Information on the Processing of Personal Data (Privacy Notice)
(Version 2.0, as of April 29, 2026)
Welcome to the privacy policy section of HiCo Hartmann & Co. KG . We are delighted that you are interested in our company. In this privacy policy, we would like to provide you with detailed information about when we collect which data and how it is processed.
Controller
The controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR) is:
Römerweg 12
D-78727 Oberndorf-Hochmössingen
Phone: +49 7423 3370
Email: thomas.hartmann@zentrierspanner.de
Owner: Thomas Hartmann
Data Protection Officer
You can contact our Data Protection Officer at:
Römerweg 12
D-78727 Oberndorf-Hochmössingen
Phone: +49 7423 3370
Email: thomas.hartmann@zentrierspanner.de
General Information on the Collection of Personal Data
The following information is provided to transparently inform you about the nature and scope of the processing of personal data,
- during your visit to our website,
- the use of our online services,
- external online presence on social media platforms
- as part of the application process
- as well as in business dealings with customers and service providers
be collected.
The legal basis for our data protection practices is provided, in particular, by the provisions of the General Data Protection Regulation (GDPR) as well as the supplementary provisions of the Federal Data Protection Act (BDSG) and the Telecommunications and Digital Services Data Protection Act (TDDDG).
Purpose / Legal Basis for Processing
In cases where we seek your consent for the processing of personal data, Article 6(1)(a) of the GDPR serves as the legal basis.
When processing personal data necessary for the performance of a contract concluded between you and us, Article 6(1)(b) of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of pre-contractual measures.
If the processing of personal data is necessary to comply with a legal obligation to which we are subject, Article 6(1)(c) of the GDPR serves as the legal basis.
Where the processing of personal data is necessary to protect the vital interests of the data subject or another natural person, the legal basis is Article 6(1)(d) of the GDPR.
If the processing of personal data is necessary to safeguard a legitimate interest of our company or a third party, and your interests, fundamental rights, and freedoms do not override that interest, then Article 6(1)(f) of the GDPR serves as the legal basis for the processing.
If cookies or similar technologies are used in the course of data processing, the storage of such cookies or the access to information on a user’s device (e.g., device fingerprinting) is carried out in accordance with Section 25(1) of the German Telemedia Act (TDDDG) in conjunction with Article 6(1)(a) of the General Data Protection Regulation (GDPR).
If the use of cookies is strictly necessary, it is based on Section 25(2), sentence 2 of the TDDDG.
Disclosure of Personal Data
If we transfer your personal data to other parties or disclose it to them in the course of our processing activities, we do so exclusively on the basis of one of the legal grounds specified above. Recipients of this data may include, for example, payment service providers in connection with the performance of a contract. In cases where we are required to do so by law or by court order, we must transfer your data to authorized authorities.
If we use external service providers to assist us in processing your data (e.g., data analysis, newsletter distribution), this is done within the framework of data processing on behalf of the controller in accordance with Article 28 of the GDPR. In such cases, we enter into contracts only with service providers that offer sufficient guarantees that appropriate technical and organizational measures will ensure the protection of your data.
Data transfers to third countries
Data will only be transferred to third countries (outside the European Union or the European Economic Area) to the extent that this is in accordance with legal requirements. Subject to express consent or a transfer required by contract or law, we process or allow the processing of data only in third countries with a recognized level of data protection (e.g., an adequacy decision by the European Commission pursuant to Art. 45(1)(3) GDPR for the “EU-US Data Privacy Framework” https://commission.europa.eu/document/fa09cbad-dd7d -4684-ae60-be03fcb0fddf_en) or pursuant to Art. 44 et seq. GDPR on the basis of specific safeguards, such as contractual obligations through the EU Commission’s so-called standard data protection clauses (EU Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).
Data storage
As soon as the purpose for which your personal data was collected no longer applies, we will delete or block it. Furthermore, your personal data will only be retained if specific statutory retention periods (in particular, retention obligations under commercial and tax law) at the national or European level prevent its deletion.
