This is a courtesy translation. The German version is legally binding.
Privacy Notice under the GDPR
1. Name and Address of the Controller
The controller within the meaning of the General Data Protection Regulation, other data protection laws applicable in the member states of the European Union, and other provisions of a data-protection nature is:
PMI Media Solutions S.L.
C/ Marbella 17, Local 48-57
07610 Palma, Illes Balears, Spain
Phone: +34 694 467 638
Email: info@pmi-media-solutions.com
2. Use of Cookies
We use cookies on our website. Cookies are small text files that your browser stores on your device.
We distinguish between two categories of cookies:
Necessary cookies: These cookies are required for the technical operation of the website and cannot be disabled. These include the session cookie "PHPSESSID" (deleted when the browser is closed), the shop cookie "PrestaShop-*" (cart and login, retention period 20 days), the cookie "la_adult_ok" (stores your age confirmation, retention period 12 months), the cookie "la_lang_seen" (remembers that the language choice was made on the first visit, retention period 12 months), and the cookie "la_consent" (stores your cookie settings, retention period 12 months). On pages with form protection (registration, contact form), Google reCAPTCHA also sets the security cookie "_GRECAPTCHA" with a retention period of approximately 6 months (see item 10.2). The legal basis is Section 25(2) TDDDG.
Statistics cookies: We only use these cookies if you have expressly consented to them. We request your consent on your first visit to our website via a corresponding notice. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Once consent has been given, Google Analytics sets the cookies _ga and _ga_* with a retention period of up to 24 months. Further details on the statistics services we use can be found under item 10 of this privacy policy.
You can change or withdraw your consent at any time with effect for the future. To do so, use the "Cookie Settings" link in the footer of our website.
3. When You Visit the Website
When the website is accessed, an automated system collects data and information. This information is temporarily stored in a so-called log file. The following information is collected without any action on your part and stored until it is automatically deleted:
(1) Information about the browser type and version used
(2) The user's operating system
(3) The user's internet service provider
(4) The user's IP address
(5) Date and time of access
(6) Websites from which the user's system reaches our website (referrer)
(7) Websites accessed by the user's system via our website
We process the data listed above for the following purposes:
• Ensuring a smooth connection to the website,
• Ensuring comfortable use of our website,
• Evaluating system security and stability, and
• Other administrative purposes.
The legal basis for this data processing is Art. 6(1)(f) GDPR. Our legitimate interest follows from the purposes for data collection listed above. Under no circumstances do we use the collected data to draw conclusions about your identity.
In addition, we use cookies and analytics services when you visit our website. Further details are provided under items 2 and 10 of this privacy policy. Log file data is always stored separately from other personal data of users.
4. Newsletter
When you sign up for our newsletter, we use the so-called double opt-in procedure: after signing up, you will receive an email with a confirmation link. Your registration only becomes effective once you click this link. We log both the time of registration and the time of confirmation.
The newsletter is sent using the self-hosted software Listmonk on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, with whom we have entered into a data processing agreement pursuant to Art. 28 GDPR. Email delivery is handled by Twilio SendGrid, a service of Twilio Inc., USA, which is certified under the EU-U.S. Data Privacy Framework.
The legal basis for this processing is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time by using the unsubscribe link included in every newsletter email.
5. Ways to Contact Us
You can contact us using the email address provided. If a data subject contacts the controller through one of these channels, the personal data transmitted by the data subject is automatically stored. Data processing for the purpose of contacting us takes place pursuant to Art. 6(1)(a) GDPR, on the basis of your voluntarily given consent.
This storage serves solely the purpose of processing the inquiry or contacting the data subject. The data is not shared with third parties.
6. Routine Erasure and Restriction of Personal Data
The controller processes and stores the personal data of the data subject only for as long as is necessary to achieve the purpose of storage. Data may also be stored where this is provided for by European or national legislators in EU regulations, laws, or other provisions to which the controller is subject.
As soon as the purpose of storage no longer applies, or a storage period prescribed by the aforementioned provisions expires, the personal data is routinely restricted or erased.
