Privacy notice

1. Controller

2. Hosting and technical access data

The website is hosted through Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Requests involve processing the IP address, requested address, time, browser and device information, and technical error and security data to deliver and secure the website and resolve errors. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure website operation.

To limit repeated form submissions, the IP address is associated with a counter in the server instance memory. The window is one minute; expired entries are removed on the next request. This protection also relies on Article 6(1)(f) GDPR.

3. Contact and non-binding business enquiries

For an enquiry we process business and contact details, product selections, quantities, project and delivery information, messages and optional attachments to assess and answer your enquiry and prepare a possible business relationship. Please provide only necessary information and no health data or other particularly sensitive information.

If you are the potential contracting party, processing relies on Article 6(1)(b) GDPR. For company representatives and general enquiries, it relies on Article 6(1)(f) GDPR and our legitimate interest in business communication. Acknowledging this notice in the form is not consent or a marketing subscription. The enquiry form does not make solely automated decisions with legal or similarly significant effects.

Fields marked as required are needed to handle the online enquiry. Providing them is not a statutory obligation; the form cannot be submitted without them. You can alternatively contact us by email or telephone.

3a. Dealer applications, accounts and optional updates

The account database is hosted by Neon (Neon, LLC / Databricks, Inc., USA) in AWS US East (N. Virginia, us-east-1). The provider processes account data required for storage, backups and database operation, including processing in the USA. Published Databricks data-processing terms provide in particular for EU Standard Contractual Clauses, supplemented by Neon-specific terms. Contact us for information about applicable contractual safeguards.

We process company and contact details, address and optional information for applications and account management. Email verification and password setup are followed by a personal company review. Processing serves to initiate and manage the business relationship (Article 6(1)(b) GDPR); for company representatives it is based on our legitimate interest in serving that company (Article 6(1)(f)). Quotations remain available without an account.

Applications, profiles, password hashes, sessions and consent/review records are stored in an account database separate from the public catalogue. Passwords are never stored as plain text. Necessary session cookies support sign-in for at most twelve hours and cannot be accessed by JavaScript. They are necessary for the account service you request (Section 25(2) TDDDG). Single-use verification links expire after 24 hours and password-reset links after 30 minutes. A reset ends existing sessions. Transactional messages use the email provider in Section 4; unsent messages are temporarily queued. Business documents are requested separately through an agreed channel when needed.

Authorized staff review applications in the Klimafaktur instance of EntraCRM. Verified applications are displayed through a protected server-to-server interface. Decisions, time and reviewer are recorded with the account data. Internal review notes are not displayed as messages in your account. Your status and customer-facing message update immediately, followed by a transactional notification. Other EntraCRM instances cannot access these applications.

Marketing consent is voluntary, unchecked by default and does not affect dealer approval. Text, version, language, choice and timestamps are recorded separately. Only a separate email confirmation activates consent. The legal basis is Article 6(1)(a) GDPR. Withdraw anytime in your account or at kontakt@klimafaktur.de. No external newsletter subscription is created automatically. Your account supports correction, export and password-protected deletion. Email changes require confirmation through the old and new addresses and withdraw existing marketing consent.

Abuse prevention uses short-lived signatures and distributed pseudonymous IP/email counters (Article 6(1)(f) GDPR). Application counters use ten-minute windows. Account subpages do not collect optional audience analytics. Regular maintenance deletes unverified applications after seven days and rejected accounts after 90 days. Other account data is kept until deletion or the purpose ceases. Sent queue entries are deleted; unsent entries after at most seven days. Expired tokens, sessions and counters are cleaned regularly. Business records, mailbox copies and backups additionally follow the purposes and legal retention limits in Section 9.

3b. Binding B2B goods orders

For direct purchases, we process company and contact details, billing and delivery addresses, your VAT ID if provided, selected items and quantities and the confirmed net total including goods and shipping. The order and accepted version of the direct-purchase terms are stored in our order database to fulfil the contract. Tax treatment is checked against the actual delivery route before invoicing. Payment is made by bank transfer following the invoice; the website does not collect bank login credentials or card details.

The details are sent to our sales mailbox and to your email address to process and confirm the order, using the existing email queue. For potential contracting parties, the legal basis is GDPR Article 6(1)(b); for company contacts, Article 6(1)(f). Our legitimate interest is to fulfil business purchases. Statutory retention duties for contracts and business documents are taken into account. Test deployments do not create real orders or send customer emails.