Definitions
Our privacy policy is based on terms used and defined in the GDPR. To ensure that our privacy policy is easy to read and understand, we would like to explain the most important terms in advance.
Personal data
“Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Processing
“Processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or any other form of making available, the alignment or combination, restriction, erasure, or destruction.
Controller
“Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Pseudonymization
“Pseudonymization” is the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures that ensure the personal data is not attributed to an identified or identifiable natural person.
Data processor
“Processor” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.
Recipient
“Recipient” means a natural or legal person, public authority, agency, or other body to whom personal data is disclosed, regardless of whether that entity is a third party or not. However, public authorities that may receive personal data in the course of a specific investigative mandate under Union law or the law of the Member States are not considered recipients.
Third party
“Third party” means a natural or legal person, public authority, agency, or other body, other than the data subject, the controller, the processor, and the persons who, under the direct authority of the controller or the processor, are authorized to process the personal data.
Consent
“Consent” means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
Profiling
“Profiling” means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
Rights of affected individuals
The processing of personal data gives you, as the data subject, certain rights that you may exercise at any time. These are:
- Right to withdraw a declaration of consent under data protection law pursuant to Article 7(3) of the GDPR
- Right to access your personal data stored by us in accordance with Article 15 of the GDPR
- Right to rectification of inaccurate data or to have incomplete data completed in accordance with Article 16 of the GDPR
- Right to erasure of your data stored by us pursuant to Article 17 of the GDPR
- Right to restrict the processing of your data pursuant to Article 18 of the GDPR
- Right to data portability pursuant to Article 20 of the GDPR
- Right to object under Article 21 of the GDPR
- Automated decision-making in individual cases, including profiling, in accordance with Article 22 of the GDPR.
Right to Information
You have the right to ask us whether we are processing any of your personal data and, if so, what data we are processing, as well as to request copies of your personal data from us. Please note that your right of access may be restricted under certain circumstances in accordance with applicable laws.
Right to rectification
If the information concerning you is no longer accurate, you have the right to request that the inaccurate personal data concerning you be corrected without delay and, where necessary, that incomplete personal data be completed.
Right to erasure
In accordance with legal requirements, you have the right to request that data concerning you be deleted immediately, for example, if the data is no longer needed for the purposes for which it was collected and there are no legal retention or archiving requirements that prevent its deletion.
Right to restriction of processing
Under the provisions of Article 18 of the GDPR, you have the right to request that the processing of your personal data be restricted, for example, if you have objected to the processing, for the duration of the review to determine whether your objection can be upheld.
Right to data portability
You have the right to receive the data you have provided to us, or to have it transferred to a third party, in a commonly used, machine-readable format. If you request that the data be transferred directly to another controller, this will only be done to the extent that it is technically feasible.
Right to withdraw consent under data protection law
If the processing of your personal data is based on consent you have provided to us, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal.
Please send your withdrawal notice in any form to HiCo Hartmann & Co. KG, Römerweg 12, D-78727 Oberndorf-Hochmössingen, thomas.hartmann@zentrierspanner.de. Please note that your objection may also apply to other procedures or, for technical reasons, must apply to them. Further information on this can be found in the respective services described.
Right to object to processing
Under the conditions set forth in Article 21(1) of the GDPR, you may object to data processing based on Article 6(1)(e) or (f) of the GDPR for reasons arising from your particular situation. This also applies to profiling based on these provisions. If you exercise your right to object, we will no longer process your personal data in question, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
Please submit your objection in writing to HiCo Hartmann & Co. KG, Römerweg 12, D-78727 Oberndorf-Hochmössingen, thomas.hartmann@zentrierspanner.de. Please note that your objection may also apply to other processes or, for technical reasons, must apply to them. You can find further information on this in the respective service descriptions.
