Privacy policy

1) Introduction and Contact Details of the Data Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when using our website. Personal data refers to any data that can be used to identify you personally.

1.2 The data controller responsible for processing personal data on this website in accordance with the General Data Protection Regulation (GDPR) is apra-norm Elektromechanik GmbH, Bei der untersten MĂĽhle 5, 54552 Mehren, Germany, Tel.: +49 6592 204-0, Email: vertrieb@apra-lean.de. The data controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 The data controller has appointed a data protection officer, who can be reached as follows:  
Dr. Alexander Birkhahn  
Dornbach GmbH Rechtsanwaltsgesellschaft  
Anton-Jordan-Straße 1  
56070 Koblenz  
Tel: +49 261 9431-222  
Fax: +49 261 9431-111  
Email: datenschutz@dornbach.de

2) Data Collection When Visiting Our Website

2.1 When you use our website purely for informational purposes, meaning that you do not register or provide us with any other information, we only collect data that your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

- The website visited
- Date and time of access
- Amount of data sent in bytes
- Source/reference from which you arrived at the page
- Browser used
- Operating system used
- IP address used (if applicable, in anonymized form)

The processing is carried out in accordance with Article 6(1)(f) of the GDPR based on our legitimate interest in improving the stability and functionality of our website. There is no transfer or other use of the data. However, we reserve the right to subsequently review the server log files if there are concrete indications of illegal use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the data controller). You can recognize an encrypted connection by the "https://" string and the lock symbol in your browser's address bar.
3) Hosting & Content Delivery Network

For hosting our website and displaying the content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). 

Data is also transmitted to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

All data collected on our website is processed on the servers of the provider. We have entered into a data processing agreement with the provider that ensures the protection of our visitors' data and prohibits unauthorized disclosure to third parties.

When data is transmitted to Canada, an adequate level of data protection is ensured by an adequacy decision from the European Commission.

4) Cookies

To make visiting our website more attractive and to enable the use of certain functions, we use cookies, which are small text files stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called "session cookies"), while others remain on your device longer and enable the storage of site settings (so-called "persistent cookies"). In the latter case, you can find the storage duration in the overview of your web browser's cookie settings.

If individual cookies we use also process personal data, the processing takes place in accordance with Art. 6 (1) (b) GDPR for the performance of the contract, in accordance with Art. 6 (1) (a) GDPR if consent has been given, or in accordance with Art. 6 (1) (f) GDPR to safeguard our legitimate interests in providing the best possible functionality of the website and a customer-friendly and effective design of the site visit.

You can set your browser to notify you when cookies are set and to decide individually whether to accept them or to exclude the acceptance of cookies for certain cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contacting Us

5.1 Shopify Inbox

This website uses the live chat system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

The processing of personal data transmitted via the chat is carried out either in accordance with Art. 6 (1) (b) GDPR because it is necessary for the initiation or performance of the contract, or in accordance with Art. 6 (1) (f) GDPR based on our legitimate interest in effectively assisting our site visitors. 

The data you provide will be deleted, subject to any conflicting statutory retention periods, once the relevant matter has been conclusively clarified.

Additionally, for the purpose of creating pseudonymized usage profiles, further information may be collected and evaluated using cookies, which do not serve your personal identification and are not combined with other datasets. If this information has a personal reference, processing occurs in accordance with Art. 6 (1) (f) GDPR based on our legitimate interest in statistically analyzing user behavior for optimization purposes.

The setting of cookies can be prevented by appropriate browser settings. However, the functionality of our website may be restricted in this case. 

You can object to the collection and storage of data for the purpose of creating a pseudonymized usage profile at any time with effect for the future.

Data is also transmitted to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

We have entered into a data processing agreement with the provider that ensures the protection of our visitors' data and prohibits unauthorized disclosure to third parties.

When data is transmitted to Canada, an adequate level of data protection is ensured by an adequacy decision from the European Commission.

**5.2 Contacting Us**

When you contact us (e.g., via contact form or email), personal data will be processed solely for the purpose of processing and responding to your inquiry and only to the extent necessary.

