Privacy policy
Here you can find out which personal data we process when you use our shop, why we need it and what rights you have. Information about individual services is provided in the relevant sections.
1. Controller and contact details
Controller
Dönges GmbH & Co. KG
Dönges-Straße 1
42929 Wermelskirchen
Telephone: +49 2196-9756-0
Email: info@sanpro.de
Data protection officer
Hackbarth Datenschutz
Matthias Hackbarth
Aufderhöher Str. 108
42699 Solingen
Telephone: +49 1705292529
Email: datenschutz@doenges-online.de
2. Your rights
Subject to the statutory requirements, you have the following rights:
- access to information about the processing of your data and a copy of that data;
- rectification of inaccurate data and completion of incomplete data;
- erasure or restriction of processing;
- data portability where processing is automated and based on consent or a contract;
- lodging a complaint with a data protection supervisory authority, in particular where you live or work or where an alleged infringement occurred.
Withdrawing consent
You may withdraw consent at any time with effect for the future. This does not affect processing before withdrawal. For optional shop services, use the cookie settings in the footer; for newsletters, use the unsubscribe link in the relevant message. You may also use the contact details provided above.
Objecting to processing
Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time; this also applies to associated profiling. Your data will then no longer be processed for that marketing.
3. Legal bases, retention and security
Depending on the purpose, we process data for the performance of a contract or to take steps before entering into a contract (Article 6(1)(b) GDPR), to comply with legal obligations (point (c)), on the basis of legitimate interests (point (f)) or your consent (point (a)). The respective purposes are described below.
We retain data for as long as it is needed for the relevant purpose. Statutory retention obligations and the establishment, exercise or defence of legal claims may require longer retention. The data is then erased. Specific information about individual processing activities is provided in the relevant section.
Our shop uses an encrypted HTTPS connection. Technical and organisational measures help protect your data. Nevertheless, completely risk-free data transmission cannot be guaranteed.
4. Shop use, customer accounts and orders
Technical operation
When you access the shop, technical data is generated, such as your IP address, time of access, page visited, referring page, and information about your browser and operating system. It is processed to provide the shop, ensure security and analyse errors. The basis is our legitimate interest in a secure and functional shop (Article 6(1)(f) GDPR).
Contact and enquiries
When you contact us, we process your contact details and the content of your message to handle your enquiry. For questions about a contract or order, the basis is Article 6(1)(b) GDPR; for other enquiries, it is our legitimate interest in answering them (point (f)). Any additional consent given is governed by point (a).
The data is erased when the enquiry has been resolved, provided no retention obligations or other legal grounds prevent this.
Customer account
We use your registration data to provide and manage your customer account. Required information is marked in the form. We inform you of important account changes via the email address on file. The basis is Article 6(1)(b) GDPR. After the account is closed, retention obligations for order and invoice data may continue to apply.
Orders, delivery and payment
We process the contact, delivery, billing and payment data required for your order. Shipping companies and payment service providers receive the relevant data insofar as necessary for processing the order. The bases are performance of the contract and legal obligations (Article 6(1)(b) and (c) GDPR). Details about payment services are provided in the next section.
5. Payments and credit checks
PayPal
When paying via PayPal, payment data needed to process the payment is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. The basis is processing the selected payment (Article 6(1)(b) GDPR). Where consent is obtained for additional functions, Article 6(1)(a) GDPR applies.
You can see which other payment options PayPal offers at checkout. Information about processing by PayPal is available in the PayPal privacy notice.
Billie – purchase on account for business customers
Where purchase on account via Billie is offered at checkout and you select this payment method, we use Billie GmbH for this purpose. The ordering process includes address and credit checks. If the checks and order are successful, the corresponding payment claim is assigned to Billie.
Billie processes company data and personal data for its payment services. Further information is available in the Billie privacy notice, particularly in the sections for buyers and all users.
Creditreform Solingen – credit checks for business customers
For business customers, we check creditworthiness when contracts are concluded and in other cases where there is a legitimate interest. For this purpose, we obtain information from Creditreform Solingen Kirschner GmbH & Co. KG, Kuller Str. 58, 42651 Solingen. We transmit names and contact details for this purpose.
Further information is provided in the Creditreform Solingen privacy policy.
6. Newsletter and Birdsview
Subscribing to and unsubscribing from the newsletter
For the newsletter, we need your email address and evidence of your subscription. Any other information is voluntary. The basis for the subscribed newsletter is your consent (Article 6(1)(a) GDPR). You may unsubscribe at any time using the unsubscribe link in a message or by notifying us.
After you unsubscribe, your data will no longer be used to send newsletters. Data we need to demonstrate consent, respect your objection or comply with legal obligations may continue to be retained.
Marketing to existing customers
Subject to the conditions of section 7(3) of the German Act against Unfair Competition (UWG), we also use an email address obtained during a purchase for offers relating to our own similar goods or services. The basis is our legitimate interest in direct marketing (Article 6(1)(f) GDPR). You may object at any time without incurring costs other than transmission costs at the basic rates. This use ends if you object.