7. Rights of the Data Subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and are entitled to the following rights against the controller:
7.1 Right of Access
You may request confirmation from the controller as to whether personal data concerning you is being processed by us.
Where such processing takes place, you may request the following information from the controller:
a. the purposes for which the personal data is processed;
b. the categories of personal data being processed;
c. the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
d. the envisaged period for which the personal data concerning you will be stored, or, if specific details are not possible, the criteria used to determine that period;
e. the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;
f. the existence of a right to lodge a complaint with a supervisory authority;
g. all available information as to the source of the data, where the personal data is not collected from the data subject;
h. the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
7.2 Right to Rectification
You have the right to obtain from the controller the rectification and/or completion of the personal data concerning you if the data processed is inaccurate or incomplete. The controller must carry out the rectification without undue delay.
7.3 Right to Restriction of Processing
Under the following conditions, you may request the restriction of the processing of the personal data concerning you:
a. if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;
b. the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of its use;
c. the controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims; or
d. you have objected to the processing pursuant to Art. 21(1) GDPR and it is not yet clear whether the controller's legitimate grounds override your own.
Where processing of the personal data concerning you has been restricted, such data may, with the exception of storage, only be processed with your consent, or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a member state.
Where the restriction of processing has been imposed under the above conditions, you will be informed by the controller before the restriction is lifted.
7.4 Right to Erasure
7.4.1. You may request that the controller erase the personal data concerning you without undue delay, and the controller is obliged to erase such data without undue delay where one of the following grounds applies:
a. The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
b. You withdraw the consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
c. You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
d. The personal data concerning you has been processed unlawfully.
e. The erasure of the personal data concerning you is required to comply with a legal obligation under Union or member state law to which the controller is subject.
f. The personal data concerning you was collected in relation to information society services offered pursuant to Art. 8(1) GDPR.
7.4.2. Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17(1) GDPR to erase it, the controller shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of any links to, or copies or replications of, that personal data.
7.4.3. The right to erasure does not apply insofar as the processing is necessary
a. for exercising the right to freedom of expression and information;
b. for compliance with a legal obligation requiring processing under Union or member state law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c. for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
d. for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to above is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
e. for the establishment, exercise, or defense of legal claims.
7.5 Right to Notification
If you have asserted the right to rectification, erasure, or restriction of processing against the controller, the controller is obliged to notify all recipients to whom the personal data concerning you has been disclosed of that rectification, erasure, or restriction, unless this proves impossible or involves disproportionate effort.
You have the right to be informed by the controller of those recipients.
7.6 Right to Data Portability
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format. You also have the right to transmit that data to another controller without hindrance from the controller to whom the personal data was provided, provided that
a. the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, or on a contract pursuant to Art. 6(1)(b) GDPR; and
b. the processing is carried out by automated means.
In exercising this right, you further have the right to obtain the direct transmission of the personal data concerning you from one controller to another, where technically feasible. The freedoms and rights of other persons must not be affected as a result.
The right to data portability does not apply to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
7.7 Right to Object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.
The controller shall no longer process the personal data concerning you unless the controller can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
Where the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of that personal data for such marketing; this also applies to profiling insofar as it is related to such direct marketing.
If you object to the processing for direct marketing purposes, the personal data concerning you will no longer be processed for those purposes.
In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you have the option of exercising your right to object by automated means using technical specifications.
7.8 Right to Withdraw Consent under Data Protection Law
You have the right to withdraw your data protection consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.
7.9 Automated Individual Decision-Making, Including Profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
a. is necessary for entering into, or the performance of, a contract between you and the controller;
b. is authorized by Union or member state law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
c. is based on your explicit consent.
However, such decisions may not be based on special categories of personal data referred to in Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) applies and suitable measures to safeguard your rights, freedoms, and legitimate interests have been taken.
With regard to the cases referred to in points a. and c., the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.
7.10 Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.
The supervisory authority with which the complaint has been lodged will inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
8. Disclosure of Data to Third Parties
To operate the website, we engage processors bound by our instructions (in particular hosting: Hetzner Online GmbH; email delivery: Twilio SendGrid). These process data exclusively on our behalf and are not third parties within the meaning of this section.
