Part A
The kit.ink website
This part covers personal data processed when you visit kit.ink or use the contact form.
1. Controller
luminoso GmbH is the controller for this website and for enquiries sent through the contact form.
- Legal name
- luminoso GmbH
- Country of establishment
- Germany
- Registered business address
- Zschierener Str. 12 c
01259 Dresden, Germany - Commercial register
- Amtsgericht Dresden · HRB 42407
- hello@kit.ink
- Website
- kit.ink
2. What we process and why
The site currently has no account area, order flow, analytics or advertising technology. It provides the contact form described below.
Website delivery and security
When the site is loaded, the hosting infrastructure may process the IP address, date and time, requested URL, referrer, browser and device information, and security events. This is technically necessary to deliver and protect the site.
Purpose: reliable delivery, abuse prevention, troubleshooting and security.
Legal basis: legitimate interests, Article 6(1)(f) GDPR.
Contact form and enquiries
When you use the contact form, we process your name, email address, optional company, selected topic, message, language and technical request metadata so that we can answer and follow up.
Purpose: responding to enquiries, discussing pilots and integrations, and taking steps before a contract where requested.
Legal basis: Article 6(1)(b) GDPR for requested pre-contractual steps; otherwise legitimate interests under Article 6(1)(f) GDPR.
Language preference
The site stores only the selected language (DE, EN or FR) in your browser under the key kit-ink-locale. It contains no name, account or customer identifier.
Purpose: remembering the language you explicitly selected.
This storage is technically necessary for the explicitly requested preference. No consent banner is used for it.
Social links
The site does not embed social media content. If you open an Instagram, LinkedIn or X link, you leave kit.ink and the selected platform processes data under its own privacy terms.
3. Hosting
The website and contact form are hosted by Netlify, Inc. Netlify may process request and security data to deliver and protect the site. Netlify Forms receives and stores contact-form submissions and can send notification emails to our Proton Mail inbox. We do not run audience analytics on this site.
Netlify privacy information4. Cookies and tracking
kit.ink sets no advertising, analytics or profiling cookies and loads no third-party fonts, scripts or embedded media. The local language preference described above is the only browser storage used by the site.
5. Retention
Language preference remains in your browser until you change it, clear site data or browser storage is removed. Enquiries are kept only as long as needed to answer, manage the business relationship, establish or defend legal claims, and meet statutory record-keeping duties. Hosting and security logs follow the configured provider retention periods and are removed or anonymised when no longer needed.
6. Recipients
Access is limited to authorised people at luminoso GmbH and the service providers needed for website hosting, security, form processing and the hello@kit.ink inbox, in particular Netlify and Proton. Providers act under contractual and confidentiality obligations where required.
Part B
The kit.ink Review app
This part covers personal data processed in the kit.ink Review app. Staff of our business customers use the app to check jersey personalizations before production.
7. What the app processes and why
Sign-in
You sign in with your account from your organization. We process the email address and a user identifier that your organization's account system gives us. We do not create or store a separate password for the app.
Purpose: identifying you as authorized staff and showing your organization's own cases.
Legal basis: legitimate interests, Article 6(1)(f) GDPR, and performance of the contract with your organization, Article 6(1)(b) GDPR.
Push notifications
If you turn on push notifications, we store a device token for that device so we can notify you when a case needs review. The token is deleted when you sign out or when your access is deactivated.
Purpose: telling you when a case is waiting, without you having to check the app.
Legal basis: legitimate interests, Article 6(1)(f) GDPR. You can turn push notifications off at any time in the app settings; the app works fully without them.
Business data you view
The app shows jersey personalizations that belong to your organization, so you can approve or reject them. This data belongs to your organization; we process it on your organization's behalf. We do not collect this data from you as an app user.
8. No advertising, no tracking, no sale of data
The app shows no advertising and uses no tracking or analytics technology. We never sell personal data.
9. Retention in the app
Sign-in data is kept for as long as your account with your organization is active. Push device tokens are kept until you sign out or your access is deactivated, whichever happens first.
10. Security
All data between the app and our servers travels encrypted.
11. Your rights in the app
You have the same rights described in section 14. Because your account belongs to your organization, please start with your organization's administrator. You can also contact us directly using the details in section 19; we forward requests to your organization where needed.
Part C
The kit.ink app for Shopify
This part covers personal data processed in the kit.ink app for Shopify. A merchant is a business that runs a Shopify shop. A shopper is a person who personalizes or buys a jersey in that shop. The merchant installs the app in its shop. The app lets shoppers personalize a jersey on the product page. Sections 12 to 19 apply to this part as well.
C1. Who is responsible
The merchant is the controller for the personal data of its shoppers. kit.ink processes this data on behalf of the merchant. The data processing agreement is part of the contract between the merchant and kit.ink. It governs this processing.
kit.ink is operated by luminoso GmbH. For the merchant's own contact data and for the operation of the app, luminoso GmbH is the controller. Section 1 gives its details.
