Privacy policy

Last updated: 9 October 2026

1. Who is responsible

Tillo Studio, inh. Mike Djossou

Germany
Email: contact@tillostudio.com

This policy explains what personal data we process when you visit tillostudio.com, order from us or contact us, why we do it, and what rights you have.

2. Visiting the website

Our shop runs on Shopify (Shopify International Ltd., Dublin, Ireland). When you visit the site, Shopify processes technical data such as your IP address, browser and device type, pages visited and time of access. This is needed to show the website and keep it secure (Art. 6 (1)(f) GDPR, our legitimate interest in a working and secure shop).

Fonts and images are loaded from our own shop. We do not use Google Fonts, Google Analytics, or advertising pixels.

3. Cookies

We only use strictly necessary cookies without your consent. Statistics and preference cookies are only used if you agree in the cookie banner (Art. 6 (1)(a) GDPR, § 25 TDDDG). You can change your choice at any time. Details: Cookie policy.

4. Orders

When you order, we process your name, email address, delivery and billing address, phone number (if given), your order and any text, sizes, photos or logos you send us for your design. We need this to make, ship and invoice your order (Art. 6 (1)(b) GDPR) and to meet tax and accounting duties (Art. 6 (1)(c) GDPR).

5. Payment

Payments are handled by the provider you choose at checkout: card payments through Shopify Payments, PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg), Apple Pay or Google Pay. We do not see or store your full card details. The provider receives the data needed for the payment (Art. 6 (1)(b) GDPR) and may also check for fraud.

6. Shipping

To deliver your order, we pass your name and delivery address to DHL Paket GmbH / Deutsche Post AG (Bonn, Germany). If you agree, we also pass your email address or phone number so DHL can tell you about the delivery (Art. 6 (1)(a) GDPR). Otherwise only the address is shared (Art. 6 (1)(b) GDPR).

We manage orders and shipping in Billbee (Billbee GmbH, Germany), which processes order and address data on our behalf under a data processing agreement (Art. 28 GDPR).

7. Contact and chat

If you email us or use the chat, we process your message and contact details to answer you (Art. 6 (1)(b) or (f) GDPR). Our email is hosted by IONOS SE (Montabaur, Germany). The chat on our site is Shopify Inbox, provided by Shopify.

8. AI assistance

We use Claude by Anthropic (Anthropic PBC, USA) as a tool to help us process orders and draft replies to customer messages. Order details or messages may be processed for this. We only share what is needed and every reply is checked by us (Art. 6 (1)(f) GDPR, our legitimate interest in handling orders efficiently). Transfers to the USA are covered by EU standard contractual clauses.

9. Transfers outside the EU

Some providers (Shopify, PayPal, Anthropic) may process data outside the EU, for example in Canada or the USA. These transfers are protected by an EU adequacy decision (Canada, and companies certified under the EU-U.S. Data Privacy Framework) or by EU standard contractual clauses.

10. How long we keep data

Order and invoice data: 10 years, as required by German tax law (§ 147 AO, § 257 HGB). Design files you send us: until the order is complete and any warranty period has passed, then deleted. Messages: as long as needed to handle your request. Cookie choices: up to 1 year.

11. Your rights

You have the right to access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). If you gave consent, you can withdraw it at any time with effect for the future. Just write to contact@tillostudio.com.

You can also complain to a data protection authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

12. Do you have to give us your data?

To order, we need your name, address and email. Without them we cannot deliver. We do not use automated decision-making or profiling.