We only disclose your personal data to third parties if:
• You have given your express consent pursuant to Art. 6(1)(a) GDPR,
• Disclosure is necessary pursuant to Art. 6(1)(f) GDPR for the establishment, exercise, or defense of legal claims, and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data,
• There is a legal obligation to disclose the data pursuant to Art. 6(1)(c) GDPR, and
• This is legally permitted and necessary pursuant to Art. 6(1)(b) GDPR for the performance of contractual relationships with you.
9. Legal Basis for Processing
Where we obtain the consent of the data subject for processing operations involving personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for carrying out pre-contractual measures.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
Where the vital interests of the data subject or of another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.
Where processing is necessary to safeguard a legitimate interest of our company or of a third party, and provided the interests, fundamental rights, and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing. Our company's legitimate interest lies in conducting our business operations.
10. Analytics Tools
We only use analytics services with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); you give your consent via the notice shown on your first visit and can withdraw it at any time via "Cookie Settings" in the footer of our website. The reCAPTCHA service described in section 10.2 is not an analytics tool but a security measure and is based on our legitimate interest (Art. 6(1)(f) GDPR).
10.1 Google Analytics
We use Google Analytics (GA4) on our website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics is only loaded once you have given your consent to the "Statistics" category via the cookie notice. We use Google Consent Mode v2 as well as IP anonymization, and disable Google Signals and all advertising features. As a result, no cross-device user tracking and no linking to Google advertising products takes place.
The data collected may also be transmitted to servers of Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. User data is retained for 14 months.
The legal basis for the use of Google Analytics is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the "Cookie Settings" link in the footer of our website.
Further information on data protection at Google can be found at policies.google.com/privacy.
10.2 Google reCAPTCHA
To protect our forms (e.g. registration and contact form) from abuse by automated programs (bots), we use the reCAPTCHA (version 3) service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). In the background, reCAPTCHA analyzes various information (e.g. IP address, time spent on the website, mouse movements) to assess whether an input is made by a human or automatically. A cookie may be set for this purpose; the data collected is transmitted to Google. A transfer to servers of Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-U.S. Data Privacy Framework.
This processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website from abusive automated use, spam, and attacks on our forms.
Further information on data protection at Google can be found at policies.google.com/privacy and policies.google.com/terms.
11. Data Security
When you visit our website, we use the widely adopted SSL (Secure Socket Layer) protocol in conjunction with the highest level of encryption supported by your browser. As a rule, this is 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. Whether an individual page of our website is transmitted in encrypted form can be recognized by the closed key or padlock icon displayed in the lower status bar of your browser.
We otherwise employ suitable technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or total loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.
12. Use of Payment Service Providers
12.1 inet-cash
For processing card payments, we use the payment service provider Inet-Cash GmbH, Herbert-Rust-Weg 27, 59071 Hamm, Germany.
As part of payment processing, we transmit the following data to Inet-Cash: name, address, email address, order amount, and order number.
This transmission takes place pursuant to Art. 6(1)(b) GDPR and only to the extent necessary for payment processing. Inet-Cash is a German provider; no transfer to third countries takes place.
12.2 Bank Transfer
Alternatively, we offer payment in advance to an account with Banco Sabadell. In this respect, the privacy notices of the respective bank apply.
12.3 PayPal
If you select PayPal as the payment method, you transfer the invoice amount yourself via a PayPal.me link to our PayPal account (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). Our shop does not transmit any personal data to PayPal; you initiate the payment yourself in your PayPal account, and PayPal's privacy notices apply. We receive from PayPal the information necessary to match the incoming payment (name, amount, payment reference). The legal basis for this processing is Art. 6(1)(b) GDPR.
13. Social Media
We do not embed any social media plugins on our website; we merely provide simple links to our profiles on social networks. Clicking such a link takes you away from our website, and the privacy policy of the respective platform then applies.
14. Hosting
Our website is hosted on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, with whom we have entered into a data processing agreement pursuant to Art. 28 GDPR. Information on the server log data collected when the website is accessed can be found under item 3 of this privacy policy.
