PRIVACY POLICY.

1. Data Controller and Legal Basis

The data controller within the meaning of the General Data Protection Regulation (GDPR) is Cropfiber GmbH, with the contact information provided above. We process personal data only to the extent that there is a legal basis for doing so, in particular to carry out pre-contractual measures and to fulfill contractual obligations (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c)), based on legitimate interests (Art. 6(1)(f)), or following valid consent (Art. 6(1)(a)).

2. Hosting with Hetzner and a domain with STRATO

Hosting / Server Log Data

Our WordPress website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you access the site, technically necessary connection and log data may be processed, including, in particular, your IP address, date and time, requested URL, browser and operating system data, referrer, and HTTP status. This processing is necessary for delivering the website, ensuring technical security, diagnosing errors, and preventing misuse (Art. 6(1)(f) GDPR). The retention period is determined by the actual server and security configuration; logs are deleted as soon as they are no longer needed, unless there are legal requirements for longer retention or security reasons.

Domain Management

The domain asphaltkind.de is managed by STRATO GmbH. Domain management is separate from our website hosting with Hetzner. In connection with DNS queries and domain management, technical connection and registration data may be processed (Art. 6(1)(f) and (b) of the GDPR, as applicable).

WordPress / Divi

We use WordPress and DIVI 5 to design and host these pages. When you use the site, files, scripts, and, if applicable, cookies necessary for its technical operation may be loaded. The specific scope depends on the configuration of the installation and its plugins.

3. Cookies and Borlab's Cookie

We use Borlabs Cookie to manage cookie consents and document the selected settings. To this end, technically necessary information regarding your consent decision is stored on your device. The legal basis for necessary storage access is Section 25(2) of the TDDDG; for the documentation of consent or the fulfillment of record-keeping obligations, it is Article 6(1)(c) and, where applicable, (f) of the GDPR.

Cookies that are not strictly necessary, as well as external services requiring consent, are activated only after you have given your consent (Section 25(1) TDDDG, Article 6(1)(a) GDPR). You may modify or withdraw your consent at any time, effective for the future. The Borlabs cookie interface shows you which specific services, cookies, and durations are active.

Change cookie settings

This function uses the CSS class documented by Borlabs for Version 3. If you are using a different Borlabs version, you will need to adjust the link.

4. Establishing Contact and Communication

When you contact us via email, phone, the contact form, or any other method we provide, we process, in particular, your name, contact information, the content of your message, and the time it was sent. For questions regarding products and orders, this is done for the purpose of preparing and fulfilling a contract (Art. 6(1)(b) GDPR); for general inquiries, it is based on our legitimate interest in processing the request (Art. 6(1)(f) GDPR).

When you click a link to WhatsApp or Instagram, you may leave our website; from that point on, the privacy policy of the respective service applies. External media will be loaded only after you have given your consent, if required.

5. Configurator, Ordering, and Manufacturing

In the store, you can select the model, finish, shipping country, and customer type. Since these selections are calculated solely within the browser, selecting them does not, by itself, submit an order or transmit any personal data to us. If you use PayPal Checkout, the information you provide during checkout will be processed in accordance with the payment processing procedures. When using the bank transfer option, you can open a pre-filled email draft; opening it does not send a message.

To process binding orders, we use—as necessary—the customer’s name, billing and shipping addresses, contact information, vehicle type and model year, equipment preferences, country of delivery, transaction and billing data, order status, and, if applicable, the VAT identification number. This data is used for the purpose of providing quotes, concluding contracts, manufacturing, delivery, customer communication, and legally required invoicing (Art. 6(1)(b) and (c) of the GDPR).

Necessary data may be shared with service providers contracted to perform the work, in particular freight forwarders and transportation service providers, accounting firms, tax advisors, and IT service providers. The data is processed to the extent necessary for the respective task.

6. Payment Methods and Accounting

PayPal and Card Payments via PayPal

For online payments, we provide a link to the payment pages of PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. When you access and use the payment service, PayPal processes the data required for the payment transaction on its own responsibility. In particular, we receive the payment and transaction information necessary for processing the transaction, but generally do not receive complete card details. For more information, see the PayPal Privacy Policy.

Bank Transfer

For bank transfers, we process the payment amount received, the transaction date, the account holder/sender, and the payment description to allocate the down payment and for accounting purposes (Art. 6(1)(b) and (c) of the GDPR). The banks involved process the data necessary for the payment independently.

Billing and Record-Keeping

We use Lexware Office (lexoffice) for accounting and invoicing. Documents relevant to invoicing, commercial law, and tax law are retained for the applicable statutory periods; after that, they are deleted unless there are other legitimate reasons for retaining them.

7. Weglot, Fonts, and Social Media

Weglot

We use Weglot for multilingual support. When providing translated pages, language-specific settings, URLs, or transferred page content, as well as technical connection information, may be processed. The legal basis depends on the technical implementation, specifically Article 6(1)(f) of the GDPR for the requested language version and, where applicable, Article 6(1)(a) of the GDPR for functions requiring consent. For more information, see the Weglot Privacy Policy.

Fonts and External Media

Among other things, we use the Syne font. When font files are embedded locally, no separate connection to an external font service is required. If, however, font files are loaded from external servers, technical connection data may be generated there; such integrations must be taken into account in our actual configuration.

For social media content from Instagram, we may use external links, previews, or embedded feeds. When external content is directly embedded, the third-party provider may receive personal and technical data. If consent is required, the content will not be loaded until you have given your consent via Borlabs Cookie. A standard external link generally establishes a connection only when you click on it.

8. Withdrawal, Complaints, and Inquiries from Data Subjects

In the event of a cancellation or complaint, we process the name, contact information, order/contract data, and the content of the statement in order to assign the matter, fulfill legal obligations, and document the process (Art. 6(1)(b) and (c) of the GDPR, or (f) where applicable). If the electronic withdrawal function is set up and used, the information transmitted in this process is first recorded on our WordPress system and forwarded to the relevant departments at Cropfiber GmbH. A confirmation of receipt is sent to the provided email address. To prevent automated bulk requests, the server function may temporarily store a non-readable verification value derived from the IP address to restrict access (Art. 6(1)(f) GDPR).

You can find the sample cancellation form and the cancellation policy exclusively on our separate cancellation page.

9. Recipients, Disclosures, and Retention Periods

Data is only transferred to recipients who need it for the specific task or for whom there is a legal obligation. Third-party providers such as PayPal or Meta may also process personal data outside the European Economic Area. Such transfers take place only in accordance with the GDPR, for example, based on an adequacy decision or appropriate safeguards. Details regarding the transfer mechanisms used by independent providers can be found in their privacy policies.

We retain data only for as long as is necessary for the purpose of processing or as required by law. Statutory retention periods and the need to provide evidence of existing claims may justify longer retention.

10. Your Privacy Rights

You may request access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21) in accordance with the legal requirements. You may withdraw your consent at any time with future effect (Art. 7(3) GDPR).

Please contact freyberg@asphaltkind.de regarding this matter. You also have the right to file a complaint with a data protection supervisory authority; for North Rhine-Westphalia, the State Commissioner for Data Protection and Freedom of Information in NRW is responsible.