Privacy Policy and Consent to Data Use

1. General Information on Data Protection

The security of your data is very important to us, and data protection is a high priority for us. That’s why we have implemented technical and organizational measures to prevent attacks, misuse, loss, and incorrect changes to personal data, as well as unauthorized access by third parties (Art. 32 GDPR).

We collect, use, and store your personal data exclusively within the scope of European and national data protection laws. Below we inform you about the type, scope, and purpose of data collection and use within our online offering, as well as your rights under data protection law.

Name and Address of the responsible party

The responsible party in terms of the Federal Data Protection Act is:
EXCOR Corrosion Protection Technologies and Products Ltd.
Tonlandstrasse 2
34346 Hann. Münden

Managing Directors:
Gerhard Hahn and Ernst Hahn

Contact:
Phone: +49 351 888573-0
info@excor.com

Data Protection Officer

data-protection@excor.com

Type, Scope, and Purpose of Processed Data

We only process data if it is necessary to provide you—our customers, prospects, suppliers, visitors, and users of our online offering—with our content, contractual and pre-contractual services, and a functional, secure, and market-compliant online presence, as well as to maintain contact with our business partners and prospects. This includes data that you enter voluntarily as part of your use of our online services (e.g., registrations, orders, contact forms, etc.) and transmit to us, as well as automatically collected and logged data (e.g., access times, device information, IP addresses, etc.). Connection data is stored to the extent necessary for the conduct of business and to comply with legal requirements.

Legal Basis of Data Processing

If we have your consent to process your data, Art. 6 para. 1 lit. a) GDPR serves as the legal basis. If data processing is required to fulfill a contract with you or to take pre-contractual measures, Art. 6 para. 1 lit. b) GDPR is the legal basis. If it serves to fulfill a legal obligation, processing is based on Art. 6 para. 1 lit. c) GDPR. Finally, it is possible that processing your data serves to protect our legitimate interests, provided your interests or fundamental rights and freedoms that require the protection of personal data do not override. In this case, Art. 6 para. 1 lit. f) GDPR serves as the legal basis.

Duration of Storage and Data Deletion

Processed data will be deleted as soon as the purpose of storage ceases to apply and no national or European laws, regulations, or other provisions and retention periods or contractual obligations require further storage. These may include, for example, any existing warranty rights, ensuring proper bookkeeping, and the prevention or investigation of misuse or fraudulent activities, which may argue against deletion.

Objection

You may revoke your consent at any time. The easiest way to do this is by sending an email to data-protection@excor.com. In this case, the stored personal data will be deleted, provided it is no longer required to fulfill the purpose of the storage, unless regulations, laws, or other provisions by the national or European legislator or contracts and agreements of any kind require continued storage. Data relevant for billing or accounting purposes is not affected by a deletion request.

Data Transfer to Third Countries

If data is processed in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)), this is done exclusively if it is based on one of the legal grounds mentioned above. Data processing takes place only within the framework of the requirements of Art. 44 et seq. GDPR. This means that processing is only carried out in compliance with officially recognized special contractual obligations (so-called "Standard Contractual Clauses").

However, we would like to point out that third countries generally do not offer the same level of data protection as the EU. For example, U.S. companies may be obligated to hand over personal data to U.S. security authorities without any recourse available to you or us.

2. Logfiles and Server Data

Description of Processed Data

For technical, system-related, and statistical reasons, we automatically collect data and information from your internet browser or computer system each time our website is accessed. Specifically, the following data is collected:

• URL of the subpage of our website you are visiting
• Amount of data transferred
• Your IP address
• Browser type and current version
• Operating system of the device used to access our website
• Date and time of the page access
• Referrer URL

The data in the log files is not stored together with other personal data.

Purpose of Data Processing

The data processing is carried out in our legitimate interest for technical reasons. The content of our website can only be displayed if the technical conditions of the accessing device are taken into account. Errors in content transmission can also be more easily identified and resolved this way.

Legal Basis of Data Processing

Our aforementioned legitimate interests pursuant to Art. 6 para. 1 lit. f) GDPR serve as the legal basis for the storage of server data and log files.

Duration of Data Storage

The log files are automatically deleted after 6 weeks.

Objection

Data processing in the context of log files is absolutely necessary for the proper functioning of our website. Therefore, you do not have the option to object.

3. Google Tag Manager

We use Google Tag Manager on our website. Within the European region, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland is responsible for all Google services. Tag Manager is a service that facilitates the integration and management of our tags. Tags are small snippets of code that allow us to measure visitor traffic and behavior, advertising effectiveness, and to optimize our website accordingly. The Tag Manager itself does not process any user data. However, you can prevent the use of Google Tag Manager by changing your cookie settings.

