Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Brenn- und Kaminholz-Service Hochspeyer, Hauptstraße 207, 67691 Hochspeyer, Germany
Phone: +49 6305 123456, Email: kundenservice@brenn-und-kaminholz.shop

2. Hosting

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The host processes the data generated when you visit the website on our behalf. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR.

3. Server log files

When you visit the website, information transmitted by your browser is collected automatically: IP address, date and time, page visited, referrer URL, browser type and operating system. This data is required for the secure and stable operation of the website (Art. 6(1)(f) GDPR) and is deleted after a short period.

4. Cookies

We only use technically necessary cookies: a session cookie that stores your cart and your language selection, and a security cookie that protects the forms (CSRF protection). These cookies are strictly necessary for operating the shop (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR) and are deleted when you close your browser or after two hours of inactivity at the latest. We do not use any analytics, tracking or advertising cookies.

5. Fonts

The fonts used on this website are loaded locally from our server. No connection is made to Google or other third-party servers.

6. Orders

When you place an order, we process the data required for it: name, company if applicable, delivery address, email address, phone number, access details, goods ordered, delivery date and payment method. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

We only use your phone number to arrange the delivery. Where applicable, the transport company commissioned with the delivery receives your name, delivery address and phone number insofar as this is necessary for delivery. To document your acceptance of our terms and conditions, we store the time of the order and your IP address.

We keep order data and invoices for as long as statutory retention obligations under commercial and tax law apply (up to ten years under the German Commercial Code and Fiscal Code, Art. 6(1)(c) GDPR).

7. Payment processing

For payment by bank transfer (prepayment, deposit or invoice), we receive the usual transfer details from your bank (name, IBAN, amount, payment reference). For cash on delivery, no payment data is processed electronically.

8. Notification of the shop launch

If you sign up to be notified when the shop opens, we store your email address, postcode, chosen language, the time of your consent and your IP address. Sign-up uses the double opt-in procedure: we only write to you after you have confirmed via the link in our email. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by email to kundenservice@brenn-und-kaminholz.shop. We delete the data after sending the launch notification or after you withdraw your consent.

8a. Order tracking and live position of the delivery vehicle

Using the link in our emails, or your order number and email address, you can check the status of your delivery. While your delivery is “on the way”, we can show you the approximate position of the delivery vehicle on a map. The position is only transmitted during the delivery round, only shown to customers with a delivery in progress, only the latest position is stored, and it is deleted at the end of the round (Art. 6(1)(b) and (f) GDPR).

The map is only loaded from the servers of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) after you click “Show map”. Your IP address is then transmitted to OpenStreetMap (Art. 6(1)(a) GDPR, consent by clicking). Without a click, no connection is made.

9. Contact by email or phone

If you contact us, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR). The data is deleted once the enquiry has been dealt with and no retention obligations apply.

10. Your rights

You have the right at any time to:

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw any consent given, with effect for the future (Art. 7(3) GDPR).

You may also lodge a complaint with a data protection supervisory authority, in particular in the federal state where you live or where we are based.

11. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the padlock icon in your browser’s address bar.

Last updated: November 2026