Privacy notice

The controller for the processing of personal data on this website is:

Company

Filterfabrik UG (haftungsbeschränkt)

Address

Gottschedstraße 27, 04109 Leipzig, Germany

Represented by

Nora Steinbach

Email

hallo@filterfabrik.de

Telephone

+49 341 3927481

We are not required to appoint a data protection officer. Please send data protection enquiries to the email address above; we answer within one month.

We collect only the data we genuinely need for the purpose at hand. We do not sell data, we do not build profiles and we use no advertising or tracking services. No automated decision-making within the meaning of Art. 22 GDPR takes place.

This website is hosted by a processor inside the European Union. When you open a page, technically necessary access data is written to a log file:

• the shortened IP address of the requesting device
• the date and time of the request
• the address requested and the volume of data transferred
• the response status code, the referrer and the browser identifier

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the stable, secure operation of the site and the defence against attacks. Log data is deleted after 14 days and is never combined with other sources.

A data processing agreement under Art. 28 GDPR is in place with the hosting provider.

We set no analytics, marketing or social media cookies. We store exactly two entries in your browser’s local storage:

• your choice in the cookie notice, so that we do not ask again on every visit
• the contents of your basket, so that it survives while you keep browsing

Both entries stay on your device and are never transmitted to us. The legal basis is § 25 (2) TDDDG, because both are strictly necessary for the service you have asked for. You can delete them at any time in your browser settings, and you can change your cookie choice at any time via the “Cookie settings” link in the footer.

The map on the home page does not load automatically. You first see only a static panel showing our address. A connection to the servers of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom, is established only once you explicitly activate the map. Your IP address and browser data are then transmitted to that provider.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw that consent at any time with effect for the future by reloading the page without activating the map. Until you activate it, not a single request is sent to a third party. Our address and directions are also given in full in the page text.

When you order coffee through the basket, we process your name, email address, the items ordered and — if you choose delivery — your shipping address. Optional notes are processed only if you write them.

The legal basis is Art. 6 (1) (b) GDPR, as the processing is necessary to perform the purchase contract. We pass the shipping address to the carrier we instruct; without that we cannot deliver. We do not collect payment details on this website.

Order and invoice data is retained for six and ten years respectively under the commercial and tax retention duties of § 257 HGB and § 147 AO. For that period the processing is justified under Art. 6 (1) (c) GDPR, and the data is blocked from everyday use.

Through the contact form we process your name, email address, the topic you select and your message. For a brew class booking we additionally process your preferred date and the number of seats.

The legal basis is Art. 6 (1) (b) GDPR where your enquiry is aimed at a contract, otherwise Art. 6 (1) (f) GDPR with our legitimate interest in answering enquiries. We delete enquiries once they are settled, at the latest after twelve months, unless a statutory retention duty applies.

For the “Röstplan” newsletter we need only your email address. We use the double opt-in procedure: after you sign up you receive an email with a confirmation link, and only then do we add you to the list. We log the time of sign-up and of confirmation as evidence of consent.

The legal basis is your consent under Art. 6 (1) (a) GDPR. You may withdraw it at any time, via the unsubscribe link at the foot of every issue or by an informal email to us. After withdrawal we delete your address from the list. The newsletter contains no tracking pixels; we measure neither opens nor clicks.

Personal data is disclosed only to our hosting provider, the carrier delivering your parcel, our tax advisers and, to the extent required by law, public authorities. All service providers we use process data within the European Union. No transfer to a third country takes place, apart from the map you activate yourself.

You have the following rights in relation to us:

• access to the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure, unless a retention duty prevents it (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability in a common format (Art. 20 GDPR)
• objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

An informal email to hallo@filterfabrik.de is enough. Exercising these rights is free of charge.

If you believe that we process your data unlawfully, you may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Saxon Commissioner for Data Protection and Transparency, Devrientstraße 5, 01067 Dresden, Germany.

This website is served exclusively over encrypted HTTPS, so anything you type into a form is protected against interception in transit.

We update this notice whenever our processing or the legal position changes. The version published here, with the date shown above, is the one that applies.