The legal basis for processing this data is our legitimate interest in responding to your inquiry in accordance with Art. 6 (1) (f) GDPR. If your inquiry aims at a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR. Your data will be deleted once it can be inferred from the circumstances that the relevant matter has been conclusively clarified, and provided that there are no statutory retention obligations to the contrary.

**6) Data Processing When Opening a Customer Account**

In accordance with Art. 6 (1) (b) GDPR, personal data will continue to be collected and processed to the extent necessary when you provide this data to us when opening a customer account. The data required for account creation can be found in the input mask of the relevant form on our website.

You can delete your customer account at any time by sending a message to the above-mentioned address of the data controller. After deleting your customer account, your data will be deleted, provided that all contracts concluded through it have been fully settled, no statutory retention periods are contrary, and we have no legitimate interest in continuing to store the data.

7) Use of Customer Data for Direct Marketing

7.1 Subscription to Our Email Newsletter

When you subscribe to our email newsletter, we will regularly send you information about our offers. The only required information for sending the newsletter is your email address. Providing additional data is voluntary and will be used to address you personally. For the newsletter distribution, we use the so-called double opt-in procedure, which ensures that you only receive the newsletter after you have explicitly confirmed your consent to receive the newsletter by clicking on a verification link sent to your provided email address.

By activating the confirmation link, you grant us your consent to use your personal data in accordance with Art. 6 (1) (a) GDPR. We also store the IP address registered by your Internet Service Provider (ISP) as well as the date and time of registration to be able to trace any misuse of your email address at a later date. The data collected during the newsletter registration will be used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the data controller mentioned above. After unsubscribing, your email address will be immediately deleted from our newsletter distribution list unless you have explicitly consented to further use of your data or we reserve the right to further data use that is legally permissible and of which we inform you in this statement.

7.2 Sending the Email Newsletter to Existing Customers

If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services from our range via email. For this, we do not need to obtain separate consent from you in accordance with § 7 (3) of the German Act Against Unfair Competition (UWG). The data processing in this regard is based solely on our legitimate interest in personalized direct marketing in accordance with Art. 6 (1) (f) GDPR. If you initially objected to the use of your email address for this purpose, we will not send any marketing emails.

You have the right to object to the use of your email address for the aforementioned advertising purpose at any time with effect for the future by notifying the data controller mentioned at the beginning. You will only incur transmission costs according to the basic tariffs. Upon receipt of your objection, we will immediately cease using your email address for advertising purposes.

7.3 Shopify Email

The dispatch of our email newsletters is carried out by this provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Data is also transmitted to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

Based on our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provided during the newsletter registration to this provider in accordance with Art. 6 (1) (f) GDPR so that they can manage the newsletter dispatch on our behalf.

Subject to your explicit consent in accordance with Art. 6 (1) (a) GDPR, the provider also conducts statistical success evaluations of newsletter campaigns using web beacons or tracking pixels in the sent emails, which can measure open rates and specific interactions with the newsletter content. This also includes collecting and evaluating device information (e.g., time of access, IP address, browser type, and operating system), but this data is not combined with other datasets.

You can revoke your consent to newsletter tracking at any time with effect for the future.

We have entered into a data processing agreement with the provider that protects our visitors' data and prohibits disclosure to third parties.

When data is transmitted to Canada, an adequate level of data protection is ensured by an adequacy decision from the European Commission.

8) Data Processing for Order Fulfillment

8.1 Transmission of Image Files for Order Fulfillment via Upload Function

On our website, we offer customers the option to personalize products by transmitting image files through an upload function. The submitted image serves as a template for personalizing the chosen product.
Through the upload form on the website, customers can immediately transmit one or more image files from the storage of the device being used via automated, encrypted data transfer. We collect, store, and use the transmitted files exclusively for the production of the personalized product in accordance with the relevant service description on our website. If the transmitted image files are shared with specific service providers for the production and fulfillment of the order, you will be explicitly informed about this in the following paragraphs. No further transmission occurs. If the transmitted files or digital motifs contain personal data (especially images of identifiable individuals), all previously mentioned processing operations are carried out solely for the purpose of processing your online order in accordance with Art. 6 (1) lit. b GDPR.
After the order has been completely processed, the transmitted image files are automatically and permanently deleted.