4. Use of Cookies

Cookies are used on our website. Cookies typically contain data about the visited website that the web browser stores while surfing. If the user accesses our website again via the corresponding server, the user’s browser sends the previously received cookie back to our website. This enables the server to evaluate the received information and simplify navigation on the website or control advertising displays.

We differentiate between technically necessary cookies and marketing and analytics cookies in our online offering. 

When you first access our online offering, your preferences regarding cookies will be requested. You can change your decision at any time by reopening the cookie settings dialog. However, technically necessary cookies cannot be deselected in the cookie settings.

By configuring your internet browser—i.e., the program you use to open or display websites (such as Microsoft Edge, Internet Explorer, Mozilla Firefox, Opera, Google Chrome, or Safari)—you can disable the use of cookies entirely. In this case, certain functions of our online offering that are essential for its proper use may no longer be available to you.

4.1 Technically Necessary Cookies

Description of Processed Data

We distinguish between session cookies and consent cookies among the technically necessary cookies. The session cookie only stores the session ID, which allows our system to recognize a user after navigating to another page. The consent cookie is placed when you make your cookie selection via the consent banner upon your first visit to our online offering. Your selection regarding which cookies you accept or reject is stored in this consent cookie.

Purpose of Data Processing

It is in our legitimate interest to present our users with a technically flawless online presence. We use technically necessary cookies to enable core functions of our online offering. For example, with their help, login functionality or shopping cart behavior can persist across multiple pages. It is also in our legitimate interest—and that of our users—that users are not shown the consent banner every time they visit our website. Therefore, we store the user's decision in the consent cookie. However, users can still change their decision at any time by manually reopening the consent banner.

Legal Basis of Data Processing

Our legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR form the legal basis for the processing of technically necessary cookies.

Duration of Data Storage

Session cookies are automatically deleted after one hour, consent cookies after one year.

4.2 Google Analytics

Description of Processed Data

We use Google Analytics on our online offering. This is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA, 94043, USA (“Google”). Provided you have given consent for the use of analytics cookies through your selection in the “We use cookies” banner, we use Google Analytics to collect information about your use of our website.

Google Analytics uses cookies that are usually transmitted to and stored on a Google server in the USA. On our website, the anonymizeIP function is activated. This means that Google anonymizes your IP address as soon as the data enters the Analytics collection network—before it is stored or processed.

The IP address transmitted by your browser within the scope of Google Analytics is not combined with other Google data unless you are logged into a Google service while using our online offering. Google Analytics is configured so that no user IDs are created.

We also use the Google Signals extension in Google Analytics, which allows us to generate cross-device statistics. Signals only provides data when you are logged into your Google account and have activated “Personalized ads.” Google Signals is also used only with IP anonymization enabled. We do not receive any personal data—only aggregated and anonymous data.

During your visit to our online offering, the following data is collected, among others:

• Your anonymized IP address
• Date and time of your visit to our online offering
• All pages you visit within our online offering
• Your browsing behavior on our website, such as clicks, time spent, form submissions
• Technical information about your device, browser, operating system, etc.
• Your approximate location
• The website URL from which you accessed our website (referrer URL)

Purpose of Data Processing

On our behalf, Google uses this data to evaluate your usage behavior on our website, to generate reports about website activity, and to provide us with further services related to website and internet usage. We have signed a data processing agreement with Google for this purpose. We use the Analytics reports and evaluations to understand how visitors use our online presence and to best tailor it to user needs.

Legal Basis of Data Processing

The legal basis for the data processing is your consent pursuant to Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR. You can revoke this consent at any time by changing your cookie settings.

Duration of Data Storage

Google Analytics on this website is configured so that cookie-related data is automatically deleted after 14 months.

Objection

You can prevent the storage of cookies by changing your cookie settings.

4.3 Google Ads

Description of Processed Data

We use Google Ads to prominently present our online offering to interested users within the Google Network. Our advertisements therefore appear in Google Search and also on third-party websites. In this context, we use Google Conversion Tracking on our online offering. This is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA, 94043, USA (“Google”). With the help of Conversion Tracking, we can tailor our ads and online offering to best meet the needs of our customers and prospects. When you click on a Google Ads ad, a cookie is set for conversion tracking.

In addition, we use the Enhanced Conversions feature, which allows for more accurate conversion tracking by supplementing conversion data with user data from our online offering—provided you are logged into your Google account while using our website. Before being sent to Google, user data is converted into a hashed string. Google matches the hashed user data with the hashed data in the Google account and can assign conversions more directly if there is a match. 

