Privacy Policy

1. General Scope of Data Processing

Data protection is of high importance in our society. We comply with the General Data Protection Regulation (GDPR), which regulates the processing of personal data uniformly for the entire European Union, as well as other national data protection laws of the member states and other applicable data protection provisions. We collect, process, and use personal data only to the extent necessary to provide a functional website and to display our services and offerings. You as a user can generally visit our websites without providing any personal information. Personal data is collected and used only to the extent necessary to provide a functional website and our content and services. The collection and use of your personal data generally take place only with your consent. An exception applies in cases where obtaining prior consent is not possible for practical reasons or where the collection and processing of the data are permitted by legal provisions. For security reasons, we use an SSL certificate on our website to ensure secure connections by encrypting all incoming and outgoing data traffic. You can recognize the encryption by the lock symbol in your browser bar and by the display of “https://”.

2. Name and Address of the Controller Responsible for Data Processing

The controller within the meaning of the GDPR is:
Stefan Apfel
APFEL GmbH
Gerhart-Hauptmann-Str. 56
69221 Dossenheim
Tel. 06221/8761-0
b.apfel@apfel-gmbh.de
www.apfel-gmbh.de
Name and address of the Data Protection Officer
The data protection officer of the controller is:
FALK IT Audit & Consulting GmbH
Dr. Jonas Tritschler
Im Breitspiel 21
69126 Heidelberg
Tel. 06221/399-3070
datenschutz@falk-itaudit.com

3. Definitions

The terms used in this privacy policy correspond to those used in Article 4 of the GDPR. For the purposes of this Regulation, the following definitions apply:
“Personal data” – any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
“Data subject” – any identified or identifiable natural person whose personal data is processed by the controller.
“Processing” – any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
“Restriction of processing” – the marking of stored personal data with the aim of limiting their future processing.
“Profiling” – any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
“Controller” – the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
“Recipient” – a natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.
“Third party” – a natural or legal person, public authority, agency, or body other than the data subject, the controller, the processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data.
“Consent” – any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

4. General Legal Basis for the Processing of Personal Data

Where we obtain the consent of the data subject for processing personal data, Article 6(1)(a) of the GDPR serves as the legal basis for processing. When the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations required to take steps prior to entering into a contract. Where the processing of personal data is necessary for compliance with a legal obligation to which we are subject, Article 6(1)(c) of the GDPR serves as the legal basis. In cases where the processing of personal data is necessary to protect the vital interests of the data subject or another natural person, Article 6(1)(d) of the GDPR serves as the legal basis. If processing is necessary for the purposes of the legitimate interests pursued by us or by a third party and these interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Article 6(1)(f) of the GDPR serves as the legal basis for processing.

5. Data Deletion and Storage Duration

Your personal data stored by us will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also occur if this is required by European or national legislation in EU regulations, laws, or other provisions to which we are subject, for example due to tax or commercial retention and documentation obligations. Data will also be blocked or deleted if a legally prescribed retention period expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

6. Collection of Technical Access Data, Server Log Files

Each time our website is accessed, our web server automatically collects data and information from the computer system of the accessing computer. The following data are collected: • Browser name and version used • Operating system used • IP address • Date and time of access • Amount of data transmitted • Website from which you accessed our site (referrer URL) • Name and URL of the files accessed via our website • Time zone difference • HTTP status code/access status
The data are temporarily stored in the log files of our web server. These data are not stored together with your other personal data. The data cannot be attributed to specific individuals. We use these technical log data solely for statistical purposes and to optimize our website and its security. The legal basis for temporary storage of the data and log files is Article 6(1)(f) GDPR.
Temporary storage of the IP address by our web server is necessary to deliver the requested web pages to your computer. For this purpose, the IP address of the accessing computer must remain stored for the duration of the session. Log file storage serves to ensure the functionality of the website. In addition, the data help us to optimize the website and ensure the security of our IT systems. Data analysis for marketing purposes does not occur in this context. These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) GDPR.
The stored data are deleted as soon as they are no longer necessary to achieve the purpose for which they were collected. The collection of data for website provision and their storage in log files is essential for website operation. Therefore, there is no possibility for you to object to or request deletion.

