Data protection

Information on the processing of personal data on our websites, as well as for customers, suppliers, business partners and prospective clients

The information set out below provides you, in accordance with Article 13 of the GDPR, with details regarding the nature, scope and purpose of the processing of your personal data (hereinafter referred to as ‘data’) within our online service and the associated websites, functions and content (hereinafter collectively referred to as the ‘online service’). It also contains information on the processing of personal data relating to our customers, suppliers, business partners and prospective clients, as well as their employees.

Please also take note of our privacy policy for our social media profiles, if required. You can find it here: Privacy Policy and Legal Notice for Our Social Media Profiles

With regard to the terms used, such as ‘processing’ or ‘controller’, please refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).

1. Name and contact details of the data controller and contact details of the data protection officer(s)
   
   The data controller is:
   
   PFALZKOM GmbH
   Wredestraße 35
   D-67059 Ludwigshafen
   Email address: info@pfalzkom.de
   
   Contact details for the external data protection officer:
   
   CS Infowerk GmbH
   Datenschutzbeauftragte/r
   Fritz-Salm-Straße 1
   D-68167 Mannheim
   Email address: dsb@cs-infowerk.com

2. Types of data processed; categories of data subjects; purposes of processing and legal bases
   
   We process the following categories of data:
   
   • Personal details (e.g. names, addresses, role/position within the company)
   • Contact details (e.g. email addresses, telephone numbers)
   • Contract details (e.g. services used, names of contact persons, payment details)
   • Sales-related data (e.g. source of the data, advertising identifiers)
   • Content data (e.g. email content, text entries, contact form entries, photographs, videos)
   • Service requests under contracts
   • Usage data (e.g. websites visited, interest in content, access data)
   • Meta/communication data (e.g. device information, IP addresses)
   
   This applies to visitors and users of our online services.
   
   We process personal data for the following purposes (with the relevant legal basis):
   
   • To provide the online service, its functions and content (Article 6(1)(f) of the GDPR; our legitimate interest lies in publicly presenting our services and facilitating interaction with customers and prospective customers)
   • Responding to contact requests and communicating with users (Article 6(1)(b) of the GDPR, where contractual requests are concerned, or Article 6(1)(f) of the GDPR; in the latter case, our legitimate interest lies in processing your enquiry)
   • Security measures (Article 6(1)(f) of the GDPR; legitimate interest: maintaining the functioning of our websites)
   • Audience measurement and marketing (Article 6(1)(a) of the GDPR, if you have given us your consent, or Article 6(1)(f) of the GDPR; legitimate interest: direct marketing)
   
   In sections 7 to 10, you will find further information on how we process your data when you subscribe to our newsletter, as well as on how data is processed on our website by tools and third-party services. In some cases, you can control this data processing yourself via our cookie banner, which you can access at any time via the ‘Cookies’ link in the footer of our website.

3. Processing of data relating to our customers, suppliers, business partners and prospective clients, as well as their employees
   
   In addition to visitors to our website, we process personal data relating to our customers, suppliers, business partners and prospective clients, as well as their employees. This primarily comprises personal data, contact details, contractual data and content data (see the data categories set out in section 2).
   
   We process this data for the following purposes (with the relevant legal basis):
   
   • Contacting and communicating with you, as well as processing your requests, for example regarding our services or an existing business relationship (Article 6(1)(b) of the GDPR, insofar as the request relates to a contract or serves to initiate one; otherwise, Article 6(1)(f) of the GDPR – legitimate interest in responding to your request)
   • Initiating, concluding, fulfilling and executing contracts with our customers and suppliers, including processing, invoicing and handling complaints (Article 6(1)(b) of the GDPR)• Maintaining existing business relationships and contacting prospective customers (Article 6(1)(f) of the GDPR – legitimate interest in customer retention, supplier management and the acquisition of new business contacts)
   • Sending follow-up emails to existing customers regarding the company’s own, similar products and services (Article 6(1)(f) of the GDPR – legitimate interest in direct marketing – subject to the conditions set out in Section 7(3) of the Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb – UWG))
   • Sending further marketing messages via electronic communication, provided you have given your consent (Article 6(1)(a) of the GDPR, Section 7(2) of the UWG)
   • Compliance with legal obligations, in particular retention obligations under commercial and tax law (Article 6(1)(c) of the GDPR)
   
   We store the data of our customers and prospective customers in a Customer Relationship Management (CRM) system. We retain this data there for as long as a contractual relationship exists or another legal basis justifies its processing. We then delete the data unless there are any statutory retention obligations that prevent us from doing so (see also section 5).
   
