Privacy policy
1. Introduction and Contact Details of the Controller
1.1 We are pleased that you are visiting our website and appreciate your interest. In the following, we will inform you about how we handle your personal data when you use our website. Personal data includes all data that can personally identify you.
1.2 The data controller for the processing of data on this website, in accordance with the General Data Protection Regulation (GDPR), is Alfaforge GmbH, Robert-Koch-Str. 10, 42549 Velbert, Germany, Email: contact_us [at] alfaforge.com. The data controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.
2.Data Collection when Visiting our Website
2.1 When you visit our website for informational purposes, meaning you do not register or otherwise provide us with information, we only collect data that your browser transmits to the server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website:
The processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR based on our legitimate interest in improving the stability and functionality of our website. There is no further disclosure or other use of the data. However, we reserve the right to retrospectively check the server log files if there are specific indications of unlawful use.
2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the "https://" and the padlock symbol in your browser's address bar.
3. Hosting & Content Delivery Network
Shopify
For hosting our website and displaying page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify").
Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.
All data collected on our website is processed on the provider's servers. We have entered into a data processing agreement with the provider, ensuring the protection of data for our website visitors and prohibiting unauthorized disclosure to third parties.
When transferring data to Canada, an adequate level of data protection is ensured through a European Commission adequacy decision.
4. Cookies
To make your visit to our website attractive and enable the use of certain functions, we use cookies, small text files that are stored on your device. Some of these cookies are automatically deleted after closing your browser (so-called "session cookies"), while others remain on your device for a longer period, allowing the storage of page settings (so-called "persistent cookies"). In the latter case, you can find the storage duration in the cookie settings overview of your web browser.
If individual cookies used by us also process personal data, the processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR either to perform the contract, in accordance with Art. 6 para. 1 lit. a GDPR in case of given consent, or in accordance with Art. 6 para. 1 lit. f GDPR to safeguard our legitimate interests in the best possible functionality of the website and a user-friendly and effective design of the page visit.
You can configure your browser to be informed about the setting of cookies and decide on acceptance individually, or exclude the acceptance of cookies for specific cases or in general.
Please note that if you do not accept cookies, the functionality of our website may be restricted.
5. Contact
When contacting us (e.g., via contact form or email), personal data is processed solely for the purpose of processing and responding to your request, and only to the extent necessary.
The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6 para. 1 lit. f GDPR. If your contact aims at concluding a contract, an additional legal basis for processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted when it can be inferred from the circumstances that the relevant matter has been conclusively clarified, and provided there are no legal retention obligations.
6. Comment Function
As part of the comment function on this website, in addition to your comment, information about the time of the comment's creation and the commentator name you choose will be stored and published on this website. Furthermore, your IP address is logged and stored. This storage of the IP address is done for security reasons and in case the person making the comment violates the rights of third parties or posts unlawful content. We require your email address to contact you in case a third party objects to your published content as unlawful.
Legal bases for the storage of your data are Art. 6 para. 1 lit. b and f GDPR. We reserve the right to delete comments if they are objected to as unlawful by third parties.
7. Data Processing when Opening a Customer Account
In accordance with Art. 6 para. 1 lit. b GDPR, personal data is collected and processed to the extent necessary when you provide it to us when opening a customer account. The data required for opening an account can be found in the input mask of the corresponding form on our website.
Deletion of your customer account is possible at any time and can be done by sending a message to the above address of the controller. After deletion of your customer account, your data will be erased provided all contracts concluded through it are fully settled, no legal retention periods oppose it, and there is no legitimate interest on our part to continue storing the data.
8. Use of Customer Data for Direct Marketing
Subscription to our Email Newsletter
When you subscribe to our email newsletter, we regularly send you information about our offers. The mandatory information for sending the newsletter is solely your email address. Providing additional data is voluntary and is used to address you personally. For newsletter dispatch, we use the so-called Double Opt-in procedure, ensuring that you only receive newsletters after confirming your consent to receive the newsletter by activating a verification link sent to the provided email address.
By activating the confirmation link, you grant us your consent to use your personal data in accordance with Art. 6 para. 1 lit. a GDPR. We store your IP address, as well as the date and time of registration, as entered by the Internet Service Provider (ISP), to be able to trace potential misuse of your email address at a later date. The data collected during newsletter registration is used strictly for the intended purpose.