7. Use of Cookies

We use “cookies” on our website. Cookies are text files stored in or by the internet browser on the user’s computer system. When a user visits a website, a cookie may be stored on the user’s operating system. This cookie contains a distinctive string that enables unique identification of the browser when the website is revisited. The purpose of using cookies is to make websites easier to use for you. Some functions of our website cannot be offered without cookies. For these, it is necessary that the browser be recognized even after a page change, e.g., login information, contents of the shopping cart, language settings, or remembered search terms. The data collected by technically necessary cookies are not used to create user profiles. The data processed by cookies are necessary for the purposes mentioned to safeguard our legitimate interest in user-friendly website design pursuant to Article 6(1)(f) GDPR or are processed under Article 6(1)(b) GDPR for contract execution. We work with advertising partners who help make our website more interesting for you. For this purpose, cookies from partner companies (third-party cookies) are also stored on your hard drive when you visit our site. You will be individually informed below about the use of such cookies and the extent of the information collected. Cookies are stored on your computer and transmitted from it to our website. Therefore, you have full control over the use of cookies. By adjusting your internet browser settings, you can disable or restrict the transmission of cookies. Cookies already stored can be deleted at any time. Depending on your browser, this can also be done automatically. Browser-specific configuration options can be found on the website of your respective browser provider. Please note that disabling cookies may limit the functionality of our website.

Overview of Cookies Used

8. Newsletter

If our website provides the option to subscribe to a free newsletter, the following applies: when you register for the newsletter, the data entered in the input form are transmitted to us. The data requested include your email address. Providing your first and last name is voluntary and enables us to address you personally in the newsletter. During the registration process, your consent is obtained, and reference is made to this privacy policy.
We use the so-called double opt-in procedure for newsletter distribution. This means that we will not send you an email newsletter unless you have expressly confirmed that you consent to receiving it. You will then receive a confirmation email from us asking you to confirm, by clicking a link, that you wish to receive our newsletter in the future. By clicking the confirmation link, you give us your consent to use your personal data pursuant to Article 6 (1)(a) GDPR.
In addition, when registering we collect the IP address of the accessing computer as well as the date and time of registration. This serves to prevent misuse of the services or the used email address and to trace possible complaints. These purposes also constitute our legitimate interest in data processing pursuant to Article 6 (1)(f) GDPR.
If you purchase goods or services on our website and provide your email address in the process, we may subsequently use it to send you a newsletter. In such a case, the newsletter will only contain direct advertising for our own similar goods or services. No data will be transferred to third parties in connection with the newsletter. The data are used exclusively for sending the newsletter. The legal basis for processing your data after newsletter registration, if consent has been obtained, is Article 6 (1)(a) GDPR.
Your data will be deleted as soon as they are no longer required for the purpose for which they were collected. Your email address will therefore be stored only as long as your newsletter subscription is active, unless you have expressly consented to further use of your data. You may unsubscribe from the newsletter at any time. A corresponding link is provided in every newsletter. This also allows you to withdraw your consent to the storage of the personal data collected during the registration process.

Rapidmail
We use Rapidmail by rapidmail GmbH, Augustinerplatz 2, 79098 Freiburg i.Br., Germany, to send our newsletters.
The legal basis for data processing is Article 6 (1)(a) GDPR (consent). You may withdraw your consent at any time by unsubscribing from the newsletter. This also applies if you do not wish to be analyzed by Rapidmail. For withdrawal, we provide a corresponding link or email address at the end of each newsletter. You can also unsubscribe directly via the website.
For analytical purposes, our emails sent via Rapidmail contain a so-called “tracking pixel” that connects to Rapidmail servers when the email is opened. In this way, we can determine whether the newsletter message has been opened. Rapidmail also enables us to see if and which links in the newsletter were clicked. All links in the email are tracking links that can record your clicks. Further information on Rapidmail’s analytics functions can be found at: https://de.rapidmail.wiki/kategorien/statistiken/.
The data you provided for newsletter receipt will be stored by us until you unsubscribe and will be deleted both from our servers and those of Rapidmail after cancellation. Data stored for other purposes (e.g., email addresses for member access) remain unaffected. Rapidmail’s privacy policy is available at: www.rapidmail.de/datenschutz.
We have concluded a specific data-processing agreement with Rapidmail obliging it to protect our customers’ data and not disclose them to third parties. The contract can be viewed at: https://de.rapidmail.wiki/files/adv/muster-auftragsdatenverarbeitung.pdf.