Shopify provides the platform that the shop runs on. Shopify is not a processor of kit.ink. Shopify processes the data of merchants and shoppers under its own privacy terms.
C2. What the app processes and why
Data we receive through Shopify
When a merchant installs the app, the app reads data from Shopify. It reads the data again when the shop details change. This is the data:
- Shop details: the name, the web addresses, the currency and the plan of the shop, and the contact email address of the shop.
- Product details: the name, the picture, the variants and the article numbers of the shop's products. The merchant uses them to link a product to a jersey.
- Order notices: Shopify sends a notice when an order is created, cancelled or refunded. kit.ink asks Shopify to include only the order reference, the item references, the quantities and the item notes. The item notes hold the references that the app wrote and a short summary of the personalization.
- Access keys: Shopify gives the app keys that allow it to act in the shop. kit.ink stores these keys in encrypted form.
kit.ink does not ask Shopify for the name, the address, the email address or the phone number of shoppers. Shopify does not send them. kit.ink keeps only the order reference, the item references, the quantities and its own references to the personalization.
Purpose: connecting the shop to the merchant's contract, setting up the configurator in the shop, linking products to jerseys, and receiving orders. The order notices also stop a cancelled or refunded order from reaching production.
Legal basis: performance of the contract with the merchant, Article 6(1)(b) GDPR, and legitimate interests, Article 6(1)(f) GDPR.
Data from the merchant
kit.ink issues a connect code to the merchant after the contract is signed. The merchant enters the code in the app. This links the shop to the contract. The code works once and expires after 7 days. kit.ink stores only a fingerprint of the code.
The merchant also chooses which product belongs to which jersey. kit.ink stores these choices. The app does not store the name or the Shopify user ID of the staff member who uses it.
Purpose: checking that a contract exists, linking the shop to the merchant's account at kit.ink, and answering support requests.
Legal basis: performance of the contract with the merchant, Article 6(1)(b) GDPR, and legitimate interests, Article 6(1)(f) GDPR.
Data from shoppers
A shopper personalizes a jersey on the product page of the shop. The shopper can enter a name, a number and other text. The shopper can also choose options such as badges. kit.ink saves each change on its servers while the shopper works. When the shopper adds the jersey to the cart, kit.ink saves the final personalization.
From the personalization, kit.ink makes pictures of the jersey, for example the back view with the name and the number. The shop uses these pictures in the cart, at checkout and in its emails.
A name that a shopper enters can be personal data, for example the shopper's own surname. kit.ink does not identify the shopper. kit.ink links a personalization only to the shop and to an order reference.
Purpose: showing the jersey, checking the personalization before production, and handing it to the merchant's shop with its price items. kit.ink also records every step.
kit.ink processes this data only on the instructions of the merchant. The merchant is responsible for the legal basis. In most cases it is the sales contract with the shopper, Article 6(1)(b) GDPR.
In the shopper's browser
The configurator saves the shopper's work in the local storage of the browser. This lets the shopper continue after a page reload. The storage holds the entries, the choices and the references that the browser needs to find the saved personalization again. The configurator sets no cookies. The shopper can remove this storage at any time by clearing the site data of the browser.
The configurator also sends two small technical reports to kit.ink. One report states an error. The other states how long the 3D model took to load. The reports contain no personalization and no page address. They state technical facts, such as the type of error, the loading time and the size of the 3D model. kit.ink writes them to a log and not to its database.
Purpose: letting the shopper continue, and finding faults. The storage is needed for the function that the shopper asks for. The legal basis for the reports is legitimate interests, Article 6(1)(f) GDPR.
Checking personalizations
kit.ink checks every personalization automatically before production. The check looks for content that is not allowed, for example offensive words. If the check finds a problem, it holds the personalization. A person then decides. This person works for the merchant or, if the merchant chose that service, for kit.ink. The check never rejects a personalization on its own.
kit.ink records each decision and its reason. By default, kit.ink uses these decisions to improve the automatic check for all merchants. Before that, kit.ink removes the links to the personalization, the order and the merchant. If the reviewed text holds a name, kit.ink uses it only in a form that does not reveal the text. A merchant can choose in its contract that kit.ink uses its decisions only for that merchant.
kit.ink runs the check on behalf of the merchant. For the improvement of the check across merchants, kit.ink is the controller. The legal basis is legitimate interests, Article 6(1)(f) GDPR. Section C8 explains how to object.
C3. No advertising, no tracking, no sale of data
The app shows no advertising. It uses no tracking or analytics technology in the shop. kit.ink never sells personal data. kit.ink does not use shopper data to build profiles.
kit.ink does not write the IP address of a shopper to its application logs.
