Legal Notice, Terms & Privacy Policy

Last updated: 1 September 2026

This page is also available in German. This is a courtesy translation for convenience; the German version is legally authoritative, and where the two differ, the German text prevails.

Legal notice (Impressum)

Information pursuant to § 5 DDG (Digitale-Dienste-Gesetz, the German Digital Services Act, replacing the Telemediengesetz since 14 May 2024):

Contact: mail@clipmark.de

VAT identification number (USt-IdNr.) under § 27a UStG: DE321159082

Responsible for content under § 18 Abs. 2 MStV (Medienstaatsvertrag, the German Interstate Media Treaty): as stated above.

Controller within the meaning of Art. 4 Nr. 7 DSGVO (GDPR) for the processing described below: as stated above.

Consumer dispute resolution: We are neither obliged nor willing to take part in dispute resolution proceedings before a consumer dispute resolution body (Verbraucherschlichtungsstelle, § 36 VSBG). The European Commission's online dispute resolution platform was discontinued on 20 July 2025; a reference to it is therefore omitted.

Terms

These terms apply to every contract for setting up and operating a clipmark page. They are deliberately short; anything not covered here follows from statutory law.

1. Scope and contracting parties

The offer is addressed exclusively to entrepreneurs within the meaning of section 14 of the German Civil Code, to legal entities under public law and to registered associations. No contract is concluded with consumers. By placing an order the customer confirms that they are acting in the course of their trade, business or profession. Any conflicting terms of the customer do not apply, even if we do not expressly object to them.

2. Services

We set up a branded page on a subdomain of clipmark.de and operate it for the agreed term. Visitors use that page to create an image with the customer’s overlay; the photo is processed exclusively in the visitor’s browser. We do not owe any particular outcome, in particular no specific number of uses or level of reach.

3. Conclusion of contract, prices and payment

The presentation on clipmark.de is not a binding offer. The contract is concluded when we confirm the order. All prices are net and exclusive of statutory VAT. Payment is made before activation via the payment service provider Mollie B.V.; the page is activated once payment has been confirmed. The invoice is sent electronically.

4. Term and expiry

The term begins on activation and runs for six or twelve months depending on the order. It does not renew automatically and does not need to be cancelled. After expiry the address shows a notice instead of the page. The files belonging to the page are then deleted unless an extension has been agreed.

5. Content and customer obligations

The customer provides the logo, texts and any other content and warrants that they hold the necessary rights. The customer indemnifies us against third-party claims raised against us because of that content, including reasonable costs of legal defence. Unlawful or infringing content and content contrary to public policy is not permitted. Where there is reasonable suspicion we may suspend the page temporarily and will inform the customer without undue delay; in the event of a serious breach we may terminate the contract for cause.

6. Availability

We operate the page with the care of a prudent business person but do not owe any particular level of availability. Maintenance, faults at upstream providers and events beyond our control may cause interruptions. Where possible we schedule planned work outside the agreed event periods.

7. Liability

We are liable without limitation in cases of intent and gross negligence, for injury to life, body or health, where a guarantee has been given and under the German Product Liability Act. In cases of slight negligence we are liable only for breach of a material contractual obligation, that is an obligation whose fulfilment makes proper performance of the contract possible in the first place and on whose observance the customer may regularly rely, and then limited to the foreseeable damage typical of this type of contract, in no case exceeding the fee paid for the contract concerned. For loss of data we are liable only up to the expense that would have been required to restore it had the customer maintained proper and regular backups. Any further liability is excluded.

8. Data protection

The core function does not give rise to processing on behalf of the customer, because the photo never leaves the visitor’s device. Where processing on behalf does come into consideration in an individual case, we will conclude an agreement under Article 28 GDPR on request. In all other respects the privacy policy on this page applies.

9. Changes to these terms

A contract already concluded is governed by the version of these terms available at the time it was concluded. Changes apply only to contracts concluded afterwards.

10. Final provisions

German law applies, excluding the UN Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction for all disputes arising from this contract is Düsseldorf, Germany, provided the customer is a merchant, a legal entity under public law or a special fund under public law. Amendments and supplements must be made in text form.

Privacy policy

The essentials first

clipmark generates profile pictures with a brand overlay. The photograph chosen for this does not leave the device. There is no upload endpoint for portraits: the page reads the file via URL.createObjectURL, draws it in the browser on a canvas and saves the result as a download. For this core function, no personal image data is transmitted to us, and to that extent no Auftragsverarbeitung (data processing on our behalf) arises either.

This site (clipmark.de) sets no cookies and embeds no third-party host. Fonts are hosted on our own server, not with a font service. For traffic measurement, a self-hosted Umami instance runs on our own server, without cookies and without recognising visitors across visits; more on that below. On customer pages, even that does not take place.

Controller

The controller is the person named in the legal notice (Impressum). Appointing a data protection officer is not required under Art. 37 DSGVO and § 38 BDSG.

Hosting

The servers are located in Germany and are operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen. We have a data processing agreement (Auftragsverarbeitung) with Hetzner under Art. 28 DSGVO. Hetzner keeps its own system logs under its own retention periods, over which we have no influence. No transfer to a third country takes place.

The application itself keeps no access log; the upstream web server is configured without an access log. Only technical errors are logged, and these without an IP address.

