Holthusen near Schwerin · Please make an appointment before visiting us.
+49 (0)3865 844 44 33 info@ostseewaffen.de

Privacy policy

Preamble

Language of this privacy notice: This privacy notice is a translation of the German version. In the event of discrepancies arising from the translation, the German version shall generally prevail, unless mandatory applicable law provides otherwise. This does not affect your statutory data protection rights.

In this privacy notice, we explain which types of your personal data (also referred to below as “data”) we process, for what purposes and to what extent. This privacy notice applies to all personal data processing carried out by us, both in providing our services and, in particular, on our websites, in mobile applications and on external online presences such as our social media profiles (collectively referred to below as our “online services”).

The terms used are gender-neutral.

Last updated: 30 October 2026

Contents

Controller

OSTSEEWAFFEN.DE, proprietor Christopher Wirowski
Am Dorfteich 8
19075 Holthusen / Lehmkuhlen
Germany

Email address: info@ostseewaffen.de

Overview of processing

The following overview summarises the types of data processed and the purposes of processing and identifies the data subjects.

Types of data processed

  • Master data.
  • Payment data.
  • Location data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Metadata, communication and procedural data.
  • Log data.

Categories of data subjects

  • Service recipients and clients.
  • Prospective customers.
  • Communication partners.
  • Users.
  • Business and contractual partners.
  • Third parties.

Purposes of processing

  • Provision of contractual services and performance of contractual obligations.
  • Communication.
  • Security measures.
  • Office and organisational procedures.
  • Organisational and administrative procedures.
  • Feedback.
  • Marketing.
  • Provision and usability of our online services.
  • IT infrastructure.
  • Financial and payment management.
  • Public relations.
  • Sales promotion.
  • Business processes and commercial procedures.

Relevant legal bases

Relevant legal bases under the GDPR: The following provides an overview of the GDPR legal bases on which we process personal data. Please note that national data protection requirements in your or our country of residence or establishment may apply in addition to the GDPR. Where more specific legal bases apply in individual cases, we inform you of these in this privacy notice.

  • Consent (Article 6(1), first subparagraph, point (a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Performance of a contract and pre-contractual enquiries (Article 6(1), first subparagraph, point (b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or to take steps at the data subject’s request prior to entering into a contract.
  • Legal obligation (Article 6(1), first subparagraph, point (c) GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Article 6(1), first subparagraph, point (f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where those interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection rules in Germany: In addition to the GDPR, national data protection rules apply in Germany, in particular the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). The BDSG contains specific provisions on the right of access, erasure and objection, the processing of special categories of personal data, processing for other purposes, transfers, and automated individual decision-making including profiling. The data protection laws of the individual German federal states may also apply.

Application of data protection rules in the country of establishment: In the country where the controller is established, national data protection rules apply alongside the General Data Protection Regulation (GDPR).

Security measures

In accordance with legal requirements, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing and the varying likelihood and severity of risks to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include protecting the confidentiality, integrity and availability of data by controlling physical and electronic access, data access, input and disclosure, ensuring availability, and separating data. We have also established procedures to enable data subjects to exercise their rights, erase data and respond to threats to data. We also take the protection of personal data into account when developing or selecting hardware, software and procedures, in accordance with the principles of data protection by design and by default.

Securing online connections using TLS/SSL encryption technology (HTTPS): To protect user data transmitted through our online services from unauthorised access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cornerstones of secure data transmission over the internet. These technologies encrypt information transmitted between the website or app and the user’s browser (or between two servers), protecting it from unauthorised access. TLS, the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. A website secured by an SSL/TLS certificate is indicated by HTTPS in the URL. This indicates to users that their data is transmitted securely and in encrypted form.

Disclosure of personal data

In processing personal data, we may transfer or disclose it to other entities, companies, legally independent organisational units or individuals. Recipients may include IT service providers or providers of services and content embedded in a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements with recipients to protect your data.

