PRIVACY POLICY
Status: 24.09.2026
1. CONTROLLER
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is: ACRYHOLZ, Owner: Frederik Wunderlich, Zur Alten Börse 41, 12681 Berlin, Germany, Telephone: +49 177 5177330, E-mail: [email protected]
2. GENERAL INFORMATION ON DATA PROCESSING
The protection of your personal data is important to us. We process personal data exclusively within the framework of the statutory provisions, in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), the Telecommunications Digital Services Data Protection Act (TDDDG) and the other applicable data protection regulations. This privacy policy informs you about which personal data we process when you use our website and our online shop as well as in the context of our business relationships, for which purposes this is done, on which legal basis the processing takes place and which rights you are entitled to. Our offer is directed both at consumers within the meaning of Section 13 of the German Civil Code (BGB) (B2C) and at entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB) (B2B).
3. ACCESS TO THE WEBSITE AND SERVER LOG FILES
When you access our website, information is automatically processed by the technical infrastructure. This may include in particular: IP address of the requesting device, date and time of access, pages and files accessed, referrer URL, browser type and browser version, operating system, Internet service provider and other technical access data. The processing is carried out to ensure the secure and stable operation of the website, for the technical provision of the website, for the detection and defence against attacks and misuse as well as for error analysis. The legal basis is Art. 6 (1) lit. f GDPR. Our legitimate interest consists in the secure, error-free and optimised provision of our online offer. This data is not combined with data from other sources. The server log data is deleted as soon as it is no longer required for the stated purposes, unless statutory retention obligations or the assertion, exercise or defence of legal claims require longer storage.
4. HOSTING, ODOO ON-PREMISE AND IONOS
We use the ERP and shop system Odoo as an on-premise installation for the operation of our online shop as well as for the management of customers, orders, products, invoices and other business processes. The Odoo database is stored on a server operated or administered by us at the hosting provider IONOS SE. In the course of operating Odoo, the following personal data may in particular be processed: First and last name, billing and delivery address, e-mail address and telephone number, customer and order data, contract and communication data, invoice and payment information, data on returns, complaints and customer enquiries, technical data insofar as these are required for the operation of the online shop. The processing is carried out in particular for the performance and processing of orders and contracts, for customer management, for invoicing, for the processing of customer enquiries and for the fulfilment of statutory retention and verification obligations. The legal basis is, insofar as the processing is necessary for the performance of a contract or pre-contractual measures, Art. 6 (1) lit. b GDPR. Insofar as statutory retention obligations exist, the processing is based on Art. 6 (1) lit. c GDPR. Insofar as the processing is necessary to safeguard our legitimate interests in the orderly administration of our business processes, it is based on Art. 6 (1) lit. f GDPR. Odoo is operated by us as on-premise software. The personal data of our customers is not stored in an Odoo cloud database operated by Odoo. Odoo S.A. itself points out that Odoo does not act as a processor with regard to the data stored in on-premise databases. The responsibility for the personal data processed in our Odoo database therefore lies with us. For the hosting of the server we use IONOS SE. In the course of hosting, personal data, in particular server and connection data as well as the data stored in the Odoo application, may be processed or technically stored. Insofar as IONOS processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.
5. PROCESSING OF DATA IN CONNECTION WITH ORDERS
If you place an order in our online shop, we process the personal data provided by you for the processing of the purchase contract. This includes in particular first and last name, billing and delivery address, e-mail address, if applicable telephone number, order data, payment information and communication data. The processing is carried out for the processing and fulfilment of your order, for invoicing, for payment and shipping processing, for communication regarding your order and for the fulfilment of statutory obligations. The legal bases are Art. 6 (1) lit. b GDPR for the performance of the contract and Art. 6 (1) lit. c GDPR for the fulfilment of legal obligations.
6. CUSTOMER ACCOUNT
If you create a customer account, we store the data provided by you so that you can manage your orders more conveniently. This includes in particular contact details, stored addresses, the order history and communication data. The legal basis is Art. 6 (1) lit. b GDPR. You may request the deletion of your customer account at any time, provided that no statutory retention obligations conflict with this.