You can unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending a corresponding message to the responsible party mentioned at the beginning. After unsubscribing, your email address will be promptly deleted from our newsletter distribution list unless you have explicitly consented to further use of your data, or unless we reserve the right to further use that is legally permitted and about which we inform you in this statement.
9. Data Processing for Order Fulfillment
9.1 To fulfill contracts for delivery and payment purposes, personal data collected by us will be shared with the appointed transportation company and the designated financial institution in accordance with Art. 6 para. 1 lit. b GDPR.
If, based on a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact details you provided during the order (name, address, email) to inform you personally about upcoming updates within the legally specified period, as part of our legal obligations under Art. 6 para. 1 lit. c GDPR, through suitable communication channels (e.g., postal or email). Your contact details will be strictly used for notifications about updates owed by us and processed by us only to the extent necessary for the respective information.
In the processing of your order, we also collaborate with the following service provider(s) who support us in whole or in part in executing closed contracts. Certain personal data will be transmitted to these service providers in accordance with the following information.
9.2 To fulfill our contractual obligations to our customers, we collaborate with external shipping partners. We share your name, delivery address, and, if necessary for delivery, your phone number, exclusively for the purpose of product delivery, in accordance with Art. 6 para. 1 lit. b GDPR, with a shipping partner selected by us.
9.3 Use of Payment Service Providers
Shopify Payments
One or more online payment methods from the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. When choosing a payment method from the provider that involves prepayment (e.g., credit card payment), your payment data provided during the ordering process (including name, address, banking and card information, currency, and transaction number) will be shared with them in accordance with Art. 6 para. 1 lit. b GDPR. The disclosure of your data in this case is solely for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.
10. Web Analytics Services
Google Analytics 4
This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables an analysis of your use of our website. By default, when visiting the website, Google Analytics 4 sets cookies that are small text files placed on your device, collecting certain information. This includes your IP address, which is, however, truncated by Google to exclude direct personal identification. The information is transmitted to Google servers and processed there. Transmissions to Google LLC in the United States are also possible. Google uses the collected information on our behalf to evaluate your website usage, compile reports on website activities for us, and provide other services related to website and internet usage. The IP address transmitted and truncated by your browser during the use of Google Analytics is not merged with other Google data. The data collected during the use of Google Analytics 4 is stored for a period of two months and then deleted. All the processing described above, especially the setting of cookies on the device used, only occurs if you have given us your explicit consent in accordance with Art. 6 para. 1 lit. a GDPR. Without your consent, the use of Google Analytics 4 will not take place during your visit to the site. You can revoke your consent at any time with effect for the future. To exercise your right of withdrawal, please disable this service through the "Cookie Consent Tool" provided on the website. We have entered into a data processing agreement with Google, ensuring the protection of our site visitors' data and prohibiting unauthorized disclosure to third parties. For further legal information about Google Analytics 4, please visit https://policies.google.com/privacy?hl=en&gl=en and https://policies.google.com/technologies/partner-sites
11. Site Functionalities
11.1 Facebook Plugins
On our website, plugins from the social network provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are used. These plugins enable direct interactions with content on the social network.
To enhance data protection during your visit, the plugins are initially deactivated through a "2-click" or "Shariff" solution integrated into the page. This integration ensures that when you visit a page containing such plugins on our website, no connection is established with the provider's servers.
Only when you activate the plugins and thereby, according to Art. 6 para. 1 lit. a GDPR, give your consent for data transmission, your browser establishes a direct connection to the provider's servers. In this case, irrespective of logging into an existing user profile, certain information about your device (including your IP address), your browser, and your page history is transmitted to the provider and may be processed there.
If you are logged into an existing user profile on the provider's social network, information about interactions performed via the plugins will also be published there and shown to your contacts.
You can revoke your consent at any time by deactivating the activated plugin through a renewed click. However, the revocation does not affect data that has already been transmitted to the provider.
Data may also be transferred to: Meta Platforms Inc., USA.
We have concluded a data processing agreement with the provider, ensuring the protection of data for our website visitors and prohibiting unauthorized disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on a European Commission adequacy decision, ensures compliance with the European level of data protection.
11.2 Instagram Plugins
On our website, plugins from the social network provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are used. These plugins enable direct interactions with content on the social network.
