Privacy notice

1. Controller

The controller is Positive Group Deutschland GmbH, Ingeborg-Krummer-Schroth-Straße 18a, 79106 Freiburg im Breisgau, Germany, represented by managing director Mathieu Tarnus. You can write to this postal address or email [email protected].

2. Hosting and technical access data

The website is hosted on a virtual server in Germany. Accessing a page involves processing connection data needed to transmit it, including IP address, date and time, requested resource, data volume and response status, browser and operating system details, and any referring address transmitted by your browser.

This processing delivers the content, identifies technical faults and protects against attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is an available and secure website. The hosting provider receives the data needed to operate, maintain and protect the service. Security-related log data is processed only to the extent necessary for these purposes.

3. Cloudflare for domain resolution and delivery

We use Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to manage the domain’s DNS. Domain resolution connects the requested name to the appropriate server and involves technical DNS query data.

When proxying is enabled, website traffic also passes through Cloudflare’s network. Cloudflare then processes information such as IP addresses, request metadata and security information to deliver and cache content and defend against attacks and harmful automated traffic. In a DNS-only configuration, HTTP/HTTPS content is delivered directly by the web server.

Necessary technical delivery and security processing rely on Article 6(1)(f) GDPR. Processing may take place outside the EU or EEA. Cloudflare describes its processing and transfer mechanisms in the Cloudflare privacy information and Cloudflare data processing terms.

4. Cookies, language and content

The website itself uses no analytics or advertising cookies, visitor profiles, local storage or session storage. Switching language opens the German or English version without storing a preference. Fonts are system fonts; graphics, stylesheets and scripts load through this domain. There is no newsletter signup, payment function, embedded map or video.

When Cloudflare security features are enabled, technical cookies may be used to protect against bots or remember a security check result. Examples include __cf_bm and cf_clearance. The cookies used and their duration depend on the security feature triggered; see the Cloudflare cookie information for details.

Access to your device that is strictly necessary to transmit communications or provide the secure page access you expressly request is governed by section 25(2) TDDDG. Where additional consent is required, it is obtained before the relevant access. Personal data processing necessary for security relies on Article 6(1)(f) GDPR.

5. Contacting us

If you send an email or letter, we process the information you provide, particularly your name, contact details, business context and message content, to handle and answer your enquiry. An email link opens your email application; the message is transmitted only when you send it. Email providers may handle technical transmission, delivery and security.

Article 6(1)(b) GDPR applies to enquiries concerning a contract with you personally. For business contact persons and other enquiries, processing relies on Article 6(1)(f) GDPR and our legitimate interest in appropriate communication. Please send special categories of personal data or confidential documents only after prior agreement.

6. Preparing contracts and project work

We process the contact, order and accounting data needed for quotations, contract performance and invoicing. Legal bases include Article 6(1)(b) and (c) GDPR and, for business contact persons, Article 6(1)(f) GDPR.

Where personal data is processed on behalf of a customer within a project, the project-specific Article 28 GDPR agreement additionally governs tasks and safeguards. This website has no recipient-list upload function. Visiting the website or making an enquiry does not automatically add you to an advertising distribution list.

7. Email advertising and objections

Advertising emails generally require prior express consent. The existing-customer exception is available only if every condition of section 7(3) of the German Act Against Unfair Competition is met. Data protection requirements are considered separately. Further requirements are set out in our Anti-Spam Policy.

Consent records and necessary suppression entries are processed only to the extent needed to demonstrate permission to contact recipients and respect objections. You can unsubscribe using the option in the message or by contacting [email protected].

8. Recipients and international processing

Recipients may include employees responsible for your enquiry and hosting, IT security, communications and email providers. Public authorities or professional advisers may also receive data where required by law or necessary to exercise legitimate rights. Providers receive data within the scope of their assigned tasks.

Cloudflare may process data in the United States and other countries. Cloudflare identifies the EU-U.S. Data Privacy Framework for covered US transfers and standard contractual clauses for further or alternative safeguards where needed. The relevant transfer and applicable agreements determine the mechanism; hosting a server in Germany does not confine all processing to Germany. Information about the mechanisms is available in the Cloudflare documents linked above. You can contact us for further information about processing relevant to you.

9. Retention

Personal data is deleted when it is no longer needed for its purpose unless a statutory retention requirement or another legal basis applies. Necessary retention of technical access data depends on delivery, fault diagnosis and the prevention or investigation of specific security incidents. Longer retention may be necessary to investigate an incident or establish, exercise or defend legal claims.

Enquiry data is deleted after the matter is concluded unless a business relationship follows or another retention basis applies. Contract and accounting records may be subject to statutory retention periods. Consent evidence and suppression entries are retained only as long as, and to the extent, needed to demonstrate permission to contact a recipient or respect an unsubscribe request.

10. Your rights

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability under Articles 15 to 20 GDPR. You may withdraw consent at any time for the future without affecting the lawfulness of processing before withdrawal.

Right to object: Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving a reason. Please contact [email protected].

You may complain to a data protection supervisory authority, particularly where you habitually live or work or where the alleged infringement occurred. The Baden-Württemberg State Commissioner for Data Protection and Freedom of Information is one possible contact for the company’s registered location.

11. Providing data and automated decisions

Technical data needed for transmission arises when you access a page. You provide enquiry details voluntarily; without necessary information, we may be unable to answer your enquiry. We do not use this website to make automated decisions producing legal or similarly significant effects under Article 22 GDPR. Technical security checks may restrict website access where attack or abuse patterns are identified.