The following data is processed, among others:

• IP address
• Device information
• Browser history
• Demographic data
• Location data
• Search terms
• Interactions with ads and content
• Visited websites
• Used apps
• Click behavior
• Conversion data
• Unique user IDs

Google also processes data in the USA. Google participates in the EU-US Data Privacy Framework, which ensures the secure transfer of personal data between the EU and the USA. In addition, Google relies on the EU’s Standard Contractual Clauses for data transfers to the USA.

More information on Google Ads and Google Conversion Tracking can be found in Google’s Privacy Policy: https://policies.google.com/privacy?hl=de

Purpose of Data Processing

By using Google Ads and Conversion Tracking, we can advertise within the Google Network and acquire new prospects and customers. We can also measure the effectiveness of our advertising and take steps to make it more efficient and targeted.

Legal Basis of Data Processing

The legal basis for the data processing is your consent pursuant to Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR. You may revoke this consent at any time by changing your cookie settings.

Duration of Data Storage

Cookies have different retention periods. The maximum storage duration is 13 months.

Objection

You can prevent the storage of cookies by changing your cookie settings.

4.4 Microsoft Advertising

Description of Processed Data 

We use Microsoft Advertising to prominently present our online offering to interested users within the Microsoft Advertising Network. Our ads appear in the Microsoft search engine Bing and on third-party websites. In this context, we use Microsoft Advertising Universal Event Tracking on our website. Microsoft Advertising and Universal Event Tracking are services of Microsoft Corporation, One Microsoft Way, Redmond, WA, 98052-6399, USA (“Microsoft"). When a user clicks on a Microsoft Advertising ad, cookies are set on the user's device.

The following data is processed, among others:

• Time of visit
• Device characteristics
• Browser characteristics
• IP address (encrypted)
• Data on the use of our website

Microsoft also processes data in the USA. Microsoft participates in the EU-US Data Privacy Framework, which ensures the secure transfer of personal data between the EU and the USA. In addition, Microsoft relies on the EU’s Standard Contractual Clauses for data transfers to the USA. 

Purpose of Data Processing

Using Microsoft Advertising and Universal Event Tracking allows us to advertise within the Microsoft Network and acquire new prospects and customers. We can also measure the effectiveness of our advertising and make it more efficient and targeted.

Legal Basis of Data Processing

The legal basis for the data processing is your consent pursuant to Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR. You may revoke this consent at any time by changing your cookie settings.

Duration of Data Storage

Microsoft Advertising cookies have different retention periods. The maximum duration is 13 months.

Objection

You can prevent the storage of cookies by changing your cookie settings.

4.5 LinkedIn Ads

Description of Processed Data 

Our online offering integrates the Insight Tag from LinkedIn Corporation. In Europe, this service is provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Tags are small snippets of code used to measure visitor traffic and behavior as well as ad performance. The Insight Tag sets cookies for visitors to our site and, among other things, recognizes when a user logs into their LinkedIn profile.

Through the Insight Tag and its cookies, the following data is processed, among others:

• URL
• Referrer URL
• Device characteristics
• Browser characteristics
• IP address

LinkedIn also processes data in the USA. LinkedIn participates in the EU-US Data Privacy Framework, which ensures the secure transfer of personal data between the EU and the USA. Additionally, LinkedIn relies on the EU’s Standard Contractual Clauses for data transfers to the USA.

For the data processing within the Insight Tag, there is joint responsibility between LinkedIn and Excor. The agreement on joint responsibility can be found here: https://legal.linkedin.com/pages-joint-controller-addendum.

Purpose of Data Processing

Embedding the Insight Tag allows us to use LinkedIn's conversion tracking and retargeting functionality. This enables us to show personalized ads on LinkedIn to users who have visited our site and are logged into their LinkedIn profiles. We also receive anonymized reports on the success of our LinkedIn advertising.

Legal Basis of Data Processing

The legal basis for the data processing is your consent pursuant to Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR and §25 para. 1 TTDSG. You may revoke this consent at any time by changing your cookie settings.

Duration of Data Storage

Insight Tag cookies have varying retention periods. Most are deleted after 30 days. The maximum retention period is 2 years.

Objection

You can prevent the storage of cookies by changing your cookie settings. Additionally, you may object to the processing of your data for direct marketing purposes at any time in accordance with Art. 21 para. 2 GDPR.

4.6 Teads

Description of Processed Data 

We use Teads on our website to recognize users who have visited our site and to serve them ads on other websites. Teads sets cookies on the user's device. The following data is processed, among others:

• Time of visit
• Device characteristics
• Browser characteristics
• IP address
• Location data
• Data on the use of our website

Teads is a service of Teads Deutschland GmbH, Poststraße 6, 20354 Hamburg (“Teads”). Teads is headquartered in the USA, so data processing in the USA cannot be ruled out. Teads bases its data transfers to the USA on the EU Standard Contractual Clauses.

