Privacy Policy
Last updated: October 2026
1. Controller
The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Martin Koch
Redaktionsbüro Martin Koch
Distelweg 12
41539 Dormagen
Germany
Phone: +49 (0) 2133 6308241
Email: hello@otakuworks-products.com
Website: otakuworks-products.com
If you have any questions about privacy or the processing of your personal data, you may contact us at any time.
2. General Information on Data Processing
We process personal data only where this is necessary to provide and operate this website, respond to enquiries, send requested content, manage email subscriptions, analyse website usage, or fulfil legal obligations.
Depending on the specific processing activity, the legal basis may be:
- your consent pursuant to Article 6(1)(a) GDPR;
- processing necessary for the performance of a contract or pre-contractual measures pursuant to Article 6(1)(b) GDPR;
- compliance with a legal obligation pursuant to Article 6(1)(c) GDPR; or
- our legitimate interests pursuant to Article 6(1)(f) GDPR.
Where consent is the legal basis, you may withdraw that consent at any time with effect for the future.
3. Hosting
This website is hosted by:
STRATO AG
Otto-Ostrowski-Straße 7
10249 Berlin
Germany
When you access this website, technical connection data may be processed in order to deliver the website securely and reliably.
This processing is based on our legitimate interest in the secure, stable, and efficient provision of our website pursuant to Article 6(1)(f) GDPR.
STRATO provides server log files for a period of up to six weeks.
4. Server Log Files
When you visit this website, the hosting provider may automatically collect and store technical information in server log files.
This may include, in particular:
- browser type and version;
- operating system;
- referring website;
- requested pages or files;
- date and time of access;
- IP address; and
- information required to detect and prevent technical faults or attacks.
The data is processed for the purpose of operating the website securely, diagnosing technical problems, and protecting our systems from misuse.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and technically reliable operation of this website.
5. Contacting Us
You may contact us by email or through the contact form provided on this website.
If you contact us, we process the information you provide, such as your name, email address, and message, in order to respond to your enquiry.
If your enquiry relates to a contract or possible future contract, the legal basis is Article 6(1)(b) GDPR. In other cases, processing is based on our legitimate interest in responding to enquiries pursuant to Article 6(1)(f) GDPR.
We do not use contact-form submissions for unrelated marketing purposes unless you have separately consented to such use.
6. Contact Form via WPForms
We use WPForms to provide the contact form on this website.
Form submissions are processed on our WordPress website. WPForms states that entry data is handled on the website on which the plugin is installed and is not collected by WPForms itself. Entry storage in the WordPress database can also be disabled on a per-form basis.
WPForms is configured so that:
- form entries are not stored permanently in the WordPress database;
- unnecessary IP address and user-agent logging is disabled; and
- the information is forwarded only to the email address required to answer the enquiry.
The legal basis for processing depends on the nature of the enquiry as described in Section 5 above.
7. Free Coloring Pages and Email Subscription
We offer free coloring pages that visitors can request by providing their email address.
When you sign up, we process your email address for the purpose of:
- sending the requested free coloring pages;
- managing your subscription; and
- sending occasional OtakuWorks emails containing coloring inspiration, product news, or other relevant updates.
The legal basis is your consent pursuant to Article 6(1)(a) GDPR.
We use a double opt-in procedure. After registering, you receive an email asking you to confirm your email address. Your subscription becomes active only after you click the confirmation link.
You may withdraw your consent and unsubscribe at any time by using the unsubscribe link contained in each email or by using the subscription-management page on our website.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
8. MailPoet
We use MailPoet to manage email subscriptions and send emails, including the free-coloring-pages email.
MailPoet is part of the WooCommerce/Automattic group. For users in Europe, WooCommerce Ireland Ltd. acts as a relevant service provider within that group.
When using MailPoet, the following data may be processed:
- email address;
- subscription status;
- confirmation status;
- delivery information; and
- technical email-delivery logs.
MailPoet states that email-sending logs generated through its sending service are automatically deleted after three months. MailPoet also uses technical service providers in Europe and the United States as part of its infrastructure.
We use MailPoet for the purpose of sending requested content and managing subscriptions on the basis of your consent pursuant to Article 6(1)(a) GDPR.
You can unsubscribe or manage your subscription at any time using the links provided in our emails.
9. Cookies and Similar Technologies
This website may use cookies or similar technologies.
Some technologies are strictly necessary for the technical operation of the website. Others, such as analytics technologies, are used only where you have given your consent.
Under Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), storing information on or accessing information from a user’s device generally requires consent unless the operation is strictly necessary to provide a service expressly requested by the user or is required solely for transmission of a communication.
10. Consent Management with Complianz
We use Complianz – The Privacy Suite for WordPress to manage cookie and privacy preferences.
