3.1. Notice for website visitors from Germany
Our website stores information in the terminal equipment of website visitors (e.g. cookies) or accesses information that is already stored in the terminal equipment (e.g. IP addresses). What information this is in detail can be found in the following sections.
This storage and access is based on the following provisions:
- Insofar as this storage or access is absolutely necessary for us to provide the service of our website expressly requested by website visitors (e.g., to carry out a chatbot used by the website visitor or to ensure the IT security of our website), it is carried out on the basis of Section 25 para. 2 no. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutzgesetz, "TDDDG").
- Otherwise, this storage or access takes place on the basis of the website visitor's consent (Section 25 para. 1 TDDDG).
The subsequent data processing is carried out in accordance with the following sections and on the basis of the provisions of the GDPR.
3.2. Informative use of our website
During the informative use of the website, i.e. when site visitors do not separately transmit information to us, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This is our legitimate interest, so that the legal basis is Art. 6 para. 1 s. 1 lit. f GDPR.
These data are:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status/HTTP status code
- Amount of data transferred in each case
- Website from which the request comes
- Browser
- Operating system and its interface
- Language and version of the browser software.
This data is also stored in log files. They are deleted when their storage is no longer necessary, at the latest after 14 days.
3.3. Web hosting and provision of the website
We host our website ourselves and thereby process the personal data accessed via the website, e.g. on content, usage, meta/communication data or contact data. It is our legitimate interest to provide a website, so the legal basis for data processing is Art. 6 para. 1 s. 1 lit. f GDPR.
3.4. Contact form
When contacting us via the contact form on our website, we store the data requested there and the content of the message.
The legal basis for the processing is our legitimate interest in answering inquiries directed to us. The legal basis for the processing is therefore Art. 6 para. 1 s. 1 lit. f GDPR.
We delete the data accruing in this context after the storage is no longer necessary or restrict the processing if there are legal retention obligations.
3.5. Vacant positions
We publish vacant positions on our website, on pages linked to the website or on third-party websites.
The processing of the data provided as part of the application is carried out for the purpose of implementing the application process. Insofar as this is necessary for our decision to establish an employment relationship, the legal basis is Art. 88 para. GDPR in conjunction with Sec. 26 para. 1 of the German Data Protection Act (Bundesdatenschutzgesetz). We have marked the data required to carry out the application process accordingly or refer to them. If applicants do not provide this data, we cannot process the application.
Further data is voluntary and not required for an application. If applicants provide further information, the basis is their consent (Art. 6 para. 1 s. 1 lit. a GDPR).
We ask applicants to refrain from providing information on political opinions, religious beliefs and similarly sensitive data in their CV and cover letter. They are not required for an application. If applicants nevertheless provide such information, we cannot prevent their processing as part of the processing of the resume or cover letter. Their processing is then also based on the consent of the applicants (Art. 9 para. 2 lit. a GDPR).
Finally, we process the applicants' data for further application procedures if they have given us their consent to do so. In this case, the legal basis is Art. 6 para. 1 s. 1 lit. a GDPR.
We pass on the applicants' data to the responsible employees in the HR department, to our data processors in the area of recruiting and to the employees otherwise involved in the application process.
If we enter into an employment relationship with the applicant following the application process, we delete the data only after the employment relationship has ended. Otherwise, we delete the data no later than six months after rejecting an applicant.
If applicants have given us their consent to use their data for further application procedures as well, we will not delete their data until one year after receiving the application.
3.6. Reviews
Site visitors can leave reviews on our website for our goods, services or generally about our company. For this purpose, we process meta data or communication data in addition to the data entered. We have a legitimate interest in receiving feedback from site visitors about our offerings. Therefore, the legal basis for data processing is Art. 6 para. 1 s. 1 lit. f GDPR. Insofar as we use a third-party tool for the agreement, the information on this can be found under "Third parties".
3.7. Customer account
Site visitors can open a customer account on our website. We process the data requested in this context based on the consent of the site visitor. Legal basis for the processing is Art. 6 para. 1 s. 1 lit. a GDPR.
The consent may be revoked at any time by contacting us, for example, using the contact details provided in our privacy policy. The revocation does not affect the lawfulness of the processing until the revocation. If the consent is revoked we will delete the data insofar as we are not obliged or have a right to retain it further.
3.8. Offer of goods
We offer goods via our website. In doing so, we process the following data as part of the ordering process:
- Title,
- Name,
- Address,
- e-mail,
- optional: telephone,
- How did you find us?
The processing of the data is carried out for the performance of the contract concluded with the respective site visitor (Art. 6 para. 1 s. 1 lit. b GDPR).
3.9. Payment processors
For the processing of payments, we use payment processors who are themselves data controllers within the meaning of Art. 4 No. 7 GDPR. Insofar as they receive data and payment data entered by us in the ordering process, we thereby fulfill the contract concluded with our customers (Art. 6 para. 1 s. 1 lit. b GDPR).
