Skip to content
Buch der Suche
DE EN

Privacy policy

Last updated: November 2026

This privacy policy is also available in German.

1. At a glance

We only process personal data insofar as this is necessary to operate this website, answer your enquiries and process your orders. This website uses no tracking, no analytics or advertising services, no social media plugins and no externally loaded fonts or scripts, and no cookies other than those that are technically necessary (section 4). There is no customer account; you order as a guest.

2. Controller

VALOXX GmbH, Buch der Suche
Baluschekstraße 1, 01159 Dresden, Germany
Represented by the managing directors Maik Scheibenstock, Justin Meißner
Phone: +49 173 5235060
Email: info@buch-der-suche.de

We have not appointed a data protection officer, as we are not obliged to do so. For all questions regarding data protection, you can contact us using the contact details above.

3. Hosting and server log files

This website is operated by OpusX GmbH, Feldweg 33, 3912 Termen, Switzerland; the servers are located in data centres within the European Union. We have concluded a data processing agreement with the hosting provider in accordance with Art. 28 GDPR. For Switzerland, there is an adequacy decision of the European Commission (Art. 45 GDPR).

No content delivery network (CDN) or external service for defending against attacks is placed in front of the website; your requests go directly to our hosting provider’s server.

Each time the website is accessed, the server automatically stores information transmitted by your browser: IP address, date and time of the request, page accessed, status code, amount of data transferred, referrer URL, and browser type and operating system. We need this data to deliver the website and to ensure its security and stability, for example to detect attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. This data is not combined with other data. The log files are deleted after one month unless they are needed for longer to investigate a security incident.

Error log of the shop software

In addition, the shop software keeps a technical error log. It contains error messages and process information such as order numbers as well as responses from Stripe and Lexware Office, and in individual cases may contain further information from the process concerned. We need it to find and fix errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the shop. The log is kept in a new file every day; files older than 14 days are deleted automatically.

4. Cookies

We only use two technically necessary cookies:

  • Session cookie: assigns your visit to a session on our server so that your cart and your entries in the ordering process are retained. The contents of the cart are stored on our server, not in the cookie.
  • XSRF-TOKEN: protects forms (order, contact, lodge enquiry, withdrawal) against misuse through forged requests from other websites.

For each session, our server stores in its database the cart, any voucher code you have entered, your entries in the ordering process, your IP address, your browser identifier (user agent) and the time of your last page view. The session data is stored in encrypted form. We do not evaluate it to analyse your behaviour.

Both cookies and the session expire two hours after your last page view; the shop software deletes expired sessions from the server during its regular automatic clean-up. They contain no information that would allow us to track you across other websites. Storing them is strictly necessary for the service you have requested and is therefore permitted without consent (Section 25(2) No. 2 TDDDG, German Telecommunications Digital Services Data Protection Act); the subsequent processing is based on Art. 6(1)(b) GDPR (ordering process) and Art. 6(1)(f) GDPR (security of the forms). You can delete or block cookies in your browser; without the session cookie, however, the cart and ordering do not work.

5. Contact form, lodge enquiry and contact by email or phone

If you contact us via the contact form, by email or by phone, we process the information you provide (for the form: name, email address and message) in order to answer your enquiry. The form data is sent by email to our mailbox info@buch-der-suche.de; the website itself does not store it. As spam protection we use an invisible form field, no captcha and no external service.

The legal basis is Art. 6(1)(b) GDPR if your enquiry is related to an order or its preparation, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). We delete the enquiry once it has been dealt with, provided there are no statutory retention obligations; we retain business letters for six years.

Our mailbox is also hosted by OpusX GmbH (see section 3); emails are not forwarded to other providers.

Lodge enquiry (bulk orders)

Using the enquiry form on the “For lodges” page, you can request a bulk order for your lodge. We process the name of the lodge, your name as contact person, your email address, the approximate quantity, the occasion and your message in order to make you an offer and answer your enquiry. As with the contact form, the information is only sent by email to our mailbox and is not stored by the website. Please do not mention the names of other lodge members in your message.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). Because your enquiry, in particular the name of the lodge, may allow conclusions to be drawn about your membership of a Masonic lodge, we also obtain your explicit consent (Art. 9(2)(a) GDPR) insofar as this constitutes data concerning philosophical beliefs. The wording and the time of your consent are contained in the email that the form sends to us. You can withdraw your consent at any time with effect for the future, for example by email to info@buch-der-suche.de; we will then delete your enquiry unless there is a statutory retention obligation. If an order results from the enquiry, section 6 applies to further processing.