   As an existing customer, you may receive follow-up emails from us regarding goods or services similar to the product you have purchased. You may object to the use of your email address for this purpose at any time, without costs arising by virtue thereof, other than transmission costs in accordance with the basic rates. We will inform you of this right to object when we collect your email address and in every email we send you.

4. Recipients or categories of recipients of the personal data
   
   In addition to the providers listed under sections 7, 8 and 10, there may be other recipients of your data. Within PFALZKOM, for example, those departments that require your personal data to fulfil the purposes set out in points 2 and 3 are granted access to it. Service providers and agents engaged by us may also receive personal data for these purposes. The involvement of service providers and agents takes place in compliance with legal requirements and includes, for example, companies in the categories of data protection, IT services, customer service, billing, printing services, credit reference agencies, debt collection, advisory and consultancy services, sales and marketing, as well as selected craftsmen and other specialist firms (e.g. electricians), insofar as this is necessary for the provision of the relevant services.
   
   Furthermore, we will only disclose information about you if required to do so by law, if you have given your consent, or if we are authorised to provide such information. Under these circumstances, recipients of personal data may include, for example, other companies or similar organisations to which we transfer personal data in order to conduct our business relationship with you, to assert our claims or to comply with legal obligations (e.g. network operators, certification authorities), as well as, for example, audit firms (e.g. tax and statutory auditors), public bodies and institutions (e.g. government authorities), and courts, lawyers and notaries (e.g. in insolvency proceedings). In all the cases mentioned, we ensure that third parties only have access to personal data to the extent necessary for the purpose of the disclosure.
   
   Should we transfer personal data to service providers outside the European Union (EU) or the European Economic Area (EEA), such transfers will only take place if the European Commission has confirmed that the third country offers an adequate level of data protection or if other appropriate data protection safeguards (e.g. EU Standard Contractual Clauses) are in place. For further information on this matter, please do not hesitate to contact our Data Protection Officer using the contact details provided above.

5. Retention period / Deletion
   
   Your personal data will be erased when it is no longer necessary for the purposes for which it was collected or otherwise processed (e.g. because our contractual relationship has ended), there are no longer any mutual claims, and there are no statutory retention requirements – such as those under commercial or tax law – or other legal grounds justifying its storage.

6. Your rights
   
   Where we process your personal data on the basis of a balancing of interests, you may, at any time, object to the storage or use of your data, in whole or in part, with effect for the future, on grounds relating to your particular situation, without this affecting the lawfulness of any storage or processing carried out up to that point. In this case, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. You have an unrestricted right to object to any form of processing for the purposes of direct marketing.
   
   If you have given your consent to the use of your personal data, you may withdraw this consent at any time. In the case of the newsletter, for example, you can do this by clicking on the relevant link at the end of the newsletter. Withdrawal of consent applies from that point onwards and does not affect the lawfulness of the data processed up to the point of withdrawal.
   
   You also have the following rights:
   
   • Right of access to the data being processed (Article 15 of the GDPR)
   • Right to rectification (Article 16 of the GDPR)
   • Right to erasure (‘right to be forgotten’) (Article 17 of the GDPR)
   • Right to restriction of processing (Article 18 of the GDPR)
   • Right to data portability (Article 20 of the GDPR)
   
   To exercise your rights, please contact us using the contact details provided in section 1 or contact our Data Protection Officer directly.
   In addition, you have the right to contact a supervisory authority with any queries or complaints. The supervisory authority responsible for us is
   
   Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
   Hintere Bleiche 34
   D-55116 Mainz

7. Data processing in connection with the distribution of newsletters; general information on the tools used
   
   a) Email marketing/newsletters
   
   We use Campaign Monitor, an email marketing automation solution provided by a US-based provider, to send out newsletters. Campaign Monitor enables us to organise the sending of newsletters and analyse their usage. In doing so, data is also stored outside the European Union, e.g. in the USA, the United Kingdom and Australia – that is, in countries where the level of data protection may not be the same as in the European Union. However, an adequacy decision has been adopted by the European Union for the United Kingdom. An ‘adequacy decision’ is a decision adopted by the European Commission pursuant to Article 45 of the GDPR, which determines that a third country (i.e. a country not bound by the GDPR) or an international organisation provides an adequate level of protection for personal data. With regard to the processing of personal data in the USA and Australia, the provider offers guarantees of compliance with data protection regulations through the adoption of the EU Standard Contractual Clauses. Furthermore, Campaign Monitor is registered under the EU-US Data Privacy Framework.
   