8.2 To the extent necessary for the fulfillment of the contract for delivery and payment purposes, the personal data we collect will be shared in accordance with Art. 6 (1) lit. b GDPR with the commissioned transportation company and the commissioned financial institution.

If we owe you updates for goods with digital elements or digital products based on a corresponding contract, we will process the contact details you provided during the order (name, address, email address) to personally inform you about upcoming updates within the legally prescribed period in accordance with our legal obligations under Art. 6 (1) lit. c GDPR via an appropriate communication method (e.g., by post or email). Your contact details will be strictly purpose-bound for notifications about updates owed by us and will only be processed for this purpose to the extent necessary for the respective notification.
To process your order, we also work with the following service provider(s) who assist us in the execution of concluded contracts. Certain personal data will be transmitted to these service providers as specified in the following information.

8.3 Transmission of Personal Data to Shipping Service Providers

  • DPD
As a transportation service provider, we use the following provider: DPD Deutschland GmbH, WailandtstraĂźe 1, 63741 Aschaffenburg, Germany.
We transmit your email address and/or phone number in accordance with Art. 6 (1) lit. a GDPR to the provider prior to the delivery of the goods for the purpose of coordinating a delivery date or notifying about delivery, provided you have given your explicit consent in the ordering process. Otherwise, we only provide the recipient's name and delivery address to the provider for the purpose of delivery in accordance with Art. 6 (1) lit. b GDPR. The transmission only occurs to the extent necessary for the delivery of the goods. In this case, prior coordination of the delivery date with the provider or notification of delivery is not possible.
The consent can be revoked at any time with future effect against the aforementioned responsible party or against the provider.

8.4 Credit Check

If we advance (e.g., delivery on account), we reserve the right to conduct a credit check based on mathematical-statistical procedures to safeguard our legitimate interest in establishing the creditworthiness of our customers. The personal data necessary for a credit check will be transmitted in accordance with Art. 6 (1) lit. f GDPR to the following service provider:
Creditreform Trier, Ostallee 3-5, 54290 Trier, Germany.
The credit report may contain probability values (so-called score values). If score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, among other things, address data. The result of the credit check regarding the statistical probability of payment default is used for the purpose of deciding on the establishment, execution, or termination of a contractual relationship. You can object to the processing of your data at any time by sending a message to the responsible party for data processing or to the aforementioned credit agency. However, we may still be entitled to process your personal data to the extent necessary for contractual payment processing.

9) Web Analysis Services

9.1 Google (Universal) Analytics

This website uses Google (Universal) Analytics, a web analysis service from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which allows an analysis of your use of our website.
By default, when visiting the website, Google (Universal) Analytics sets cookies, which are small text blocks stored on your device and collect certain information. This information includes your IP address, which is shortened by Google by the last digits to exclude direct personal reference.
The information is transmitted to Google's servers and further processed there. Transfers to Google LLC based in the USA are also possible.
Google uses the collected information on our behalf to evaluate your use of the website, compile reports on website activities for us, and provide other services related to website and internet usage. The shortened IP address transmitted by your browser within the scope of Google Analytics will not be merged with other data from Google. The data collected in the context of the use of Google (Universal) Analytics is stored for a duration of two months and then deleted.
All processing described above, especially the setting of cookies on the device used, only occurs if you have given us your explicit consent in accordance with Art. 6 (1) lit. a GDPR. Without your consent, the use of Google (Universal) Analytics during your visit to the site is omitted. You can revoke your consent at any time with future effect. To exercise your right of revocation, please deactivate this service via the "Cookie Consent Tool" provided on the website.
We have concluded a data processing agreement with Google, ensuring the protection of our website visitors' data and prohibiting unauthorized disclosure to third parties.
Further legal information on Google (Universal) Analytics can be found at https://business.safety.google/intl/de/privacy/, https://policies.google.com/privacy?hl=de&gl=de, and https://policies.google.com/technologies/partner-sites.
Demographic Features
Google (Universal) Analytics uses the special "demographic features" function and can create statistics that make statements about the age, gender, and interests of website visitors. This is done by analyzing advertising and information from third parties. This allows for the identification of target groups for marketing activities. However, the collected data cannot be attributed to a specific person and will be deleted after being stored for a duration of two months.
Google Signals
As an extension to Google (Universal) Analytics, Google Signals may be used on this website to create cross-device reports. If you have enabled personalized advertising and linked your devices with your Google account, Google may analyze your usage behavior across devices, subject to your consent to use Google Analytics in accordance with Art. 6 (1) lit. a GDPR, and create database models, including for cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop cross-device analysis, you can disable the "Personalized Advertising" feature in your Google account settings. Follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=de. For more information on Google Signals, please refer to the following link: https://support.google.com/analytics/answer/7532985?hl=de.
User IDs
As an extension to Google (Universal) Analytics, the "User IDs" function may be used on this website. If you have consented to the use of Google (Universal) Analytics in accordance with Art. 6 (1) lit. a GDPR, set up an account on this website, and log in with this account on different devices, your activities, including conversions, can be analyzed across devices.
For data transmissions to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision by the European Commission.

