Privacy

Controller

The company named in the imprint is responsible for the processing of personal data on this website. Contact details for data protection enquiries are given there.

1. Contact form

When you use the contact form we process the details you enter:

• contact person (required)
• email address (required)
• message (required)
• company, telephone number and area of interest (optional)
• the language version and the page the enquiry was sent from
• the product or category the enquiry relates to, if you write from a product page

We additionally store a cryptographic hash of your IP address. The address itself is not stored. The hash is used solely to limit automated bulk submissions.

Purpose and legal basis: processing takes place in order to handle your enquiry and to take steps prior to entering into a contract, Art. 6(1)(b) GDPR. Where your enquiry is not directed at concluding a contract, processing is based on our legitimate interest in responding to business enquiries, Art. 6(1)(f) GDPR.

Recipients: your enquiry is stored in our database and additionally sent to our mailbox by email. You receive an automatic acknowledgement at the address you provided. Your email address is set as the reply address but is not used as the sender.

Retention: enquiries are deleted once they have been dealt with and no statutory retention obligation applies, as a rule no later than 24 months. If the enquiry leads to a business transaction, the statutory commercial and tax retention periods of six and ten years apply.

2. Cookies

This website sets the following cookies:

Session cookie (STONEGET_SESSION)
Strictly necessary. It holds a random session identifier and protects the contact form against cross-site request forgery. Without it the form cannot be submitted. It is deleted when you close your browser. Legal basis: Section 25(2)(2) TTDSG; no consent is required.

Consent cookie (stoneget_consent)
Set only where optional cookies are offered and you have made a choice. It stores your decision so that you are not asked again on every page. Lifetime: six months.

Statistics cookies (_ga, _ga_*)
Set only if you agree to the "Statistics" category in the cookie banner. They belong to Google Analytics 4 (see section 3) and have a lifetime of up to two years. Without your consent Google Analytics is not loaded and no connection to Google is made.

Marketing cookies are not used.

You may withdraw your consent at any time with effect for the future via the "Cookie settings" link at the bottom of every page. The statistics cookies are then deleted and no further data is sent to Google Analytics.

3. Google Analytics 4

With your consent we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics is only loaded after you have agreed to the "Statistics" category in the cookie banner; before that, no connection to Google is made.

Google Analytics uses cookies (see section 2) and collects information about your use of the website, in particular pages viewed, time spent, approximate location (country/region), device type and browser, and the source through which you reached the site. Google Analytics 4 does not store IP addresses; they are used only in truncated form for coarse location. We use Google Consent Mode v2: until you decide, all storage and advertising signals are set to "denied"; after your consent only the statistics signal is granted. Google Signals, personalised advertising and any link to Google Ads are disabled.

The purpose is statistical analysis of usage in order to improve the website. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Data is processed on Google servers, including in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the EU Commission's standard contractual clauses apply in addition. Usage data stored by Google Analytics is deleted after 14 months.

You may withdraw your consent at any time via "Cookie settings" at the bottom of every page. Further information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245.

4. Server log files

When the website is accessed, the hosting provider automatically records access data in log files, in particular IP address, time, address requested, volume of data transferred, referrer and browser identification. This data is required for secure operation. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted at regular intervals.

5. Language selection by country

When the home page is first opened without a language in the address, your country is determined from your IP address in order to redirect you to the matching language version. The lookup takes place solely on our server using a locally stored database (IP geolocation by DB-IP, db-ip.com, licensed CC BY 4.0). Only the country is determined; the IP address is neither stored nor transmitted to third parties for this purpose. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in an understandable website). You can choose a different language at any time via the language switcher.

6. Hosting

The website runs on servers of a provider located in the European Union. A data processing agreement under Art. 28 GDPR is in place with that provider.

7. No disclosure to third parties

Your data is not passed to third parties unless this is necessary to perform a contract, you have consented, or we are legally obliged to do so. No transfer to third countries outside the EU takes place.

8. No automated decision-making

No automated decision-making, including profiling, takes place. Your enquiries are handled by people.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). You may withdraw consent at any time; the lawfulness of processing carried out before withdrawal is unaffected.

An informal message to the address given in the imprint is sufficient to exercise these rights.

You also have the right to lodge a complaint with a data protection supervisory authority.