15. Data Transfer to Third Countries
Personal data is only transferred to third countries outside the European Union to providers certified under the EU-U.S. Data Privacy Framework, namely Google LLC and Twilio Inc., both USA. Otherwise, your data is processed within the European Union.
16. Orders, Customer Account, and Shipping
To process your order, we process the order, address, and contact details you provide (Art. 6(1)(b) GDPR). To deliver physical goods, we pass on your name and delivery address to the shipping provider entrusted with delivery (DHL / Deutsche Post). We retain invoicing and accounting records for six or ten years respectively, in accordance with commercial and tax law requirements (Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)).
If you create a customer account, we store your account and order data until the account is deleted. You may request deletion at any time via the "Privacy" section in your customer account or by email to info@lady-anja.shop; statutory retention obligations remain unaffected.
17. Auctions
When you participate in auctions, we process your bids (customer account, bid amount, time) to conduct the respective auction and to notify the highest bidder (Art. 6(1)(b) GDPR). To prevent abuse, we only enable new customer accounts to place bids after a first completed purchase or after manual review (Art. 6(1)(f) GDPR — protection against sham bids).
18. Digital Content (Downloads)
When you purchase digital content, we make the files available to you via your customer account and log the number of downloads to provide the service and prevent abuse (Art. 6(1)(b) and (f) GDPR).
19. Customer Reviews
You may voluntarily review products. The name you provide (a pseudonym is possible), as well as the title and text of the review, are published only after review by a moderator. The legal basis is the consent you give by submitting the review (Art. 6(1)(a) GDPR); you may request deletion at any time via info@lady-anja.shop.
20. Slave Pillory (Voluntary Public Outing)
Our shop offers products for purchase ("Pillory Outing Tribute – Entrance") through which you voluntarily provide us with personal data (e.g. name or pseudonym, photos, personal details, texts and stories, and where applicable information about your sex life) so that this data can be published on the publicly accessible "slave pillory" at lady-anja.com. Publication takes place exclusively on the basis of your explicit consent (Art. 6(1)(a) GDPR, and for special categories of personal data, Art. 9(2)(a) GDPR) and only with the data you have released for this purpose. Please note: published content is accessible worldwide and may be indexed by search engines.
You can withdraw your consent at any time with effect for the future — free of charge, informally, and without giving reasons. An email to info@lady-anja.shop is sufficient; your entry will then be removed without delay. Paid offers such as "Pillory Outing Tribute – Exit" are a voluntary role-play ritual and are not a precondition for withdrawing your consent or having your data deleted.
21. Picture Rating
When you purchase a picture rating product, you can send us photos and a comment via a personal link that is activated once payment has been received. Depending on the variant selected, the images are evaluated either by artificial intelligence or by Lady Anja personally; you retrieve the result via the same link.
The legal basis is your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR), as the images transmitted regularly constitute special categories of personal data. You can withdraw your consent at any time with effect for the future — an email to info@lady-anja.shop is sufficient.
For AI-supported ratings, we transmit the uploaded images and your comment for evaluation to OpenRouter, Inc. and xAI (both USA); if the result includes a voice output, it is also transmitted to ElevenLabs, Inc. (USA). Only the uploaded images and your comment are transmitted — no names, contact details, or order data. As these providers are based in the USA, this constitutes a transfer of data to a third country; the basis for this is your explicit consent pursuant to Art. 49(1)(a) GDPR.
The uploaded images are deleted 14 days after delivery of the result; the rating itself is deleted 30 days after delivery of the result, after which final erasure takes place. Storage is encrypted. You can exercise your rights under Art. 15 et seq. GDPR via the data access and deletion request form in your customer account.
22. Duration of Storage of Personal Data
Personal data is stored for the duration of the respective statutory retention period. Once the period expires, the data is routinely deleted unless it is still required for entering into or performing a contract.
23. Currency and Amendment of this Privacy Policy
This privacy policy is currently valid and has the status: August 22, 2026.
Due to the further development of our website and the offerings made available through it, or as a result of changed statutory or regulatory requirements, it may become necessary to amend this privacy policy.