Privacy and Cookie Policy
Last updated: 27 August 2026
1. Controller
The controller responsible for processing personal data on this website is:
Thingstone GmbH
Bruchsaler Str. 18
76356 Weingarten
Germany
Managing Director: Collin Raddatz
Commercial Register: Amtsgericht Mannheim, HRB 749403
VAT ID: DE 365945203
Email: info@thingstone.com
Telephone: +49 151 10533333
In this Privacy and Cookie Policy, “we”, “us” and “Thingstone” refer to Thingstone GmbH.
2. Scope of this Privacy Policy
This Privacy and Cookie Policy applies to the website:
It explains which personal data we process when you visit the website, contact us, subscribe to our newsletter or use the Track8 Theme Editor.
Our online shop at https://shop.thingstone.com is operated separately using Shopify and is subject to the privacy information provided there.
Links on this website may lead to external websites operated by third parties. Their own privacy policies apply after you follow such a link.
3. General information about data processing
Personal data is any information relating to an identified or identifiable natural person. This can include an IP address, an email address, technical device information or information submitted when contacting us.
We process personal data only where:
you have given your consent pursuant to Article 6(1)(a) GDPR;
processing is necessary to perform a contract or take steps at your request before entering into a contract pursuant to Article 6(1)(b) GDPR;
processing is necessary to comply with a legal obligation pursuant to Article 6(1)(c) GDPR; or
processing is necessary for our legitimate interests or those of a third party pursuant to Article 6(1)(f) GDPR, provided that your interests, fundamental rights and freedoms do not override those interests.
Where consent is required for storing information on or accessing information from your device, we also obtain consent in accordance with Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
4. Hosting and delivery of the website
This website is created and hosted using services provided by:
Squarespace Ireland Limited
Squarespace House
Ship Street Great
Dublin 8
Ireland
D08 N12C
When you visit the website, Squarespace processes technical data necessary to deliver the website and maintain its security and stability. This may include:
your IP address;
date and time of access;
requested pages and files;
referrer URL;
browser type and browser version;
operating system and device information;
language and regional settings;
technical error and diagnostic information; and
information used to detect and prevent fraud, abuse and attacks.
The processing is necessary to display the website, provide its functions, maintain technical security and diagnose errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of our website and the protection of our systems against misuse.
Technically necessary access to or storage of information on your device is based on Section 25(2)(2) TDDDG.
Squarespace acts as our processor for personal data that it processes on our behalf. Squarespace may also process certain information as an independent controller for its own security, integrity and service-management purposes.
Squarespace Ireland Limited may engage affiliated companies and other subprocessors, including Squarespace, Inc. in the United States. Where personal data is transferred outside the European Economic Area, Squarespace relies, where applicable, on the EU-US Data Privacy Framework. Where the Data Privacy Framework does not apply, Squarespace uses the European Commission’s Standard Contractual Clauses or another legally recognised transfer mechanism.
More information is available in the Squarespace Privacy Policy:
https://www.squarespace.com/privacy
Squarespace Data Processing Addendum:
https://www.squarespace.com/dpa
Technical log and security data is retained only for as long as necessary to provide and secure the website, investigate errors or attacks and fulfil applicable legal obligations. The specific retention period may depend on the nature and purpose of the relevant log entry.
5. Cookies and similar technologies
This website uses cookies and similar technologies, including local storage. Cookies are small data files stored on your device. Local storage allows information to be stored directly in your browser.
We distinguish between:
Technically necessary technologies
These technologies are required to deliver the website, protect it against attacks, store your privacy preferences or provide a function you have expressly requested.
They do not require consent under Section 25(2)(2) TDDDG. Where personal data is processed, the legal basis is Article 6(1)(f) GDPR.
Analytics, performance, marketing and external-media technologies
These technologies help us understand how visitors use the website or enable content supplied by external providers, such as YouTube videos. They are used only after you have given consent through the cookie banner.
The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG.
Managing your preferences
When you first visit the website, you can:
accept all optional technologies;
reject all optional technologies; or
choose individual categories.
You can change or withdraw your decision at any time using the “Cookie Preferences” option displayed on the website.
Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.
6. Squarespace cookies and browser storage
Depending on the pages and functions you use, Squarespace may use the following cookies or browser-storage entries.
Necessary cookies and storage
Crumb
Purpose: Protection against cross-site request forgery and unauthorised form submissions.
Duration: Session.
Test
Purpose: Determines whether the browser supports cookies and helps prevent technical errors.
Duration: Session.
ss_performancecookiesAllowed
Purpose: Stores your decision concerning analytics and performance cookies.
Duration: 30 days.
ss_marketingcookiesAllowed
Purpose: Stores your decision concerning marketing-cookie preferences. This preference cookie does not itself perform marketing tracking.
Duration: 30 days.
squarespace-announcement-bar
Purpose: Remembers whether you dismissed an announcement bar.
Storage type: Local storage.
Duration: Persistent until deleted from the browser.