International data transfers

Processing in third countries: If we transfer data to a third country (i.e. outside the European Union (EU) or European Economic Area (EEA)), or if this occurs when using third-party services or disclosing or transferring data to other persons, entities or companies (as indicated by the provider’s postal address or an express reference to a third-country transfer in this privacy notice), this is always done in accordance with legal requirements.

For transfers to the United States, we primarily rely on the Data Privacy Framework (DPF), recognised as a safe legal framework by an adequacy decision of the European Commission of 10 July 2023. In addition, we have concluded standard contractual clauses with the respective providers that comply with European Commission requirements and establish contractual obligations to protect your data.

This dual safeguard ensures comprehensive protection of your data: the DPF forms the primary layer of protection, while the standard contractual clauses provide additional security. Should the DPF change, the standard contractual clauses serve as a reliable fallback. In this way we ensure that your data remains adequately protected even in the event of political or legal changes.

For individual service providers, we inform you whether they are DPF-certified and whether standard contractual clauses are in place. Further information about the DPF and a list of certified companies are available on the US Department of Commerce website at https://www.dataprivacyframework.gov/ (in English).

Appropriate safeguards apply to transfers to other third countries, in particular standard contractual clauses, explicit consent or transfers required by law. Information about third-country transfers and applicable adequacy decisions is available from the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

General information on data retention and erasure

We erase the personal data we process in accordance with statutory provisions as soon as the underlying consent is withdrawn or no other legal basis for processing exists. This applies where the original purpose of processing no longer applies or the data is no longer required. Exceptions apply where statutory obligations or particular interests require longer retention or archiving.

In particular, data that must be retained under commercial or tax law or whose retention is necessary to pursue legal claims or protect the rights of other natural or legal persons must be archived accordingly.

Our privacy information contains additional information on retention and erasure applicable to specific processing activities.

Where several retention or erasure periods are specified for a data item, the longest period always applies. Data no longer retained for its original purpose but retained due to legal requirements or other reasons is processed exclusively for the reasons justifying its retention.

Retention and erasure: The following general periods apply to retention and archiving under German law:

  • 10 years – retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets and the instructions and other organisational documents necessary to understand them (section 147(1) no. 1 in conjunction with (3) AO, section 257(1) no. 1 in conjunction with (4) HGB).
  • 8 years – accounting records, such as invoices and expense receipts (section 147(1) nos. 4 and 4a in conjunction with (3) sentence 1 AO, section 14b(1) UStG and section 257(1) no. 4 in conjunction with (4) HGB).
  • 6 years – other business records: commercial or business correspondence received, copies of correspondence sent, and other documents relevant for taxation, such as hourly wage slips, operating accounts, costing documents, price labels and payroll records where not already accounting records, and cash register tapes (section 147(1) nos. 2, 3 and 5 in conjunction with (3) AO, section 257(1) nos. 2 and 3 in conjunction with (4) HGB).
  • 3 years – data needed to address potential warranty and damages claims or similar contractual claims and rights and related enquiries is retained for the regular three-year statutory limitation period, based on previous business experience and usual industry practices (sections 195, 199 BGB).

Period begins at year-end: Unless a period expressly begins on a specific date, and provided it is at least one year, it automatically begins at the end of the calendar year in which the triggering event occurred. For continuing contractual relationships under which data is retained, the triggering event is the date on which termination or other ending of the relationship takes effect.

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you have various rights under the GDPR, in particular under Articles 15 to 21:

  • Right to object: You have the right, on grounds relating to your particular situation, to object at any time to processing of personal data concerning you based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. Where your personal data is processed for direct marketing, you have the right to object at any time to processing for such marketing, including profiling insofar as it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw consent at any time.
  • Right of access: You have the right to request confirmation as to whether relevant data is being processed and access to that data, further information and a copy in accordance with legal requirements.
  • Right to rectification: You have the right, in accordance with legal requirements, to request completion of incomplete data or correction of inaccurate data concerning you.
  • Right to erasure and restriction of processing: You have the right, subject to legal requirements, to request that data concerning you be erased without undue delay or, alternatively, that its processing be restricted.
  • Right to data portability: You have the right, subject to legal requirements, to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller.
  • Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that processing of your personal data infringes the GDPR. A complaint may be lodged in particular with a supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.