   To receive our newsletter, we ask for your email address and your consent, which you provide by clicking the ‘Register’ button. You will then receive a further email asking you to confirm your subscription, so that we can ensure that the subscription was actually made by the owner of the email address (‘double opt-in’ procedure). To this end, we log the newsletter subscription request, the sending of a confirmation email and the receipt of the reply requested therein, so that we can provide evidence of the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation, as well as the IP address. Any changes to your stored data are also logged. In addition to this personal data, further data relating to your use of the newsletter is collected, as described below.
   
   Your consent to receive the newsletter includes
   
   • consent to receive the newsletter and any further email marketing regarding offers,
   • consent to the tracking and analysis of your usage as described below,
   • consent to the processing of your personal data outside the EU as described above.
   
   Once you have given your consent and thereby registered for the newsletter, we will create a profile based on your usage data so that we can provide you with targeted content. The nature of the data processing is described in more detail below.
   
   Campaign Manager uses cookies and web beacons to track your interaction with the newsletter. This data processing is used to analyse and measure the success of marketing campaigns. Web beacons enable us to determine whether the email has been delivered and opened. In addition, the following data is stored: your IP address, your browser, the email client you use and other details. If you click on links in the newsletter, this is also recorded. Such data may also be stored in the provider’s service logs to monitor the proper functioning of the systems.
   
   You may withdraw your consent to the storage of your personal data and its use for the newsletter at any time, with effect for the future. To this end, we provide a link for this purpose in every newsletter. You may also unsubscribe directly by email or inform us of your wish to do so via the contact details provided in section 1 of this privacy notice.
   
   b) Logfiles
   
   We, or rather our hosting provider, collect data on every access to the server on which this service is hosted (so-called server log files) on the basis of our legitimate interests within the meaning of Article 6(1)(f) of the GDPR. The access data includes the name of the webpage accessed, the file, the date and time of access, the amount of data transferred, confirmation of successful access, the browser type and version, the user’s operating system, the referrer URL (the previously visited page), the IP address and the requesting provider. Log file information is stored for a maximum of one month for security reasons (e.g. to investigate cases of misuse or fraud) and is subsequently deleted. Data which must be retained for further evidence purposes is exempt from deletion until the relevant incident has been fully clarified.
   
   c) Cookies
   
   Cookies are small files that are stored on users’ devices. They help to make a website user-friendly and convenient, for example by saving a shopping basket or a login status.
   
   Some cookies are automatically deleted as soon as the browser is closed (known as session cookies). Others remain stored for a longer period (persistent cookies), for example to save settings or to analyse website usage.
   
   Cookies may originate either from us (first-party cookies) or from other providers (third-party cookies).
   
   We explain which cookies we use in the cookie banner, which can be accessed at any time via the ‘Cookies’ link in the footer. Cookies can also be restricted or deleted via your browser settings. If you disable cookies, this may affect the functionality of the website.
   
   On our website, we use cookies that are technically necessary for the website to function properly (see section 9). These cookies process data on the basis of Article 6(1)(f) of the GDPR (legitimate interest), as we have a legitimate interest in providing a fully functional online service. In all cases, an ID is stored in the cookie for recognition purposes.
   
   We also use cookies that only become active once you have given your consent. These are used to activate the third-party services described in section 10.

8. Use of Friendly Captcha
   
   We use the Friendly Captcha service provided by Friendly Captcha GmbH, a company based in Germany. To this end, we have integrated Friendly Captcha’s code into our website (e.g. for contact forms) so that the visitor’s device can establish a connection to Friendly Captcha’s servers. This allows us to verify whether the visitor is a human or whether the service is being misused through automated, machine-based processing (e.g. bots).
   
   To prevent fraudulent activity, the service is typically used in the following contexts: forms (enquiries, contact requests, password resets), orders and login pages. The service helps us to prevent automated attacks that could pose risks to the company’s infrastructure. It also protects our website visitors from becoming potential victims of cybercrime.
   