Purpose of Data Processing

By using Teads, we can recognize users who have visited our site and serve them targeted advertising on other websites. This allows us to remind potential customers of the benefits of our company and products.

Legal Basis of Data Processing

The legal basis for the data processing is your consent pursuant to Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR. You may revoke this consent at any time by changing your cookie settings.

Duration of Data Storage

There are varying retention periods for this data. Most are deleted after 4 months. The maximum retention period is 1 year.

Objection

You can prevent the storage of cookies by changing your cookie settings.

5. Customer Account / Registration

Description of Processed Data

We offer users of our online services the option to create a customer account. To do so, you must enter a number of details in the designated registration form. Specifically, these include:

• Company address (company name, street, house number, postal code, city, country)
• Company phone and fax numbers
• Company’s commercial register and tax ID numbers
• Contact person (first name, last name, title)
• Email address of the contact person
• Self-chosen password

In addition to the data you enter yourself, the date and time of your registration and each login to your customer account will be stored.

To submit your registration data, you will be asked to consent to the processing of the information you provide.

When you log in to your customer account after registering, the following data is processed:

• Pages visited and products viewed
• Your wishlist
• Items in your shopping cart
• Your completed orders

Purpose of Data Processing

By registering, you can purchase products in our online shop or add them to a wishlist for future purchases. Your wishlist will be permanently saved in your customer account. A filled cart can be retrieved later to complete your order. Completed orders can be viewed at any time. By analyzing the pages and items you view, we can provide personalized recommendations. These features are intended to make shopping easier and more intuitive for you. We also store login timestamps and viewed shop pages to protect against abuse and unauthorized use — this is in our legitimate interest.

Legal Basis of Data Processing

Art. 6 para. 1 lit. a) GDPR serves as the legal basis for processing your registration data. Since registration is required to place orders in our online shop, it is considered a pre-contractual measure, making Art. 6 para. 1 lit. b) GDPR also applicable. Additionally, Art. 6 para. 1 lit. f) GDPR applies for protecting our legitimate interests in preventing abuse or unauthorized access.

Duration of Data Storage

Your customer account and all data collected during registration will be manually deleted by us, subject to any commercial or tax retention obligations under Art. 6 para. 1 lit. c) GDPR, once you notify us that you no longer wish to use your account.

Objection

You can revoke your consent to the processing of your customer account data at any time with future effect by requesting deletion via email to: shop@knueppel.de.

6. Orders in the Online Shop

Description of Processed Data

In connection with placing orders in our online shop, additional data beyond your registration data is collected and processed. These include:

• Address and contact details for delivery and invoicing that differ from your customer account
• Email addresses for order confirmation, shipping confirmation, and/or invoices that differ from the one stored in your customer account
• A customer order number

The data is manually entered by you into the appropriate fields during the checkout process.

Purpose of Data Processing

The primary purpose of processing this data is to manage your order. Specifically, we use it for:

• Product delivery
• Invoicing, payment processing, reminders, and enforcement of our claims
• Communication with you
• Returns management
• Warranty and liability issues

Additionally, data is processed in our legitimate interest for general customer data management, statistics and marketing, and to make your past orders available for future use in your account.

Legal Basis of Data Processing

As the majority of the data processing relates to executing the purchase agreement, Art. 6 para. 1 lit. b) GDPR is the legal basis. For the other processes, Art. 6 para. 1 lit. f) GDPR applies.

Duration of Data Storage

Your customer account and all related order data will be manually deleted by us, subject to any commercial or tax retention obligations under Art. 6 para. 1 lit. c) GDPR, once you notify us that you no longer wish to use your account.

Objection

You may revoke your consent to the processing of order-related data at any time with future effect by requesting deletion of your account via email to: shop@knueppel.de.

7. Social Media

7.1 LinkedIn

We operate a company profile on the LinkedIn social media platform (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). LinkedIn’s privacy policy, including contact information, can be found at: https://de.linkedin.com/legal/privacy-policy.

For certain processing activities related to our LinkedIn profile — in particular the use of LinkedIn Page Insights, LinkedIn Lead Gen Forms, and the LinkedIn Insight Tag in ad campaigns — we and LinkedIn share joint responsibility under Art. 26 GDPR.

The agreement on joint controllership (“Page Insights Joint Controller Addendum”) can be found at:
https://legal.linkedin.com/pages-joint-controller-addendum

Additional information about the processing of personal data by LinkedIn and your rights as a data subject can also be found in the above-linked privacy policy.