Special information: firearms trade, forms with attachments, enquiry list, product data

Firearms trade and legal obligations: When trading in firearms and ammunition, we are legally required to verify acquisition authorisations and document acquisitions and transfers in the National Firearms Register and our firearms dealers’ register. For this purpose, we process names, addresses, dates of birth, identity document details, authorisation details (for example a firearms possession card or acquisition authorisation), and details of the relevant firearm or ammunition. When purchasing firearms, including from estates, we also process documents such as certificates of inheritance, copies of identity documents and firearms possession cards to verify authorisation. For exports, we transmit the required information to the Federal Office for Economic Affairs and Export Control (BAFA), customs and appointed transport companies. Legal bases: Article 6(1)(c) GDPR in conjunction with firearms and foreign trade legislation, and Article 6(1)(b) GDPR. We retain the data for the periods prescribed by firearms, commercial and tax law.

Forms and attachments: Our forms (contact, purchase enquiry, offer firearms, ammunition enquiry, withdrawal and enquiry list) are sent to our mailbox by email; the entries are not stored on the website itself. You may attach up to five files (photos or documents) to the “Offer firearms” form. They are sent to us only as email attachments and deleted from the web server immediately after sending. After submitting a withdrawal or enquiry list, you receive an automatic acknowledgement at the email address supplied. To prevent automated abuse, we check an invisible form field, completion time and the number of enquiries per internet connection within one hour; the IP address is stored briefly in encrypted form for this purpose (Article 6(1)(f) GDPR).

Enquiry list: When you add items to the enquiry list using “Add to enquiry”, your browser stores the list (items and quantities) in your device’s local storage until you submit the enquiry, remove the entries or 30 days have elapsed. No data is transmitted to us at this stage; we receive the list only when you submit the enquiry form. The legal basis for storage on your device is section 25(2) no. 2 TDDDG, as it is strictly necessary for the function you expressly requested. Your browser also stores your language selection (one year) and your choice regarding the map view.

Product data from our dealer shop: The products, images and descriptions displayed on the “Firearms” and “Ammunition” pages and product pages come from our dealer shop on the Progun marketplace (VDB Service GmbH). Our server regularly retrieves and stores this data locally. When you visit our website, no data about you is transmitted to Progun as a result.

Business services

We process personal data of our contractual and business partners, such as customers, clients, prospective customers, suppliers and other cooperation partners (collectively “contractual partners”), to initiate, perform and administer contractual and comparable legal relationships. This also includes pre-contractual steps taken on request and communication relating to the respective relationship.

Processing serves in particular to fulfil our primary and ancillary contractual obligations. These include providing agreed services, any duties to update or inform, handling warranty claims and other performance issues, withdrawals, termination of continuing obligations, reversals, refunds and other contractual declarations and enquiries. This covers both one-off contracts and ongoing contractual relationships.

We process in particular master data such as name, address and, where applicable, company; contact data such as email address and telephone number; contract and service data such as subject matter, duration and order or case number; usage and service data; payment and billing data; and communication content and histories. Where necessary, we also process data disclosed or transmitted to us in the performance of an assignment.

We also process data to protect our rights and fulfil legal obligations, including commercial and tax retention, documentation and, where applicable, evidence and accountability obligations. Processing is also based on our legitimate interests in proper business management, internal administration, risk management and IT security, and protecting our business and contractual partners against misuse, threats to data, secrets and other legally protected interests. This may include engaging external service providers such as IT and telecommunications providers, transport and logistics companies, banks, tax and legal advisers or other agents, where necessary to perform a contract or fulfil legal obligations.

Personal data is disclosed to third parties only where necessary for contract performance, pre-contractual steps, legitimate interests or legal obligations. We provide separate information in this privacy notice on further processing, particularly for marketing purposes.

We inform contractual partners which data is required in each case when collecting it, for example by marking fields in online forms or in personal communications.

