Privacy Policy

1. Controller

The controller for the processing of personal data on this website is:

You may contact us at any time with questions about the processing of your personal data.

2. General information on data processing

We process personal data exclusively within the framework of applicable law. Personal data means any information relating to an identified or identifiable natural person — for example names, addresses, email addresses, telephone numbers and IP addresses. Processing is based in particular on the following legal grounds:

• Art. 6(1)(a) GDPR: the data subject has given consent to the processing.
• Art. 6(1)(b) GDPR: processing is necessary for the performance of a contract or pre-contractual measures.
• Art. 6(1)(c) GDPR: processing is necessary for compliance with a legal obligation.
• Art. 6(1)(f) GDPR: processing is necessary for our legitimate interests, unless the interests or fundamental rights of the data subject override them.

3. Hosting

This website is provided by Vercel Inc. (USA). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure, reliable and technically faultless operation of our website. A data processing agreement under Art. 28 GDPR is in place with Vercel. Where personal data is transferred to the USA, the transfer is based on the European Commission's standard contractual clauses pursuant to Art. 46 GDPR. When the website is accessed, the following technical data is processed in server log files:

• Visitor's IP address
• Date and time of access
• Pages and files requested
• Browser type and version
• Operating system used
• Referrer URL, where transmitted
• Information about the server request

4. SSL and TLS encryption

Our website uses SSL/TLS encryption to protect the transmission of confidential content. You can recognise an encrypted connection by the address bar of your browser starting with “https://”. Encryption is intended to prevent transmitted data from being read by unauthorised third parties.

5. Contact by email and telephone

If you contact us by email or telephone, we process the personal data you provide in order to handle your enquiry. Processing is based on Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, and on Art. 6(1)(f) GDPR for general enquiries. The data is deleted once its storage is no longer necessary and no statutory retention obligations apply. This may include in particular:

• First and last name
• Email address
• Telephone number
• Postal address
• The content of your enquiry
• Details of the products you are interested in
• Information about building and renovation projects

6. Contact form and quotation requests

When you submit an enquiry via our website, we process the information you enter in order to provide individual advice, prepare a quotation and prepare possible orders. The legal basis is Art. 6(1)(b) GDPR. The data transmitted is not used for other purposes without an appropriate legal basis; your contact details are used for electronic advertising only where this is permitted by law. This may include in particular:

• First and last name
• Email address
• Telephone number
• Postcode and town
• Selected product
• Construction drawings and sketches
• Information about the building project
• Further information provided voluntarily

7. Storage of enquiry data

Enquiry data submitted through our forms is stored in a database operated by Supabase Inc. and transmitted to us by email via the delivery service Resend (Resend, Inc.), which also sends you a confirmation of receipt. Data processing agreements under Art. 28 GDPR are in place with both providers. Where personal data is transferred outside the European Union, the transfer is based on the European Commission's standard contractual clauses pursuant to Art. 46 GDPR. The legal basis for the processing is Art. 6(1)(b) GDPR.

8. Email mailbox

Our email mailbox is operated by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you write to us or we reply to you, STRATO processes the data required for delivery and storage. The legal basis is Art. 6(1)(b) or (f) GDPR; where a statutory retention obligation applies, additionally Art. 6(1)(c) GDPR. This includes in particular:

• Sender and recipient address
• Subject of the email
• Content of the message
• Attachments transmitted
• Technical information about message delivery

9. Processing of customer and contract data

In the course of our business we process personal data of customers and prospective customers, in particular for advice on, sale of and ordering of windows, doors, sliding systems and other products we offer. The legal basis is Art. 6(1)(b) GDPR; where statutory retention obligations apply, additionally Art. 6(1)(c) GDPR. Personal data may be processed for the following purposes:

• Handling customer enquiries
• Preparing individual quotations
• Checking technical requirements
• Agreeing product dimensions and configurations
• Placing orders
• Organising deliveries
• Invoicing and payment processing
• Handling warranty claims and complaints

10. Disclosure to manufacturers and suppliers

In order to prepare quotations, order products and carry out deliveries, it may be necessary to disclose personal data to the manufacturers, suppliers, forwarding companies or other business partners involved. Data is disclosed only to the extent necessary for the respective purpose; the legal basis is in particular Art. 6(1)(b) GDPR. Where business partners process personal data on our behalf, we conclude the data processing agreements required by law. Transfers to countries outside the European Union or the European Economic Area take place only in compliance with Art. 44 et seq. GDPR. This may include in particular:

• Contact details
• Delivery addresses
• Details of products ordered
• Technical drawings
• Dimensions
• Project-related information

11. Cookies and similar technologies

Technically necessary cookies provide basic functions of our website, such as storing your privacy settings. Where they are strictly necessary for a service you have expressly requested, no consent is required under § 25(2) TDDDG. For analytics, marketing or non-essential external content we obtain your consent before activation; the legal basis is § 25(1) TDDDG together with Art. 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future.