To enhance data protection during your visit, the plugins are initially deactivated through a "2-click" or "Shariff" solution integrated into the page. This integration ensures that when you visit a page containing such plugins on our website, no connection is established with the provider's servers.
Only when you activate the plugins and thereby, according to Art. 6 para. 1 lit. a GDPR, give your consent for data transmission, your browser establishes a direct connection to the provider's servers. In this case, irrespective of logging into an existing user profile, certain information about your device (including your IP address), your browser, and your page history is transmitted to the provider and may be processed there.
If you are logged into an existing user profile on the provider's social network, information about interactions performed via the plugins will also be published there and shown to your contacts.
You can revoke your consent at any time by deactivating the activated plugin through a renewed click. However, the revocation does not affect data that has already been transmitted to the provider.
Data may also be transferred to: Meta Platforms Inc., USA.
We have concluded a data processing agreement with the provider, ensuring the protection of data for our website visitors and prohibiting unauthorized disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on a European Commission adequacy decision, ensures compliance with the European level of data protection.
12. Tools and Miscellaneous
12.1 - DATEV
For handling our accounting, we utilize the services of the cloud-based accounting software provided by the following provider: DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany. The provider processes inbound and outbound invoices, and possibly also our company's bank transactions, to automatically capture invoices, match them to transactions, and, through a partially automated process, create financial accounting records.
If personal data is processed in this context, the processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in efficiently organizing and documenting our business transactions.
12.2 - Cookie Consent Tool
This website employs a "Cookie Consent Tool" to obtain effective user consents for consent-required cookies and cookie-based applications. The "Cookie Consent Tool" is presented to users as an interactive user interface upon accessing the site, allowing them to grant consent for specific cookies and/or cookie-based applications by checking boxes. Through the use of the tool, all cookies/services requiring consent are only loaded when the user grants corresponding consent by checking the boxes. This ensures that such cookies are only set on the user's device in the case of granted consent.
The tool sets technically necessary cookies to store your cookie preferences. Personal user data is generally not processed in this context.
If, in individual cases, the processing of personal data (such as IP address) occurs for the purpose of storing, assigning, or logging cookie settings, it is carried out in accordance with Art. 6 para. 1 lit. f GDPR, based on our legitimate interest in a legally compliant, user-specific, and user-friendly consent management for cookies, and thus, in a legally compliant design of our website.
Another legal basis for the processing is Art. 6 para. 1 lit. c GDPR. As controllers, we are legally obligated to make the use of technically unnecessary cookies dependent on the respective user's consent.
If necessary, we have entered into a data processing agreement with the provider, ensuring the protection of data for our website visitors and prohibiting unauthorized disclosure to third parties.
Further information about the operator and the settings of the Cookie Consent Tool can be found directly in the corresponding user interface on our website.
13. Rights of the Data Subject
13.1 The applicable data protection law grants you the following rights concerning the processing of your personal data by the controller (information and intervention rights), with reference to the specified legal basis for the respective exercise conditions:
13.2 Right to Object
IF, IN THE CONTEXT OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA BASED ON OUR PREDOMINANT LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE CONCERNED DATA. HOWEVER, FURTHER PROCESSING IS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE CONCERNED DATA FOR DIRECT MARKETING PURPOSES.
14. Duration of Personal Data Storage
The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing, and, if applicable, additionally based on the respective statutory retention periods (e.g., commercial and tax retention periods).
When processing personal data based on explicit consent according to Art. 6 para. 1 lit. a GDPR, the relevant data is stored until you revoke your consent.
If there are legal retention periods for data processed in the context of contractual or contract-like obligations based on Art. 6 para. 1 lit. b GDPR, these data will be routinely deleted after the expiration of the retention periods, provided they are no longer necessary for contract fulfillment or initiation, and/or there is no legitimate interest on our part in continued storage.
For processing personal data based on Art. 6 para. 1 lit. f GDPR, these data will be stored until you exercise your right to object according to Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
For processing personal data for the purpose of direct marketing based on Art. 6 para. 1 lit. f GDPR, these data will be stored until you exercise your right to object according to Art. 21 para. 2 GDPR.
Unless otherwise indicated in the specific processing situations in the rest of this statement, stored personal data will be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.