Data is erased once no longer needed for these purposes and no statutory retention obligation prevents erasure. Statutory retention periods, particularly under commercial and tax law, may require longer storage. Data transmitted for a specific assignment is erased after completion and expiry of applicable retention periods, unless further legal or contractual storage obligations apply.

The legal bases are Article 6(1)(b) GDPR for pre-contractual steps and performance of the relevant contract, and Article 6(1)(c) GDPR for compliance with legal obligations. Where processing is based on legitimate interests, Article 6(1)(f) GDPR applies. These legitimate interests include proper and efficient business organisation, internal administration and documentation of transactions, asserting and defending legal claims, ensuring IT and data security, preventing misuse and fraud, and managing and developing our business economically. These interests include ensuring secure and legally compliant operations and preserving our business’s ability to act.

  • Types of data processed: Master data (e.g. full name, residential address, contact information, customer number); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); contract data (e.g. subject matter, term, customer category); usage data (e.g. page views, time spent, click paths, intensity and frequency of use, device types and operating systems, interactions with content and functions); metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).
  • Data subjects: Service recipients and clients; prospective customers; business and contractual partners.
  • Purposes and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; security measures; communication; office and organisational procedures; organisational and administrative procedures; business processes and commercial procedures.
  • Retention and erasure: Erasure as described under “General information on data retention and erasure”.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR); legal obligation (Article 6(1)(c) GDPR); legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • Enquiries, orders and fulfilment: You can enquire about products on our website; orders and payments cannot be made through the website. Contracts are concluded through personal contact. We process customer data to enable selection, purchase, provision or delivery and billing of selected products. Payment is by bank transfer or cash on site; we do not use a payment service provider. Where required for fulfilment, we engage transport companies to deliver products. Required information is marked as such during the enquiry or purchase process and includes information required for delivery and billing and contact details for queries; Legal basis: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR).

Business processes and procedures

Personal data of service recipients and clients – including customers, clients or, in specific cases, legal clients, patients or business partners and other third parties – is processed within contractual and comparable relationships and pre-contractual steps such as initiating business relationships. Processing supports business operations in areas such as customer management, sales, payments, accounting and project management.

The data collected is used to fulfil contractual obligations and make operations efficient. This includes handling transactions, managing customer relationships, optimising sales strategies and ensuring internal accounting and financial processes. The data also supports protection of the controller’s rights and administrative and organisational tasks.

Personal data may be disclosed to third parties where necessary for these purposes or legal obligations. Data is erased after statutory retention periods expire or the processing purpose ceases. This includes data that must be retained longer due to tax and statutory record-keeping obligations.

  • Types of data processed: Master data (e.g. full name, residential address, contact information, customer number); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts and related information such as authorship or creation time); contract data (e.g. subject matter, term, customer category); log data (e.g. logs of logins, data retrieval or access times); usage data (e.g. page views, time spent, click paths, intensity and frequency of use, device types and operating systems, interactions with content and functions); metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).
  • Data subjects: Service recipients and clients; prospective customers; communication partners; business and contractual partners; third parties; users (e.g. website visitors and users of online services).
  • Purposes and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; office and organisational procedures; business processes and commercial procedures; communication; marketing; sales promotion; public relations; financial and payment management; IT infrastructure (operation and provision of information systems and technical equipment such as computers and servers).
  • Retention and erasure: Erasure as described under “General information on data retention and erasure”.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR); legitimate interests (Article 6(1)(f) GDPR); legal obligation (Article 6(1)(c) GDPR).

Further information on processing activities, procedures and services:

