Privacy Policy

Version 2026-08-31

1. Controller

The controller for the processing described below is the Provider. Privacy enquiries may be sent to the email address shown above.

2. Scope and legal bases

This policy applies to the website, B2B registration, customer portal, webshop orders, delivery, invoicing, returns, and business communications.

Depending on the purpose, processing is based on steps requested before entering into a contract or performance of a contract, compliance with legal obligations, legitimate interests in secure and efficient business operations, or consent where the law requires consent.

3. Website access and necessary cookies

When the website is accessed, technical log data such as IP address, date and time, requested resource, referrer, browser, and operating system may be processed to deliver the website, prevent abuse, diagnose faults, and protect systems.

Session, security, language, cart, and authentication cookies may be used where necessary for the requested service. Optional analytics or marketing technologies will be used only where configured, disclosed, and permitted by the required consent.

4. B2B registration and manual verification

For company registration we process company and contact details, VAT information, addresses, communication details, trade-registration documents, chamber documents if supplied, application language, and review status.

The purpose is to verify business-customer status, prevent consumer or fraudulent access to the B2B shop, communicate about the application, and create an approved portal account. The decision is made through manual review and is not based solely on automated decision-making.

Required information must be provided to process the application. Without it, registration and B2B access cannot be completed.

5. Customer account, orders, and fulfilment

We process account, order, product, price, tax, payment-status, billing, delivery, communication, return, and warranty data to conclude and perform contracts, provide the portal, prevent misuse, and establish or defend legal claims.

Payment providers process payment details under their own notices. The Provider ordinarily receives transaction references and status information rather than full payment credentials.

6. Recipients

Data may be disclosed where necessary to hosting and IT service providers, payment providers, carriers, tax and legal advisers, banks, public authorities, and other processors bound by data-protection requirements.

Data is not sold. A transfer outside the European Economic Area occurs only where necessary and where a lawful transfer mechanism, such as an adequacy decision or appropriate safeguards, is available.

7. Retention

Data is retained only as long as required for the stated purpose, account administration, contractual and warranty claims, fraud prevention, or applicable commercial and tax retention duties. When no purpose or legal duty remains, data is deleted or anonymised.

Verification documents for rejected or abandoned applications are reviewed for deletion when they are no longer needed for the application, abuse prevention, or legal claims.

8. Rights

Subject to the statutory requirements, data subjects have rights of access, rectification, erasure, restriction, data portability, and objection. Consent may be withdrawn at any time for the future without affecting prior lawful processing.

A complaint may be lodged with a competent supervisory authority, including the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

9. Security and updates

Appropriate technical and organisational measures are used to protect personal data. This policy may be updated when processing, services, or legal requirements change; the current version is published on this page.