Privacy Policy

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Grossmann GmbH i. Gr.
Am Waggonbau 12
06844 Dessau-Roßlau
Germany
Phone: +49 340 85921833
E-mail: info@grossmann.de
Represented by the managing director Hans Großmann

Data protection officer

We are not obliged to appoint a data protection officer and have not appointed one. For data protection questions, please contact us directly at info@grossmann.de.

Website (Vercel)

The website is delivered by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, Vercel processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system. Pages are delivered via Vercel’s global network; server-side rendering currently takes place in data centres in the USA. Vercel is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46 (2) (c) GDPR).

Shop server and media storage (Hetzner)

We run the shop application with cart, orders, customer accounts and enquiries, and its database, on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the Helsinki (Finland) data centre. Product images, drawings and 3D models are stored in Hetzner’s object storage in Falkenstein (Germany). Our e-mail mailbox is also hosted by Hetzner in Germany. Hetzner processes the data on our behalf (Art. 28 GDPR).

Server logs

With every access the servers store log data (IP address, time, request, status code, browser identifier). For security reasons we also log failed login attempts with e-mail address and IP address, and the receipt of contact enquiries with name and e-mail address. The purpose is secure and stable operation and the prevention of misuse; the legal basis is Art. 6 (1) (f) GDPR. Logs are kept only as long as necessary for these purposes and then deleted.

We only use technically necessary cookies and entries in your browser’s local storage (e.g. for the cart and login). We only store delivery addresses in your browser if you explicitly select this at checkout. The legal basis for accessing your device is § 25 (2) no. 2 TDDDG; for further processing Art. 6 (1) (b) or (f) GDPR. All entries with purpose and duration: Cookies & Storage.

If you contact us via the contact form, by e-mail or by telephone, we process your details (name, e-mail address, where applicable company, telephone, country, product area and your message) to handle your enquiry. Messages from the contact form are not stored in the shop database but forwarded to our team by e-mail. The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to a contract or its preparation, otherwise Art. 6 (1) (f) GDPR (our legitimate interest in answering enquiries).

If you request a quotation or technical advice (e.g. from a configurator), we store your contact details (name, e-mail address, where applicable company, telephone, country), the product concerned, your technical data and configuration, the quantity and your message in our database in order to prepare a quotation and advise you. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request).

For the cart we store the selected products, quantities and configurations on our server, linked to a random identifier (for guests) or to your customer account.

For an order we process: e-mail address, name, where applicable company and VAT ID, billing and delivery address, where applicable telephone number and notes, and the ordered items with configuration and prices. The purpose is performance of the contract – review, order confirmation, invoice, shipping and customer service. The legal basis is Art. 6 (1) (b) GDPR; retention under commercial and tax law is based on Art. 6 (1) (c) GDPR. For delivery we pass your name and delivery address to the carrier we commission.

There is no online payment; no payment data is transmitted to payment service providers.

If you create a customer account, we store your e-mail address, password (only in encrypted form as a hash), first and last name and, voluntarily, telephone number, company, VAT ID and addresses. To confirm your e-mail address we send you a code that expires after ten minutes. Your orders are shown in the account. The legal basis is Art. 6 (1) (b) GDPR. We store the data until you request deletion of your account – an e-mail to info@grossmann.de is sufficient; statutory retention obligations for order data remain unaffected.

If you use the “Withdraw from contract” function, we process your name, e-mail address, order number, order and receipt dates, your details on the scope of the withdrawal and any message in order to process the withdrawal and acknowledge its receipt. The legal basis is Art. 6 (1) (c) GDPR in conjunction with § 356a BGB.

Your data is only received by persons and bodies that need it for the purposes stated:

• our management;
• an employee or service provider working for us in IT, order processing and bookkeeping, based in India. It receives orders, enquiries and contact messages by e-mail notification and processes them on our behalf;
• hosting providers (Vercel, Hetzner) as processors;
• the carrier commissioned with delivery (name and delivery address);
• tax advisers and authorities where we are legally obliged.

E-mail sending

We send shop confirmations and notifications via our e-mail server at Hetzner Online GmbH in Germany (processing on our behalf, Art. 28 GDPR).

Third countries

India is a third country without an adequacy decision of the European Commission. The transfer to our employee or service provider in India is based on the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914; Art. 46 (2) (c) GDPR). You can request a copy at info@grossmann.de. Transfers to the USA (Vercel) are made to a company certified under the EU-U.S. Data Privacy Framework.

• 3D viewer and images: product images, drawings and 3D models are loaded from our own server or our media storage at Hetzner (Falkenstein). The 3D viewer only loads when you open it on a product page.
• Fonts: the fonts used are hosted on our server; no connection to Google Fonts is made when you open a page.
• Google Search Console: we use this service to retrieve statistics on how our website is found in Google Search. No data about visitors to our website is transmitted to Google.
• Links: links to social networks (e.g. for sharing posts) are plain links. Data is only transmitted when you click such a link; the privacy policy of the respective provider then applies.
• Blog comments: if you write a comment, we store name, e-mail address, where applicable website, and the comment text; only name and text are published after approval (Art. 6 (1) (f) GDPR).

We delete personal data as soon as the purpose of processing ceases and no statutory retention obligations apply. In particular:

• commercial and business letters (e.g. quotations, order confirmations, business correspondence): 6 years (§ 257 HGB, § 147 AO);
• accounting vouchers such as invoices: 8 years; books and annual financial statements: 10 years (§ 257 HGB, § 147 AO);
• enquiries that do not lead to a contract: until final processing and thereafter, insofar as they are business correspondence, in accordance with the periods above;
• customer account: until you request deletion;
• guest cart: until you order or clear your browser storage.

The periods begin at the end of the calendar year in which the document was created.

You have the following rights towards us regarding your personal data:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

An informal message to info@grossmann.de is sufficient.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz Sachsen-Anhalt (State Commissioner for Data Protection of Saxony-Anhalt)
Otto-von-Guericke-Straße 34a
39104 Magdeburg
datenschutz.sachsen-anhalt.de

• We need the details marked as required fields for an order or enquiry to conclude the contract or process the enquiry. Without them we cannot process your order or enquiry.
• There is no automated decision-making including profiling (Art. 22 GDPR). Our system calculates prices of configured products according to fixed rules from your technical selection; this is not a decision about you as a person.
• Transmission between your browser and our servers is TLS-encrypted (recognisable by “https://” and the padlock symbol).

We adapt this privacy policy when our processing or the legal situation changes. The version published here applies.