Privacy policy
Stand: 13. March 2026
This policy describes which personal data we process when you visit bitaxe.de and place an order, why we do so and what rights you have.
This English version is a convenience translation. In case of doubt, the German version of this page applies.
1. Controller
Nanohash OÜ, Ehitajate tee 110, 13517 Tallinn, Estonia
Email: [email protected]
Registry number 17442825, VAT ID EE102957611
We are not required to appoint a data protection officer. For questions about data protection, please write directly to the address above.
2. Legal bases
We process data on the basis of Art. 6 (1) (b) GDPR (contract and pre-contractual measures), (c) GDPR (legal obligations, for example under commercial and tax law), (f) GDPR (legitimate interests, for example the secure operation of the shop) and (a) GDPR (consent, for example for analytics cookies and the newsletter).
3. Hosting and delivery of the website
Our shop runs on rented servers of a hosting provider within the European Union. The provider processes the data exclusively on our behalf (Art. 28 GDPR).
In front of it sits the content delivery network of Cloudflare (Cloudflare, Inc., USA, and Cloudflare Germany GmbH). Cloudflare delivers content from a data centre near you, filters attacks and establishes the encrypted connection. In doing so, Cloudflare processes the IP address and technical connection data. The basis is our legitimate interest in a fast and attack-resistant shop (Art. 6 (1) (f) GDPR); transfers to the USA are covered by standard contractual clauses, supplemented by certification under the EU-US Data Privacy Framework.
4. Server log files
Every request is automatically logged: IP address, date and time, requested address, amount of data transferred, status code, referring page as well as browser and operating system. We need this data for operation, troubleshooting and security (Art. 6 (1) (f) GDPR). We delete it after 14 days at the latest, unless a security incident requires longer retention.
5. Cookies and consent
We set technically necessary cookies without consent (§ 25 (2) TDDDG): the session identifier, the cart, protection against form abuse (CSRF), the storage of your cookie decision and your language choice (German or English).
Everything beyond that – in particular web analytics – is only loaded once you agree in the cookie banner. You can change or withdraw your decision at any time via “Cookie settings” in the footer; withdrawal takes effect for the future.
6. Orders in the shop
For an order we process name, billing and delivery address, email address, ordered items, prices, chosen payment method and the order status. Without this data no contract can be concluded (Art. 6 (1) (b) GDPR). We keep invoices and receipts for up to ten years in accordance with commercial and tax law obligations (Art. 6 (1) (c) GDPR).
A customer account is not required – you order as a guest. You retrieve the status of your order through a non-personalised link that we send you by email.
7. Payment processing
Bitcoin and Lightning: processing runs through our own BTCPay Server. No payment provider is involved and we receive no bank details. Transactions on the Bitcoin blockchain are, however, public and permanently visible by design.
Card, Apple Pay and Google Pay: these payments are handled by Revolut Payments UAB (Lithuania). You enter card and payment details there; we neither see nor store them. We only receive confirmation of whether the payment succeeded.
PayPal: processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Order number, amount and the details necessary for the payment are transmitted. PayPal’s privacy policy applies in addition.
Bank transfer: we receive the details your bank transmits in the payment reference and match the incoming payment to your order.
The legal basis in each case is Art. 6 (1) (b) GDPR.
8. Shipping
For delivery we pass name, delivery address and – where necessary to arrange delivery – email address to DHL or UPS (Art. 6 (1) (b) GDPR). As soon as the shipment is on its way we send you a shipping confirmation with a tracking link.
9. Merchandise management
We manage orders, stock and prices in our own merchandise management system (“Kontor”), which runs on rented servers in Europe. Order data is transferred there so that we can allocate payments, ship goods and issue invoices. It is operated on our behalf and on the basis of a data processing agreement (Art. 28 GDPR).
10. Contact by email or Telegram
If you write to us, we process your details in order to answer the enquiry (Art. 6 (1) (b) or (f) GDPR). For live chat we use Telegram (Telegram FZ-LLC, Dubai). If you write to us there, Telegram’s terms apply in addition; you should not send sensitive data through that channel. We delete enquiries once they are settled and no retention obligation applies.
11. Product reviews
After shipping we send you a personal, signed link through which you can review the product you bought (Art. 6 (1) (f) GDPR – interest in genuine, verifiable reviews). First name, date, star rating and your text are published; we do not publish the email address. On request we remove a review again.
Reviews from our previous shop system were carried over with first name and date.
12. Newsletter
If you sign up to our list, we store the email address, the time and the IP address of the sign-up as proof of consent (Art. 6 (1) (a) GDPR). We send you offers, restock notices and new guides. Every email contains an unsubscribe link; after unsubscribing we only process the address in order to exclude it from further mailings.
13. Web analytics with Google Analytics 4
Only with your consent do we use Google Analytics 4 (Google Ireland Limited, Ireland). It tells us which pages are viewed and how orders come about. The service runs in consent mode: without consent no analytics cookies are set and no identifiers are transmitted. IP addresses are processed in truncated form. A transfer to the USA to Google LLC is possible; the basis is standard contractual clauses and the EU-US Data Privacy Framework. Legal basis: Art. 6 (1) (a) GDPR, § 25 (1) TDDDG. You can withdraw consent at any time via “Cookie settings”.
14. Protection of the administration area
The login to the internal administration area is protected against automated attacks by Cloudflare Turnstile (Art. 6 (1) (f) GDPR). Customers are not affected by this.
15. Recipients of the data
- Hosting provider in the EU (operation of the website)
- Cloudflare (delivery, attack protection)
- Payment providers: Revolut Payments UAB, PayPal (Europe) S.à r.l. – with Bitcoin, nobody
- Shipping providers: DHL, UPS
- our merchandise management system Kontor (data processing)
- Google Ireland Limited – only where consent to web analytics has been given
- tax advisors and accounting within the scope of legal obligations
- authorities and courts where we are obliged to do so
16. Transfers to third countries
Where data reaches countries outside the EU/EEA – in particular with Cloudflare, Google and Telegram – we base this on the European Commission’s standard contractual clauses, supplemented where appropriate by additional safeguards or certification under the EU-US Data Privacy Framework.
17. Retention periods
- Order and invoice data: up to ten years (commercial and tax law obligations)
- Server log files: 14 days
- Enquiries by email or Telegram: until settled, then within the scope of retention obligations
- Newsletter data: until you unsubscribe, proof of consent beyond that
- Reviews: until withdrawal or until we remove them
18. Your rights
You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and a right to object to processing based on legitimate interests (Art. 21 GDPR). You may withdraw consent at any time with effect for the future. An informal message to [email protected] is enough.
19. Right to complain
You can lodge a complaint with a data protection supervisory authority, for example the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the authority of your country of residence.
20. Obligation to provide data
For an order we need the data mentioned; without it we cannot perform the contract. All other details are voluntary.
21. No automated decision-making
Automated decision-making or profiling within the meaning of Art. 22 GDPR does not take place.
22. Changes to this policy
We adapt this policy when the shop or the legal situation changes. The version published here at the time applies.