Right to file a complaint with the data protection authority
Under Article 77 of the GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that your personal data is not being processed lawfully.
Automated decision-making in individual cases, including profiling
You have the right not to be subject to a decision based solely on automated processing—including profiling—that produces legal effects concerning you or similarly significantly affects you.
Use of Online Services
Below, we explain when and in what context data is processed when you use our online services.
Collection of Personal Data When Visiting Our Website
When you use the website solely for informational purposes—that is, if you do not register or otherwise provide us with information—we collect only the personal data that your browser transmits to our server. When you view our website, we collect the data listed below. This data is technically necessary to display our website to you and to ensure the stability and security of the display. The legal basis for storing information in the form of cookies or in the server log file on your device, or for accessing this information on your device, is Section 25(2)(2) of the German Telemedia Act (TDDDG). The associated data processing is based on Article 6(1)(f) of the General Data Protection Regulation (GDPR):
- IP address
- Date and time of the request
- Time zone difference from Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access Status / HTTP Status Code
- amount of data transferred in each case
- Website from which the request originates
- Browser
- Operating system and its user interface
This data is temporarily stored in our system’s log files for a maximum of seven days. Storage beyond this period is possible; however, in such cases, the IP addresses are partially deleted or anonymized so that the requesting client can no longer be identified.
Use of Cookies
In addition to the data mentioned above, cookies are stored on your device (e.g., PC, laptop, smartphone) when you use our website. Cookies are small text files that are stored on your device and associated with the browser you are using, and through which certain information is transmitted to the entity that sets the cookie (in this case, us). Cookies cannot execute programs or transfer malware to your devices. They serve to make the online offering more user-friendly and effective overall.
This website uses the following types of cookies, the scope and functionality of which are explained below:
Session Cookies
Transient cookies are automatically deleted when you close your browser. These include, in particular, session cookies. These cookies store a so-called session ID, which allows various requests from your browser to be associated with the same session. This enables your computer to be recognized when you return to our website. Session cookies are deleted when you log out or close your browser.
Persistent cookies
Persistent cookies are automatically deleted after a specified period of time, which may vary depending on the cookie. You can delete these cookies at any time in your browser's security settings.
We use cookies on our website that are generated by us as the website operator and are necessary for the full functionality and presentation of our website. The legal basis for storing information in the form of cookies on your device or accessing this information on your device is Section 25(2)(2) of the German Telemedia Act (TDDDG). We use these cookies based on a legitimate interest pursuant to Article 6(1)(f) of the GDPR to ensure the proper functioning of our online service.
In addition to the cookies we set as the data controller, we also use cookies provided by other providers. We process these cookies based on your consent in accordance with Article 6(1)(a) and Section 25(1) of the TDDDG (storage of cookies or access to information on a device, e.g., via device fingerprinting). Further information regarding the use of cookies and our collaboration with external service providers can be found in the privacy policies of the respective online services.
You can configure your browser settings as you wish and, for example, refuse to accept cookies from third-party providers or all cookies. Please note, however, that this may prevent you from using all features of this website. If you have consented to the use of cookies and wish to revoke that consent in the future, you can delete the stored cookies in your browser settings.
Cookie Settings in Web Browsers
Web browsers can be configured to notify you when cookies are set, or to block or disable cookies entirely or partially. By disabling and deleting all cookies, you can also revoke any consent you previously provided. If you disable or restrict cookies using your browser, certain features on our website may not be available to you. You can delete stored cookies at any time using your web browser, including automatically.
You can use the following links to learn more about these features in the most commonly used browsers:
Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-informationen-websites-auf-ihrem-computer
Google Chrome: https://support.google.com/chrome/bin/answer.py?hl=de&answer=95647
Apple Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac
Microsoft Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Microsoft Edge: https://support.microsoft.com/de-de/help/4027947/microsoft-edge-delete-cookies
Opera: https://help.opera.com/de/latest/web-preferences/
If no restrictions have been applied to your cookie settings, cookies that enable and ensure the necessary technical functions will remain on your device until you close your browser; other cookies may remain on your device for a longer period. The exact cookie durations are displayed by the respective services used.