LinkedIn is a U.S.-based company. It is therefore possible that your personal data is processed outside the European Union (EU). LinkedIn participates in the EU-US Data Privacy Framework.

7.2 Xing

We operate a company profile on the Xing social media platform (New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany). Xing’s privacy policy, including contact information, can be found at: https://privacy.xing.com/de/datenschutzerklaerung. 

Only XING (New Work SE) is considered the data controller under the GDPR for any personal data processed on the platform.
There is no joint controllership under Art. 26 GDPR, as there is no jointly defined purpose or means of processing between XING and Excor.

EXCOR Corrosion Protection Technologies and Products GmbH is solely responsible for the content published via the company profile (e.g., posts, images, or information).

You may revoke your consent to the processing of your customer account data at any time with future effect by requesting deletion via email to: data-protection@excor.com.

8. Data Transfers to Third Parties

In the context of order processing, customer data management, and sales processes, as well as to make your visit to our website as pleasant and informative as possible, it may be necessary to transfer data to third parties. This particularly applies to processes involving customer data management, payment processing, product delivery, and the integration of third-party content. The transfer of data is always limited to the minimum required. Where necessary, the basis for such transfers is a data processing agreement concluded with the respective third parties.

8.1 Product Delivery

Description of Processed Data

As part of our obligations to customers when an order is placed, we are responsible for delivering the ordered goods to the desired location on time. To achieve this, we cooperate with various shipping providers and/or suppliers.

The selection and commissioning of the transport company or supplier responsible for a specific order depends on the case and material. For the delivery process, the following data may be shared with the transport company:

• Delivery address,
• Special delivery instructions
• If necessary, internal contact person and their contact information

Purpose of Data Processing

The data processing is necessary to fulfill our contractual obligation arising from the purchase agreement made via our online shop to deliver the ordered goods on time to the agreed location. Communication between the shipping company and the customer contact person may also be required.

Legal Basis of Data Processing

Data processing is directly related to the execution of the purchase agreement concluded via the online shop, and is therefore based on Art. 6 para. 1 lit. b) GDPR.

Duration of Data Storage

According to our data processing agreement, shipping companies and suppliers are required to delete the data they receive after delivery, subject to any legal commercial or tax-related retention obligations in accordance with Art. 6 para. 1 lit. c) GDPR.

Objection

You may object to the processing of your data by our commissioned shipping companies and suppliers at any time with future effect by emailing: data-protection@excor.com. However, doing so may prevent us from delivering products ordered in our online shop.

8.2 Credit Check and Scoring

Description of Processed Data

If we provide goods or services in advance, such as in the case of purchase on account, we may carry out a credit check. This is based on the company's customer number in our system and its prior payment history. If our internal assessment is insufficient, we may obtain a credit report from Creditreform Braunschweig Göttingen Bruns und Harland GmbH & Co. KG, Willi-Eichler-Str. 11, 37079 Göttingen. For this purpose, the following data may be transmitted:

• Company address (including company name, legal form, street, house number, postal code, city)
• Phone number (if applicable)
• VAT ID (if applicable)
• Tax number (if applicable)

We use the information received about the statistical likelihood of payment default to make a well-informed decision about initiating, performing, or terminating the contractual relationship. The credit report may contain probability values (score values) regarding the likelihood that a customer will meet their payment obligations. These scores are based on scientifically recognized mathematical-statistical methods.

Purpose of Data Processing

Processing is carried out in our legitimate interest to protect ourselves from payment defaults. In addition, the credit check is part of processing a purchase agreement arising from an online order.

Legal Basis of Data Processing

The legal basis is our legitimate interest under Art. 6 para. 1 lit. f) GDPR.

Duration of Data Storage

Your customer account, associated transactions, payment processes, and credit check results from Creditreform will be manually deleted by us — subject to commercial or tax retention obligations under Art. 6 para. 1 lit. c) GDPR — once you inform us that you no longer wish to use your account.

Objection

You may revoke your consent to the processing of data related to all orders placed via your customer account at any time with future effect by requesting deletion via email to: data-protection@excor.com

8.3 PayPal

When ordering from our online shop, you may choose to pay via PayPal, among other options. PayPal is a service that enables online payments to third parties, provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. If you choose this payment method, data will be transmitted to PayPal to complete the payment process.

Please note that PayPal may collect, process, and potentially share additional data when you use their service. For details on PayPal’s data processing, please visit: www.paypal.com/de/webapps/mpp/ua/privacy-full

We have no control over what data PayPal processes, where, how long, or with whom it is shared. If you wish to prevent PayPal from processing your data, please select a different payment method. The advance payment option is always available to you.