9. Contact Form and Email Contact

If our website provides a contact form for electronic communication, the following applies: when you use this form, the data entered in the input mask are transmitted to and stored by us. The specific data collected can be seen in the respective contact form. At the time the message is sent, the IP address of the accessing computer and the date and time of submission are also stored to prevent misuse of the contact form and to ensure the security of our IT systems. These purposes also constitute our legitimate interest in data processing pursuant to Article 6 (1)(f) GDPR.
We obtain your consent to data processing before submission and refer to this privacy policy. Alternatively, you may contact us via email. In this case, only the personal data you transmit with your email will be stored to process your inquiry. Your data will not be shared with third parties under any circumstances. They are used solely for the intended communication. The legal basis for processing data when consent has been obtained is Article 6 (1)(a) GDPR. The legal basis for processing personal data transmitted by email is Article 6 (1)(f) GDPR. If the contact by email aims to conclude a contract, Article 6 (1)(b) GDPR also serves as a legal basis.
The data will be deleted once they are no longer required for the purpose of their collection. For personal data entered in the contact form and those sent by email, this occurs when the communication with you has ended. The conversation is deemed to have ended when the circumstances indicate that the relevant matter has been conclusively resolved.
You may withdraw your consent to the processing of personal data at any time. If you contacted us by email, you may object to the storage of your personal data at any time. The withdrawal can be made, for example, by sending an email or a letter to the contact addresses listed in our legal notice. All personal data stored during the contact process will then be deleted.

10. Data Transfer to Service Providers for Order Processing

We transfer your personal data only to service partners involved in fulfilling contractual obligations, such as the shipping company entrusted with delivery or the bank handling payment transactions. The extent of the data transfer to third parties is limited to the minimum necessary, namely your first and last name, address, and, where applicable, delivery address. The legal basis is Article 6 (1)(b) GDPR.
If you have given us or, at your request, the service partner your explicit consent, we may also transfer your email address, telephone number, or date of birth to coordinate a delivery date or for identity and credit checks by the payment service provider. If you do not provide consent, prior coordination of a delivery date, delivery notifications, or options such as “purchase on account,” “direct debit,” or “installment purchase” will not be possible. The legal basis in such cases is Article 6 (1)(a) GDPR.
You may withdraw your consent at any time with future effect either from us or from the respective service provider. However, the service provider may still be entitled to process your personal data if necessary for contractual performance.
We cooperate in particular with the following shipping providers:

Shipping providers:
DHL – If shipping is carried out via DHL, we forward your data to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn.

DPD – If shipping is carried out via DPD, we forward your data to DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg.

UPS – If shipping is carried out via UPS, we forward your data to United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss.

GLS – If shipping is carried out via GLS, we forward your data to General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1–7, 36286 Neuenstein.

11. Third-Party Tools and Plugins

We use third-party tools on our website, for example to analyze usage data, so that we can design and optimize our online offerings in a user-friendly and needs-based manner. These tools generally use “cookies” (see definition above under “Cookies”). For data processed in this way, your prior informed consent pursuant to Article 6 (1)(a) GDPR may be required, which you grant via a consent window (cookie-consent tool) before activation.
To protect your privacy, data that could potentially identify you—such as IP address, login data, or device identifiers—are anonymized or pseudonymized as early as possible. The tools used include the following:

a) Google Analytics
We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google Analytics uses “cookies” that are stored on your computer to analyze your use of the website. The information generated by the cookie (including your anonymized, shortened IP address) is usually transmitted to a Google LLC server in the USA (1600 Amphitheatre Parkway, Mountain View, CA 94043) and stored there.
IP anonymization “_anonymizeIp()” is activated on our website. Through this function, your IP address is shortened by Google within EU Member States or other contracting states of the EEA Agreement before transmission, making personal identification impossible. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.
On our behalf, Google uses this information to evaluate your use of our website, compile reports on website activity, and provide other services related to website and internet usage. The IP address transmitted by your browser within Google Analytics will not be merged with other Google data.
The processing described—especially the use of Google Analytics cookies—requires your explicit informed consent under Article 6 (1)(a) GDPR. For this purpose, we use a “cookie-consent tool” displayed when you visit our site. Through this tool, you can grant or deny consent to the use of Google Analytics. You may withdraw your consent at any time with future effect using the same tool.
We have concluded a data-processing agreement with Google. This contract obliges Google to protect our website visitors’ data under standard contractual clauses and not to disclose them to third parties. Data transfers from the EU to the USA are based on the European Commission’s standard contractual clauses ensuring compliance with EU data protection standards, see: https://policies.google.com/privacy/frameworks
Further details on Google Analytics can be found at: https://policies.google.com/privacy

