Privacy policy

Controller

The controller responsible for the processing described in this notice is Filip Madrzyk, Formed in Wax, Mühlendamm 70, 22087 Hamburg, Germany. Contact: hello@formedinwax.com.

German version: Deutsch — Datenschutzerklärung.

Website features, cookies and external content

This is a static information website. We do not use analytics or advertising tracking services, or related cookies or similar storage technologies, on this website. Fonts, scripts and images are served through this website rather than embedded font, image or video services. There is no contact form, user account or embedded checkout. Technical connection and security data processed to operate the website are explained under “Hosting and connection data”. External websites that we link to have their own privacy notices.

The external Gumroad product page

This website links to the video archive’s product page on Gumroad. The link leads to a separate service; no Gumroad checkout is embedded on this website. On its platform, Gumroad, Inc. processes personal data as an independent controller, particularly for purchases, payments, security and taxes. For certain services involving content delivery and buyer data processed on our behalf, Gumroad acts as a processor. Its role depends on the particular processing activity. Further information: gumroad.com/privacy and gumroad.com/dpa. Our own processing of buyer data is explained below. These privacy notices do not replace purchase or withdrawal terms. Use of the videos is governed by our licence terms.

Buyer data and product support

If you purchase the video archive through Gumroad, information about your purchase may become available to us through Gumroad’s seller tools. This includes the email address used for the purchase, your name if provided at checkout, the product purchased, a purchase or order identifier, the purchase date and time, transaction amounts, and information about refunds and payment disputes. Gumroad also provides country or location information, which may come from details you provide or approximate geolocation based on your IP address. The information available depends on the purchase features used and details supplied. We do not receive full credit card details through these seller tools.

We use the information necessary for the particular matter to identify your purchase, assist with access to and delivery of the content, respond to product and licence enquiries, and maintain required accounting records. Gumroad handles the sale, payment, invoices and first-tier refund requests as reseller and merchant of record.

Where processing is necessary to perform our licence agreement with you or take steps you request before entering into it, the legal basis is Article 6(1)(b) GDPR. Where we assist you with a Gumroad purchase or assess and defend legitimate claims, we rely on Article 6(1)(f) GDPR; our legitimate interest is providing reliable support for our product and resolving related claims. Records required by law are processed under Article 6(1)(c) GDPR, particularly in conjunction with Section 147 of the German Fiscal Code and, where applicable, Section 257 of the German Commercial Code. We do not use this purchase data for newsletters or marketing emails merely because you made a purchase.

Where we receive information from Gumroad’s own purchase processing, the data source is Gumroad, Inc.; you do not provide that information directly to us. Where Gumroad collects data directly from you on our instructions for our purposes, it collects that data on our behalf. Additional information you send us yourself in an enquiry is processed as described under “Contact by email”. Without sufficient purchase information, we may be unable to identify the purchase associated with your enquiry.

We retain our own support records and working copies only for as long as necessary to handle the enquiry or resolve related claims. Accounting vouchers subject to statutory retention requirements are generally retained for eight years, and business correspondence subject to those requirements for six years, after the end of the relevant calendar year; certain books and records must be retained for ten years. The applicable document category and our legal obligations determine the period, rather than a blanket period for the entire buyer database. Statutory extensions and necessary retention during ongoing proceedings remain unaffected. Unnecessary additional data is deleted earlier.

Recipients involved in delivery and support may include Gumroad and the email service provider used for our business correspondence, in each case only as necessary. Details are set out under “Recipients and international processing”. Gumroad also processes data in the United States. According to its privacy notice, Gumroad relies on EU standard contractual clauses for transfers from the EEA to the United States; where it acts as our processor, these are addressed in its Data Processing Addendum. Information and copies of relevant safeguards can be requested at hello@formedinwax.com; Gumroad’s terms are available at gumroad.com/dpa and gumroad.com/privacy. The rights described in the rights section also apply to our processing of buyer data.

Contact by email

If you email us at hello@formedinwax.com, we process your email address, message and other details you provide to handle your enquiry. For enquiries about a contract with us, or steps you ask us to take before entering into one, the legal basis is Article 6(1)(b) GDPR. For other enquiries, it is Article 6(1)(f) GDPR; our legitimate interest is handling business communications reliably. Legally required retention is based on Article 6(1)(c) GDPR.

We use united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany, as our email service provider to operate, deliver and store our business email correspondence. This provider processes contact details, message content and technical message and connection data as necessary. You do not have to send an enquiry; without necessary contact information and relevant details, we may be unable to respond. Please do not send data unnecessary for your enquiry.

We delete correspondence once it is no longer needed to handle the matter or resolve related claims where necessary. For messages that qualify as business correspondence or accounting vouchers subject to statutory retention requirements, the statutory periods explained under “Buyer data and product support” apply.

Hosting and connection data

This website is delivered through Cloudflare Pages by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. To deliver pages and protect against disruptions and attacks, Cloudflare processes technical connection and traffic data, particularly IP addresses, requested pages or files, request times, and technical information about the connection and browser. Our processing is based on Article 6(1)(f) GDPR; our legitimate interest is operating this information website securely and reliably.

Where Cloudflare processes data on our behalf, the incorporated Data Processing Addendum under Article 28 GDPR applies. Cloudflare also processes certain network data as an independent controller for its own operational and security purposes; Cloudflare explains this at cloudflare.com/privacypolicy.

We do not keep our own access logs and do not analyse individual connection data. According to Cloudflare, it stores this data only for a limited period and only for as long as necessary for delivery, security and troubleshooting; Cloudflare does not specify a fixed period. Processing on our behalf ends at the latest when it is no longer necessary to provide this website or when our contract with Cloudflare ends. In the event of a specific security incident, necessary data is retained separately only for as long as required to investigate it and safeguard legitimate claims.

Processing may also take place in the United States. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework for non-HR data. The corresponding adequacy decision provides the basis for covered transfers to the United States. For transfers without an applicable adequacy decision, the Data Processing Addendum provides for EU standard contractual clauses and additional safeguards where necessary. Terms: cloudflare.com/cloudflare-customer-dpa; register entry: dataprivacyframework.gov/participant/5666. You may request a copy of the safeguards relevant to our processing at hello@formedinwax.com.

Recipients and international processing

When the website is delivered, the provider identified in the hosting section receives the technical data described there. For business email correspondence, the email service provider described in the contact section processes the data needed for that communication. For purchases on Gumroad and related enquiries, Gumroad is involved as an independent controller or processor as explained above. Where disclosure is required by law, data may be provided to the competent bodies. Details of processing outside the EEA and the relevant transfer mechanisms are set out in the sections for each service. We limit our disclosures to what is necessary for the particular purpose.

Your rights

Subject to the GDPR, you have rights including access, rectification, erasure, restriction of processing and data portability. Where we rely on your consent, you may withdraw it at any time with effect for the future; this does not affect the lawfulness of earlier processing. Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to direct marketing at any time. To exercise your rights, contact hello@formedinwax.com. You may also lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, place of work or the alleged infringement. The Hamburg data protection authority is responsible for our place of establishment.

Updates

We update this privacy notice when our processing of personal data changes. Last updated: November 2026.