Squarespace may also use short-lived diagnostic or cookie-test entries to identify errors and verify that the website functions correctly.
Analytics and performance cookies
The following cookies are used only if you consent to analytics and performance technologies:
ss_cid
Purpose: Identifies unique visitors and helps measure visits and sessions.
Duration: Two years.
ss_cpvisit
Purpose: Identifies unique visitors and helps measure visits and sessions.
Duration: Two years.
ss_cvisit
Purpose: Identifies a visitor session.
Duration: 30 minutes.
ss_cvr
Purpose: Identifies unique visitors and helps measure visits and sessions.
Duration: Two years.
ss_cvt
Purpose: Identifies a visitor session.
Duration: 30 minutes.
The technologies actually used may vary depending on the page, browser and Squarespace functions involved. Squarespace may update the names or technical implementation of its cookies. Its current cookie information is available at:
https://support.squarespace.com/hc/en-us/articles/360001264507-The-cookies-Squarespace-uses
We do not currently use independent advertising networks, Google Analytics, Google Tag Manager, Meta Pixel or comparable third-party marketing trackers on this website.
7. Squarespace Analytics
If you consent through the cookie banner, we use Squarespace Analytics to understand how visitors use the website.
Squarespace Analytics may process:
pages visited;
date and time of visits;
duration and sequence of visits;
referring websites;
general device, browser and operating-system information;
approximate geographic information derived from the IP address;
interactions with pages, forms and buttons; and
identifiers stored in the analytics cookies described above.
We use this information to measure website usage, identify technical or usability problems and improve our content and website structure.
The legal bases are your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.
Squarespace Ireland Limited processes this information on our behalf. Transfers to Squarespace group companies and subprocessors are governed by the safeguards described in Section 4.
You can withdraw your consent at any time through the website’s Cookie Preferences. The analytics cookies will then no longer be used for future visits. Previously generated statistics may continue to exist in aggregated form.
8. Newsletter
You can voluntarily subscribe to the Thingstone newsletter. We use the newsletter to provide information about Thingstone, Track8, product updates, software releases, availability, events and related news.
When you subscribe, we process:
your email address;
date and time of registration;
confirmation and consent information;
subscription status; and
technical information required to document and secure the registration process.
Newsletter registrations and mailing lists are stored and managed through Squarespace. Squarespace acts as our processor for this purpose.
We use a confirmation procedure under which you receive an email asking you to confirm your subscription. Your address is added to the active newsletter list only after confirmation.
The legal basis for sending the newsletter is your consent pursuant to Article 6(1)(a) GDPR.
Squarespace Email Campaigns may record whether a newsletter was delivered, opened, whether links were clicked and whether a recipient unsubscribed. This information is used to prepare campaign statistics and improve future newsletters. Where this measurement involves personal data or tracking technologies, it is based on your consent pursuant to Article 6(1)(a) GDPR.
You may withdraw your consent at any time by:
clicking the unsubscribe link contained in each newsletter; or
contacting us at info@thingstone.com.
After unsubscribing, your email address will no longer be used to send newsletters. We may retain limited information in a suppression list to ensure that your unsubscribe request continues to be respected. Evidence of consent may also be retained for the duration of applicable statutory limitation periods where necessary to establish, exercise or defend legal claims. The legal basis for this limited retention is Article 6(1)(f) GDPR.
Subscription is voluntary. You are not legally or contractually required to provide your email address.
9. Contact by email or telephone
If you contact us by email or telephone, we process the information you provide, which may include:
your name;
email address or telephone number;
the content of your enquiry;
attached documents;
date and time of communication; and
related technical and communication metadata.
We process this information to respond to your enquiry and manage subsequent communication.
If your enquiry concerns a potential or existing contract, the legal basis is Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the efficient handling of enquiries and business communication.
Where correspondence is subject to statutory commercial, accounting or tax-retention requirements, it is retained for the required statutory period pursuant to Article 6(1)(c) GDPR. Other correspondence is deleted when it is no longer required and no legal claims or retention obligations require continued storage.
10. Track8 Theme Editor
The Track8 Theme Editor allows you to create and download a theme configuration for a Track8 device.
Information entered into the Theme Editor is used to generate the requested theme configuration and may be included in the downloaded theme file or a generated sharing URL. We do not use theme settings to create advertising profiles or to make automated decisions about users.
A sharing URL may contain the selected theme settings. Anyone who receives that URL may be able to view or reproduce the settings it contains. You should therefore not enter personal, confidential or sensitive information into theme names or other theme fields and should share generated URLs only with intended recipients.
Technical data generated when accessing the Theme Editor is processed as described in Section 4.
The legal basis for providing the Theme Editor is Article 6(1)(f) GDPR. Our legitimate interest is to provide Track8 users with a convenient way to create and exchange device themes.
11. External services and links
11.1 External links
The website contains links to third-party websites, including YouTube, GitHub, retailers and our separate online shop.