b) Google Maps
We use Google Maps (API) provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”). Google Maps is a web service for displaying interactive (land) maps to visualize geographic information. Using this service enables you to view our location and facilitates route planning.
When loading subpages containing Google Maps, information about your website usage (e.g., your IP address) is transmitted to and stored on Google servers in the USA. This occurs regardless of whether you are logged in to a Google user account. If you are logged in, the data will be directly associated with your account. If you do not wish this association, log out before activating the map. Google stores such data (even for non-logged-in users) as user profiles and analyzes them.
Cookies for Google Maps require your informed consent under Article 6 (1)(a) GDPR, which you can give via the consent window. You also have the right to object to the creation of these user profiles by contacting Google directly. If you do not agree with the future transfer of your data to Google within the scope of using Google Maps, you can disable the web service by turning off JavaScript in your browser. Google Maps and the map display on this website can then no longer be used.
Google’s terms of use can be found at www.google.de/intl/de/policies/terms/regional.html and the additional terms for Google Maps at https://www.google.com/intl/de_US/help/terms_maps.html.
Detailed information on data protection regarding Google Maps is available in Google’s Privacy Policy: https://policies.google.com/privacy?hl=en&gl=en.

c) YouTube
We use the “YouTube” service to embed our own videos on this website (“framing”). YouTube is operated by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).
We embed YouTube videos only in “enhanced privacy mode,” which prevents YouTube from initially storing cookies on your device. However, when such a page is loaded, your IP address and certain other data are transmitted, allowing Google to know which of our web pages you have visited. This information cannot be directly attributed to you unless you are logged in to YouTube or another Google service.
Use of YouTube requires your informed consent under Article 6 (1)(a) GDPR, granted via the cookie-consent tool. If consent is not given, videos remain blocked by a content blocker until you click and explicitly agree to Google’s privacy terms.
When playback of an embedded video starts, YouTube—under enhanced privacy mode—only sets cookies that do not contain personally identifiable information unless you are simultaneously logged into a Google service. To avoid association, log out from YouTube. The integration of cookies takes place under Article 6 (1)(f) GDPR to collect information on user behavior and improve YouTube’s usability.
Regardless of playback, visiting such a page creates a connection to the Google “DoubleClick” network. Further details on Google’s handling of user data can be found at https://www.google.de/intl/de/policies/privacy.

d) Leadinfo
We use the lead-generation service of Leadinfo B.V., Rotterdam, Netherlands. This service identifies business visits to our website based on IP addresses and displays publicly available company information, such as company names and addresses. Additionally, Leadinfo sets two first-party cookies to analyze user behavior and processes form-entry domains (e.g., “leadinfo.com”) to correlate IP addresses with companies and improve services. For more information, see www.leadinfo.com and the opt-out option at https://www.leadinfo.com/en/opt-out/.

e) Facebook Pixel
Our website uses the “Facebook Pixel” of the social network Facebook, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).
The Facebook Pixel allows us to define visitors of our website as target groups for displaying ads (“Facebook Ads”). We use the Facebook Pixel to show our Facebook Ads only to users who have shown interest in our online content or who share specific characteristics (e.g., interest in particular topics or products identified by visited websites) that we transmit to Facebook (“Custom Audiences”). The Facebook Pixel also enables us to track the effectiveness of Facebook Ads for statistical and market-research purposes by seeing whether users were redirected to our site after clicking a Facebook ad (“conversion”).
The legal basis for using the Facebook Pixel is your consent under Article 6 (1)(a) GDPR. You may withdraw consent at any time with future effect via our cookie-settings.
Data collected via the Facebook Pixel are anonymous to us, i.e., we cannot identify individual users. However, Facebook stores and processes this data, enabling linkage to user profiles and allowing Facebook to use them for its own advertising purposes in accordance with its data-use policy. This may allow Facebook and its partners to display ads on and outside Facebook.
More information: https://www.facebook.com/about/privacy/