  • Contact administration and maintenance: Procedures required to organise, maintain and secure contact information (e.g. establishing and maintaining a central contact database, regular updates, monitoring data integrity, implementing data protection measures, access controls, backups and restoration, staff training in contact management software, reviewing communication histories and adapting contact strategies); Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR), legitimate interests (Article 6(1)(f) GDPR).
  • General payment transactions: Procedures required to conduct payments, monitor bank accounts and control payment flows (e.g. preparing and checking transfers, processing direct debits, checking bank statements, monitoring incoming and outgoing payments, managing returned direct debits, account reconciliation and cash management); Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR), legitimate interests (Article 6(1)(f) GDPR).
  • Bookkeeping, accounts payable and receivable: Procedures for recording, processing and monitoring transactions in accounts payable and receivable (e.g. preparing and checking incoming and outgoing invoices, monitoring and managing outstanding items, payments, reminders, reconciliation of receivables and liabilities, accounts payable and receivable); Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR), legal obligation (Article 6(1)(c) GDPR), legitimate interests (Article 6(1)(f) GDPR).
  • Financial accounting and taxes: Procedures for recording, administering and monitoring financially relevant transactions and calculating, reporting and paying taxes (e.g. account assignment and posting, quarterly and annual accounts, payments, reminders, account reconciliation, tax advice, preparation and submission of tax returns and tax administration); Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR), legal obligation (Article 6(1)(c) GDPR), legitimate interests (Article 6(1)(f) GDPR).
  • Purchasing: Procedures for procuring goods, raw materials or services (e.g. supplier selection and assessment, price negotiations, placing and monitoring orders, checking deliveries and invoices, order and inventory management, preparing and maintaining purchasing policies); Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR), legitimate interests (Article 6(1)(f) GDPR).
  • Sales: Procedures for planning, implementing and monitoring marketing and sales of products or services (e.g. customer acquisition, preparing and following up quotations, order processing, customer advice and support, sales promotion, product training, sales control and analysis, and sales channel management); Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR), legitimate interests (Article 6(1)(f) GDPR).
  • Marketing, advertising and sales promotion: Procedures for marketing, advertising and sales promotion (e.g. market analysis and target groups, marketing strategies, planning and executing campaigns, designing and producing advertising materials, online marketing including SEO and social media campaigns, event marketing and trade fairs, customer loyalty and sales promotions, performance measurement and optimisation, budgeting and cost control); Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
  • Public relations: Procedures for public relations (e.g. developing and implementing communication strategies, PR campaigns, producing and distributing press releases, media relations, monitoring and analysing media response, press conferences and public events, crisis communication, social media and website content, and corporate branding); Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Provision of online services and web hosting

We process user data to provide our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

  • Types of data processed: Usage data (e.g. page views, time spent, click paths, intensity and frequency of use, device types and operating systems, interactions with content and functions); metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved); log data (e.g. logs of logins, data retrieval or access times); content data (e.g. text or image messages and posts and related information such as authorship or creation time).
  • Data subjects: Users (e.g. website visitors and users of online services).
  • Purposes and legitimate interests: Provision and usability of our online services; IT infrastructure (operation and provision of information systems and technical equipment such as computers and servers); security measures.
  • Retention and erasure: Erasure as described under “General information on data retention and erasure”.
  • Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • Providing online services on rented storage: We use storage space, computing capacity and software rented or otherwise obtained from a server provider (also called a web host) to provide our online services; Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
  • Collection of access data and log files: Access to our online services is recorded in server log files. These may include the address and name of pages and files accessed, date and time, amount of data transferred, success status, browser type and version, user’s operating system, referrer URL (previously visited page), and generally IP addresses and the requesting provider. Server log files may be used for security, for example to prevent server overload (particularly in abusive distributed denial-of-service attacks), and to ensure server capacity and stability; Legal basis: Legitimate interests (Article 6(1)(f) GDPR). Erasure: Log file information is retained for a maximum of 30 days and then erased or anonymised. Data required as evidence is exempt from erasure until the incident is finally resolved.
  • Email transmission and hosting: Our web hosting services include sending, receiving and storing emails. For these purposes, recipient and sender addresses, other information about transmission (e.g. the providers involved) and email contents are processed. This data may also be processed to detect spam. Please note that emails are generally not sent in encrypted form over the internet. While emails are normally encrypted in transit, they are not encrypted on the sending and receiving servers unless end-to-end encryption is used. We therefore cannot assume responsibility for email transmission between the sender and receipt on our server; Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
  • ALL-INKL: Provision of IT infrastructure and related services (e.g. storage and/or computing capacity); Provider: ALL-INKL.COM – Neue Medien Münnich, proprietor: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://all-inkl.com/; Privacy notice: https://all-inkl.com/datenschutzinformationen. Data processing agreement: Provided by the service provider.