8.4 Trusted Shops

Description of Processed Data

Our online shop integrates the Trustbadge from Trusted Shops. Trusted Shops GmbH is located at Subbelrather Straße 15C, 50823 Cologne. When the Trustbadge is accessed, the web server automatically stores the following data in a log file:

• IP address
• Date and time of access
• Amount of data transferred
• Requesting provider

If you use any of the buyer protection products offered by Trusted Shops, additional data — especially order data — is transmitted to Trusted Shops GmbH. Whether you are already registered for such a service is checked via a neutral parameter: your email address is hashed using a cryptographic one-way function and compared to existing records. The hash is non-reversible. Once checked, the parameter is immediately deleted.

For more information on data protection at Trusted Shops, visit: www.trustedshops.de/impressum/

Purpose of Data Processing

Our partnership with Trusted Shops provides our customers with guidance and security during online purchases and serves as a marketing tool that builds trust. By embedding the Trustbadge in our shop, we offer a seal of approval for safe online shopping. The partnership also gives customers access to Trusted Shops' buyer protection program. The display of customer reviews via the Trustbadge helps customers assess the reliability of our shop.

Legal Basis of Data Processing

A transparent review system and secure shopping experience are in the legitimate interests of both us and our customers. Therefore, the legal basis for displaying the Trustbadge and storing access data in the log file is Art. 6 para. 1 lit. f) GDPR. The legal basis for further data processing under Trusted Shops’ services is the contractual agreement between customers and Trusted Shops.

Duration of Data Storage

Log files are automatically deleted no later than 90 days after creation. The neutral parameter for verifying registration with Trusted Shops is deleted immediately after verification.

Objection

You may withdraw your consent to the data processing associated with the Trustbadge at any time with future effect by emailing: data-protection@excor.com.

8.5 YouTube

We embed videos hosted on YouTube into our online offerings. YouTube is a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA, 94043, USA.

Videos will only be loaded if you accept YouTube cookies. You can do this in two ways:

1. Via the cookie consent banner that appears when you first visit our site
2. If you initially declined cookies, you will see a preview where you are prompted to accept cookies to view the video

No data is exchanged with YouTube until you have consented. Once you agree, a cookie is stored in your browser. Data collected by this cookie is usually transmitted to and stored on a Google server in the USA.

If you are logged into YouTube or another Google service while playing the video, Google may associate the data with other personal data.

More information on YouTube’s privacy practices: policies.google.com/privacy

We have no control over which data YouTube processes, where, for how long, or with whom it is shared. If you wish to prevent this, do not enable video playback.

8.6 LinkedIn Lead Gen Forms

Description of Processed Data 

We use LinkedIn Lead Gen Forms to generate leads on LinkedIn. In the EU, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland is responsible. Leads are interested users who provide us with their contact data. Depending on the campaign, different forms are used. In all cases, contact and company data is collected. When a user fills out a form, LinkedIn processes personal data and transfers it to us.

For this processing, there is joint responsibility between LinkedIn and Excor. The joint controller agreement is available at: legal.linkedin.com/pages-joint-controller-addendum

Purpose of Data Processing

Generating new leads is vital for us to establish business relationships and acquire customers. LinkedIn, as a business-focused network, is ideal for this purpose. Forms where users leave their contact details are especially useful for making contact.

Legal Basis of Data Processing

The legal basis is your consent pursuant to Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR. Once transferred to our CRM, further processing is also based on Art. 6 para. 1 lit. b) and f) GDPR.

Duration of Data Storage

Your personal data will be manually deleted by us — subject to commercial or tax-related retention obligations under Art. 6 para. 1 lit. c) GDPR — as soon as you inform us that you no longer consent to processing. Data stored in our CRM will also be manually deleted under the same legal framework once you object via email.

Objection

You may withdraw your consent to processing at any time with future effect by emailing: data-protection@excor.com. You may also object to the processing of your data for marketing purposes at any time pursuant to Art. 21 para. 2 GDPR.

8.7 Salesforce

Description of Processed Data

We use Salesforce to manage our customer data, sales processes, lead generation, and marketing automation. In Germany, this service is provided by salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich. Personal data from LinkedIn campaigns, lead gen forms, user interactions, customer registrations, online orders, newsletter sign-ups, and general inquiries is stored and processed in our CRM system. Some employees use LinkedIn professionally for business outreach. If LinkedIn contact data is shared with Excor, it is further processed in Salesforce.

Customer data is stored on Salesforce servers. Since Salesforce is headquartered in the USA, data processing in the USA cannot be ruled out. Salesforce participates in the EU-US Data Privacy Framework and additionally relies on the EU Standard Contractual Clauses.