These payment processors are:
- PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxemburg
3.10. Technically necessary cookies
Our website sets cookies. Cookies are small text files that are stored in the web browser on the end device of a site visitor. Cookies help to make the offer more user-friendly, effective and secure. Insofar as these cookies are necessary for the operation of our website or its functions (hereinafter "Technically Necessary Cookies"), the legal basis for the associated data processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in providing customers and other site visitors with a functional website.
Specifically, we set technically necessary cookies for the following purpose or purposes:
- Cookies, that save the shopping cart
3.11. Third partiess
3.11.1. OpenAI API
We use OpenAI API . The provider is OpenAI, L.L.C., 3180 18th St 100, San Francisco, CA 94110, USA. The provider processes usage data (e.g. web pages visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses) in the USA.
The legal basis for the processing is Art. 6 para. 1 s. 1 lit. f GDPR. We have a legitimate interest in developing new applications in a simple way.
The legal basis for the transfer to a country outside the EEA are standard contractual clauses. The security of the data transferred to the third country (i.e. a country outside the EEA) is guaranteed by standard data protection clauses (Art. 46 para. 2 lit. c GDPR) adopted by the EU Commission in accordance with the examination procedure under Art. 93 para. 2 of the GDPR, which we have agreed to with the provider.
The data will be deleted when the purpose for which it was collected no longer applies and there is no obligation to retain it. Further information is available in the provider's privacy policy at https://openai.com/policies/privacy-policy.
3.11.2. Traceparts
We use Traceparts. The provider is TraceParts S.A.S., Parc Eco Normandie, 76430 Saint Romain, France. The provider processes usage data (e.g. websites visited, interest in content, access times), contact data (e.g. email addresses) and meta/communication data (e.g. device information, IP addresses) in the EU.
The legal basis for the processing is Art. 6 (1) sentence 1 f) GDPR. We have a legitimate interest in improving our public image.
The data will be deleted when the purpose of its collection no longer applies and there is no obligation to retain it. Further information can be found in the provider's privacy policy at https://info.traceparts.com/legal/general-gtu/.
3.11.3. Cloudflare Turnstile (bot protection)
We use "Cloudflare Turnstile". The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile is used to distinguish human users from automated access (bots) and thereby to protect our website from abuse and spam. In doing so, Turnstile processes only the "signals" necessary for this purpose (including IP address, TLS fingerprint, User‑Agent, site key and associated origin). Identification, profiling or commercial use is not intended.
The legal basis for the processing is Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in ensuring the security, availability and integrity of our website as well as protection against abusive requests.
The legal basis for the transfer to a country outside the EEA are standard contractual clauses. The security of the data transferred to the third country (i.e., a country outside the EEA) is ensured by standard data protection clauses issued under the assessment procedure pursuant to Art. 93(2) GDPR (Art. 46(2)(c) GDPR), which we have agreed with the provider.
Turnstile uses only technically necessary technologies/cookies; details can be found in the Turnstile privacy notice and in the general Cloudflare privacy policy. The data are deleted as soon as the purpose for which they were collected ceases to apply and no retention obligations prevent this.
3.12. Chatbot in the eShop (AI‑assisted support)
We use a chatbot in our eShop to answer inquiries, to initiate transactions and to support our customer service. In doing so, we process the contents of chat messages, usage/metadata (e.g., timestamps, technical protocol data, where applicable IP address/User‑Agent) as well as — if provided by you — contact details (e.g., telephone number, e‑mail). When initiating/performing transactions, we additionally process master data (company name/name), address data and e‑mail address.
The chatbot uses a language model from OpenAI; further information about the provider can be found in section 3.11.1 ("OpenAI API"). As part of a human‑in‑the‑loop process, your request together with the contact details you provided may be forwarded to our internal support team.
The legal bases are Art. 6(1) sentence 1 lit. b GDPR (pre‑contractual measures/contract performance, in particular for transaction‑related processes and the answering of specific enquiries) as well as Art. 6(1) sentence 1 lit. f GDPR (legitimate interest in efficient customer communication as well as the availability and security of our eShop). To the extent we ask you for optional consents (e.g., for feedback outside the specific request), processing is carried out on the basis of Art. 6(1) sentence 1 lit. a GDPR.
A transfer to a country outside the EEA (in particular the USA) may occur in connection with the use of OpenAI; the legal basis are standard contractual clauses (Art. 46(2)(c) GDPR), see section 3.11.1.
We generally store the contents of chat conversations and associated log data for 90 days in order to be able to trace inquiries (support/documentation purposes) and to improve our chatbot and internal processes qualitatively (quality assurance/development). The legal basis for this is Art. 6(1) sentence 1 lit. f GDPR (legitimate interest in efficient customer communication, availability and improvement of our offering). You may object to this processing (Art. 21 GDPR).
Transaction‑related data (e.g., company name/name, address, e‑mail, ordered goods) are processed and stored by us in addition in accordance with the statutory retention periods. Where possible, we anonymise or pseudonymise chat contents for evaluation purposes.
For session control of the chatbot, technically necessary cookies or similar technologies may be used; we base these on § 25(2) no. 2 TDDDG (see also section 3.10).
There is no solely automated decision‑making with legal effect.