Privacy Policy

1. Data protection overview

The following notes provide a simple overview of what happens to your personal data when you visit our website and the B2B-Shop. Personal data refers to any information that can be used to identify you personally.

Data collection on our website

Data processing on this website is carried out by the website operator. You can find the operator’s contact information in the “Information on the Data Controller” section of this Privacy Policy.

Your data is collected, on the one hand, when you provide it to us—for example, data you enter into the contact form. Other data is automatically collected by our IT systems when you visit the website. This consists primarily of technical data (e.g., internet browser, operating system, or time of page access). 

This data is collected automatically as soon as you access our website. Some of the data is collected to ensure the website functions properly. Other data may be used to analyze your user behavior. 

You have the right at any time to receive information, free of charge, about the origin, recipients, and purpose of your stored personal data. You also have the right to rectification, restriction, or erasure of this data. Furthermore, you have the right to file a complaint with the competent supervisory authority. 

You can contact us at any time regarding this matter or any other questions about data protection.

Analytics and third-party tools

When you visit our website, your behavior may be analyzed for statistical purposes. This is primarily done using cookies and analytics tools. The analysis of your activities is generally anonymous and cannot be traced back to you. You can opt out of this analysis at any time by adjusting your cookie settings.

2. External Hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the hosting provider(s). This may include, in particular, IP addresses, contact requests, metadata and communication data, contract data, contact information, names, website visits, and other data generated through a website.

External hosting is carried out for the purpose of fulfilling our contractual obligations to our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of ensuring the secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR). If consent has been obtained, processing is carried out exclusively based on Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

Our hosting provider will process your data only to the extent necessary to fulfill its service obligations and will follow our instructions regarding this data. 

We use the following web hosting provider: 

Metaways Infosystems GmbH
Schloßstraße 49
22967 Tremsbüttel

We have entered into a Data Processing Agreement (DPA) for the use of the service. This is a contract required under data protection law that ensures the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

3. General information and mandatory disclosures

The operators of this website take the protection of your personal data very seriously. Your personal information is treated confidentially and in accordance with both statutory data protection regulations and this Privacy Policy. 

Please note that data transmission over the internet (such as when communicating by email) may be subject to security vulnerabilities. Absolute protection of data against access by third parties is not possible. 

Information on the controller 

The controller responsible for processing data on this website is: 

Hermann Hartje KG
Deichstr. 120-122 27318 Hoya, Germany
Phone: +49 (0) 4251 / 811 - 0
E-Mail: info@hartje.de

Retention Period

Unless a more specific retention period is stated in this Privacy Policy, we will retain your personal data until the purpose for which it was collected no longer applies. If you submit a valid request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing your personal data (e.g., retention periods under tax or commercial law); in the latter case, the data will be deleted once these grounds no longer apply.

General Information on the Legal Bases

If you have consented to the processing of your data, we process your personal data based on Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, provided that special categories of data as defined in Article 9(1) of the GDPR are being processed. In the event of explicit consent to the transfer of personal data to third countries, data processing is also carried out based on Article 49(1)(a) of the GDPR. 

If you have consented to the storage of cookies or to access to information on your device (e.g., via device fingerprinting), data processing is additionally based on Section 25(1) of the TDDDG. You may revoke your consent at any time. 

If your data is necessary for the performance of a contract or for the implementation of pre-contractual measures, we process your data based on Article 6(1)(b) of the GDPR. Furthermore, we process your data if it is necessary to comply with a legal obligation based on Article 6(1)(c) of the GDPR. 

Data processing may also be carried out based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR. The following sections of this Privacy Policy provide information on the specific legal bases applicable in each individual case.

Data Protection Officer

We have appointed a Data Protection Officer for our organization: 

secom IT GmbH
Nienburger Straße 9a
27232 Sulingen, Germany 
Phone: +49 4271 / 9473 - 800
 Email: datenschutz@secom-it.gmbh

Recipients of Personal Data

As part of our business operations, we collaborate with various external parties. In some cases, this requires the transfer of personal data to these external parties. We disclose personal data to external parties only if this is necessary for the performance of a contract, if we are legally obligated to do so (e.g., disclosure of data to tax authorities), if we have a legitimate interest in the disclosure pursuant to Article 6(1)(f) of the GDPR, or if another legal basis permits the disclosure of data. When using data processors, we only disclose our customers’ personal data based on a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Withdrawal of your consent to data processing 

Many data processing operations are only possible with your explicit consent. You may revoke any consent you have already given at any time. The lawfulness of the data processing carried out prior to the revocation remains unaffected by the revocation. 

Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1) E OR F OF THE GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR SPECIFIC SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. YOU CAN FIND THE SPECIFIC LEGAL BASIS ON WHICH PROCESSING IS BASED IN THIS PRIVACY POLICY. 

IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISING OR DEFENDING LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) OF THE GDPR). 

IF YOUR PERSONAL DATA IS BEING PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING PURPOSES; THIS ALSO APPLIES TO PROFILING, TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) OF THE GDPR).

Right to lodge a complaint with a supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in the Member State of their habitual residence, their place of work, or the location of the alleged violation. This right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to request that any personal data we process through automated means – based on your consent or in fulfilment of a contract – be transferred to you or a third party in a commonly used, machine-readable format. You also have the right to request that this data be transferred directly to another controller, where technically feasible.

Access, restriction and deletion

In accordance with applicable legal provisions, you have the right to access your stored personal data free of charge at any time, including its origin, recipients and the purpose of data processing. You may also have the right to request rectification, restriction or deletion of this data. For this, as well as any other questions relating to personal data, you may contact us at any time via the address provided in our Legal Notice.

Right to Restriction of Processing

You have the right to request that the processing of your personal data be restricted. You may contact us at any time to exercise this right. The right to restriction of processing applies in the following cases:

• If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to request that the processing of your personal data be restricted.
• If the processing of your personal data was or is unlawful, you may request that the processing be restricted instead of having the data erased.
• If we no longer need your personal data, but you need it to exercise, defend, or assert legal claims, you have the right to request that the processing of your personal data be restricted instead of erasure.
• If you have lodged an objection pursuant to Article 21(1) of the GDPR, a balancing of your interests against ours must be carried out. If it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data. 

If you have restricted the processing of your personal data, such data, apart from storage, may be processed only with your consent, or for the purpose of asserting, exercising, or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the European Union or a Member State.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content – such as orders or enquiries you send to us as the site operator – this website uses SSL and/or TLS encryption. You can recognize an encrypted connection by the change in the browser’s address bar from “http://” to “https://” and by the padlock symbol in your browser bar. When SSL or TLS encryption is enabled, any data you transmit to us cannot be read by third parties.

4. Data collection on our website

Cookies

Our website uses so-called “cookies.” Cookies are small data packets that do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Persistent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically. 

Cookies may be set by us (first-party cookies) or by third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain third-party services within websites (e.g., cookies for processing payment services). 

Cookies serve various purposes. Many cookies are technically necessary, as certain website features would not work without them (e.g., the shopping cart feature or the display of videos). Other cookies may be used to analyze user behavior or for advertising purposes. 

Cookies that are required to carry out the electronic communication process, to provide certain functions you have requested (e.g., the shopping cart function), or to optimize the website (e.g., cookies for measuring website traffic) (necessary cookies), are stored based on Article 6(1)(f) of the GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure the technically error-free and optimized provision of its services. If consent to the storage of cookies and similar recognition technologies has been requested, processing is carried out exclusively based on this consent (Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG); consent may be revoked at any time. 

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block cookies in certain cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website. 

You can find information about which cookies and services are used on this website in this Privacy Policy.

Server log files

The website provider automatically collects and stores information in server log files, which your browser transmits to us automatically. This includes:

• Browser type and version
• Operating system used
• Referrer URL
• Host name of the accessing device
• Time of server request
• IP address 

These data are not combined with data from other sources. 

This data is collected pursuant to Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in ensuring that its website functions properly and is optimized. Therefor server log files must be collected.

Contact form

If you submit an enquiry to us via the contact form, the information you provide – including the contact details entered – will be stored by us for the purpose of processing your enquiry and addressing any follow-up questions. We will not disclose this information without your consent. 

The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries directed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), provided that such consent was requested; you may revoke your consent at any time. 

The data you enter in the contact form will be retained by us until you request its deletion, withdraw your consent to storage or the purpose for which the data was stored no longer applies (for instance, once your enquiry has been fully dealt with). Mandatory statutory provisions – including, but not limited to, retention periods – remain unaffected.

Registration on This Website

You can register on this website to access additional features. We use the data you provide solely for the purpose of using the specific offering or service for which you have registered. The required information requested during registration must be provided in full. Otherwise, we will reject your registration.

