Privacy policy

1. Controller

The controller under the GDPR is Stahlmann Commerce GmbH, Untere Wiesenstraße 17, 32120 Hiddenhausen, Germany. Phone: +49 5221 1875544, email: info@fulfillment-smc.de. No data protection officer has been designated. Please direct privacy enquiries to the email address above.

2. Hosting and access logs

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you access it, technically necessary connection data may be processed, including IP address, access time, requested URL, response status, browser information and possibly the referring page. We process these data to deliver the site and prevent misuse, pursuant to Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website. Server logs are deleted in accordance with the hosting provider’s applicable settings and deletion rules unless longer retention is required for security or legal purposes.

3. Enquiries by contact form and email

Enquiries are transmitted through STRATO SMTP to a business mailbox. This website does not use an additional database to retain complete enquiries. Enquiries which do not lead to a contract are generally deleted no later than six months after receipt, unless legal obligations, legal claims or other legitimate retention grounds require longer retention. Business and tax records may be subject to longer statutory retention periods.

When you contact us using the form or by email, we process the information you provide, in particular your name, company, business email address, enquiry and message, and any product URL. We use this information to respond and, where applicable, prepare a potential business relationship. Where processing is necessary for pre-contractual steps with a natural person, the legal basis is Article 6(1)(b) GDPR; otherwise it is our legitimate interest in business communications under Article 6(1)(f) GDPR. The form includes acknowledgement of this privacy notice, but does not sign you up for marketing emails.

4. Essential session cookie and form security

The website uses the essential SMCSESSID session cookie to protect the contact form against forged requests. It does not track visitors for advertising or analytics. Storing and accessing it is necessary to provide the requested form service under Section 25(2)(2) TDDDG; the related personal data processing is based on Article 6(1)(f) GDPR. The cookie is normally limited to the browser session.

Anti-spam and security functions include a hidden field, time-based checks and rate limiting. For this purpose the server may briefly process protected values derived from IP addresses and timing data (Article 6(1)(f) GDPR), without using them to build advertising profiles.

5. Files and recipients

Under the current website configuration, no analytics or advertising trackers and no third-party CAPTCHA services are used. Fonts, images and scripts are delivered locally. We use STRATO as a technical service provider for hosting and business email transmission. If you choose to follow an external link, the destination site is separately responsible for its own processing.

6. International transfers and automated decisions

The website functions are not intended to transfer personal data to recipients outside the European Economic Area. No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place.

7. Your rights

Subject to legal conditions, you may request access, correction, erasure, restriction, data portability and object to processing based on legitimate interests (Articles 15–21 GDPR). You may withdraw consent for the future at any time. Please use the contact details above.

8. Right to lodge a complaint

You can complain to a data protection supervisory authority (Article 77 GDPR), including the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information: www.ldi.nrw.de.

9. Updates

We update this privacy notice if material changes are made to the website or its data processing operations.