LEGAL
Privacy Policy
1. Introduction
With the following information, we would like to give you as a "data subject" an overview of the processing of your personal data by us and your rights under data protection laws. In principle, it is possible to use our Internet pages without entering personal data. However, if you want to use special services of our enterprise via our website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we will generally obtain your consent.
The processing of personal data, such as your name, address, or e-mail address, shall always be in line with the General Data Protection Regulation (GDPR), and in accordance with the country-specific data protection regulations applicable to Sandhelden GmbH & Co. KG. By means of this data protection declaration, we would like to inform you about the scope and purpose of the personal data collected, used and processed by us.
As the controller, we have implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. Nevertheless, Internet-based data transmissions can always be subject to security vulnerabilities, so that absolute protection cannot be guaranteed. For this reason, you are also free to transmit personal data to us by alternative means, for example by telephone or by post.
2. Responsible person
The responsible party within the meaning of the GDPR is: Sandhelden GmbH & Co KG, Max-Planck-Straße 8, 85716 Unterschleißheim, Germany. Phone: +49 (0)821 32 919 790. E-mail: info@sandhelden.de. Representative of the person responsible: Laurens Faure.
3. Data protection officer
You can reach our data protection officer at info@sandhelden.de or our postal address with the addition of "data protection officer".
4. Definitions
The data protection declaration is based on the terms used by the European Directive and Ordinance Maker when issuing the GDPR. Our data protection declaration should be easy to read and understand for the public as well as for our customers and business partners.
4.1 Personal data
Personal data is any information relating to an identified or identifiable natural person.
4.2 Data subject
Data subject is any identified or identifiable natural person whose personal data is processed by the controller (our company).
4.3 Processing
Processing is any operation or set of operations which is performed upon personal data, whether or not by automatic means.
4.4 Restriction of processing
Restriction of processing is the marking of stored personal data with the aim of limiting its future processing.
4.5 Profiling
Profiling is any type of automated processing of personal data consisting in using such personal data to evaluate certain personal aspects relating to a natural person.
4.6 Pseudonymisation
Pseudonymization is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information.
4.7 Processors
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
4.8 Recipient
Recipient means a natural or legal person, public authority, agency or other body to whom personal data are disclosed.
4.9 Third party
Third party means any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons authorized to process the personal data.
4.10 Consent
Consent means any freely given specific and informed indication of the data subject's wishes by which they signify agreement to the processing of personal data relating to them.
5. Legal basis of the processing
Art. 6(1)(a) GDPR serves as the legal basis for processing operations in which we obtain consent for a specific purpose. Where processing is necessary for the performance of a contract, Art. 6(1)(b) GDPR applies. Where we are subject to a legal obligation, Art. 6(1)(c) GDPR applies. In rare cases where processing is necessary to protect vital interests, Art. 6(1)(d) GDPR applies. Processing operations not covered by the above are based on Art. 6(1)(f) GDPR where necessary to protect a legitimate interest of our company or a third party.
6. Technology
6.1 SSL/TLS encryption
This site uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as orders, login data or contact requests. You can recognise an encrypted connection by the "https://" in the address bar and the lock symbol in your browser.
6.2 Data collection when visiting the website
When you use our website for information purposes only, we collect the data that your browser transmits to our server in server log files: browser type and version, operating system used, referrer URL, sub-pages accessed, date and time of access, IP address, and internet service provider. This data is used to deliver website content correctly, optimize content and advertising, ensure IT security, and provide law enforcement with information if necessary. The legal basis is Art. 6(1)(f) GDPR.
6.3 Encrypted payment transactions
Payment transactions via common means of payment (Visa/MasterCard, direct debit) are made exclusively via an encrypted SSL or TLS connection.
7. Cookies
7.1 General information about cookies
We use cookies on our website — small files stored on your device when you visit our site. We use session cookies to recognise that you have already visited individual pages; these are deleted after you leave the site. We also use temporary cookies to optimize user-friendliness and cookies to statistically record and evaluate the use of our website.
7.2 Legal basis for the use of cookies
Data processed by cookies required for the proper functioning of the website are necessary to protect our legitimate interests under Art. 6(1)(f) GDPR. For all other cookies, your consent is obtained via our opt-in cookie banner in accordance with Art. 6(1)(a) GDPR.
8. Contents of our website
8.1 Registration as a user
You have the option of registering on our website by providing personal data, which is collected and stored exclusively for internal use. Registered persons are free to change or delete their data at any time.
8.2 Data processing when opening a customer account and for contract processing
Personal data is collected and processed under Art. 6(1)(b) GDPR if you provide it for the execution of a contract or when opening a customer account. Deletion of your account is possible at any time.