SSL or TLS encryption
Our website uses TLS encryption (formerly SSL) to ensure security and protect the transmission of confidential information. Orders or contact requests you send to us are therefore transmitted using transport encryption. Depending on your browser type, you can recognize this by the padlock icon and/or the “https” protocol in the address bar.
External Hosting
We host our website externally. The personal data collected on this website is stored on the servers of the hosting provider(s). This may include all information relating to users of our online service that is generated during use and communication, such as, in particular, content data (e.g., entries in online forms); usage data (e.g., websites visited, access times); and meta/communication data (e.g., device information, IP addresses).
We collect the aforementioned data to ensure the secure, fast, and efficient provision of our online services. The legal basis for storing information in the form of cookies on your device or accessing this information on your device is Section 25(2)(2) of the German Telemedia Act (TDDDG). The associated processing of your data is carried out in accordance with Article 6(1)(f) of the GDPR based on our legitimate interest in the proper display and functionality of our website.
We use the following hosting providers:
Mittwald CM Service GmbH & Co. KG, 4–6 Königsberger Street, 32339 Espelkamp
For more information on data protection, please visit https://www.mittwald.de/datenschutz.
We have also entered into a data processing agreement (DPA). This agreement governs the scope, nature, and purpose of the access rights granted to the aforementioned provider(s) regarding the data. These access rights are limited solely to what is necessary to provide the hosting services in compliance with the GDPR.
Contact Us
Contact Form
When you contact us via a contact form, the data you provide (your email address, your name if applicable, your phone number, and the content of your message) will be stored by us in order to respond to your inquiry. The processing of the data entered in the contact form is based on your consent pursuant to Art. 6(1)(a) GDPR. If your contact request is related to the performance of a contract or the implementation of pre-contractual measures, we process your data based on Art. 6(1)(b) GDPR. We will delete the data collected in this context once storage is no longer necessary, or restrict processing if statutory retention obligations apply. You may revoke this consent at any time. The lawfulness of the data processing operations carried out prior to revocation remains unaffected by the revocation.
Inquiries by email or phone
When you contact us by email, phone, or fax, we will store the personal data you provide (your email address, your name if applicable, your phone number, and the content of your message) in order to process your inquiry. We will not share this data without your consent.
Data processing is based on Article 6(1)(b) of the GDPR if your inquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, we process your data based on your consent pursuant to Article 6(1)(a) of the GDPR and/or on our legitimate interests pursuant to Article 6(1)(f) of the GDPR. Our legitimate interest lies in particular in the effective handling of your request.
The data you send us via contact requests will remain with us until you request that we delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your request has been processed). Mandatory legal provisions—in particular statutory retention periods—remain unaffected.
Marketing Tools
Social Media Plugin: Custom Facebook
Our website uses the “Custom Facebook and Instagram Feed by Smash Balloon” plugin, which integrates content we post on the social networks Facebook and Instagram, operated by Me-ta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
When you visit our website, the plugin establishes a direct connection between your browser and the Facebook server. This informs Facebook that you have visited our website using your IP address.
If you visit our site and consent to the loading of external media, Facebook may associate your visit to our site with your user account. Please note that, as the provider of the site, we have no knowledge of the content of the data transmitted or how Facebook uses it.
For more information, please see Facebook's Privacy Policy at https://de-de.facebook.com/policy.php
If you do not want Facebook to associate your visit to our site with your Facebook account, please use a VPN connection and log out of your Facebook account.
Embedded third-party content
Social media content
In order to enhance the user experience on our website, we also embed content from third-party providers (social media platforms). Subject to your consent, your browser establishes a direct connection to the servers of the respective third-party provider as soon as this content is loaded and displayed.