   Legal basis
   
   The legal basis for this processing is therefore our legitimate interest under Article 6(1)(f) of the GDPR in preventing potentially fraudulent activities on our website.
   
   Type of data processed
   
   • HTTP request header data, in particular User Agent (browser, operating system), origin and referrer (previously visited websites)
   • Date and time of the request
   • Version of the Friendly Captcha widget used
   • Customer account ID of our website as the client
   • Hash value (one-way encryption) of the incoming IP address (the IP address is discarded; only the hash value is stored)
   • Number of requests from the (hashed) IP address per time period
   • Response to the maths problem solved by the visitor’s computer
   
   No cookies are used.
   Further information on data protection at Friendly Captcha can be found here (link to external website): https://friendlycaptcha.com/en/legal/privacy-end-users/

9. Technically necessary cookies
   
   a) borlabs cookie
   
   This cookie stores information about your consent to service groups and individual services. Storage period: 60 days
   
   b) WPML cookies
   
   These cookies are required in order to provide a multilingual website. The storage period of each of these cookies is 1 day. They serve the following purposes:
   
   • The language you have selected is stored.
   • The language to which you may have been redirected is stored. This cookie is active for all visitors when browser language redirection is used.
   • It is checked whether cookies are enabled in your browser. This cookie is likewise active for all visitors when browser language redirection is used.
   • The language currently in use is stored.
   • The language currently in use is stored, provided that language filtering for AJAX operations is employed on the website.

10. Data processing by means of third-party services
    
    The legal basis for processing by analytics tools is the consent you have given via our cookie settings. You can withdraw the consent you have given at any time, centrally for all analytics tools, in the cookie settings. You can access these at any time via the footer of the website under “Cookies”.
    
    You can also disable cookies in your browser settings or delete cookies that have already been stored. Please note that this may restrict individual functions of the website.
    
    For the Google services used, there are also options available directly at Google for restricting data processing on other websites.
    
    Data collection by Google Analytics can be disabled, for example, via a special browser add-on provided by Google: https://tools.google.com/dlpage/gaoptout?hl=en
    
    You can also disable personalized advertising from Google directly in your Google account under the advertising settings: https://myadcenter.google.com/home?hl=en
    
    Instructions for this can be found at Control your ad experience – My Ad Center Help
    
    In addition, there is the option to disable cookies and personalized advertising from third-party providers via the opt-out page of the Network Advertising Initiative: https://www.networkadvertising.org/choices/
    
    Specifically, we use the following:
    
    a) Google Analytics 4
    
    On our website we use the analytics tracking tool Google Analytics 4 Property of the company Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Subject to your consent, Google Analytics collects data about your actions on our website. With the help of the reports we receive from Google Analytics, we can better tailor our website and our service to your wishes. In the following, we would like to go into more detail about the tracking tool and, above all, inform you about which data is stored and how you can prevent this.
    Google Analytics is a tracking tool used to analyse the traffic on our website. For Google Analytics to work, a tracking code is embedded in the code of our website. When you visit our website, this code records various actions that you perform on our website. As soon as you leave our website, this data is sent to the Google Analytics servers and stored there. Google processes the data and we receive reports about your user behaviour.
    
    Using a tracking code, Google Analytics creates a random, unique ID that is, where applicable, linked to a browser cookie. In this way, Google Analytics recognizes you as a new user. The next time you visit our site, you are recognized as a “returning” user. All collected data is stored together with this user ID. This is what makes it possible to evaluate pseudonymous user profiles.
    In particular, the following data is collected with Google Analytics:
    
    • Heatmaps: Google creates so-called heatmaps. Heatmaps show exactly those areas that you click on. In this way, we obtain information about where on our site you are “moving around”.
    • Session duration: Google defines session duration as the time you spend on our site without leaving it. If you have been inactive for 20 minutes, the session ends automatically.
    • Bounce rate: A bounce is when you view only one page on our website and then leave our website again.
    • Account creation: If you create an account or place an order on our website, Google Analytics collects this data.
    • IP address: The IP address is displayed only in truncated form, so that no unambiguous attribution is possible.
    • Location: The country and your approximate location can be determined via the IP address. This process is also referred to as IP geolocation.
    • Technical information: Technical information includes, among other things, your browser type, your internet provider, or your screen resolution.
    • Source of origin: Naturally, Google Analytics — and we — are also interested in which website or which advertisement brought you to our site.
    • Device data: By default, Google Analytics collects device-specific data, such as device brand, device model, device name, minor version of the operating system, minor version of the platform, and screen resolution.
    