9.2 Google Tag Manager

This website uses the "Google Tag Manager," a service from the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google").
The Google Tag Manager provides a technical foundation for consolidating various web applications, including tracking and analysis services, and allows them to be calibrated, controlled, and conditioned through a unified user interface. The Google Tag Manager itself does not store information on user devices or read it. The service does not conduct independent data analyses. However, when the Google Tag Manager is called, your IP address is transmitted to Google and may be stored there. A transfer to servers of Google LLC in the USA is also possible.
This processing only occurs if you have given us your explicit consent in accordance with Art. 6 (1) lit. a GDPR. Without this consent, the use of Google Tag Manager during your visit to the site is omitted. You can revoke your consent at any time with future effect. To exercise your right of revocation, please deactivate this service in the "Cookie Consent Tool" provided on the website.
We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
For data transmissions to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision by the European Commission.
Further legal information on Google Tag Manager can be found at https://business.safety.google/intl/de/privacy/ and https://policies.google.com/privacy?hl=de&gl=de.
9.3 Leadfeeder
This website uses the Leadfeeder service provided by Liidio Oy, Mikonkatu 17 C, Helsinki 00100, Finland in conjunction with Google Analytics to track page visits from companies and their respective usage behavior.
Leadfeeder accesses the list of anonymized IP addresses provided by Google Analytics in the evaluation and automatically matches these with information about companies that can be found in public sources under those IP addresses. This allows Leadfeeder to associate page visits with specific businesses and enrich the list of IP addresses with information about companies found online under those IP addresses. To track user behavior on our website after this association, Leadfeeder uses the cookie "_lfa," which is a small text file stored on the visitor's device that provides a breakdown of which page contents were accessed and how long the visit lasted. The cookie has a validity period of 2 years.
All of the aforementioned processing, especially the setting of the cookie to read information on the device used, will only occur if you have given us your explicit consent in accordance with Art. 6 Para. 1 lit. a GDPR. You can revoke your consent at any time with future effect by disabling this service in the "Cookie Consent Tool" provided on the website.
We have entered into a data processing agreement with Leadfeeder, which obligates Leadfeeder to protect our website visitors' data and not to disclose it to unauthorized third parties.
Companies can manage the data aggregated and used for matching by Leadfeeder from public sources here: https://yourdata.leadfeeder.com/.
10) Page Functionalities
10.1 Google Web Fonts
This page uses web fonts from the following provider for the uniform display of fonts: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
When a page is accessed, your browser loads the required web fonts into its browser cache to correctly display texts and fonts and establishes a direct connection to the provider's servers. In this process, certain browser information, including your IP address, is transmitted to the provider.
Data may also be transmitted to: Google LLC, USA.
The processing of personal data during the connection with the font provider only occurs if you have given us your explicit consent in accordance with Art. 6 Para. 1 lit. a GDPR. You can revoke your consent at any time with future effect by disabling this service in the "Cookie Consent Tool" provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision of the European Commission.
Further information on Google’s privacy policy can be found here: https://business.safety.google/intl/de/privacy/.
10.2 Google reCAPTCHA
On this website, we use the CAPTCHA service from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
Data may also be transmitted to: Google LLC, USA. For the visual design of the captcha window, "Google Fonts," i.e., fonts loaded from the internet by Google, are used. No processing of further information beyond what has already been transmitted to Google via the functionality of reCAPTCHA occurs.
The service checks whether an input is made by a natural person or abusively through machine and automated processing, and blocks spam, DDoS attacks, and similar automated malicious access. To ensure that an action is performed by a human and not by an automated bot, the provider collects the IP address of the used device, recognition data of the browser and operating system type used, as well as the date and duration of the visit, and transmits this for evaluation to the provider’s servers.