7. CONTACT BY E-MAIL AND CONTACT FORM
If you contact us by e-mail, contact form or by other means, we process the data transmitted by you for the processing of your enquiry. This may include in particular name, e-mail address, telephone number, the content of your message and other information voluntarily provided. The processing is carried out for the processing of your enquiry and for the performance of pre-contractual measures or for the fulfilment of an existing contract. The legal basis is Art. 6 (1) lit. b GDPR insofar as your enquiry is related to a contract or an order, and Art. 6 (1) lit. f GDPR insofar as it is a general enquiry. Our legitimate interest consists in the proper processing of customer enquiries and communication with interested parties and business partners. The transmitted data will be deleted as soon as your enquiry has been finally processed and no statutory retention obligations or legitimate reasons for further storage exist.
8. WITHDRAWAL, COMPLAINTS, RETURNS AND CUSTOMER SERVICE
If you contact us via the withdrawal function or the contact form on our website or by other means regarding a withdrawal, a return, a complaint, a warranty or any other matter relating to an order, we process the data provided by you. This includes in particular name, e-mail address, order number, order date, the content of your message and further information on the matter. The processing is carried out for the fulfilment of our statutory obligations in connection with purchase contracts, for the processing of your request as well as for the processing and assertion or defence of claims. The legal bases are Art. 6 (1) lit. b and lit. c GDPR as well as, if necessary, Art. 6 (1) lit. f GDPR.
9. NEWSLETTER WITH ODOO
If you subscribe to our newsletter, we use the personal data provided by you at the time of registration, in particular your e-mail address and if applicable your name, in order to send you regular information about products, offers and news from ACRYHOLZ. Registration takes place only with your express consent. Registration and the sending of the newsletter are carried out via the newsletter function of our own Odoo on-premise installation. The data required for this purpose is stored in our Odoo database operated on our own server. Transmission of the newsletter recipient data to Odoo S.A. for the purpose of sending the newsletter does not take place with our on-premise installation. The processing is based on your consent pursuant to Art. 6 (1) lit. a GDPR. You may revoke your consent at any time with effect for the future. For this purpose you may use the unsubscribe link contained in every newsletter or contact us using the contact details given in the legal notice. The lawfulness of the processing carried out until the revocation remains unaffected. After unsubscription your e-mail address will no longer be used for sending the newsletter. The data may, however, continue to be stored insofar as this is necessary for the documentation of the consent given or due to statutory retention obligations.
10. PAYMENT PROCESSING VIA MOLLIE
For the processing of online payments we use the payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. Depending on the selected payment method, payments may in particular be processed by credit or debit card, PayPal, Bancontact, Belfius, EPS, Przelewy24 (P24), iDEAL or SEPA bank transfer. Which payment methods are actually offered is displayed in the respective order process. For the execution of the payment the data required for this purpose is transmitted to Mollie. This may include in particular: name, e-mail address, billing and if applicable delivery address, order and transaction data, payment amount and currency, IP address, if applicable further data required for the selected payment method. Which data is processed in the individual case depends on the selected payment method and the specific technical processing. The transmission of the data required for payment processing is carried out for the performance of the contract pursuant to Art. 6 (1) lit. b GDPR. Mollie processes personal data in connection with payment services partly as an independent controller, in particular due to statutory obligations, for fraud prevention and for the execution and securing of payment transactions. In the case of individual payment methods the respective payment providers or payment networks may additionally be involved. For these processing operations the respective privacy policies are decisive. Privacy information of Mollie: https://www.mollie.com/legal/privacy
11. SHIPPING PROCESSING VIA SENDCLOUD
For the creation of shipping labels and the processing of our shipping processes we use the shipping service provider Sendcloud B.V., Stadhuisplein 10, 5611 EM Eindhoven, Netherlands. In the course of shipping processing we transmit the personal data required for shipping to Sendcloud. This includes in particular: first and last name, delivery address, if applicable e-mail address and telephone number, order and shipping information. The processing is carried out for the performance of the purchase contract pursuant to Art. 6 (1) lit. b GDPR. Sendcloud processes the data in the course of shipping processing and the shipping services used by us. Insofar as Sendcloud processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR. Sendcloud provides corresponding data protection and data processing information. Privacy information of Sendcloud: https://www.sendcloud.com/de/datenschutz/
12. SHIPPING WITH DHL AND DEUTSCHE POST