    Further data includes contact details, any ratings, the playback of media (e.g. if you play a video via our site), the sharing of content via social media, or the adding of content to your favourites.
    
    Because we use Google Analytics 4 Property on our website, the IP addresses of visitors are automatically anonymized. The anonymization or masking of the IP takes place as soon as the IP addresses arrive in the Google Analytics data collection network and before any storage or processing of the data occurs.
    
    b) Google Remarketing
    
    This website uses Google Remarketing. Google Remarketing is an advertising service of Google Ireland Limited (“Google”) which enables us, based on your usage behaviour during previous visits to our website, to present you with targeted advertising presumed to be of interest to you. This advertising appears only on Google advertising slots, on advertising space of Google Ads.
    
    c) Google Ads conversion tracking
    
    On our website we use the online advertising program “Google Ads” and, in this context, conversion tracking for evaluating visitor actions. Google conversion tracking is an analytics service of Google LLC (“Google”). When you click on an advertisement placed by Google, a cookie for conversion tracking is stored on your computer. These cookies have a limited validity, contain no personal data, and therefore do not serve to identify you personally. If you visit certain pages of our website and the cookie has not yet expired, Google and we can recognize that you clicked on the advertisement and were redirected to this page. Each Google Ads customer receives a different cookie. There is thus no possibility for cookies to be tracked across the websites of Ads customers.
    
    The information obtained with the help of the conversion cookie serves the purpose of creating conversion statistics. In doing so, we learn the total number of users who clicked on one of our advertisements and were redirected to a page tagged with a conversion tracking tag. However, we do not receive any information by means of which users could be personally identified.
    
    d) Use of Microsoft Advertising
    
    On this website we use Microsoft Advertising, an online advertising and analytics platform of Microsoft Ireland Operations Limited, One Microsoft Way, Redmond, WA, USA.
    
    If you consent to the use of Microsoft Advertising, a so-called UET tag is placed on our website. Various data can be processed via this tag, for example:
    
    • information about your use of the website (e.g. pages visited, clicks, interactions),
    • technical data (e.g. your IP address, device data, browser),
    • information about conversions (e.g. purchase, registration, contact form), insofar as you carry out such an action.
    
    The purpose of the data processing is, in particular, the measurement and analysis of advertising effectiveness and — if you have consented — the targeted delivery of advertising (e.g. remarketing).
    
    The legal basis for this is your consent pursuant to Art. 6(1)(a) of the GDPR and pursuant to Section 25(1) sentence 1 of the Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (Gesetz über den Datenschutz und den Schutz der Privatsphäre in der Telekommunikation und bei digitalen Diensten (TDDDG)). You can withdraw this consent at any time — e.g. via our cookie banner. Without your consent, Microsoft Advertising is not activated and no tracking takes place.
    
    e) YouTube und Google Maps
    
    On our website we use components (videos and interactive map material) of the company Google LLC, based in the USA, whereby the services in Europe are provided by Google Ireland Limited, based in Ireland.
    
    When you call up a page that contains an embedded video or an embedded map, this video or map will only be displayed to you if you have activated the External Media YouTube or Google Maps option in our cookie banner, or if you click on “Unblock content” or “Accept required service and unblock content” within the image. Regardless of which option you choose, in these cases a connection to the Google servers is established and, in the process, the content is displayed on the web page by being transmitted to your browser. As a result, your IP address is transmitted to Google and thus, where applicable, also to third countries that do not have the same level of data protection as the EU. If you are logged in to YouTube or Google in the same browser, this information can be attributed to your member account with YouTube or Google. You can prevent this by logging out of your member account before visiting our website.
    
    If you select the “Unblock content” option, only a session cookie is set, which is necessary in order to be able to display the service to you. It expires automatically after the end of your visit to our website.
    
    If you select the “Accept required service and unblock content” option, the further cookies displayed in the cookie banner under YouTube or Google Maps are stored on your end device. You can withdraw this consent with effect for the future by deactivating the service again in the cookie banner.
    
    You can find further privacy settings on Google here:
    
    Privacy policy: www.google.de/intl/en/policies/privacy
    Opt-out: https://adssettings.google.com/authenticated

Last updated: September 2026