Use of cookies

“Cookies” refers to functions that store information on and read information from users’ devices. Cookies may be used for various purposes, such as ensuring functionality, security and convenience of online services and analysing visitor flows. We use cookies in accordance with legal requirements. Where required, we obtain users’ prior consent. Where consent is not necessary, we rely on our legitimate interests. This applies where storing and accessing information is essential to provide expressly requested content and functions, including saving settings and ensuring the functionality and security of our online services. Consent may be withdrawn at any time. We clearly explain its scope and which cookies are used.

Cookies and storage on this website: We use no cookie banner, analytics cookies or advertising cookies. Only technically necessary information is stored: your language selection (one year), your decision on the map view, the enquiry list (30 days in your browser’s local storage), and session cookies when logging into the administration area. Google Maps is loaded only after you click; your choice remains on your device and is not transmitted to us.

Information on data protection legal bases: Whether we process personal data using cookies depends on consent. Where consent is given, it is the legal basis. Without consent, we rely on our legitimate interests as explained above and in relation to the respective services and procedures.

Storage period: The following types of cookies are distinguished by storage period:

  • Temporary cookies (also session cookies): These are deleted no later than when a user leaves an online service and closes their device or application (e.g. browser or mobile app).
  • Persistent cookies: These remain stored after the device or application is closed. They may, for example, retain login status and display preferred content directly when a user revisits a website. Usage data collected through cookies may also be used for audience measurement. Unless we give users explicit information about cookie type and storage period (e.g. when obtaining consent), users should assume cookies are persistent and may be stored for up to two years.

General information on withdrawal and objection (opt-out): Users may withdraw consent at any time and object to processing in accordance with legal requirements, including through their browser’s privacy settings.

  • Types of data processed: Metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).
  • Data subjects: Users (e.g. website visitors and users of online services).
  • Legal bases: Legitimate interests (Article 6(1)(f) GDPR); consent (Article 6(1)(a) GDPR).

Contact and enquiry management

When you contact us (e.g. by post, contact form, email, telephone or social media) and within existing user and business relationships, we process the information provided by enquirers insofar as necessary to answer enquiries and take any requested measures.

  • Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts and related information such as authorship or creation time); metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).
  • Data subjects: Communication partners.
  • Purposes and legitimate interests: Communication; organisational and administrative procedures; feedback (e.g. collecting feedback via an online form); provision and usability of our online services.
  • Retention and erasure: Erasure as described under “General information on data retention and erasure”.
  • Legal bases: Legitimate interests (Article 6(1)(f) GDPR); performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR).

Further information on processing activities, procedures and services:

  • Contact form: When you contact us through our form, by email or other communication channels, we process the personal data supplied to answer and handle the matter. This generally includes your name, contact information and any other information supplied and needed to handle the matter appropriately. We use this data solely for the stated purpose of contact and communication; Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR), legitimate interests (Article 6(1)(f) GDPR).

Communication via messenger services

We use messenger services for communication and ask you to note the following information about their operation, encryption, use of communication metadata and your options to object.

You can also contact us by alternative means, such as telephone or email. Please use the contact details provided to you or listed in our online services.

Where content (i.e. your message and attachments) is end-to-end encrypted, the communication content (message and attached images) is encrypted from end to end. This means the message content cannot be viewed, even by the messenger providers. You should always use a current version of the messenger with encryption enabled to ensure message content is encrypted.

We also point out that messenger providers cannot see the content but may learn that and when communication partners communicate with us, and may process technical information about their devices and, depending on device settings, location information (metadata).

Information on legal bases: Where we request permission before communicating via messenger, consent is the legal basis for processing. Otherwise, if we do not request consent and you contact us on your own initiative, for example, we use messenger services with contractual partners and when initiating contracts as a contractual measure; for other prospective customers and communication partners we rely on our legitimate interests in quick and efficient communication and meeting their needs for messenger communication. We do not transmit contact details supplied to us to messenger services for the first time without your consent.