Protection of the forms against misuse

To prevent mass automated submissions, we limit the number of form submissions per internet connection. For this purpose, our server stores a check value derived from your IP address for a maximum of ten minutes; it is then deleted automatically. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the website and our mailbox against misuse.

6. Orders in the shop

To process your order, we process:

  • name, billing and delivery address, where applicable the company or lodge name, email address;
  • your phone number, but only if you order the “Personalisation for Masons”, so that we can agree the binding of your documents with you by phone;
  • the products ordered with your configuration, prices, shipping method and, where applicable, your note on the order;
  • for the “Personalisation for Lodges”, the uploaded image of the lodge jewel (bijou); it is stored on our server and is not publicly accessible;
  • for the “Personalisation for Masons”, the documents you send us by post (e.g. your lodge passport), until they are returned in the finished diary;
  • payment status and reference numbers from Stripe (no card or account details), tracking number, invoices;
  • when purchasing a gift voucher: your name, billing address and email address, the voucher code, value, validity and remaining balance, and the orders in which the voucher is redeemed; when redeeming a voucher, additionally the code used and the amount credited.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract and pre-contractual measures) and, for invoices and accounting, Art. 6(1)(c) GDPR in conjunction with the retention obligations under commercial and tax law. Without this information we cannot process your order.

After receipt of payment, you will receive an order confirmation and, after shipment, a shipping notification with the tracking number by email. We do not send advertising emails or a newsletter.

You receive a gift voucher as a PDF file by email. The person redeeming the voucher does not have to be the purchaser. We do not tell the purchaser who redeemed the voucher or what that person ordered, and we do not tell the person redeeming it who purchased the voucher; on request, we only tell either of them the remaining balance. The processing required for vouchers is likewise based on Art. 6(1)(b) and (c) GDPR.

Withdrawal via the “Withdraw from contract here” button

If you withdraw from your contract using our online form, we store your name, your email address, the order number, your declaration, the time of receipt and the language of the form. You receive an acknowledgement of receipt from us by email; a notification with the same information is sent to our mailbox. We use this information to confirm the withdrawal, to unwind the order and to be able to prove the withdrawal. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (BGB) (acknowledgement of receipt), Art. 6(1)(b) GDPR (unwinding the contract) and Art. 6(1)(f) GDPR (proof; our legitimate interest lies in defending and asserting claims).

Particularly sensitive information

We do not ask about your membership of a Masonic lodge. However, the purchase of a diary for Freemasons, a lodge order and, all the more, a lodge passport sent in to us may under certain circumstances allow conclusions to be drawn about such membership. We therefore treat this information confidentially, use it exclusively to process your order and only pass it on to the bookbindery (section 7) and, as part of the invoice, to our accounting service (section 9); both are bound by our instructions as processors. The shipping service provider receives your name and delivery address and, for deliveries to Switzerland, additionally the information on the contents of the parcel required for customs. Stripe only receives the order number, the amount and your email address, but no information about which products you have ordered (section 8).

Insofar as this constitutes data concerning philosophical beliefs within the meaning of Art. 9(1) GDPR, we process it on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give during the ordering process and can withdraw at any time with effect for the future, for example by email to info@buch-der-suche.de. We store the wording and the time of your consent together with the order so that we can prove it. Data that we are required to retain by law is not affected by the withdrawal.

7. Disclosure to the bookbindery and shipping service providers

Our diaries are made by a bookbindery, which also ships them directly to you:

buchschnitt – Handbuchbinderei Annette Pohlenz
Michelangelostraße 1
01217 Dresden
Germany

Via a protected supplier portal, the bookbindery only receives the information it needs for production and shipping: your name, your delivery address, the products ordered with their configuration, your note from the “Note on your order” field, for the “Personalisation for Lodges” the jewel artwork and for the “Personalisation for Masons” your phone number and the documents you have sent in. Please only write in the note what is relevant for production and shipping. It does not receive invoice amounts, payment data or your email address, and it does not receive orders for gift vouchers at all. For deliveries to Switzerland, the bookbindery uploads the export evidence (e.g. the customs declaration with your name and address) to the portal; we retain it as a tax record (section 10). The bookbindery acts on our behalf and in accordance with our instructions; we have concluded a data processing agreement with it in accordance with Art. 28 GDPR.