For the actual delivery of our goods we use in particular: DHL Paket for parcel shipping, Deutsche Post for Warenpost or corresponding letter and goods consignments. For the execution of the delivery the shipping data required for this purpose is transmitted to the respective shipping service provider. This includes in particular name and delivery address as well as the order and consignment data required for shipping processing. If necessary, telephone number or e-mail address are also transmitted for delivery purposes. The data is only transmitted insofar as this is necessary for the delivery. The processing is carried out for the performance of the purchase contract pursuant to Art. 6 (1) lit. b GDPR. Further information on data processing by the respective shipping service providers can be found in their privacy policies, e.g. Deutsche Post: https://www.deutschepost.de/datenschutz
13. SALES VIA EBAY
In addition to our own online shop we also offer our products via the sales platform eBay. If you purchase our products via eBay or communicate with us via eBay, personal data is initially processed by eBay in the course of the use of the platform. For the performance and processing of the purchase contract concluded via eBay we receive the customer data required for this purpose. This data may in particular include name, billing and delivery address, e-mail address, order and payment information as well as communication data. We process this data in particular for: processing and fulfilment of the order, communication with the customer, shipping processing, invoicing, processing of enquiries, complaints and returns, fulfilment of statutory retention and verification obligations. The legal basis is Art. 6 (1) lit. b GDPR as well as, insofar as statutory obligations are concerned, Art. 6 (1) lit. c GDPR. For the processing of personal data by eBay in the course of the use of the platform, for which eBay is independently responsible, the privacy policy of eBay is additionally decisive.
14. COOKIES AND CONSENT MANAGEMENT WITH ODOO
Our website uses cookies and comparable technologies. Cookies are small text files that are stored on your end device and may contain certain information about your use of our website. Further information can be found in our cookie policy on the website. We distinguish between technically necessary technologies that are required for the operation and the basic functions of our online shop (e.g. technical provision, storage of settings) and technologies that are used for analysis, marketing or other optional purposes. Technically necessary cookies are used on the basis of Art. 6 (1) lit. f GDPR insofar as their use is necessary for the secure and functional operation of our website. Our legitimate interest consists in the secure and user-friendly provision of our online shop. For cookies and comparable technologies that are not technically necessary, in particular for analysis or marketing purposes, we obtain your consent before their use. The legal basis is Art. 6 (1) lit. a GDPR. For the display of our cookie notice and the management of your consent decisions we use the cookie/consent function integrated into our Odoo on-premise installation. Your consent decision is stored within the technical possibilities of our Odoo installation so that we can track whether and to what extent you have consented to the use of non-necessary cookies and comparable technologies. The information required for this purpose is processed within our own Odoo database on our server at IONOS. You may change or revoke your consent decision at any time via the cookie/privacy settings available on our website. The revocation takes effect for the future. The lawfulness of the processing carried out until the revocation remains unaffected. Insofar as you consent to optional services, the following services may in particular be activated: Google Analytics, Google Ads, Google Tag Manager or tags triggered thereby, YouTube content, further optional analysis or marketing technologies insofar as these are used on our website. The respective services are explained in more detail in the following sections of this privacy policy.
15. GOOGLE SERVICES
On our website we use various services of Google. Depending on the service, personal data, in particular IP address, device and browser information, usage data, pages accessed, referrer information and interaction data may be processed. The processing takes place – insofar as required – only after your consent via our consent management system. The specific consent is documented via the consent technology used by us. You may revoke or change your consent at any time with effect for the future via our cookie/consent settings. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing by Google LLC or other companies affiliated with Google outside the European Economic Area cannot be excluded in the context of the services offered by Google (see section “Transfers to third countries”). Further information on data processing by Google can be found in Google’s privacy information: https://policies.google.com/privacy?hl=de
16. GOOGLE ANALYTICS
We use Google Analytics for the analysis of the use of our online shop and for the creation of statistics on the use of our website. In this context, information on page views, sessions, interactions, devices used, browsers, origin of visitors and other usage data may in particular be processed. The processing is based on your consent pursuant to Art. 6 (1) lit. a GDPR insofar as such consent is required for the use of the service. You may revoke or change your consent at any time with effect for the future via our cookie/consent settings.
