This page explains which personal data we process when you visit this website, for what purpose, on what legal basis and to whom we pass it on. The website is transmitted in encrypted form. We do not use automated decision-making or profiling.

The website is hosted by Render (Render Services, Inc., USA) and delivered via Cloudflare (Cloudflare, Inc., USA). Images and videos are delivered by Sanity (Sanity AS, Norway), the system in which we manage our content. When you open a page, these providers process technically necessary access data:

- IP address

- date and time of access

- page or file requested and amount of data transferred

- page you came from

- browser and operating system

The legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR). The data is deleted as soon as it is no longer needed for operation and security. Render and Cloudflare are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision.

We count visits with Plausible Analytics (Plausible Insights OÜ, Estonia, servers in Germany). Plausible does not set cookies and stores nothing on your device. It records the page visited, the referring page, country, device type, browser and operating system. Your IP address is not stored; it is only used in encrypted form with a daily changing key to count visits. We only see aggregated statistics. The legal basis is our legitimate interest in improving the website based on its use (Art. 6(1)(f) GDPR).

The cart and checkout are run by Shopify (Shopify International Limited, Ireland). To keep your cart for your next visit, we store a cart ID in your browser’s local storage. This entry contains no personal information and is strictly necessary for the cart function you use (Section 25(2) No. 2 TDDDG).

To place an order, you are redirected to Shopify’s checkout page, where you enter your name, address, email address, phone number if applicable, and payment details. We and Shopify process this data to handle, deliver and invoice your order (Art. 6(1)(b) GDPR). Payment is handled by the payment provider you choose, which receives your payment details for this purpose. For delivery, we pass your name and address to the shipping company we use. Shopify may transfer data to Shopify group companies in Canada and the USA. For Canada there is an adequacy decision of the European Commission; for the USA, Shopify relies on appropriate safeguards such as standard contractual clauses. Details can be found in Shopify’s privacy policy.

You are not obliged to provide this data, but without it we cannot process an order. We keep order and invoice data for up to ten years in accordance with commercial and tax law (Art. 6(1)(c) GDPR in conjunction with Section 147 AO and Section 257 HGB).

If you sign up for our newsletter on the home page, we use your email address to send you news about Formfeld’s projects and developments. The legal basis is your consent (Art. 6(1)(a) GDPR). Your sign-up is passed via Netlify (Netlify, Inc., USA, certified under the EU-U.S. Data Privacy Framework) to our mailing service Brevo (Sendinblue SAS, France), which stores the address and sends the newsletter. Brevo records whether a newsletter is opened and which links are clicked, so we can see which topics are of interest. This is also covered by your consent. You can unsubscribe at any time via the link in each issue or by emailing info@formfeld.net. Your address will then be removed from the list.

On the “Dealers” page we show a map from Mapbox (Mapbox, Inc., USA). Only when you open this page does your browser load map data from Mapbox, which transmits your IP address and technical information about your browser to Mapbox. The legal basis is our legitimate interest in presenting our dealers clearly (Art. 6(1)(f) GDPR). Mapbox is certified under the EU-U.S. Data Privacy Framework.

If you contact us by email or phone, we process your details to answer your enquiry. If it concerns a quote or an order, the legal basis is Art. 6(1)(b) GDPR; otherwise it is our legitimate interest in responding (Art. 6(1)(f) GDPR). We delete your details once the enquiry has been dealt with and no retention obligations apply.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw your consent at any time with effect for the future (Art. 7(3)). An email to info@formfeld.net is sufficient. Data we are legally required to retain is blocked instead of deleted. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, www.lda.bayern.de).

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). Please write to info@formfeld.net.

Last updated: October 2026