Privacy notice

In case of conflict, the German version prevails.

1. Data controller

Robert Foehles, trading as TYG5
Sandbienenweg 4
63457 Hanau, Germany
Email: hello@tyg5.com

2. General

TYG5 collects and processes personal data only where necessary to operate a functioning website and handle enquiries, and only on the legal bases set out in Art. 6(1) GDPR.

Important: TYG5 never processes payment data. Purchasing a template happens entirely through an external checkout provider (Merchant of Record) — only that provider's own privacy notice governs the data collected there (payment data, invoicing data). TYG5 does not receive payment details from the checkout provider.

3. Hosting (Vercel)

This website is hosted via Vercel Inc. Visiting the site causes Vercel to automatically process technical access data (including IP address, date and time of access, page visited, referrer URL, browser used) in server log files.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable, error-free provision of the website).

On the Vercel Hobby plan currently in use, runtime logs are retained for 1 hour (per Vercel's own documentation, February 2026).

As Vercel is a US company, personal data may be transferred to the US. A data processing agreement with Vercel is in place. Vercel states it relies on EU Standard Contractual Clauses for international transfers.

4. Google Fonts (web fonts)

This website uses Google Fonts (also known as Google Web Fonts) to render the brand typeface Syne consistently. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

When a page is loaded, the browser fetches the required font files from Google's servers fonts.googleapis.com and fonts.gstatic.com. The visitor's IP address is transmitted to Google in that process. Google may combine this data with other Google services. TYG5 has no influence over that processing.

Purpose: consistent, brand-compliant presentation of the website (Syne in weights 400, 700 and 800).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a consistent and professional presentation of the website).

As Google is a US company, personal data may be transferred to the US. Google states that it relies on EU Standard Contractual Clauses for international transfers.

Further information on Google's processing: https://policies.google.com/privacy https://developers.google.com/fonts/faq

In addition, the body typeface Cabinet Grotesk is loaded via Fontshare, a service of Indian Type Foundry (ITF), Ahmedabad, India. The browser fetches the font files from api.fontshare.com and cdn.fontshare.com. Technical access data (including IP address and the requesting domain) are transmitted in that process. Fontshare states that it does not collect personal user data for tracking or advertising. Further information: https://www.fontshare.com/faq

Legal basis likewise: Art. 6(1)(f) GDPR.

5. Contact form

Submitting the contact form (/kontakt) processes: name, email address, reason for enquiry, relevant template (if any), message text.

Purpose: handling and responding to the enquiry.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measure) or Art. 6(1)(f) GDPR (legitimate interest in handling enquiries), depending on content.

Retention: until the enquiry is fully resolved, then deleted within 6 months unless a statutory retention obligation applies.

6. Waitlist signup

Signing up for the waitlist stores only the email address.

Purpose: notification about new templates or availability.

Legal basis: Art. 6(1)(a) GDPR (consent).

Consent can be withdrawn at any time with future effect, e.g. by emailing hello@tyg5.com. An unsubscribe link is intended in every notification email.

7. Processors

The following service providers act as processors for operating the website and handling enquiries:

Data processing agreements under Art. 28 GDPR are in place, or intended, with all providers listed.

International transfers: Vercel and Supabase are US companies. For Supabase, confirmed (per Supabase's own published Transfer Impact Assessment documents): transfers rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2) plus the UK International Data Transfer Addendum. A data processing agreement is in place with Resend; details of the specific transfer mechanism are available on request (hello@tyg5.com).

8. Cookies

This website uses one functional cookie (TYGLANG) to store the selected language (German/English), retained for 365 days.

As this is a strictly necessary cookie (no analytics or marketing purpose), no consent under Section 25 TTDSG is required (exemption for strictly necessary cookies).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning, language-appropriate site).

Note: Should further cookies (e.g. analytics tools) be introduced in future, this notice must be expanded accordingly and a consent banner may need to be added — not currently the case.

9. Links to external platforms

The "Buy" and "Buy direct" buttons on tyg5.com link to external checkout platforms and, where relevant, the Framer Marketplace. Clicking them leaves tyg5.com; only the respective platform's own privacy notice governs data processing there. TYG5 has no influence over that processing.

10. Data subject rights

Every data subject has the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent with future effect (Art. 7(3) GDPR)

An email to hello@tyg5.com is sufficient to exercise these rights.

11. Right to lodge a complaint

Data subjects have the right to lodge a complaint with a data protection supervisory authority. The competent authority for TYG5 is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Postfach 3163, 65021 Wiesbaden, Germany poststelle@datenschutz.hessen.de

12. Currency of this notice

This privacy notice is updated as needed to reflect changed processing purposes or legal requirements.