17. GOOGLE ADS
We use Google Ads for the advertising of our online shop and for measuring the effectiveness of our advertisements (conversion tracking). In this context, information on visits to our website, interactions with advertisements and if applicable purchases made or other defined conversion events may be processed. Processing for non-necessary analysis and marketing purposes is based on your consent pursuant to Art. 6 (1) lit. a GDPR.
18. GOOGLE TAG MANAGER
We use the Google Tag Manager for the management and technical control of tags and scripts on our website. The Google Tag Manager serves in particular to technically integrate and control other services such as analysis, marketing or conversion tags. The use of the Tag Manager may process technical connection data such as IP address and browser information. Which further personal data is processed depends on the tags integrated via the Tag Manager. The services triggered by the Tag Manager are controlled in accordance with their respective consent and data protection requirements; non-necessary analysis and marketing tags are only activated after the required consent has been obtained.
19. GOOGLE MERCHANT CENTER
We use Google Merchant Center for the provision and management of product information for Google services and in particular for the display of our products in Google Shopping or corresponding Google offers. In connection with the use of these Google services, product, offer, technical and if applicable usage-related information may be processed. Insofar as personal data of website visitors or customers is processed in this context, the relevant data protection and consent regulations additionally apply.
20. YOUTUBE
Videos of the YouTube platform may be embedded on our website in order to provide additional information on our products and manufacturing processes. YouTube is a service of Google Ireland Limited or the companies affiliated with Google. When accessing a page with an embedded YouTube video or when playing a video, technical data, in particular IP address, browser information, device information, information on the page accessed and usage behaviour, may be transmitted to Google. Insofar as the embedding is not technically necessary, the activation of the corresponding YouTube content takes place only after your consent via our consent management system. The processing is in this case based on Art. 6 (1) lit. a GDPR. Further information can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=de
21. GOOGLE reCAPTCHA
We use Google reCAPTCHA to protect certain forms and functions of our online shop against automated access, spam and misuse. reCAPTCHA checks whether an entry is made by a natural person. In this context, technical information such as IP address, browser information, device information, technical characteristics of the end device and interaction data may be processed and transmitted to Google. The specific processing depends on the reCAPTCHA version used by us and its technical integration. The use is carried out to safeguard our legitimate interest in the security of our website and protection against spam, fraud and abusive access pursuant to Art. 6 (1) lit. f GDPR, insofar as the statutory requirements for this are met. Insofar as consent is required for the specific implementation, the processing takes place only after consent has been given on the basis of Art. 6 (1) lit. a GDPR. The provider is Google Ireland Limited or Google LLC. Further information can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=de
22. CLOUDFLARE
We use services of Cloudflare, Inc. for the securing, stabilisation and optimisation of our online shop and our IT infrastructure. In this context Cloudflare may process technical connection data, in particular IP address, information on the end device used, browser information, requested resources as well as further data required for the security and network functions. The processing is carried out in particular for the defence against attacks, for the detection and prevention of abusive access, for ensuring the availability and security of our website as well as for the technical optimisation of the delivery of content. The processing is, insofar as required, based on Art. 6 (1) lit. f GDPR. Our legitimate interest lies in particular in the secure and reliable operation of our online shop. Depending on the Cloudflare service used, data may also be processed by affiliated companies and service providers of Cloudflare. Cloudflare provides information on data protection, GDPR and data transfers in its Trust Hub: https://www.cloudflare.com/de-de/trust-hub/privacy-and-data-protection/
23. EMBEDDED CONTENT, SOCIAL MEDIA AND EXTERNAL LINKS
Our website may contain embedded external content, for example videos, images, social media content or external services. When accessing such content a connection to the servers of the respective providers may be established. In this context technical data such as IP address, browser information, time of access and referrer information may be transmitted. The embedding serves to improve our information offer and to provide additional product information. Non-necessary embedded content is activated in accordance with our consent configuration only insofar as consent is required for this purpose and has been given. Our website also contains links to our profiles in social networks and to other external websites. When clicking on such a link you leave our online offer and the data protection provisions of the respective provider apply. For a mere link where no connection to the external service is established when accessing our website, the above statements on embedded content do not apply.