Withdrawal, objection and erasure: You may withdraw consent and object to communication with us via messenger at any time. We erase messages in accordance with our general erasure policies (e.g. as described above, after contractual relationships end and subject to archiving requirements) and otherwise as soon as we can assume we have answered enquiries, no reference to an earlier conversation is expected and no statutory retention obligation prevents erasure.

Referral to other communication channels: To ensure your security, we ask for your understanding that, for certain reasons, we may be unable to answer enquiries via messenger. This applies where, for example, contractual details require particular confidentiality or a messenger response does not meet formal requirements. In these cases we recommend more suitable communication channels.

  • Types of data processed: Contact data (e.g. postal and email addresses or telephone numbers); content data (e.g. text or image messages and posts and related information such as authorship or creation time); usage data (e.g. page views, time spent, click paths, intensity and frequency of use, device types and operating systems, interactions with content and functions); metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).
  • Data subjects: Communication partners.
  • Purposes and legitimate interests: Communication.
  • Retention and erasure: Erasure as described under “General information on data retention and erasure”.
  • Legal bases: Consent (Article 6(1)(a) GDPR); performance of a contract and pre-contractual enquiries (Article 6(1)(b) GDPR); legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • WhatsApp: A communication service enabling text and voice messages, images, videos, documents, and voice and video calls to be sent and received over the internet. Communication is end-to-end encrypted, so content is accessible only to participants. To provide the service, the platform processes metadata (e.g. telephone numbers, timestamps and device information) and may use it to improve functions, security and optimise services; Provider: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.whatsapp.com/. Privacy notice: https://www.whatsapp.com/legal/privacy-policy-eea.

Customer reviews

We link to our Google business profile, where customers can review us. Reviews are submitted directly to Google and generally require a Google account; Google’s terms of use and privacy information apply. We do not transmit customer data to Google to solicit reviews. Google processes your data (e.g. IP address) only when you follow the link.

  • Types of data processed: Usage data (e.g. page views, time spent, click paths, intensity and frequency of use, device types and operating systems, interactions with content and functions); metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).
  • Data subjects: Users (e.g. website visitors and users of online services).
  • Purposes and legitimate interests: Feedback; marketing.
  • Legal basis: Legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • Google Business Profile (reviews): Link to our business profile where customers can submit and read reviews; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Article 6(1)(f) GDPR); Website: https://www.google.com/; Privacy notice: https://business.safety.google/privacy/. Basis for third-country transfers: Data Privacy Framework (DPF).

Plug-ins and embedded functions and content

We integrate functional and content elements into our online services obtained from the servers of their respective providers (referred to below as “third-party providers”). These may include graphics, videos or maps (collectively “content”).

Integration always requires the providers to process users’ IP addresses, because they cannot send content to browsers without an IP address. The IP address is therefore necessary to display content or functions. We strive to use only content whose providers use IP addresses solely to deliver the content. Providers may also use pixel tags (invisible graphics, also called web beacons) for statistical or marketing purposes. Pixel tags can be used to analyse information such as visitor traffic. Pseudonymous information may also be stored in cookies on users’ devices and may include technical information about browsers and operating systems, referring websites, visit times and other information about use of our online services, and may be combined with information from other sources.

Information on legal bases: Where we request users’ consent to use third-party providers, consent is the legal basis for processing. Otherwise, user data is processed on the basis of our legitimate interests (i.e. efficient, economical and recipient-friendly services). Please also refer to the cookie information in this privacy notice.

  • Types of data processed: Usage data (e.g. page views, time spent, click paths, intensity and frequency of use, device types and operating systems, interactions with content and functions); metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved); location data (information about the geographical position of a device or person).
  • Data subjects: Users (e.g. website visitors and users of online services).
  • Purposes and legitimate interests: Provision and usability of our online services.
  • Retention and erasure: Erasure as described under “General information on data retention and erasure”. Cookies stored for up to two years (unless otherwise stated, cookies and similar storage methods may be stored on users’ devices for two years).
  • Legal bases: Consent (Article 6(1)(a) GDPR); legitimate interests (Article 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • Google Fonts (hosted on our own server): Provision of font files for user-friendly display of our online services; Provider: Google Fonts are hosted on our server; no data is transmitted to Google; Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
  • Google Maps: We integrate maps from Google’s Google Maps service. Data processed may include users’ IP addresses and location data; Provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Consent (Article 6(1)(a) GDPR); Website: https://mapsplatform.google.com/; Privacy notice: https://business.safety.google/privacy/. Basis for third-country transfers: Data Privacy Framework (DPF).