No connection to the linked website is established merely because a normal text or image link is displayed. Data is transmitted to the third-party provider only after you choose to follow the link. From that point onward, the third party is responsible for processing data under its own privacy policy.
11.2 Embedded YouTube videos
We embed videos provided by YouTube on parts of this website. The provider responsible for YouTube services in the European Economic Area is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
The embedded YouTube player is activated only after you have consented to the relevant external-media technologies through our cookie banner.
When a YouTube video is activated, information may be transmitted to Google and YouTube. This may include:
your IP address;
the page on which the video is embedded;
browser, device and operating-system information;
date and time of access;
your interactions with the video; and
cookies, local-storage entries or other identifiers used by Google and YouTube.
If you are signed in to a Google account, Google may associate your interaction with that account.
The processing is carried out to display video content on our website. The legal bases are your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.
You can withdraw your consent at any time using the website’s Cookie Preferences. Withdrawing consent does not affect processing carried out before withdrawal.
Google may process information outside the European Economic Area, including in the United States. Where required, such transfers are based on an adequacy decision, including the EU-US Data Privacy Framework where applicable, the European Commission’s Standard Contractual Clauses or another recognised transfer mechanism.
Further information is available in Google’s Privacy Policy:
https://policies.google.com/privacy
11.3 Adobe Fonts
We use Adobe Fonts to provide a consistent presentation of typefaces on this website. The provider for users outside North America is:
Adobe Systems Software Ireland Limited
4–6 Riverwalk
Citywest Business Park
Dublin 24
Ireland
When you access the website, your browser connects to Adobe’s servers to obtain the required font files and related resources. Adobe may receive or process:
your IP address;
the hostname of the page loading the fonts;
information about the fonts being served;
the Adobe Fonts web-project identifier;
the JavaScript version and type of font integration; and
technical information necessary to deliver and diagnose the font service.
Adobe states that its web-font service does not set or use cookies to deliver fonts and that the IP address received for delivery is not stored.
The processing is necessary to provide the fonts and maintain the consistent visual presentation of the website. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the reliable, efficient and consistent presentation of our website.
Adobe may process information outside the European Economic Area, including in the United States. Where required, Adobe relies on recognised transfer mechanisms such as adequacy decisions or the European Commission’s Standard Contractual Clauses.
Further information is available here:
https://www.adobe.com/privacy/policies/adobe-fonts.html
https://www.adobe.com/privacy/policy.html
12. Data retention
Unless a more specific retention period is stated in this Privacy Policy, we retain personal data only for as long as necessary for the purpose for which it was collected.
We delete data when:
the processing purpose has been fulfilled;
you withdraw consent and no other legal basis applies;
you object to processing and there are no overriding legitimate grounds for continued processing; or
continued storage is no longer required.
Data may be retained for longer where required by statutory commercial, accounting, tax or other retention obligations, or where necessary to establish, exercise or defend legal claims.
13. Recipients of personal data
Personal data may be disclosed to:
Squarespace Ireland Limited and its authorised subprocessors;
Adobe Systems Software Ireland Limited and relevant Adobe group companies for the delivery of web fonts;
Google Ireland Limited and relevant Google group companies if you consent to and activate embedded YouTube content;
IT, hosting and security providers acting on our behalf;
professional advisers where necessary;
public authorities where disclosure is legally required; and
other recipients where you have expressly consented or disclosure is otherwise permitted by law.
We do not sell personal data.
14. Automated decision-making
We do not use personal data collected through this website for automated decision-making, including profiling, within the meaning of Article 22 GDPR.
15. Your rights
Subject to the applicable legal requirements, you have the right to:
obtain information about whether and how we process your personal data;
receive a copy of your personal data;
correct inaccurate or incomplete personal data;
request deletion of your personal data;
request restriction of processing;
receive data you provided in a structured, commonly used and machine-readable format;
transmit that data to another controller where technically feasible;
withdraw consent at any time with effect for the future; and
lodge a complaint with a data-protection supervisory authority.
Right to object
Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing on grounds relating to your particular situation.
If your objection concerns direct marketing, you may object at any time without providing reasons. We will then stop processing your personal data for direct-marketing purposes.
To exercise your rights, contact:
We may request information necessary to verify your identity before responding to a request.
16. Right to complain to a supervisory authority
You have the right to lodge a complaint with a data-protection supervisory authority.
The supervisory authority responsible for Thingstone GmbH is:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany
Telephone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
Website: https://www.baden-wuerttemberg.datenschutz.de/
You may also contact a supervisory authority in the EU or EEA member state in which you live, work or believe an infringement has occurred.
17. Data security
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
The website is delivered using encrypted HTTPS connections. However, internet-based data transmission can never be guaranteed to be completely secure.
18. Changes to this Privacy and Cookie Policy
We may update this Privacy and Cookie Policy when legal requirements, our website, Squarespace functions or our processing activities change.
The version published on this page is the current version. The date of the latest revision is displayed at the beginning of the policy.