C4. How long we keep data
Shop details, product links and the encrypted access keys stay while the app is installed. Section C5 describes what happens when the merchant uninstalls the app.
A personalization that never becomes an order lapses after 30 days. kit.ink deletes it, with its pictures, 30 days later. A merchant can agree other periods in its contract.
A personalization that became an order stays for as long as the order needs it. The default periods after the end of the order are: 30 days after a cancelled order, 90 days after a rejected personalization, and 12 months after printing or handover. Then kit.ink deletes the personalization, with its pictures. A merchant can agree other periods in its contract.
Technical records of order notices are deleted after 7 days. Technical logs are deleted after 30 days. kit.ink keeps a record of the steps taken for each personalization as evidence. This record has no personalization text. It stays for the term of the contract and for the statutory retention periods.
A deletion request overrides these periods. Section C5 describes how deletion requests work.
C5. Uninstalling the app and deleting data
When a merchant uninstalls the app, kit.ink destroys the access keys at once. kit.ink also turns the configurator off in the shop.
48 hours after the uninstall, Shopify asks kit.ink to delete the data of the shop. kit.ink then deletes the shop record, the product links and the personalizations that came from this shop, with their pictures. kit.ink keeps only an audit record that the deletion happened. This record holds no personal data.
Shopify can also ask kit.ink to delete the data of one shopper. kit.ink then deletes the personalizations and pictures of the orders that the request names. kit.ink completes every such request within 30 days.
Shopify can ask kit.ink for the data of one shopper. kit.ink finds the personalizations through the order references in the request. kit.ink has no contact data of shoppers. It therefore sends its answer to the contact email address of the shop, within 30 days. The answer states what kit.ink holds.
C6. Where we process data
luminoso GmbH is established in Germany. kit.ink processes the data of the app on servers of Hetzner Online GmbH in Germany. Proton AG in Switzerland sends the emails of the app, for example the answer to a data request. Switzerland has an adequacy decision of the European Commission. kit.ink does not process the data of the app in any other country.
Section 13 gives the address of each provider.
C7. Security
All data between the shop, the app and the servers of kit.ink travels encrypted. kit.ink stores access keys in encrypted form. kit.ink checks the signature of every notice from Shopify before it reads the notice.
C8. Your rights and how to use them
A shopper uses the rights described in section 14 with the shop. The merchant is the controller. The merchant passes the request to kit.ink where kit.ink holds data for it. Shopify can also pass a request of a shopper to kit.ink. Section C5 describes how kit.ink answers.
Merchants and their staff contact kit.ink directly. Use the details in section 19. Section 15 explains how to complain to a supervisory authority.
A person can object to the use of review decisions that section C2 describes. Use the details in section 19.
The configurator is part of the merchant's shop. kit.ink does not know the age of a shopper and does not ask for it. The merchant is responsible for how its shop deals with children.
12. International transfers
Some infrastructure providers may process data outside the European Economic Area. Where no adequacy decision applies, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and supplementary measures where needed.
13. Processors
We use service providers to run the website and the app. The recipients named in section 6 apply to the website. For the app we use these processors:
- Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany: operation of the app's servers, database and file storage in a data center in Germany. We run the sign-in system ourselves on these servers.
- Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA: delivery of push notifications to iPhones (Apple Push Notification service: device tokens and generic notice texts without personalization data) and distribution of the app through the App Store and TestFlight. Transfer to the USA under the European Commission's Standard Contractual Clauses (section 12).
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Firebase Cloud Messaging): delivery of push notifications to Android devices (device tokens and generic notice texts without personalization data) and distribution of the app through Google Play. Transfer to the USA within the Google group under the European Commission's Standard Contractual Clauses (section 12).
- Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland: delivery of the e-mails the app and the portal send to you, for example the message to set your password. Switzerland is covered by an adequacy decision of the European Commission.
14. Your rights
Depending on the circumstances, you may request access, rectification, erasure, restriction and data portability, or object to processing based on legitimate interests. You may withdraw consent at any time where processing is based on consent. Neither the website nor the app relies on consent-based tracking.
15. Complaints
You may contact us first so we can resolve the issue. You also have the right to lodge a complaint with the Saxon Data Protection and Transparency Commissioner or another competent supervisory authority.
Saxon data protection authority16. Automated decisions
Neither the website nor the app uses profiling or automated decision-making that produces legal or similarly significant effects. Decisions on jersey personalizations are made by human staff at your organization.
17. Children
The kit.ink website and the kit.ink Review app are business tools for staff of our business customers. Neither is directed at children, and we do not knowingly collect children's data through either.
18. Changes to this notice
We update this notice when the website, the app, providers or processing activities change. The date at the top shows the current version.
19. Privacy contact
For privacy questions or to exercise your rights, use the contact form, write to hello@kit.ink, or use the app's support page. We may need enough information to verify and handle your request securely.
Contact form