12. Google Analytics

Only with your express consent do we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to evaluate the use of our website statistically. Cookies are set and usage data — including a truncated IP address — is processed, also in the USA. Without your consent no Google script is loaded and no data is transmitted to Google. The legal basis is § 25(1) TDDDG together with Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future:

Cookie settings

13. Vercel Analytics

We use Vercel Analytics (Vercel Inc.) to measure reach. The service works without cookies, does not create cross-device user profiles and does not store personal data permanently. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest lies in the statistical evaluation of website use.

14. Our own reach measurement

To measure the reach of our website we count page views on our own server. No cookies are set and nothing is stored on or read from your device — consent under § 25 TDDDG is therefore not required. Your IP address is not stored: a non-reversible hash is formed from the IP address, the browser identifier, a secret key and the calendar day, which makes visits distinguishable within a single day. Because the day is part of the calculation, a different value results on the following day; recognition across several days or across different websites is ruled out. Individual records are automatically aggregated into anonymous daily totals each day and then deleted. The legal basis is our legitimate interest in a data-minimising, statistical evaluation of our offering (Art. 6(1)(f) GDPR).

• Page viewed and language version
• Time of the view
• Daily changing hash used to distinguish visits (not an IP address)

15. Fonts

All fonts used are served from our own server. No connection to Google Fonts or other external font providers is made when our website is accessed.

16. External links and social networks

Our website may contain links to external websites and to profiles on social networks. When you click an external link you leave our website; the respective operators are responsible for the processing of personal data on the linked platforms. We recommend that you read the privacy notices of the respective providers. Where external content is embedded directly in our website and personal data is therefore transmitted as soon as the page is loaded, we inform you separately and obtain the necessary consent where required.

17. Retention period

As a rule we store personal data only for as long as is necessary to fulfil the respective purpose of processing. Longer storage takes place only where statutory retention obligations exist or another legal basis permits it. For documents relevant under tax and commercial law, retention periods of six, eight or ten years may apply depending on the type of document. Once the relevant periods have expired, personal data is deleted unless other legal grounds require further storage.

18. Data security

We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, manipulation and unlawful disclosure. These include in particular suitable access restrictions, secure communication procedures and measures to secure our IT systems. Our security measures are reviewed and adapted in line with technical developments and legal requirements.

19. Your rights as a data subject

Under applicable data protection law you have the following rights. An informal message to the email address given above is sufficient to exercise them.

• Right of access to the processing of your personal data (Art. 15 GDPR)
• Right to rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR)
• Right to erasure under the statutory conditions (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR)
• Right to object to processing based on legitimate interests (Art. 21 GDPR)
• Right to withdraw consent at any time with effect for the future; the lawfulness of processing carried out before withdrawal remains unaffected

20. Right to lodge a complaint with a supervisory authority

Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection law. The authority responsible for our registered office is the State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen (datenschutz.bremen.de).

21. Disclosure of data to third parties

Personal data is disclosed only where there is a legal basis for doing so. Service providers that process personal data on our behalf are engaged in compliance with statutory requirements. Personal data is not disclosed without authorisation for third-party advertising purposes. Disclosure may take place in particular in the following cases:

• Disclosure is necessary for the performance of a contract.
• There is a legal obligation.
• Valid consent has been given.
• An overriding legitimate interest justifies the disclosure.

22. Transfers to third countries

Where personal data is transferred to recipients outside the European Union or the European Economic Area, this takes place only in compliance with statutory requirements. In particular, an adequacy decision of the European Commission or appropriate safeguards under Art. 46 GDPR may be required. The services actually used and the corresponding safeguards are named in the relevant sections of this privacy policy.

23. Provision of personal data

Providing personal data is generally neither legally nor contractually required when you merely visit our website. However, certain technical data is necessary in order to display our website on your device. If you wish to request a quotation or enter into a contract with us, we need the information required to process and perform it. Without this information we may not be able to handle certain enquiries or provide contractual services.

24. Automated decision-making

Decision-making based solely on automated processing, including profiling within the meaning of Art. 22 GDPR, does not take place in the context of our customer communication and preparation of quotations.

25. Updates to this privacy policy

We reserve the right to amend this privacy policy where changes to our website, the services used or legal requirements make this necessary. The current version is always available on our website.