8.3 Data processing for order processing
Personal data collected is passed on to the transport company commissioned with delivery and the credit institution handling payment, insofar as necessary. The legal basis is Art. 6(1)(b) GDPR.
8.4 Conclusion of contracts with online shop, dealer and shipment of goods
We transmit personal data to third parties only if necessary in the context of the contract, e.g. to delivery companies or payment institutions. Further transmission does not take place without your express consent.
8.5 Contact / contact form
In the context of contacting us (e.g. via contact form or e-mail), personal data is collected and used exclusively to answer your request. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if your contact aims at concluding a contract. Data is deleted once your request has been conclusively resolved, unless legal retention obligations apply.
8.6 Application management / job exchange
We collect and process applicants' personal data to manage the application process. If we conclude an employment contract, data is stored in compliance with statutory provisions. If not, application documents are automatically deleted six months after the rejection decision, unless other legitimate interests apply. The legal basis is Art. 88 GDPR in conjunction with § 26(1) BDSG.
9. Newsletter dispatch
9.1 Newsletter dispatch to existing customers
If you have provided your e-mail address when purchasing goods or services, we reserve the right to send you e-mail offers for similar goods or services, based on our legitimate interest under Art. 6(1)(f) GDPR (§ 7(3) UWG). You may object to this use at any time.
9.2 Advertising newsletter
You may subscribe to our newsletter. A confirmation e-mail is sent using the double opt-in procedure. We also store the IP address, date and time of registration for legal protection purposes. Your data is used exclusively for sending the newsletter and is not passed on to third parties. You may unsubscribe at any time. The legal basis is Art. 6(1)(a) GDPR.
9.3 Newsletter dispatch via MailerLite
Our e-mail newsletters are sent via the technical service provider MailerLite Limited, 71 Lower Baggot Street, Ground Floor, Dublin, Ireland. Data is usually transferred to a MailerLite server within the EU. MailerLite uses tracking pixels to determine whether a newsletter has been opened and which links were clicked; this data is collected pseudonymously. You can object by unsubscribing from the newsletter. A data processing agreement based on EU standard contractual clauses is in place with MailerLite.
10. Our activities in social networks
We maintain pages on social networks to communicate with you and inform you about our services. We are jointly responsible with the respective platform provider under Art. 26 GDPR for the processing operations triggered thereby. Your data may be processed outside the EU/EEA. Processing is carried out under Art. 6(1)(f) GDPR, or Art. 6(1)(a) GDPR where consent is required.
10.1 Facebook
(Co-)responsible: Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy policy: facebook.com/about/privacy. Opt-out: facebook.com/ads/preferences.
10.2 Instagram
(Co-)controller: Facebook Ireland Ltd. Privacy policy: instagram.com/legal/privacy. Opt-out: instagram.com/accounts/privacy_and_security.
10.3 YouTube
(Co-)controller: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: policies.google.com/privacy. Opt-out: adssettings.google.com.
10.4 Pinterest
(Co-)controller: Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Privacy policy: policy.pinterest.com/de/privacy-policy. Opt-out: pinterest.com/settings/privacy.
11. Web analysis
11.1 Facebook Pixel (Custom Audience)
This website uses the Facebook Pixel of Facebook Inc, 1 Hacker Way, Menlo Park, CA 94025, USA, to track user behaviour after they have seen or clicked a Facebook ad, for statistical and market research purposes, only with your explicit consent under Art. 6(1)(a) GDPR. You can deactivate cookies via your browser settings or via aboutads.info/choices.
11.2 Google Analytics
We use Google Analytics, provided by Google Ireland Limited, to create pseudonymised usage profiles via cookies. Data such as browser type, operating system, referrer URL, IP address and time of request are transmitted to a Google server in the USA; IP addresses are anonymized (IP masking). Processing is carried out only with your express consent under Art. 6(1)(a) GDPR. You can prevent data collection via a browser add-on or an opt-out cookie.
11.3 Google Analytics remarketing
We use Google Remarketing, operated by Google Ireland Limited, to display interest-based advertising to visitors who have previously visited our website, via a cookie. Personal data, including your IP address, may be transferred to and stored by Google in the USA. Processing takes place only with your express consent under Art. 6(1)(a) GDPR. You can object to interest-based advertising via google.de/settings/ads.
12. Advertising
12.1 Google Ads (formerly AdWords)
We use Google Ads, operated by Google Ireland Limited, to advertise this website in Google search results and on third-party websites via a cookie enabling interest-based advertising. Processing is carried out only with your express consent under Art. 6(1)(a) GDPR.