The legal basis is our legitimate interest in determining individual accountability on the internet and avoiding abuse and spam in accordance with Art. 6 Para. 1 lit. f GDPR.
We have entered into a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision of the European Commission.
Further information on Google’s privacy policies can be found here: https://business.safety.google/intl/de/privacy/
  1. Tools and Miscellaneous
Cookie Consent Tool
This website uses a so-called “Cookie Consent Tool” to obtain valid user consent for cookies that require consent and cookie-based applications. The “Cookie Consent Tool” is displayed to users upon page access in the form of an interactive user interface, where consents for specific cookies and/or cookie-based applications can be granted by checking boxes. With the use of the tool, all cookies/services requiring consent will only be loaded if the respective user has given the corresponding consent by checking the boxes. This ensures that such cookies are only set on the user's device if consent has been granted.
The tool sets technically necessary cookies to store your cookie preferences. Personal user data is generally not processed in this context.
In individual cases, if processing of personal data (such as IP address) occurs for the purpose of storing, assigning, or logging cookie settings, this is done in accordance with Article 6(1)(f) GDPR based on our legitimate interest in a legally compliant, user-specific, and user-friendly consent management for cookies and thus in a legally compliant design of our website.
Another legal basis for processing is Article 6(1)(c) GDPR. As data controllers, we are legally obligated to make the use of technically unnecessary cookies dependent on the respective user consent.
If necessary, we have entered into a data processing agreement with the provider, ensuring the protection of our website visitors' data and prohibiting unauthorized disclosure to third parties.
Further information about the provider and the settings options of the Cookie Consent Tool can be found directly in the corresponding user interface on our website.
  1. Rights of the Data Subject
12.1 The applicable data protection law grants you the following rights regarding the processing of your personal data by the data controller (rights of access and intervention), referring to the respective exercise requirements in the mentioned legal basis:
  • Right of access according to Article 15 GDPR;
  • Right to rectification according to Article 16 GDPR;
  • Right to erasure according to Article 17 GDPR;
  • Right to restriction of processing according to Article 18 GDPR;
  • Right to notification according to Article 19 GDPR;
  • Right to data portability according to Article 20 GDPR;
  • Right to withdraw consent given according to Article 7(3) GDPR;
  • Right to lodge a complaint according to Article 77 GDPR.
12.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE RELEVANT DATA. HOWEVER, FURTHER PROCESSING IS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR IF THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE RIGHT TO OBJECT AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE RELEVANT DATA FOR DIRECT MARKETING PURPOSES.
  1. Duration of Storage of Personal Data
The duration of storage of personal data is determined based on the respective legal basis, the purpose of processing, and – if applicable – additionally based on the respective statutory retention period (e.g., commercial and tax retention periods).
When processing personal data based on explicit consent in accordance with Article 6(1)(a) GDPR, the data will be stored until you withdraw your consent.
If statutory retention periods exist for data processed under contractual or similar obligations based on Article 6(1)(b) GDPR, these data will be routinely deleted after the retention periods have expired, provided they are no longer necessary for the fulfillment of the contract or for the initiation of a contract and/or we no longer have a legitimate interest in further storage.
When processing personal data based on Article 6(1)(f) GDPR, these data will be stored until you exercise your right to object under Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.
When processing personal data for direct marketing purposes based on Article 6(1)(f) GDPR, these data will be stored until you exercise your right to object under Article 21(2) GDPR.
Unless otherwise stated in the other information of this declaration regarding specific processing situations, stored personal data will be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.