For delivery, the bookbindery passes your name and delivery address on to the shipping service provider. As a rule, this is DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany; registered mail is sent via Deutsche Post AG. For deliveries to other EU member states, DHL hands the parcel over to the postal service provider in the country of delivery and passes your name and delivery address on to it for this purpose. For deliveries to Switzerland, the shipping service provider passes the information required for customs clearance (name, address, contents and value of the parcel) on to Swiss Post and the customs authorities. The legal basis is Art. 6(1)(b) GDPR. We do not pass your email address or phone number on to the shipping service provider.

8. Payment processing via Stripe

We process payments via Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). After clicking “Order with obligation to pay”, you are redirected to a Stripe payment page. We only transmit your order number, the amount payable as a single item “Order” with this number, and your email address to Stripe. We do not tell Stripe which products you have ordered, nor your name or address. You enter your payment details (e.g. card number or IBAN) and any further information Stripe requires depending on the payment method (such as the name of the card or account holder, country or postcode) directly with Stripe; we do not receive them, only the information as to whether and how the payment was made.

The legal basis is Art. 6(1)(b) GDPR. Stripe processes the data partly on our behalf and partly as an independent controller, in particular for fraud prevention and to comply with legal obligations (e.g. anti-money laundering). On the payment page, Stripe’s privacy policy applies, including the cookies used there: https://stripe.com/privacy.

Stripe may transfer data to Stripe, Inc. in the USA. Stripe, Inc. is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the European Commission (Art. 45 GDPR); in addition, Stripe uses standard contractual clauses.

If you choose a payment method of another provider at Stripe, that provider receives the data required for the payment and processes it under its own responsibility:

  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, privacy policy;
  • Apple Pay: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, privacy policy;
  • Google Pay: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, privacy policy;
  • Klarna (if offered): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, privacy policy. For certain payment methods, Klarna may carry out an identity and credit check.

Draft: Liste an die tatsächlich im Stripe-Dashboard aktivierten Zahlungsarten anpassen; nicht aktivierte Anbieter streichen – in beiden Sprachfassungen gleich.

9. Invoices and accounting

We create invoices ourselves as soon as your order has been shipped and store them on our server. For accounting purposes, we transfer each invoice to Lexware Office of Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany: invoice number, date and amounts as well as the invoice as a PDF file with your name, your address and the products ordered. Haufe-Lexware acts as our processor; we have concluded an agreement in accordance with Art. 28 GDPR. In addition, our tax advisor and, where applicable, tax authorities receive this data insofar as required by law. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).

10. Storage period

  • Order and invoice data: eight years (accounting records, Section 147 AO), business letters including order-related emails six years, in each case from the end of the calendar year of the order. They are then deleted.
  • Phone number: we delete it automatically three months after your order has been shipped. You can also request its erasure earlier (Art. 17 GDPR).
  • Orders that are cancelled or not paid and for which we have not sent an order confirmation, including any uploaded jewel artwork and consent given: we delete them automatically 30 days after the order. If the contract has already been confirmed (e.g. while a direct debit is still being processed), the periods for order data apply.
  • Images you upload without completing the order: we delete them automatically after two days.
  • Lodge jewel artwork: kept for repeat orders by the lodge as long as the lodge does not object; then deleted.
  • Documents sent in: returned with the finished diary; we do not keep copies.
  • Export evidence for deliveries to Switzerland: eight years from the end of the calendar year of export as a record for the tax-exempt export (Section 147 AO, Sections 9 et seq. of the German VAT Implementing Ordinance, UStDV); legal basis Art. 6(1)(c) GDPR.
  • Withdrawals via the online form: together with the associated order (see above).
  • Gift vouchers: until the end of the validity period and until all redemptions and refunds have been processed; the data on the voucher purchase as an accounting record for eight years from the end of the calendar year of the purchase.
  • Contact enquiries and lodge enquiries: deleted once dealt with, unless there is a retention obligation.
  • Server log files, error log, sessions and cookies: see sections 3 and 4.

11. Your rights

Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). If you have given consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). An informal message to info@buch-der-suche.de is sufficient.

Right to object (Art. 21 GDPR): Insofar as we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence. The authority responsible for us is: Die Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner), Devrientstraße 5, 01067 Dresden, Germany.

12. Automated decision-making

We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles. Payment service providers may carry out automated fraud or credit checks under their own responsibility; you can find details in their privacy policies (section 8).

13. Encryption

This website uses TLS encryption throughout. You can recognise it by “https://” and the padlock symbol in your browser’s address bar.