Privacy policy

Marc Mintel, Cable Creations, Georg-Meistermann-Straße 8, 54586 Schüller, Germany. Email: info@cablecreations.de. Further details can be found in our legal notice.

We are not obliged to appoint a data protection officer and have not appointed one. For all questions about data protection, you can reach us at info@cablecreations.de.

• We use no advertising or tracking cookies and embed no third-party services in our pages: no fonts, maps, videos or scripts from other servers. Everything your browser loads comes from our own server.
• We count page views without cookies and without storing your IP address. We measure what you click on our pages only if you allow it.
• Our servers are located in data centers in Germany.
• Data that our customers store on the platform about other people (for example, inquiries from their catalogs) is processed by us only on their behalf.

The website and platform run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centers in Germany; the database, file storage and backups are also located there. Hetzner processes the data as our processor (Art. 28 GDPR) and is certified to ISO/IEC 27001.

With every request, your browser transmits technically necessary data to our server: IP address, date and time, the address requested, the amount of data transferred, status code, and browser and operating system (user agent). We use this data to deliver the pages and to detect attacks and errors. In our access logs we store the IP address only in shortened form (IPv4 without the last byte, IPv6 truncated to the first 48 bits), so that it can no longer be attributed to a connection; sign-in links and other identifiers in addresses are removed before storage. The logs are continuously overwritten.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.

We use only cookies and entries in your browser's storage that are strictly necessary for the service you have expressly requested (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG)). No consent is required for this. The only exception is the measurement of clicks; it is described in the next section and runs only with your consent.

Within the platform, your browser also stores settings and drafts that remain on your device only: the view of tables, dismissed notes, messages not yet sent, the Academy's sound settings and, in the sales folder, images and data for use without an internet connection. These entries are not transmitted to us; you can delete them at any time in your browser's settings.

Where personal data is processed in this context, the legal basis is Art. 6(1)(b) GDPR (provision of the customer account) or Art. 6(1)(f) GDPR (security of sign-in, your chosen settings).

To understand which pages are used and where we need to improve our services, we measure the use of our website and our customer portal with the open-source software Umami. Umami runs on our own server at Hetzner in Germany; the data is not passed to any third party. Our customers' catalogs, showcases, embeds and share links, and our internal area, are never measured.

Page views (without consent). Our server itself reports each page view to Umami. No script runs in your browser for this, and nothing is stored on or read from your device. What is stored is the address requested (without identifiers and without query parameters, except campaign information such as “utm_source”), the website you came from, browser, operating system, device type and language, and the country, region and city derived from your IP address. Umami does not store your IP address itself. To be able to count visits, Umami creates a hash from the IP address and browser identifier using a key that changes every month; you cannot be recognized through it beyond that period. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is designing our services to meet demand.

Interactions (only with your consent). If you allow it, your browser additionally reports which buttons and links you click, which files you download, which forms you submit (never their content), how far you read a page, and the size of your screen. These reports go to our own server and from there to Umami. The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

Conversions. When you submit or confirm a registration, accept a quote or create developer access, our server reports this event to Umami without your email address or any other details about you (Art. 6(1)(f) GDPR).

Your choice. You can withdraw your consent at any time via “Privacy settings” at the bottom of every page; the measurement of interactions then ends immediately. If your browser sends the “Do Not Track” or “Global Privacy Control” signal, we measure nothing at all, not even page views, and do not ask.

We delete the measurement data no later than 25 months after it was collected.

When you write to us, we process your details (name, email address, company, content of your message) in order to respond to your inquiry. The legal basis is Art. 6(1)(b) GDPR if your message concerns or prepares a contract with us, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding).

We operate our email server ourselves on our server at Hetzner. We send outgoing emails via the Amazon Simple Email Service of Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in its data center in Frankfurt am Main, as a processor. For transfers to the United States, see Transfers to third countries.

We store messages sent through the contact form with the page they came from and the time of your consent; you receive a confirmation of receipt by email that does not repeat your message. We delete these entries 12 months after receipt. We use your IP address only briefly to limit mass submissions and do not store it with the message. We keep emails for as long as necessary for handling them and for a possible business relationship; business correspondence relating to a contract in accordance with the retention periods under commercial and tax law (6 and 8 years respectively).

For a customer account, we process your business email address, your name, the company you act for, your password (only as a cryptographic hash), your role in the organization and, if you set it up, the key for the second factor. When registering, you confirm your email address via a link that is valid for 24 hours; we delete unconfirmed registrations after that. We store which version of our terms and conditions and of the data processing agreement you accepted and when, as proof, without an IP address.