12.2 Google AdSense
We have integrated Google AdSense, operated by Google Ireland Limited, to place interest-related advertisements via cookies and tracking pixels. Personal data, including your IP address, is transferred to and processed by Alphabet Inc. in the USA. Processing is carried out only with explicit consent under Art. 6(1)(a) GDPR.
12.3 Google Ads with conversion tracking
We use Google Ads conversion tracking, operated by Google Ireland Limited. A conversion cookie (valid for thirty days) tracks whether certain sub-pages were called up after a visitor arrived via a Google ad; personal data including your IP address is transmitted to Google in the USA. Processing is carried out only with your express consent under Art. 6(1)(a) GDPR.
13. Plugins and other services
13.1 Google Maps
We use Google Maps (API), operated by Google Ireland Limited, to visually present geographical information such as our location. Information about your use of the website, including your IP address, is transmitted to Google servers in the USA when a page with an embedded map is called up. Processing is carried out only with explicit consent under Art. 6(1)(a) GDPR; you can deactivate this by disabling JavaScript.
13.2 Google reCAPTCHA
We use the reCAPTCHA function of Google Ireland Limited to distinguish human input from automated/machine input; this involves sending your IP address and other required data to Google. Processing is carried out only with explicit consent under Art. 6(1)(a) GDPR.
13.3 Google Tag Manager
This website uses Google Tag Manager, a cookie-less domain that does not itself collect personal data, but can trigger other tags that may collect data. Processing is carried out only with explicit consent under Art. 6(1)(a) GDPR.
14. Shop system "Wix"
We use the platform Wix.com Ltd, 40 Namal, 6350671 Tel Aviv, Israel, to host and display our online shop. All data collected on our website is processed on Wix's servers and may be transferred to Wix in Israel; an adequate level of data protection is guaranteed by an adequacy decision of the European Commission. More information: wix.com/about/privacy.
15. Payment providers
15.1 Klarna
We have integrated components of Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden, an online payment service enabling purchase on account or by instalments, including buyer protection and credit checks. If you select this payment option, your data (name, address, date of birth, e-mail, payment and order-related information) is transmitted to Klarna for identity verification, payment administration and fraud prevention, and may be passed to credit agencies. Use is based on our legitimate interest under Art. 6(1)(f) GDPR. Klarna's privacy policy: cdn.klarna.com — data protection.
15.2 PayPal
We have integrated components of PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. If you select PayPal, your data (name, address, e-mail, IP address, phone number, order-related data) is transmitted to PayPal for payment processing and fraud prevention, and may be passed to credit agencies for identity and creditworthiness checks. Use is based on our legitimate interest under Art. 6(1)(f) GDPR. PayPal's privacy policy: paypal.com/de/webapps/mpp/ua/privacy-full.
15.3 Apple Pay
We have integrated Apple Pay, a payment method of Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Transaction data is encrypted and not stored by us. If you select Apple Pay, your data is transmitted to Apple for payment processing and fraud prevention, and may be shared with credit reporting agencies. Use is based on our legitimate interest under Art. 6(1)(f) GDPR. Apple's privacy policy: apple.com/de/legal/privacy/de-ww.
16. Your rights as a data subject
16.1 Right to confirmation as to whether personal data relating to you is being processed.
16.2 Right to information (Art. 15 GDPR) — free information about your stored personal data and a copy of this data.
16.3 Right to rectification (Art. 16 GDPR) — correction of incorrect data and completion of incomplete data.
16.4 Right to deletion (Art. 17 GDPR) — deletion of your personal data where a statutory reason applies.
16.5 Right to restriction of processing (Art. 18 GDPR).
16.6 Right to data portability (Art. 20 GDPR) — receive your data in a structured, machine-readable format and have it transferred to another controller.
16.7 Right to object (Art. 21 GDPR) — object at any time to processing based on Art. 6(1)(e) or (f) GDPR, including for direct marketing purposes and related profiling.
16.8 Right to revoke consent under data protection law at any time with effect for the future.
16.9 Right to complain to a supervisory authority responsible for data protection.
17. Routine storage, deletion and blocking of personal data
We process and store your personal data only for the period required to achieve the storage purpose or as required by law. Once the purpose ceases to apply or a prescribed retention period expires, the data is routinely blocked or deleted.
18. Duration of the storage of personal data
The criterion for the duration of storage is the respective statutory retention period. After expiry, the data is routinely deleted, provided it is no longer required for contract fulfilment or initiation.
19. Up-to-dateness and change of the privacy policy
This data protection declaration is currently valid and has the status: January 2022. Due to the further development of our websites and offers, or due to changed legal or official requirements, it may become necessary to change this data protection declaration. You can access and print out the current data protection declaration at any time on this website.
Last revision: March 2026