 25(2)(2) TDDDG); the associated processing serves the requested language function under Article 6(1)(f) GDPR. No language preference is stored until you make a manual selection. It loads no external analytics script, advertising pixel, social feed, third-party font or embedded video. All product and character images are served by this website. Normal public browsing does not require a ChatGPT account.
The operator’s separate protected statistics area uses ChatGPT sign-in. If that sign-in is chosen, OpenAI may provide account identity, which is checked only to restrict the statistics area to the operator. Its authentication and service-layer cookies are covered by OpenAI’s Cookie Policy. The public site does not use that identity for audience measurement. Hosting-level security processing remains distinct from our application’s cookie-free design.
5. Email enquiries
If you email us, we process the contact details, message and attachments you choose to provide to respond to you. Purchase-related and pre-contractual enquiries are processed under Article 6(1)(b) GDPR; other enquiries under Article 6(1)(f), our interest in answering correspondence. Any legally required retention is based on Article 6(1)(c).
Correspondence is handled through Yahoo Mail. See Yahoo’s privacy information and its notice for non-users for its processing and international safeguards. We review correspondence for deletion when an enquiry is resolved and retain it only while needed for follow-up, claims or applicable record-keeping duties. Please do not send passwords, payment-card details or unnecessary identity documents.
6. External stores and Pinterest
Etsy, Payhip, Gumroad and Pinterest are ordinary external destinations. Store links pass through a same-site redirect to count the selected destination; only the aggregate event described above is recorded. We do not send the original referring URL to the destination. Opening a link starts a connection to that service under its own privacy policy:
Purchases and downloads are handled by your selected store. This website has no checkout or payment-card collection. Order information may be made available to the seller through that store as described there.
7. Search services
We may use Google Search Console and Bing Webmaster Tools to inspect aggregate search performance, indexing, queries and impressions when those services make data available. No Search Console or Bing tracking script is installed in visitors’ browsers. A verification meta tag or text file proves website management; it does not collect visitor data. These tools’ setup and availability do not mean that pages have been indexed.
8. Your rights and contact
Subject to the GDPR’s conditions, you have rights to access, rectification, erasure, restriction and data portability, and to object to processing based on legitimate interests, including on grounds relating to your situation. If processing relies on consent, you can withdraw it prospectively. Contact Robert Holts at the postal or email address above.
You may complain to a competent supervisory authority, including the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg. We do not make solely automated decisions producing legal or similarly significant effects. You do not have to submit personal information to read the site, although necessary connection data is involved in delivery. This website is a general-audience business site, not a service directed at children.