For important changes, such as those affecting the scope of our offerings or technically necessary changes, we will use the email address you provided during registration to notify you. 

The data entered during registration is processed for the purpose of fulfilling the user relationship established by the registration and, where applicable, to initiate further contracts (Art. 6(1)(b) GDPR). 

We will store the data collected during registration for as long as you remain registered on this website, after which it will be deleted. Statutory retention periods remain unaffected

5. Analytics and advertising

Google Analytics 4 with Server-Side Tracking

This website uses Google Analytics 4. Google Analytics enables us to analyze the behavior of website visitors and continually improve our website. In this process, information is processed for example regarding website access, interaction, technical features of the end device being used as well as approximate geographical origin. 

Data is collected using a server-side Google Tag Manager. To ensure processing in line with data protection requirements, we use server-side tracking based on Google Tag Manager. Technical provision of the server container is delivered by the service provider Stape Technologies Ltd. The collected tracking data is first processed using a server controlled by us before it is transferred to Google Analytics. This enables us to have better control of data transmission and the implementation of settings that help to ensure data protection. 

A data processing agreement pursuant to Art. 28 GDPR has been concluded with Stape. The servers are operated within the European Union.

Processing occurs solely based on your consent, as per Article 6(1)(a) of the GDPR as well as Section 25 (1) TDDDG. Consent may be revoked at any time with future effect under data protection settings. Google can process the processed information on servers in the USA. Data transmission occurs based on suitable guarantees pursuant to Art. 46 GDPR. You can find more information about data protection involving Google at: https://policies.google.com/privacy

KnownAgents

On our website we use the service “KnownAgents” to analyze and manage access by web crawlers, bots, AI agents and other automated systems. 

The purpose of processing is to guarantee the security and stability of our website, to detect fraudulent access, to protect against automated scraping and to optimize the technical provision of our content. 

In this context, the following technical access data may be processed in particular:

• IP address
• Browser and device information (user agent)
• Accessed URL
• Referrer URL
• Time of access
• Technical status and log data 

Processing occurs based on Art. 6 (1)(f) GDPR. Our legitimate interest is in guaranteeing IT security, protecting our website from fraudulent access and optimising the technical provision of our website. We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR. 

Insofar as personal data is transferred to third countries, particularly to the USA, this occurs based on suitable guarantees pursuant to Art. 46 GDPR, particularly by establishing the standard contractual clauses of the European Commission. Data will only be stored if this is required for the above-mentioned purposes or as long as statutory retention obligations apply.

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising program provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. 

Google Ads enables us to display ads in the Google search engine or on third-party websites when users enter specific search terms into Google (keyword targeting). Furthermore, targeted ads can be displayed based on user data available to Google (e.g., location data and interests) (audience targeting). As the website operator, we can evaluate this data quantitatively by, for example, analyzing which search terms led to the display of our ads and how many ads resulted in corresponding clicks. 

The use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may revoke your consent at any time. 

Data transfers to the U.S. are based on the European Commission’s Standard Contractual Clauses. Details can be found here: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/. 

The company is certified under the “EU-U.S. Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when processing data in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5780.

Google Ads Remarketing

This website uses Google Ads Remarketing features. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. 

Google Ads Remarketing allows us to assign people who interact with our online offerings to specific target groups so that we can subsequently display interest-based ads to them on the Google Display Network (remarketing or retargeting). 

Furthermore, the advertising target groups created with Google Ads Remarketing can be linked to Google’s cross-device features. In this way, interest-based, personalized advertising messages, which have been tailored to you based on your previous usage and browsing behavior on one device (e.g., a cell phone), can also be displayed on another of your devices (e.g., a tablet or PC). 

If you have a Google account, you can opt out of personalized advertising at the following link: https://adssettings.google.com/anonymous?hl=de. 

The use of this service is based on your consent pursuant to Art. 6(1)(a) of the GDPR and § 25(1) of the TDDDG. You may revoke your consent at any time. 

For more information and the privacy policy, please see Google’s Privacy Policy at: https://policies.google.com/technologies/ads?hl=de. 

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards when processing data in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5780.

6. Newsletter

Newsletter Information

If you would like to subscribe to the newsletter offered on the website, we need your email address as well as information that allows us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter. No other data is collected or is collected only on a voluntary basis. We use this data exclusively to send you the requested information and do not share it with third parties. 