Opt-Out and Withdrawal of Consent
You may withdraw your consent to the Facebook Pixel at any time by adjusting your cookie settings on our website. You can also prevent Facebook or LinkedIn tracking by using their respective opt-out tools: Facebook Opt-Out.

f) LinkedIn Insight Tag
We use the “LinkedIn Insight Tag,” a tool provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”).
The LinkedIn Insight Tag collects data about visits to our website, including URL, referrer URL, IP address, device and browser characteristics, timestamp, and page views. These data are encrypted, anonymized within seven days, and deleted within 90 days. LinkedIn does not provide personal data to us but only aggregated reports and insights (which do not identify you) on website audiences and ad performance.
The legal basis for using the LinkedIn Insight Tag is your consent under Article 6 (1)(a) GDPR. You may withdraw it at any time via our cookie-settings.
Further information: https://www.linkedin.com/legal/privacy-policy

Opt-Out and Withdrawal of Consent
You may withdraw your consent to the LinkedIn Insight Tag at any time by adjusting the cookie settings on our website. You can also use LinkedIn’s own opt-out tools: LinkedIn Opt-Out.

12. Rights of the Data Subject

If your personal data are processed, you are a “data subject” under the GDPR and have the following rights vis-à-vis the controller:
Right of access (Art. 15 GDPR) – You may request confirmation as to whether personal data concerning you are being processed. Where that is the case, you may request information on the purposes, categories of data, recipients, storage duration, rights to rectification, erasure, restriction, or objection, existence of a complaint right, source of the data, and any automated decision-making including profiling. You may also request information about transfers to third countries and the safeguards under Article 46 GDPR.
Right to rectification (Art. 16 GDPR) – You have the right to have inaccurate or incomplete personal data corrected or completed without undue delay.

Right to erasure (Art. 17 GDPR) – You may request immediate deletion of personal data if one of the following applies:
(1) The data are no longer necessary for the purposes collected;
(2) You withdraw consent and there is no other legal basis;
(3) You object under Article 21 and there are no overriding legitimate grounds;
(4) Data were unlawfully processed;
(5) Erasure is required by Union or Member State law;
(6) Data were collected in relation to services offered to children under Article 8(1) GDPR.
If we have made your data public and are obliged to delete it, we will take reasonable steps, including technical measures, to inform other controllers processing the data that you have requested deletion of all links or copies.
This right does not apply when processing is necessary for freedom of expression, legal obligations, public interest, scientific or historical research, or legal claims.

Right to restriction of processing (Art. 18 GDPR) – You may request restriction if you contest data accuracy, processing is unlawful but you oppose deletion, we no longer need the data but you need them for legal claims, or you have objected under Article 21 pending verification.

Right to notification (Art. 19 GDPR) – If you exercise your rights to rectification, erasure, or restriction, we must notify all recipients of your data unless impossible or disproportionate.

Right to data portability (Art. 20 GDPR) – You may receive your personal data in a structured, commonly used, machine-readable format and transfer them to another controller, where processing is based on consent or contract and carried out by automated means.

13. Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to processing based on Article 6 (1)(e) or (f) GDPR, including profiling. We will cease processing unless we demonstrate compelling legitimate grounds overriding your interests or for legal claims.
If your data are processed for direct marketing, you may object at any time; the data will then no longer be processed for this purpose.
You may exercise your right to object by automated means using technical specifications, regardless of Directive 2002/58/EC.

14. Right to Withdraw Consent

You have the right to withdraw your consent under data protection law at any time. The withdrawal does not affect the lawfulness of processing carried out before withdrawal.

15. Automated Individual Decision-Making Including Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you, except when necessary for a contract, authorized by law with safeguards, or based on your explicit consent.
Such decisions shall not involve special categories of data unless based on Article 9 (2)(a) or (g) with adequate safeguards. In these cases, the controller shall implement measures to protect your rights, including the right to human intervention, to express your viewpoint, and to contest the decision.

16. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to other administrative or judicial remedies, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your residence, workplace, or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The supervisory authority will inform you of the progress and outcome of your complaint, including the possibility of a judicial remedy under Article 78 GDPR.

17. Further Data Protection Information

If you have further questions regarding data protection, you may contact us at any time. Our contact details can be found above under the information on the controller of this privacy policy or in our legal notice.
This privacy policy is provided by
RA Kai Harzheim, Hamburg – www.harzheim.eu

Version dated: 17 September 2025