Complianz enables us to:
- display a consent banner;
- obtain and record consent;
- block non-essential services until consent has been given; and
- allow visitors to change or withdraw their consent later.
Complianz states that its WordPress privacy suite can store an anonymised IP address in connection with consent records.
The processing of consent records is based on our legal obligation to be able to demonstrate valid consent pursuant to Article 6(1)(c) GDPR in conjunction with Article 7 GDPR.
You can change your consent preferences at any time using the Cookie Settings link provided on this website.
11. Google Analytics 4 and Google Site Kit
We intend to use Google Analytics 4 via Google Site Kit in order to understand how visitors use our website and to improve content, navigation, and website structure.
Google Analytics will only be used in accordance with the consent preferences managed through our consent-management system.
If you consent to analytics, Google Analytics may process information such as:
- pages visited;
- approximate location;
- device and browser information;
- time and duration of visits;
- interaction with website content; and
- referring websites.
Google states that individual IP addresses of users in the European Union, Switzerland, and the United Kingdom are not logged or stored in Google Analytics.
We plan to integrate Google Analytics with Complianz and Google Consent Mode. Complianz provides a dedicated integration with Google Site Kit and Consent Mode for managing analytics consent.
For users in the European Economic Area, Google requires appropriate consent signals where Google tags are used for measurement and related purposes.
Google Analytics is therefore activated only where the required consent has been obtained.
The legal basis is your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.
You may withdraw your consent at any time through the cookie settings on our website.
12. External Links
Our website contains links to third-party websites, for example online stores or social-media platforms.
No data is transferred to those third parties merely because a normal external link is displayed on our website. If you click such a link, you leave our website and the privacy policies of the respective third-party provider apply.
We are not responsible for how third-party websites process personal data.
13. No Embedded Third-Party Content
At present, this website does not embed external content such as YouTube videos, TikTok videos, Google Maps, or social-media widgets.
If we introduce such services in the future, we will update this Privacy Policy and, where required, integrate those services into our consent-management system before activating them.
14. Data Retention
We store personal data only for as long as necessary for the purpose for which it was collected or for as long as required by applicable law.
In particular:
- contact enquiries are deleted when they have been fully resolved and no legal retention obligation applies;
- newsletter and subscription data is stored until you unsubscribe or withdraw your consent, unless continued retention is required for legal reasons;
- consent records may be retained for as long as necessary to demonstrate that valid consent was obtained;
- server log files are retained according to the retention periods of our hosting provider.
Where statutory retention obligations apply, data may be retained beyond the original processing purpose for the required period.
15. Recipients and Processors
Where necessary, personal data may be processed by service providers acting on our behalf, including:
- STRATO AG for website hosting;
- MailPoet/WooCommerce/Automattic for email delivery and subscription management;
- WPForms for form functionality;
- Complianz for consent management; and
- Google, if and when Google Analytics is activated with your consent.
Where required by law, we conclude appropriate data-processing agreements with service providers.
16. International Data Transfers
Some service providers used by us may process data outside the European Economic Area.
Where personal data is transferred to a country outside the EEA, we rely on an appropriate legal mechanism under the GDPR, such as an adequacy decision by the European Commission or suitable contractual safeguards.
MailPoet states that parts of its technical infrastructure involve service providers located in the United States.
Google services may also involve processing outside the EEA.
17. Your Rights under the GDPR
Under the GDPR, you have the right to:
- obtain information about personal data we process about you;
- request correction of inaccurate data;
- request deletion of your personal data;
- request restriction of processing;
- object to certain processing;
- receive personal data you have provided to us in a structured, commonly used, and machine-readable format where the legal requirements are met; and
- withdraw consent at any time with effect for the future.
The GDPR also requires controllers to inform data subjects about the purposes, legal bases, recipients, storage periods, and their rights when personal data is collected.
To exercise your rights, contact:
18. Right to Object
Where processing is based on Article 6(1)(f) GDPR, you have the right to object to the processing on grounds relating to your particular situation.
If personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.
If you object to processing for direct marketing, your personal data will no longer be used for that purpose.
19. Withdrawal of Consent
If processing is based on your consent, you may withdraw that consent at any time.
For email subscriptions, you can do so by clicking the unsubscribe link in any OtakuWorks email or by using the subscription-management page.
For analytics and cookies, you can change your preferences through the Cookie Settings link on our website.
20. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
You may in particular contact the supervisory authority responsible for North Rhine-Westphalia:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
You may also contact another competent supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.
21. Automated Decision-Making
We do not use automated decision-making or profiling within the meaning of Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
22. Security
We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure.
However, data transmission over the internet can never be guaranteed to be completely secure.
23. Changes to This Privacy Policy
We may update this Privacy Policy if legal requirements change, if we introduce new services, or if the way we process personal data changes.
The current version will always be available on this website.