Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

[Full name] [Address] Telephone: [Phone number] Email: [Email address]

2. General information on data processing

We process personal data of our users only insofar as this is necessary to provide a functional website and our content and services. Processing generally takes place only with the user's consent. An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law.

Legal bases may include:

Art. 6 (1) (a) GDPR — consent
Art. 6 (1) (b) GDPR — performance of a contract or pre-contractual measures
Art. 6 (1) (c) GDPR — compliance with legal obligations
Art. 6 (1) (f) GDPR — legitimate interests

3. Definitions

This privacy policy uses the terms defined in Art. 4 GDPR. In particular, "personal data" means any information relating to an identified or identifiable natural person.

4. SSL/TLS encryption

For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries), this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser's address bar switching from "http://" to "https://" and by the padlock icon in the browser bar. When SSL/TLS encryption is active, the data you transmit to us cannot be read by third parties.

5. Provision of the website and server log files

On every visit to our website, our hosting provider automatically records data transmitted by your browser, in particular:

IP address
Date and time of the request
Time zone offset from Greenwich Mean Time (GMT)
Content of the request (specific page or file)
Access status / HTTP status code
Volume of data transferred
Referrer URL
Browser type and version, operating system

This data is processed to ensure smooth connection establishment, to evaluate system security and stability, and to defend against attacks. The legal basis is Art. 6 (1) (f) GDPR. We do not use the data collected to draw conclusions about your person.

Log data is deleted after no later than 30 days, unless there are specific indications of an attack.

Hosting provider: [Provider name and address]

6. Cookies

This website uses only technically necessary cookies (e.g. language preference, cookie consent, framework session management). No analytics or marketing cookies are set without your explicit consent. Details on all cookies used and on managing your consent can be found in our Cookie Policy.

7. Contact form and email contact

If you contact us via the contact form or by email, we process the information you provide (name, email address, message, and optionally phone number) to handle your request and any follow-up. The legal basis is Art. 6 (1) (b) GDPR if your request is aimed at concluding a contract, otherwise Art. 6 (1) (f) GDPR. We store this data until the purpose of storage no longer applies or you request deletion, but no longer than the expiry of statutory retention periods.

8. Orders in the online shop

When you place an order, we collect and process the following data:

First and last name
Billing and shipping address
Email address
Phone number (optional)
Order number, order items, prices

Processing is carried out for the performance of the contract and pre-contractual measures (Art. 6 (1) (b) GDPR) and to comply with tax and commercial retention obligations (Art. 6 (1) (c) GDPR in conjunction with § 147 AO). Order data is retained for the legally required period (generally ten years following the end of the calendar year). After this period the data is deleted, unless other retention obligations or legitimate interests prevent deletion.

9. Payment processing via bank transfer

We offer payment by SEPA bank transfer. No payment data (such as credit card numbers or online banking credentials) is collected or processed on our website. You transfer the invoice amount directly from your account to our business account, quoting the order number as the payment reference. The processing of your bank details is carried out exclusively by your bank and our bank.

10. Shipping service provider

To deliver orders, we pass your name and shipping address to a shipping service provider. The legal basis is Art. 6 (1) (b) GDPR.

Shipping provider: [Provider name and address]

11. Email delivery

To send order confirmations, status notifications and replies to enquiries, we use an external SMTP provider: [Provider name and address — or: "own mail server"]

Your email address as well as the subject and content of the message are transmitted. The legal basis is Art. 6 (1) (b) and (f) GDPR.

12. Map embed (optional)

If the map on the contact page is enabled, an iFrame from Google Maps operated by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) is loaded when the page is accessed. When the map is accessed, your IP address and other technical information may be transmitted to Google. We have no influence on Google's further processing. Privacy information from Google: https://policies.google.com/privacy

13. Recipients of the data

We only pass your personal data to third parties if this is necessary to perform a contract, a legal obligation exists, or you have explicitly consented. Possible recipients are:

the hosting provider named above (technical provision of the website)
the SMTP / email provider named above
the shipping service provider named above
our bank for payment processing
tax advisors and tax authorities within the scope of legal retention obligations

Data processing agreements pursuant to Art. 28 GDPR have been concluded with our processors.

14. Transfers to third countries

Your data is not regularly transferred to third countries outside the EU/EEA. Insofar as individual services (e.g. the optional map embed) involve a transfer to the USA, this is based on the EU Commission's standard contractual clauses and your consent pursuant to Art. 49 (1) (a) GDPR.

15. Your rights

As a data subject you have the right to:

Access information about the personal data stored about you (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Object to processing (Art. 21 GDPR)
Withdraw consent at any time with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an informal message to the contact address above is sufficient.

You have the right at any time to withdraw consent already given to data processing with effect for the future. The lawfulness of processing carried out up to the withdrawal remains unaffected.

17. Right to object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 (1) (e) or (f) GDPR.

18. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The competent authority for our registered office is:

[Address of the competent state data protection authority]

19. Data security

We secure our website and other systems through technical and organisational measures against loss, destruction, access, modification or disclosure of your data by unauthorised persons. Despite regular checks, complete protection against all dangers is not possible.

20. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place on this website.

21. Changes to this privacy policy

We reserve the right to adapt this privacy policy if this becomes necessary due to new technologies or a change in the legal situation. The current version is always published on this page.

22. Last updated

This privacy policy was last updated on: [Date].