Purpose of Data Processing

Using Salesforce enables us to manage customer data and sales processes efficiently (Salesforce Sales Cloud) and conduct effective marketing campaigns (Salesforce Marketing Cloud). 

Legal Basis of Data Processing

The legal basis is our legitimate interest in managing customer data and sales processes efficiently under Art. 6 para. 1 lit. f) GDPR. Where applicable, processing is also based on consent under Art. 6 para. 1 lit. a) GDPR and on contractual obligations under Art. 6 para. 1 lit. b) GDPR.

Objection

You may withdraw your consent to the processing of your data at any time with future effect by emailing: data-protection@excor.com. You may also object to the processing of your data for marketing purposes pursuant to Art. 21 para. 2 GDPR.

9. Contact

Description of Processed Data

To get in touch with us, we offer various contact options such as contact forms, email, phone, etc. If you reach out to us, we will process all data you provide.

Purpose of Data Processing

The data from your inquiry will be used solely for the purpose of communicating with you and addressing your request.

Legal Basis of Data Processing

It is in both your and our legitimate interest that we respond to your inquiry. Therefore, Art. 6 para. 1 lit. f) GDPR is always a valid legal basis for the data processing. If your inquiry is made via our contact form, Art. 6 para. 1 lit. a) GDPR also applies. If your inquiry is aimed at entering into a contract, Art. 6 para. 1 lit. b) GDPR applies additionally.

Duration of Data Storage

We will process your data only as long as necessary to maintain our business relationship. Unless you object, we will use your data to maintain and strengthen our trusted relationship to the benefit of both parties. If you request deletion, we will delete your data immediately unless legal retention obligations prevent this.

Objection

You may object to the processing of your contact-related data at any time by emailing data-protection@excor.com. In such a case, however, we will no longer be able to continue our communication with you.

10. Newsletter and Event-Based Emails

Description of Processed Data

Our online offering gives you the option to register for our free newsletter. To do so, you must provide the email address to which the newsletter will be sent. Additionally, the date and time of your registration will be recorded.

To complete your subscription, you must actively consent to data processing by checking the relevant box beneath the form.

We use a double opt-in procedure for newsletter registration. After registering, you’ll receive an email with a confirmation link. You must click this link to confirm your subscription. This ensures no one can register others’ email addresses without permission.

We also use your name and email address, as stored in your online shop account, to send you event-based emails based on your activity in our online shop.

Purpose of Data Processing

We use your email address to send you the newsletter. The processing also helps us document your consent and prevent misuse of the newsletter or your email address.

For event-based emails, we use your name and email to recommend products based on the items you’ve viewed, ordered, or added to your cart.

Legal Basis of Data Processing

Art. 6 para. 1 lit. a) GDPR serves as the legal basis for newsletter data processing, as your active consent is required. Art. 6 para. 1 lit. f) GDPR also applies for the purpose of documenting past newsletter subscriptions.

For event-based email campaigns, the legal basis is §7 para. 3 of the German Unfair Competition Act (UWG).

Duration of Data Storage

The data collected for newsletter subscriptions will be retained beyond the subscription period to allow us to prove your prior consent.

Your customer account and all related data will be deleted manually — subject to commercial or tax retention obligations under Art. 6 para. 1 lit. c) GDPR — once you inform us that you wish to cancel your account.

Objection

You may unsubscribe from the newsletter at any time via the unsubscribe link provided in each newsletter. Alternatively, you can send a cancellation request via email to: data-protection@excor.com. You may also request deletion of your subscription data at any time via this email address.

11. Surveys

Description of Processed Data

From time to time, we conduct customer surveys. We use the open-source software LimeSurvey from LimeSurvey GmbH for this purpose. Both the software and the individual surveys are hosted on our own servers. No data is exchanged with LimeSurvey GmbH.

Depending on the specific survey, we may ask for personal data. The exact data collected will vary from survey to survey.

Participation is always voluntary. To participate, you must actively consent to data processing by checking the appropriate box at the end of the survey form.

Purpose of Data Processing

Surveys are usually conducted for market research purposes — typically to gather insights into our customers’ buying behavior. The exact purpose may vary depending on the specific survey.

Legal Basis of Data Processing

Since data is only processed following your voluntary participation in a survey, Art. 6 para. 1 lit. a) GDPR serves as the legal basis.

Duration of Data Storage

Survey data about customer purchasing behavior is typically of long-term interest to us and will only be deleted upon explicit request by the participant.

Objection

You can avoid data processing by not participating in surveys. If you have already participated and would like to revoke your consent or request deletion of your data, please email: data-protection@excor.com.