Sending and analysis with Birdsview
For regular newsletters and personalised email communication, we use Birdsview GmbH, Sebastian-Bach-Str. 47, 04109 Leipzig. Birdsview processes data on our behalf. The service supports sending, recipient groups and analysis of openings and clicked links.
The legal basis for sending follows from the preceding sections. Personalised analysis of openings and clicks must be assessed separately; permission to market to existing customers does not automatically cover every form of tracking. Where consent is required for this, Article 6(1)(a) GDPR applies, together with section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) when accessing your terminal equipment.
Further information: Privacy at Birdsview.
Birdsview tracking in the shop
With your consent to the corresponding entry in the cookie settings, page views and shopping cart activities are recorded to personalise our emails. The identifier bv-tracking is used for this purpose; the stated duration is 180 days. The bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. You may change your selection in the cookie settings at any time.
7. Cookies, analytics and advertising in the shop
Cookie settings
Cookies and similar technologies store information on your terminal equipment or access information stored there. The exemption under section 25(2) TDDDG applies to strictly necessary functions. Section 25(1) TDDDG applies to access requiring consent. This must be distinguished from the legal basis for subsequent processing of personal data.
You can view and change the listed services and your selections in the cookie settings in the footer. Blocking cookies in your browser may make certain shop functions unavailable.
Google Analytics
Google Analytics is used for statistical analysis of shop use. Usage and device information and online identifiers may be processed. The responsible provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing outside the EU, particularly in the USA, may take place.
Analytics functions requiring consent are governed by Article 6(1)(a) GDPR and section 25(1) TDDDG. You can change your selection in the cookie settings. Information about processing by Google and your settings options is available in the Google privacy policy.
Meta pixel
The Meta pixel is integrated into the shop. It measures and analyses activities for advertising. Usage data and online identifiers may be transmitted to Meta and linked with data already held there. The collection cannot therefore be considered anonymous in all cases.
Article 6(1)(a) GDPR and section 25(1) TDDDG apply to processing requiring consent. You manage your selection in the cookie settings. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Further information is provided in the Meta privacy policy.
8. Integrated functions
Protecting forms with Google reCAPTCHA
We use reCAPTCHA to detect automated and abusive form submissions. The service may analyse technical information such as IP addresses, browser data and interactions. The provider is Google Ireland Limited; processing in the USA may take place.
Our interest is protection against spam and abuse. Insofar as processing can be based on this interest, Article 6(1)(f) GDPR applies; required consent is governed by Article 6(1)(a) GDPR and section 25(1) TDDDG. Further information is available in the Google privacy policy.
Maps
The dealer map uses maps from OpenStreetMap. When external maps are loaded, technical data such as your IP address is transmitted to the relevant map provider. The dealer map is enabled through the cookie settings. Further information: Privacy at OpenStreetMap.
Any additionally integrated Google maps are subject to the Google privacy notice. You can manage your selection for map functions requiring consent in the cookie settings.
Fonts and external resources
The shop uses fonts and symbols for display. Locally hosted files are loaded from the shop. Where resources are retrieved from external servers, the relevant provider receives, in particular, your IP address for technical reasons. Among other things, the shop loads symbols and font files via cdnjs (Cloudflare). Further information: Cloudflare privacy notice.
9. Social media
We use our linked social media profiles to provide information about our company and answer enquiries. If you write to us there or interact with posts, we process the content and profile information you provide for communication. Article 6(1)(b) GDPR applies to contract-related enquiries; otherwise, the basis is our legitimate interest in communication (point (f)).
Facebook and Instagram (Meta)
Facebook and Instagram are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When the platforms are used, Meta processes, among other things, device and usage data; association with your Meta account and processing outside the EU are possible. You manage your privacy and advertising settings directly with Meta.
We share joint responsibility with Meta for processing data for Facebook Page statistics (Page Insights). Details are governed by the Page Insights agreement. You may exercise your data protection rights against us or Meta.
Further information is provided in the Meta privacy policy. For questions about our company, you can also contact us directly using the contact details above.
The platform provider for our LinkedIn presence is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. When you visit, LinkedIn processes profile, device and usage data, among other things. Activities may be associated with your LinkedIn account. Information about purposes, international data processing and your settings is provided in the LinkedIn privacy policy.
We operate our XING presence on the New Work SE platform. Use of the platform and processing by the provider are subject to the XING privacy notice. This also contains information about your rights and settings options.
YouTube
We publish videos on our YouTube channel. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit YouTube, Google processes device and usage data, among other things; if you are signed in, activities may be associated with your account. Further information is provided in the Google privacy policy.
Profile links and embedded videos
A profile link takes you to the relevant platform. By contrast, an embedded video player may transmit data such as your IP address and technical device information to the provider while you are still within the shop. Where consent is required for embedded content, Article 6(1)(a) GDPR and section 25(1) TDDDG apply. You manage your selection for the listed video services in the cookie settings.
10. Job applications
We process the information and documents in your application to decide whether to establish an employment relationship. If an employment relationship is established, the necessary data is retained for its performance.
Following rejection, application documents are erased after two months unless legal obligations or legitimate interests, such as defending legal claims, require longer retention.