4. Enquiry transmission and receipt confirmation

Form delivery uses Resend (Plus Five Five, Inc., USA). The service receives the necessary recipient and sender details, enquiry contents and attachments to deliver them to our sales mailbox. Your separate receipt confirmation contains no attachments or advertising. Delivery and error data may also be processed. The legal bases are the same as for handling enquiries.

To deliver reliably, we temporarily store form enquiries and attachments encrypted in a separate mail queue. After provider acceptance, the relevant contents are removed; regular maintenance removes remaining contents after seven days. Opaque references preventing duplicate sends are retained for at most 90 days. New conversations in the connected Klimafaktur mailbox also receive an automatic acknowledgement using sender, display name, receipt time and a technical conversation reference. Incoming message contents are not included in the acknowledgement. Automatic replies, bulk mail and existing reply threads do not trigger another confirmation. The catalogue database contains only product data. Test deployments never email customers.

5. Browser storage

The enquiry basket (klimafaktur-cart-v1) and your selected language (klimafaktur-language) use local browser storage until you clear the basket, change the preference or delete browser data. The form draft (klimafaktur-inquiry-draft-v2) stores only enquiry type and selected products for the browser session. Contact details, free text, attachments and acknowledgements are not saved in the draft. The draft is removed after successful submission.

This storage serves the functions you request (section 25(2)(2) TDDDG). Where personal data is involved, Article 6(1)(f) GDPR applies; our interest is providing those functions. The analytics choice is stored separately under klimafaktur-consent-v3 to respect your decision. It is valid for up to six months and is removed on the next visit after expiry. The site remains usable if storage is blocked, but preferences may not persist.

6. Optional analytics

Vercel Web Analytics loads only after you actively consent in the analytics preferences at the bottom of the page. The provider is Vercel Inc. (address under Hosting). It records page views, general browser, device and source information and predefined cart, enquiry and order events. Query parameters and URL fragments are removed before transmission. Names, email addresses, free search and enquiry text and attachments are not sent as analytics events.

After consent, a broad source category such as Google Search or ChatGPT is stored under klimafaktur-acquisition-v1 for the browser session and linked to enquiry and order events. After an order is confirmed, its reference is stored locally under kf-measured-order: for the browser session solely to prevent duplicate analytics events; it is not sent to Vercel Analytics. Vercel states that it uses no analytics cookies and discards its request-derived visitor identifier after 24 hours. The legal bases are Article 6(1)(a) GDPR and, where device information is accessed, section 25(1) TDDDG.

Consent is voluntary and not required for an enquiry. You can withdraw it at any time in the preferences at the bottom of the page. The source category is deleted and the page reloads to stop the loaded analytics script. Withdrawal does not affect the lawfulness of earlier processing.

7. Fonts, images and external links

Font files and images are served through our website. Visits do not connect to the Google Fonts service. Maps, videos and social media widgets are not embedded automatically. Manufacturer and other external links open those services only when selected; their privacy notices then apply.

8. Recipients and processing outside the EU

Access is provided to the persons handling enquiries and providers of hosting, email delivery and, where enabled, analytics. For subsequent contracts, necessary information may be shared with supply and transport partners or with authorities where required by law.

Vercel and Resend are US providers; data may be processed in the USA and by their subprocessors. Their published data processing terms provide in particular for EU Standard Contractual Clauses for relevant transfers. You may request information about the safeguards and a copy of applicable contractual provisions using the contact above.

9. Retention

Enquiry data is retained to handle the enquiry and necessary follow-up. Once the matter is closed, that purpose ends unless statutory retention duties or a specific need to establish or defend legal claims remain. Such data is retained only for those purposes. This also applies to attachments and mailbox correspondence.

Technical logs are deleted when no longer needed for operation or security; a security incident may require longer retention for investigation. Hosting and mail service deletion periods also depend on the applicable contract and account settings. Browser storage periods are stated above.

10. Your rights

Subject to the statutory requirements, you have rights of access (Article 15 GDPR), rectification (16), erasure (17), restriction (18) and portability (20). You may withdraw consent at any time for the future (Article 7(3)). Use the contact above to exercise these rights.

Right to object: You may object to processing under Article 6(1)(f) GDPR on grounds relating to your particular situation (Article 21 GDPR). You may object to direct marketing at any time without giving reasons.

Under Article 77 GDPR you can complain to a data protection authority, particularly where you live, work or where the suspected infringement occurred.