24. PROCESSORS AND FURTHER RECIPIENTS
In the course of our business operations we use various technical and organisational service providers. Insofar as a service provider processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR. The service providers may process the personal data exclusively in accordance with our instructions and only for the agreed purposes. The service providers or recipients used for our online shop include in particular providers for hosting and infrastructure (IONOS SE), payment processing (Mollie B.V.), shipping processing and delivery (Sendcloud B.V., DHL, Deutsche Post), analysis and marketing (Google) as well as technical security services (Cloudflare, Inc.). Not every service provider mentioned in this privacy policy is automatically a processor. In particular payment service providers, shipping service providers or platform operators (e.g. eBay) may be independent controllers for certain processing operations and process data in accordance with their own data protection provisions.
25. TRANSFERS TO THIRD COUNTRIES
In the case of individual services used by us, personal data may be processed outside the European Economic Area. This may in particular be the case with certain Google and Cloudflare services as well as with further internationally active service providers. A transfer to third countries takes place only in compliance with the requirements of Art. 44 et seq. GDPR. Depending on the service and the specific processing, an adequacy decision of the European Commission, standard contractual clauses approved by the European Commission or other guarantees permissible under the GDPR may in particular apply. Which specific transfers take place depends on the respective technical configuration used and the current contractual and data protection conditions of the respective service provider.
26. STORAGE PERIOD AND DELETION
We store personal data in principle only for as long as this is required for the respective purposes. In addition we store data insofar as statutory retention obligations exist. This applies in particular to commercial and tax retention obligations under the German Commercial Code (HGB) and the Fiscal Code (AO). After expiry of the respective retention periods the corresponding data is deleted or anonymised, provided that no other legal basis for further storage exists. Data may also be stored longer if this is necessary for the assertion, exercise or defence of legal claims.
27. NECESSITY OF DATA PROVISION; NO AUTOMATED DECISION-MAKING
The provision of the personal data required for the conclusion and performance of the contract (in particular name, address, e-mail address) is necessary for an order. Without this data we cannot execute your order. Apart from that the provision of personal data is voluntary. A decision based exclusively on automated processing including profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you does not take place by us.
28. YOUR RIGHTS
Under the General Data Protection Regulation you are in particular entitled to the following rights: Right of access (Art. 15 GDPR): You have the right to obtain information about the personal data processed by us. Right to rectification (Art. 16 GDPR): You may request the rectification of inaccurate data or the completion of incomplete data. Right to erasure (Art. 17 GDPR): You may request the erasure of your personal data if the statutory requirements are met. Right to restriction of processing (Art. 18 GDPR): You may under certain conditions request the restriction of processing. Right to data portability (Art. 20 GDPR): You have the right to receive certain personal data in a structured, commonly used and machine-readable format. Right to object (Art. 21 GDPR): You may at any time object to the processing of your data on grounds relating to your particular situation insofar as this processing is based on Art. 6 (1) lit. e or lit. f GDPR. Right to withdraw consent: You may withdraw a given consent at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected. To exercise your rights you may contact us at any time using the contact details given above.
29. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
You have the right to lodge a complaint with a data protection supervisory authority if you are of the opinion that the processing of your personal data violates data protection law. The complaint may in particular be lodged with the supervisory authority of your habitual place of residence, your place of work or the place of the alleged infringement.
30. UPDATING OF THIS PRIVACY POLICY
We reserve the right to adapt this privacy policy if this becomes necessary due to technical developments, statutory changes or changes to our services. The current version published on our website shall apply in each case.