Datenschutzerklärung

Controller

HGL Lederwaren GmbH, Raiffeisenstraße 8, 55595 Weinsheim, Germany
Email: support@hgllederwaren.shop · Telephone: +49 1602061882

We have not appointed a data protection officer, because we are not required to under Art. 37 GDPR or § 38 BDSG. Data protection questions go to the address above and are answered by the management.

At a glance

We are a small shop. We collect what an order needs and very little else. We do not sell data, we do not run advertising pixels, we do not build profiles, and we do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR.

• Browsing the shop requires no personal data beyond the server log.
• Placing an order requires a name, an address, an email and a phone number.
• Optional analytics is off unless you switch it on. Refusing costs nothing.

Server log files

Our host records each request automatically. This is technically unavoidable for operating a website.

Data

IP address (shortened where the host supports it), date and time, page requested, referrer, browser and operating system version, transferred data volume

Purpose

Delivering the site, diagnosing faults, defending against attacks and abuse

Legal basis

Art. 6(1)(f) GDPR — our legitimate interest in a functioning, secure website

Retention

Up to 14 days, then deleted or fully anonymised

Recipients

Our hosting provider, acting as a processor under Art. 28 GDPR

Cookies and local storage

We do not set advertising or tracking cookies. What we store in your browser is listed below and in the cookie policy.

Strictly necessary

Your cart contents, your consent choice, and the spam-protection token on our forms. Stored under Art. 6(1)(f) GDPR and § 25(2) TDDDG — no consent is required for these, because the service you asked for cannot work without them.

Optional

Aggregate page counts, only if you tick the box. Legal basis Art. 6(1)(a) GDPR and § 25(1) TDDDG. Withdrawable at any time from the cookie settings link in the footer, with effect for the future.

Refusing

One click, same size and prominence as accepting. Nothing on this site is withheld from you for refusing.

Orders and delivery

Data

First and last name, delivery address, email address, telephone number, order contents and value, any delivery note you write

Purpose

Concluding and performing the purchase contract, delivering the goods, invoicing, handling withdrawals and warranty claims

Legal basis

Art. 6(1)(b) GDPR — performance of a contract. For the invoice specifically, Art. 6(1)(c) GDPR together with § 147 AO and § 257 HGB

Recipients

The shipping carrier (name, address, and phone number only where the carrier needs it for delivery); our tax adviser; the payment provider

Obligation

Providing these details is required to conclude the contract. Without them we cannot deliver an order

Retention

Ten years for invoices and contract documents under German commercial and tax law, counted from the end of the calendar year. Other order data is deleted once no longer needed

Payment

Payment is handled by an external payment service provider. When you pay, you are transferred to that provider’s own form; your card or account details are entered there and are transmitted to the provider, not to us. We receive confirmation that a payment succeeded or failed, and the reference needed to allocate it, but never the full payment credentials.

The provider is an independent controller for the payment data it collects and applies its own privacy notice. Legal basis for the transfer of the order reference and amount is Art. 6(1)(b) GDPR.

Contact form and leather consultation

Data

The details you enter: name, email, optional telephone, subject and your message; for a consultation also the intended use, what you carry and your budget band

Purpose

Answering your enquiry and any follow-up correspondence about it

Legal basis

Art. 6(1)(b) GDPR where the enquiry concerns a contract or its initiation; otherwise Art. 6(1)(f) GDPR — our legitimate interest in answering people who write to us

Obligation

None. You are free not to write to us, and you can email or call instead of using the form

Retention

Deleted six months after the matter is closed, unless commercial or tax retention rules require longer

Withdrawal function

Data

Your name, email address, order number, order and delivery dates, and the scope of the withdrawal

Purpose

Recording your withdrawal, issuing the acknowledgement required by § 356a(4) BGB and processing the refund

Legal basis

Art. 6(1)(c) GDPR — a legal obligation to provide the withdrawal function and the acknowledgement; Art. 6(1)(b) GDPR for unwinding the contract

Retention

With the associated order documents, for the statutory ten-year period

Email updates

Subscribing is optional and uses double opt-in: we record the address, the time of the request and the time of the confirmation, so we can prove the consent was given. Legal basis Art. 6(1)(a) GDPR and § 7(2) no. 3 UWG. You can withdraw at any time using the unsubscribe link in every message or by writing to us; withdrawal does not affect the lawfulness of what was sent before it. We delete the address on unsubscribe, keeping only the record needed to prove the consent existed.

Spam protection

Our forms are protected by Cloudflare Turnstile, which checks that the submission comes from a person rather than a script. It works without cookies and without tracking across sites. It processes your IP address and limited technical characteristics of your browser session. Legal basis Art. 6(1)(f) GDPR — our legitimate interest in not receiving automated spam.

Hosting and processors

This site is hosted on infrastructure operated by Vercel Inc. Data is stored and processed in European data centres for this deployment. Application data — orders, enquiries, withdrawals — is stored in a Supabase database. Both act as processors under Art. 28 GDPR on the basis of a data processing agreement. Transactional email is sent through an email service provider under the same arrangement.

Transfers outside the EU

We aim to keep processing inside the EU or EEA. Where a processor is established in a third country, the transfer is safeguarded either by an adequacy decision of the European Commission under Art. 45 GDPR, or by the Standard Contractual Clauses under Art. 46(2)(c) GDPR together with additional technical measures. You can ask us for a copy of the safeguards in place.

Retention periods, in short

• Server logs — up to 14 days.
• Cart and consent in your browser — until you clear them, consent record 12 months.
• Enquiries — six months after the matter is closed.
• Orders, invoices and withdrawals — ten years, as German tax and commercial law requires.
• Email subscription — until you unsubscribe.

Your rights

You have the following rights in relation to your personal data, free of charge:

• Access (Art. 15 GDPR) — confirmation of whether we process your data, and a copy of it.
• Rectification (Art. 16 GDPR) — correction of inaccurate data and completion of incomplete data.
• Erasure (Art. 17 GDPR) — deletion, where no retention obligation stands in the way.
• Restriction (Art. 18 GDPR) — processing limited to storage while a dispute over accuracy or lawfulness is resolved.
• Portability (Art. 20 GDPR) — the data you gave us, in a structured, commonly used, machine-readable format, transmitted to another controller where technically feasible.
• Objection (Art. 21 GDPR) — to processing based on legitimate interests, on grounds relating to your particular situation. Objection to direct marketing is absolute and takes effect immediately.
• Withdrawal of consent (Art. 7(3) GDPR) — at any time, with effect for the future.

Write to support@hgllederwaren.shop with the subject “Datenschutz”. We answer within one month, as Art. 12(3) GDPR requires, and will tell you if we need to extend that and why. We may ask for enough information to be sure the request is really yours.

Complaints to a supervisory authority

You can complain to a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR). For our registered office in Rhineland- Palatinate, the competent authority is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz.

We update this notice when our processing changes. The version date is at the top of the page.