In this process, the third-party provider always processes your IP address, which is necessary to establish a connection to the third-party provider’s server and to display the content, as well as any additional device-related information required for technical reasons (screen resolution, browser, and operating system).
To protect your data, we explicitly notify you before displaying external content and transmitting data to third-party providers. Visitors to our website can then independently consent to the data transfer and view the content with a single click (“two-click solution”). You can also give your consent to the display of external content via our consent banner. You can revoke this setting at any time in the cookie settings.
The legal basis for processing the data following the user’s consent is Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.
Details about individual providers:
You can use the links below to learn about the respective providers’ privacy policies and how they process your data:
LIST:
Facebook Content: We use the Facebook plugin to integrate content from our own Facebook pages or those of other providers into our website. Meta's Privacy Policy: https://www.facebook.com/privacy/explanation.
Instagram Content: Instagram’s embed feature allows us to integrate images and videos from Instagram into our pages. For Meta’s privacy policy: https://www.instagram.com/legal/privacy/.
Google Maps
We have added a link to Google Maps on our website so you can more easily locate us on a map. [Clicking on our “Directions” tab will take you directly to the Google Maps website].
Please note that we have no control over the content or data processing practices of external third-party websites.
Third-party provider information: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.
For more information about the purpose and scope of data collection and its processing by Google, please refer to the provider’s privacy policy. There you will also find further information regarding your rights in this regard and settings options for protecting your privacy: https://policies.google.com/privacy?hl=de&gl=de.
Google Fonts (Local)
We use “Google Fonts” on our website, a service provided by Google Ireland Limited (hereinafter referred to as “Google”). This service allows us to use external fonts, known as Google Fonts. The Google Fonts are installed locally on our server. No connection is established with Google’s servers.
Use of social plugins
We use plugins from the social networks listed below on our website. To integrate these plugins, we use
the privacy-friendly “Shariff” buttons. It is not the user’s browser, but the server hosting the website that establishes a connection with the server of the respective social media platform. The user remains anonymous. Information about the user’s activity is only collected by the respective social network once the buttons are clicked.
We have no control over the data collected or the data processing operations, nor are we aware of the full scope of data collection, the purposes of processing, or the retention periods. We also have no information regarding the deletion of the collected data by the plugin provider.
The plug-in provider stores the data collected about you in user profiles and uses this data for advertising, market research, and/or to tailor its website to your needs. Such analysis is carried out in particular (even for users who are not logged in) to display targeted advertising and to inform other users of the social network about your activities on our website. You have the right to object to the creation of these user profiles; to exercise this right, you must contact the respective plug-in provider. Through the plugins, we offer you the opportunity to interact with social networks and other users, so that we can improve our offering and make it more interesting for you as a user. The legal basis for the use of the plugins is Art. 6(1)(f) GDPR.
Data is shared regardless of whether you have an account with the plugin provider and are logged in there. If you are logged in with the plugin provider, the data we collect about you is directly linked to your existing account with the plugin provider. If you click the activated button and, for example, share the page, the plugin provider will also store this information in your user account and share it publicly with your contacts. We recommend that you log out regularly after using a social network, but especially before activating the button, as this will help you avoid having the action associated with your profile on the plugin provider’s platform.
For more information on the purpose and scope of data collection and processing by the plugin provider, please refer to the privacy policies of these providers listed below. There you will also find further information about your rights in this regard and options for adjusting settings to protect your privacy.
The following social media plugins are integrated into our website: only Facebook on the old DSE site
Facebook:
Provider: Meta Platforms, Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Agreement on the Joint Processing of Personal Data on Facebook Pages: https://www.facebook.com/legal/terms/page_controller_addendum
Privacy Policy: https://www.facebook.com/about/privacy
Opt-out option: https://www.facebook.com/settings?tab=ads
Instagram:
Provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland Privacy Policy: http://instagram.com/about/legal/privacy
Opt-out option: http://instagram.com/about/legal/privacy