Changes and updates

Please review this privacy notice regularly. We amend it when changes in our data processing require this. We inform you when changes require your participation (e.g. consent) or other individual notification.

Where this notice specifies addresses and contact information for companies and organisations, please note that these may change over time and check the details before making contact.

Definitions

This section provides an overview of terms used in this privacy notice. Where terms are legally defined, their statutory definitions apply. The following explanations are intended primarily to aid understanding.

  • Master data: Master data comprises essential information necessary to identify and administer contractual partners, user accounts, profiles and similar associations. It may include personal and demographic details such as names, contact information (addresses, telephone numbers, email addresses), dates of birth and specific identifiers (user IDs). Master data forms the basis for formal interaction between persons and services, institutions or systems by enabling unambiguous identification and communication.
  • Content data: Content data comprises information generated when creating, editing and publishing content of any kind. This may include text, images, videos, audio files and other multimedia content published on various platforms and media. Content data includes not only the content itself but also metadata providing information about it, such as tags, descriptions, authorship and publication dates.
  • Contact data: Contact data is essential information that enables communication with individuals or organisations. It includes telephone numbers, postal and email addresses and communication identifiers such as social media handles and instant messaging identifiers.
  • Metadata, communication and procedural data: These categories contain information about how data is processed, transmitted and managed. Metadata, also known as data about data, describes the context, origin and structure of other data. It may include file size, creation date, document author and revision history. Communication data records the exchange of information between users through channels such as email, call logs, social network messages and chat histories, including participants, timestamps and transmission routes. Procedural data describes processes and workflows within systems or organisations, including workflow documentation, transaction and activity logs and audit logs used to trace and review operations.
  • Usage data: Usage data records how users interact with digital products, services or platforms. It includes information showing how users use applications, which functions they prefer, how long they remain on pages and the paths they take through an application. Usage data may also include frequency of use, activity timestamps, IP addresses, device information and location data. It is particularly valuable for analysing user behaviour, optimising user experiences, personalising content and improving products or services. It also plays an important role in identifying trends, preferences and potential problems in digital services.
  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person (the “data subject”); an identifiable natural person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier (e.g. a cookie), or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
  • Log data: Log data is information about events or activities recorded in a system or network. It typically includes timestamps, IP addresses, user actions, error messages and other details about the use or operation of a system. Log data is often used to analyse system problems, monitor security or produce performance reports.
  • Location data: Location data arises when a mobile device (or another device technically capable of determining location) connects to a radio cell, Wi-Fi or similar technical means and location functions. Location data indicates the geographically determinable position of the device on Earth. It may, for example, be used to display map functions or other location-dependent information.
  • Controller: The “controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.
  • Processing: “Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers virtually all handling of data, including collection, analysis, storage, transmission and erasure.
  • Contract data: Contract data is specific information relating to formalisation of an agreement between two or more parties. It documents the terms under which services or products are provided, exchanged or sold. This category is essential for managing and fulfilling contractual obligations and includes identification of the parties and specific terms and conditions. Contract data may include start and end dates, the nature of agreed services or products, pricing, payment terms, termination rights, renewal options and special terms or clauses. It forms the legal basis for the relationship and is important for determining rights and obligations, enforcing claims and resolving disputes.
  • Payment data: Payment data comprises all information needed to process payment transactions between buyers and sellers. It is essential for electronic commerce, online banking and other financial transactions. It includes details such as credit card numbers, bank details, payment amounts, transaction dates, verification numbers and billing information. Payment data may also include payment status, chargebacks, authorisations and fees.