The processing of the data entered in the newsletter sign-up form is based solely on your consent (Art. 6(1)(a) GDPR). You may revoke your consent to the storage of your data and email address, as well as their use for sending the newsletter, at any time—for example, by clicking the “Unsubscribe” link in the newsletter. The lawfulness of data processing operations that have already taken place remains unaffected by this revocation. 

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe or once the purpose for which it was collected no longer applies. We reserve the right to delete or block email addresses from our newsletter distribution list at our sole discretion within the scope of our legitimate interest pursuant to Article 6(1)(f) of the GDPR. 

Data stored by us for other purposes remains unaffected by this. 

After you unsubscribe from the newsletter mailing list, your email address may be stored on a blacklist by us or the newsletter service provider, if necessary, to prevent future mailings. The data from the blacklist is used solely for this purpose and is not combined with any other data. This serves both your interest and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Article 6(1)(f) of the GDPR). There is no time limit on storage in the blacklist. You may object to this storage if your interests outweigh our legitimate interest.

Newsletter distribution to existing customers

When you order goods or services from us, you must provide your email address. We may use this email address to send you newsletters, provided we inform you of this in advance. In such cases, the newsletter will contain only direct marketing for our own similar goods or services. You may unsubscribe from this newsletter at any time. A link for this purpose is included in every newsletter. The legal basis for sending the newsletter in this case is Article 6(1)(f) of the GDPR in conjunction with Section 7(3) of the UWG. 

After you unsubscribe from the newsletter distribution list, your email address may be stored on our blacklist to prevent future mailings to you. The data from the blacklist is used solely for this purpose and is not combined with other data. This serves both your interest and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Article 6(1)(f) of the GDPR). There is no time limit on storage in the blacklist. You may object to this storage if your interests outweigh our legitimate interest. .

6. Newsletter

YOUTUBE

This website embeds videos from YouTube. The website is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. 

When you visit one of our web pages that includes YouTube, a connection is established with YouTube’s servers. In the process, the YouTube server is informed which of our pages you have visited. 

Furthermore, YouTube may store various cookies on your device or use comparable technologies for recognition (e.g., device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to collect video statistics, improve user experience, and prevent fraud. Furthermore, the collected data is processed within the Google advertising network. 

If you are logged into your YouTube account, you allow YouTube to associate your browsing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account. 

We use YouTube to ensure an engaging presentation of our online offerings. This constitutes a legitimate interest within the meaning of Article 6(1)(f) of the GDPR. If consent has been requested, processing is carried out exclusively based on Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time. 

For more information on the handling of user data, please see YouTube’s Privacy Policy at: https://policies.google.com/privacy. 

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5780.

CDN provided by creoline GmbH (cstatic.io)

Our website uses a Content Delivery Network (CDN) provided by creoline GmbH, Bergstraße 9a, 48341 Altenberge. A CDN is a network of high-performance servers that cache content at various locations around the world. A CDN essentially has two functions. First, it is designed to deliver content as quickly as possible, and second, to reduce the load on the web host by distributing data traffic. To enable this, your IP address, HTTP host, timestamp, and other browser information are transmitted to the provider. Our CDN does not use cookies. No data is transferred outside the EU or outside a country for which the European Commission has issued an adequacy decision. The legal basis for using the service is Art. 6(1)(f) of the GDPR (legitimate interest). You can view the privacy policy of creoline GmbH here: https://www.creoline.com/de/legal/privacy8.

8. E-Commerce

Processing of Customer and Contract Data

We collect, process, and use personal customer and contract data to establish, define the terms of, and modify our contractual relationships. We collect, process, and use personal data regarding the use of this website (usage data) only to the extent necessary to enable the user to use the service or to bill the user. The legal basis for this is Article 6(1)(b) of the GDPR. 

The collected customer data will be deleted upon completion of the order or termination of the business relationship and after the expiration of any applicable statutory retention periods. Statutory retention periods remain unaffected.

Data Transfer for Shipping Goods

When you order goods from us, we disclose your personal data to the shipping company entrusted with the delivery. Only data necessary for the respective service provider to fulfill its task is disclosed. The legal basis for this is Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

9. Processing of Applicant Data

We offer you the opportunity to apply for a position with us. We provide information about this data processing here: https://hartje.de/en/privacy-policy-for-applicants/