Data privacy

Data privacy statement

Effective date: 10/02/2026

Controller
Schmitz-Metallographie GmbH
Kaiserstraße 100, 52134 Herzogenrath, Germany
Phone: +49 2407 568296-0
Email: info@schmitz-metallographie.de

Scope
This policy applies to

  • metallographie.shop
  • schmitz-metallographie.de

Data protection contact (no Data Protection Officer appointed)
No Data Protection Officer is appointed. For privacy matters please contact the management via the contact details above.

Legal bases, purposes, retention

  • Legal bases: Art. 6(1)(a) consent, (b) contract, (c) legal obligation, (f) legitimate interests GDPR; for non-essential cookies: Sec. 25 TTDSG.
  • Purposes: website operation and security, communication, customer/order processing, web analytics/marketing.
  • Retention: only as long as necessary; statutory retention periods (e.g., HGB/AO) remain unaffected.

Server logs

  • Data: IP address, date/time, URL, referrer, browser/user agent, OS, HTTP status, transferred data volume.
  • Purpose: technical operation, stability, IT security, error analysis.
  • Legal basis: Art. 6(1)(f) GDPR.

Cookies & consent

  • Necessary cookies: Art. 6(1)(f) GDPR.
  • Preference/statistics/marketing cookies: only with consent (Art. 6(1)(a) GDPR; Sec. 25 TTDSG).
  • Manage/withdraw consent via the consent banner and your browser settings.

Contact
Email and phone

  • Channels: Phone +49 2407 568296-0, Email info@schmitz-metallographie.de
  • Data: name, contact details, your message.
  • Purpose: handling your inquiry and communication.
  • Legal basis: Art. 6(1)(b) GDPR (pre-/contractual) or Art. 6(1)(f) GDPR; if expressly given: Art. 6(1)(a) GDPR.

CRM
SmartWe (CAS ecosystem)

  • Provider: SmartWe World SE, Karlsruhe, Germany.
  • Purpose: customer/lead management, offers/contracts, service, communication, history.
  • Legal basis: Art. 6(1)(b) and (f) GDPR; if applicable (a).
  • DPA in place; EU processing.

ERP/WMS
JTL (JTL‑Wawi/JTL‑Shop)

  • Purpose: order processing, stock/warehouse, shipping, invoices, customer service.
  • Legal basis: Art. 6(1)(b) GDPR; (f) for internal organisation.
  • DPA in place; EU processing.

Payments

  • Bank transfer/advance payment via your bank; no PayPal; no WhatsApp.

Carriers & shipping plugins (metallographie.shop)

  • Purpose: shipping processing, labels, tracking, tariffs/zones.
  • Legal basis: Art. 6(1)(b) GDPR; (f) for efficient logistics.
  • DPAs with plugin providers; carriers usually act as independent controllers.

Web analytics & advertising
Google Analytics and Google Ads

  • Applies to both domains; IP anonymization enabled in Analytics; consent required (Art. 6(1)(a) GDPR; Sec. 25 TTDSG). Opt-out via browser add-on and consent banner; Ads opt-out via Google Ad Settings/NAI.

Third-party embeds/plugins

  • Only if used (e.g., YouTube, Maps, reCAPTCHA, fonts/CDNs). Legal basis: consent or legitimate interests.

Hosting/IT services

  • Host: aiges GmbH, Manching, Germany. DPA pursuant to Art. 28 GDPR; EU processing.

Recipients

  • IT/hosting (aiges), CRM (SmartWe), ERP (JTL), carriers & shipping plugins, authorities when legally required. DPAs with processors.

Your rights

  • Access, rectification, erasure, restriction, data portability, objection, withdrawal, complaint to a supervisory authority.

Provision of data

  • Required for contract/order processes; otherwise voluntary.

Automated decisions/profiling

  • No automated individual decisions; profiling for marketing only with consent.

Security

  • SSL/TLS, role-based access, encryption, backups, TOMs per Art. 32 GDPR.

Third-country transfers

  • Only where necessary (e.g., Google); safeguarded by adequacy/DPF or SCCs and supplementary measures.

Changes

  • This policy will be updated when services or laws change; current date at the top.