12. Rights of the Data Subject

If your personal data is processed, you are considered a data subject under the GDPR, and you have the following rights against the controller:

12.1 Right of Access

You may request confirmation from us as to whether we process personal data concerning you. If such processing exists, you have the right to access this personal data and the information listed in Art. 15 GDPR.

You also have the right to know whether your personal data is transferred to a third country or international organization. In this context, you may request information about the appropriate safeguards pursuant to Art. 46 GDPR in connection with such transfers.

12.2 Right to Rectification

You have the right to request the correction and/or completion of your personal data if it is inaccurate or incomplete. We will make the requested corrections without undue delay.

12.3 Right to Restriction of Processing

Under the conditions outlined in Art. 18 GDPR, you may request the restriction of the processing of your personal data.

If processing has been restricted, such data – aside from storage – may only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person, or for reasons of substantial public interest of the Union or a Member State.

If the restriction of processing was lifted in accordance with Art. 18 GDPR, you will be informed beforehand.

12.4 Right to Erasure

You may request the immediate deletion of your personal data, and we are obliged to comply if one of the following applies:

(1) The data is no longer necessary for the purposes for which it was collected or otherwise processed.

(2) You withdraw your consent on which the processing was based according to Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR, and there is no other legal basis for the processing.

(3) You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds, or you object pursuant to Art. 21 para. 2 GDPR.

(4) The data has been unlawfully processed.

(5) Erasure is required to fulfill a legal obligation under Union or Member State law to which the controller is subject.

(6) The data was collected in relation to services offered by the information society according to Art. 8 para. 1 GDPR.

Notification to Third Parties

If we have made your personal data public and are obliged under Art. 17 para. 1 GDPR to erase it, we will take appropriate measures – including technical ones – to inform controllers processing your data that you have requested erasure of all links to or copies of this data, taking available technology and implementation cost into account.

Exceptions

The right to erasure does not apply if the processing is necessary:

(1) For exercising freedom of expression and information;

(2) To comply with a legal obligation requiring processing under Union or Member State law, or for the performance of a task carried out in the public interest or in the exercise of official authority;

(3) For reasons of public interest in the area of public health under Art. 9 para. 2 lit. h and i and Art. 9 para. 3 GDPR;

(4) For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes according to Art. 89 para. 1 GDPR, if the right to erasure is likely to render impossible or seriously impair the achievement of these purposes; or

(5) For the establishment, exercise or defense of legal claims.

12.5 Right to Notification

If you have exercised your right to rectification, erasure, or restriction of processing, we are obliged to inform all recipients to whom your personal data was disclosed unless this proves impossible or involves disproportionate effort.

You have the right to be informed about these recipients.

12.6 Right to Data Portability

Under Art. 20 GDPR, you have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. You also have the right to transmit this data to another controller without hindrance.

In exercising this right, you may also request that your personal data be transferred directly from us to another controller, where technically feasible. This must not adversely affect the rights and freedoms of others.

This right does not apply to processing necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller.

12.7 Right to Object

You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data based on Art. 6 para. 1 lit. e or f GDPR, including profiling based on those provisions.

We will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is for the establishment, exercise or defense of legal claims.

You also have the option, in connection with the use of information society services – notwithstanding Directive 2002/58/EC – to exercise your right to object by automated means using technical specifications.

12.8 Right to Withdraw Consent

You have the right to withdraw your consent to data processing at any time. The withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

12.9 Automated Decision-Making Including Profiling

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or significantly affects you in a similar way. This does not apply if the decision:

(1) Is necessary for entering into, or the performance of, a contract between you and us,

(2) Is authorized by Union or Member State law, and such laws contain appropriate measures to safeguard your rights and freedoms and legitimate interests, or

(3) Is based on your explicit consent.

However, such decisions may not be based on special categories of personal data under Art. 9 para. 1 GDPR unless Art. 9 para. 2 lit. a or g applies and suitable safeguards are in place to protect your rights and freedoms.

In cases (1) and (3), we will take reasonable steps to safeguard your rights and freedoms, including at least the right to obtain human intervention, express your point of view, and contest the decision.

12.10 Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your residence, place of work or of the alleged infringement, if you believe that the processing of your personal data violates the GDPR.

The supervisory authority will inform you about the status and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR.

13. Changes and Updates to This Privacy Policy

Should we introduce new services, products, or procedures, or if web and IT security technology advances, this privacy policy will be updated accordingly. We reserve the right to amend this policy where necessary. All changes will be posted here. We recommend checking this page regularly to stay informed about the current state of the privacy policy.

Last updated: 07/2025