For the security of your account, we store the IP address and browser identifier for each session; you can see both under “Security” and end unfamiliar sessions there. We delete session data 30 days after the session expires. We count failed sign-in attempts per account (as a hash of the address) and per IP address in order to slow down attacks; we delete these counters 30 days after the last failed attempt. We delete links for setting or resetting a password 30 days after they expire.

The legal basis is Art. 6(1)(b) GDPR (provision of the account) and, for the security measures, Art. 6(1)(f) GDPR (protection of your account and our systems). We store your account data for as long as your account exists. If your membership in an organization ends, only the details needed to keep orders traceable (who ordered what and when) are retained. You can ask us to delete your account at any time.

What you and your colleagues create, upload and order on the platform (cable data, datasheets, logos, images, messages about orders, catalog content) is processed by us to perform the contract with your company (Art. 6(1)(b) GDPR). Where this content contains personal data of other people, we process it as a processor under the data processing agreement.

We store on which days a member used the platform, with the first and last time of the day and the number of active ten-minute intervals, without the pages viewed, IP address or browser. Only our staff see these details; we use them to recognize whether a customer needs help getting started. The legal basis is Art. 6(1)(f) GDPR; we delete the details after 400 days.

So that we can support customers with questions and errors, our staff can view an organization's portal as its members see it, or act on its behalf. Every such access is limited in time and logged; your portal shows what our staff have created (Art. 6(1)(b) and (f) GDPR).

For the Academy's learning content, we store your learning progress (points, answered cards, badges, certificates). We delete individual learning sessions 30 days after they end. Your colleagues see learning figures only as a total from five learners upward, without names.

For quotes, order confirmations, invoices, credit notes and payment reminders, we process company name, address, VAT identification number, billing email address, contact person, and the name, position and email address of the person who accepts a quote. The legal bases are Art. 6(1)(b) GDPR and, for retention and tax audits, Art. 6(1)(c) GDPR.

We create quotes and invoices with Lexware Office of Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany, as a processor. We verify VAT identification numbers through the European Commission's VAT Information Exchange System (VIES).

You pay by bank transfer. If you choose the PayPal payment link offered on the invoice, the privacy policy of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, which is responsible for it in its own right, applies to that payment.

We keep invoices and accounting records for 8 years and commercial and business letters for 6 years, in each case from the end of the calendar year (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)).

We approach companies for which our services may be a good fit. For this purpose, we store, for companies and their contact persons, name, position, business email address and telephone number, our notes on conversations, and the sender, recipients, subject and beginning of emails we exchange with them. This data comes from the persons themselves, from trade fairs, from referrals or from publicly accessible sources such as company websites, industry directories and professional networks.

If we send you a personal presentation, we count whether, when and how often it was opened and up to which section, without an IP address and without device data, so that we follow up at the right time.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is initiating and maintaining business relationships (Recital 47 GDPR). We send promotional emails only where the law permits it (Section 7 of the German Act Against Unfair Competition (UWG)). If no business relationship comes about, we anonymize the details no later than 24 months after the last contact. You can object to this processing at any time; we will then no longer contact you and will delete your details except for a blocking note.

Our customers publish their own product catalogs through the platform, send showcases and share links, and embed catalogs in their websites. The respective manufacturer is responsible for the data of the visitors to these pages, for inquiries submitted through their forms and for their audience measurement; we process this data only on the manufacturer's behalf. Which data is processed in this context is set out in the manufacturer's privacy policy, which is linked on each of these pages.

Within our company, only the staff who need your data for their tasks receive it. Outside our company, personal data is received only by the following service providers, each as a processor under a contract pursuant to Art. 28 GDPR, and by authorities where we are legally obliged to disclose it.

We process your data in Germany. Amazon Web Services processes outgoing emails in Frankfurt am Main; access from the United States can nevertheless not be ruled out. Amazon Web Services, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR); in addition, the EU Standard Contractual Clauses apply.

We delete personal data as soon as the purpose no longer applies and no statutory retention obligation prevents deletion. In detail:

You have the right of access to the data we store about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to receive the data you have provided to us in a commonly used, machine-readable format (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To do so, simply write to us at info@cablecreations.de; no particular form is required. If your request concerns data we process on behalf of one of our customers, we forward it to that customer.

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defense of legal claims.

You can object to the processing of your data for direct marketing purposes at any time without giving reasons (Art. 21(2) GDPR); we will then no longer use it for this purpose. An informal note to info@cablecreations.de is sufficient.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.

You do not have to provide us with any data to visit the website. Without the details required for an account or a contract, we cannot conclude either. No decision based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR takes place.

We adapt this policy when our processing or the legal situation changes. The version published here applies.