Legal notices
Privacy
Information on how we handle personal data.
We take the protection of your personal data seriously. Here we explain how we process data when you visit our website, contact us or receive our newsletter.
1. Controller and privacy contact
The controller responsible for processing personal data is:
Chromtech GmbH
Carl-Zeiss-Strasse 20
65520 Bad Camberg
Germany
Please address privacy enquiries to our management using the contact details above.
2. Website visits and hosting
Our website is hosted by STRATO GmbH in Germany. Requests involve the processing of technically necessary connection data, including IP address, date and time, requested page or file, access status, data volume and information supplied by the browser about the browser, operating system and referring page.
This enables website delivery, stability and the detection and prevention of attacks. The legal basis is Article 6(1)(f) of the General Data Protection Regulation (GDPR); our legitimate interest is secure and reliable operation. STRATO states that IP addresses are retained for attack detection for a maximum of seven days. According to STRATO, access logs provided in the customer account contain anonymised IP addresses or hostnames.
STRATO also provides technical access statistics in the customer account. These count page views, estimated visits, individual server requests and delivered files (pageviews, sessions, hits and files). They are based on server logs processed by STRATO with anonymised IP addresses or hostnames. We do not embed additional visitor tracking in the website for this purpose.
3. Contact by form or email
When you contact us, we process the information you provide to handle and answer your enquiry. The form requires your name, email address, subject and message; your company is optional. Required fields must be completed before the form can be submitted.
The form sends your information to our web server over an encrypted HTTPS connection. The server forwards it by email to our contact address shown above. No website database is used to store enquiries. An extra field that visitors should leave empty helps prevent spam; no external CAPTCHA service is used.
For enquiries concerning a contract or steps prior to entering into a contract with you, the legal basis is Article 6(1)(b) GDPR. Other enquiries are handled under Article 6(1)(f) GDPR based on our legitimate interest in responding to business enquiries. The confirmation in the form acknowledges that you have read this privacy notice.
We delete enquiries once they have been fully handled and storage is no longer necessary. Where statutory retention obligations apply or information is needed to establish, exercise or defend legal claims, the relevant data is retained for the applicable period.
4. Cookies, fonts and external content
The product catalogue stores the selected category, manufacturer and search text in your browser tab’s local session storage and page history. This preserves your selection when you go back. This selection is not transmitted to our server or to third parties.
The website itself does not set analytics or marketing cookies. Cross-site visitor tracking services such as Google Analytics are not embedded. Product filters and search do not persistently store your choices. Fonts use the system fonts installed on your device. Images, videos and documents are loaded from our own webspace; Google Maps, YouTube and social networks are not embedded.
External services, such as LinkedIn posts, partner websites and newsletter registration, can be opened through labelled links. A connection to the provider is established when you open the link. The provider’s privacy notice applies there.
5. Newsletter via rapidmail
Our newsletter uses rapidmail, a service provided by Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau, Germany. Registration takes place on an external rapidmail page. Your email address is required. First and last name, telephone number, company or institution, street address, postcode and town can be provided voluntarily.
Registration uses a confirmation email: it takes effect only after you click the confirmation link (double opt-in). Registration and confirmation records provide evidence of consent. We process subscription data to send information about our products, applications and offers. Newsletter distribution is based on your consent under Article 6(1)(a) GDPR.
We also analyse whether newsletters are opened and which links are clicked. rapidmail uses tracking pixels and trackable links for this purpose, processing technical request data and associating it with the recipient. This helps us understand interest in content and improve our newsletter. The legal basis is your consent under Article 6(1)(a) GDPR; where information is stored on or accessed from your device, Section 25(1) of the German TDDDG also applies.
You can withdraw consent at any time with effect for the future using the unsubscribe link in each newsletter or by emailing our contact address shown above. Processing carried out before withdrawal remains lawful. After you unsubscribe, your data will no longer be used to send newsletters. Necessary consent records or suppression entries may be retained where required to meet legal obligations or protect legitimate interests.
6. Recipients and disclosure
Your data is accessible to the people at Chromtech handling your enquiry and the hosting, email and newsletter service providers involved in the relevant processing. Other disclosures take place only where needed to handle your order, required by law or covered by your consent.
7. Your rights
Subject to the legal requirements, you have the right to access your personal data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with effect for the future (Article 7(3)). Please contact us using our contact address shown above.
Right to object
Where we process data under Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.
You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the place of your habitual residence, work or the alleged infringement. The authority for our registered office in Hesse is the Hessian Commissioner for Data Protection and Freedom of Information.
Hessian data protection authority →
The processing described here does not involve solely automated decision-making, including profiling, with legal or similarly significant effects.