When you visit a customer page

Customer pages are located at <kunde>.clipmark.de and run on the same server. There, the following applies in addition:

• No image is sent to us. The page fetches exactly one file, namely the template as JSON. Everything else happens in the browser.
• Session cookie on protected pages. If a page is only accessible with an access code, the code is exchanged for a cookie (csid) so that it does not remain in the address bar. The cookie contains a random value, no information about you as a person; it is HttpOnly, SameSite=Lax and expires after twelve hours. The legal basis is § 25 Abs. 2 Nr. 2 TDDDG in conjunction with Art. 6 Abs. 1 lit. b and f DSGVO: without this cookie, the function you requested cannot be provided. Public pages set no cookie.
• Abuse protection. Every check of an access code is limited in number. For this, your IP address is held exclusively in working memory, for the duration of the ten-minute time window, and is written neither to a file nor to a database. The legal basis is Art. 6 Abs. 1 lit. f DSGVO, legitimate interest in protection against the guessing of access codes.
• No traffic measurement. Customer pages, too, embed no analytics service and no third-party host. Fonts are downloaded before publication and delivered by us.

Traffic measurement on clipmark.de

On clipmark.de we measure how the site is used. For this, Umami runs on our own server in Germany, not with an analytics provider. There is no Auftragsverarbeitung with a third party and no transfer to a third country.

• No cookie, no recognition. Nothing is stored on your device and nothing is read from it. To count repeat visits within a day, Umami forms a checksum from the IP address, browser identifier and a randomly chosen value that changes daily. The IP address itself is not stored, and from the next day on the checksum can no longer be matched to an earlier one.
• No third-party host. The measurement script and the reports run via clipmark.de/analyse/…. Here too, your browser communicates exclusively with this domain.
• What is measured: the page visited, referrer, screen size, browser and country. In addition, individual events that indicate at which point someone proceeded further, for instance that the demo was opened or a step in the design wizard was reached. These events contain no input from you: no names, no addresses, no files.
• The legal basis is Art. 6 Abs. 1 lit. f DSGVO, legitimate interest in designing this site to meet demand. A consent banner is not required because no information is either stored on or read from the terminal device (§ 25 Abs. 1 TDDDG).

On customer pages at <kunde>.clipmark.de, no traffic measurement takes place, not even our own. A portrait is processed there, and these pages stay silent.

Contacting us

If you write to us by email, we process your address and the content of your message in order to answer it. The legal basis is Art. 6 Abs. 1 lit. b DSGVO for an enquiry relating to a contract, otherwise Art. 6 Abs. 1 lit. f DSGVO. The mailbox is with the same provider as the servers. We delete the correspondence as soon as it is no longer needed and no commercial or tax-law retention obligation stands in the way.

Payment processing

If you order a page, we handle the payment via Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. For this we transmit to Mollie the billing address you provided (company, street and house number, postal code, town and country), your email address as well as the amount and a payment reference naming the term booked.

Your payment details do not reach us. You enter card and account details only on Mollie's payment page; we never see them at any point and do not store them. All that comes back to us is whether a payment was confirmed and for which amount.

The legal basis is Art. 6 Abs. 1 lit. b DSGVO: without this transfer the contract cannot be performed. For the payment processing itself, Mollie is its own controller within the meaning of Art. 4 Nr. 7 DSGVO and maintains its own privacy policy for it, over which we have no influence. Mollie is based in the Netherlands, so no transfer to a third country takes place.

Storage period

• Access sessions: twelve hours, seven days for a customer preview; after that they become invalid.
• Abuse counters: ten minutes, in working memory only, and gone with every restart.
• Customer pages: templates, colours and the client's uploaded brand material remain stored for the term and are deleted once it ends.
• Invoices and the associated data: ten years. This period is prescribed by § 14b UStG and § 147 AO; earlier erasure is therefore not possible for us.
• Emails: see above.

Recipients and third countries

We do not pass data on to advertising networks and we do not integrate any external analytics service; traffic measurement runs on our own server. The only recipients are the service providers named above: Hetzner Online GmbH for operating the servers and Mollie B.V. for payment processing, each to the extent described there. Both are based in the European Union; no transfer to a country outside the EU or the EEA takes place. We make a data processing agreement (Auftragsverarbeitung) under Art. 28 DSGVO for our service available to clients on request.

Your rights

With regard to personal data concerning you, you have the right to:

• access (Art. 15 DSGVO), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18);
• data portability, that is a copy in a structured, machine-readable format (Art. 20);
• object to processing based on our legitimate interest (Art. 21);
• withdraw any consent given, with effect for the future (Art. 7 Abs. 3).

To exercise these, please contact the address given in the legal notice (Impressum).

You also have the right to lodge a complaint with a supervisory authority (Art. 77 DSGVO). The competent authority is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf.

No automated decision-making, including profiling, within the meaning of Art. 22 DSGVO takes place.

Right to one's own image

These pages process portrait photographs. That the photograph does not leave the device is the technical answer to that. Anyone who subsequently publishes a generated image decides that themselves; obtaining the consent of the person depicted remains the responsibility of whoever publishes it.

Liability for content and links

We are responsible for our own content on these pages under the general laws. Responsibility for the content of linked external sites lies with their respective provider; no legal violations were apparent at the time of linking. Trade marks and other commercial designations (Kennzeichen) on customer pages belong to the respective client and are used only within the scope of the commission.