Data Protection Policy

Scope of data collection and data storage

Enquiry handling

We require personal data in order to answer individual enquiries – for example through the enquiry form on this website, for rental requests, product information or technical support. We collect the details you enter in the form yourself: form of address, first and last name, email address, phone number, company and your message, and for rental enquiries additionally the products you selected and the details of your event (period, event name, delivery and pickup address, delivery and pickup times).

This data is stored in our content management system and forwarded for further handling to our self-hosted ERP/CRM system and to Missive, the communication system our team uses to process and answer enquiries. Both systems are used solely to handle your enquiry.

The legal basis is Art. 6(1)(b) GDPR (steps taken prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). After your enquiry has been closed we keep your data so that we can handle future enquiries more quickly and maintain a consistent quality of service, and for as long as statutory retention obligations apply.

Hosting and server log files

When you access our website, technical data is automatically transmitted to our servers and stored in log files: IP address, date and time of access, the page or file requested, browser type and version, operating system and the previously visited page (referrer).

This processing is technically necessary in order to deliver the website, ensure its stable operation and defend against attacks. The legal basis is Art. 6(1)(f) GDPR. The website, database and media storage are operated by service providers who act as processors on our behalf and are contractually bound to comply with the GDPR.

Error and security monitoring

We use Sentry to detect technical errors. If an error occurs, technical information about the error, the page requested and the browser used is processed. Processing takes place on servers in the European Union, and the transmission of personal user data is disabled. The legal basis is Art. 6(1)(f) GDPR.

Local storage in your browser

For basic website functions we store information locally in your browser: your privacy preferences including the time of your decision, and the contents of your enquiry basket. This information stays on your device, is not transmitted to us, and can be deleted at any time through your browser settings.

Google Tag Manager

To manage the services used on this website we use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager loads on every page view, including before you have made a choice. It does not set cookies of its own and does not collect data for analytics purposes – it is solely the tool through which the services described below are switched on and off. Loading it transmits your IP address to Google as a technical necessity.

Your consent decision is passed to Tag Manager and evaluated there for each individual service: services you have not consented to are blocked and do not load. The legal basis for using Tag Manager is our legitimate interest in a centrally manageable, privacy-compliant integration of these services under Art. 6(1)(f) GDPR.

Cookies and consent

Our website uses cookies and similar technologies to provide essential functions and – if you consent – to analyse how the website is used and to enable marketing activities. We deliberately do not list individual cookies here, but describe the categories they fall into. The specific set of cookies may change without the purpose or the category changing.

We distinguish four categories:

• Essential – required for the operation and basic functions of the website, for example for security and for storing your privacy preferences. This category cannot be disabled.
• Statistics and analytics – helps us understand how our website is used so that we can improve what we offer.
• Video integration – enables embedding and playback of videos from external platforms.
• Advertising and marketing – enables measurement of advertising campaigns as well as personalised advertising and remarketing.

Cookies and technologies that are not essential are only set after you have given your consent. Until then the corresponding services remain deactivated. The legal basis for this processing is your consent under Art. 6(1)(a) GDPR.

You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of the website. A withdrawal takes effect for the future and does not affect the lawfulness of processing carried out until then. We store the time of your decision in order to document your consent. Whenever we make significant changes to the services, purposes or categories covered, we increase the version of the consent banner and ask you to renew your consent.

Independently of this, you can also block or delete cookies generally in your browser. In that case, some functions of the website may not be fully available.

Services requiring consent

Statistics and analytics

To analyse how our website is used we use Umami, open-source analytics software that we operate ourselves at analytics.touchlay.com on our own server in Germany. The data is processed solely by us: it is not passed to any third party and is not processed outside the European Union.

Umami works without cookies: neither cookies nor cross-device identifiers are created. We collect the page requested, date and time of access, the previously visited page (referrer), browser, operating system, device type and screen size, your browser language, your approximate location at country level, and individual interactions – such as clicking a button or submitting an enquiry. Your IP address is processed technically during transmission but not stored: it only feeds into a pseudonymous identifier valid for one day, which does not allow you to be recognised beyond that day. It is loaded via Google Tag Manager; the analytics script is only loaded once you have consented to the "Statistics and analytics" category. The legal basis is your consent under Art. 6(1)(a) GDPR.

Advertising and marketing

If you consent to the “Advertising and marketing” category, we use Google Ads (Google Ireland Limited). Cookies are then used to measure whether a visit to our website originated from an advertisement (conversion tracking) and to show you advertising for our products on third-party websites (remarketing).

In this case Google and companies affiliated with Google may process data such as your IP address, device information and your behaviour on our website, and use that information for personalised advertising. Processing in the USA cannot be ruled out. Without your consent, no advertising cookies are set and no such data is transmitted.

You can withdraw this consent at any time via the cookie settings. In addition, you can disable personalised advertising directly in your Google ad settings.

Video integration

On individual pages we embed videos from YouTube (Google Ireland Limited). These integrations are deactivated by default: as long as you have not consented to the “Video integration” category, no connection to YouTube’s servers is established and no data is transmitted to Google.

If you enable video integration, the videos are loaded in extended privacy mode. YouTube may then set cookies and collect data such as your IP address, device information and interaction data. By enabling it you consent to this processing by YouTube and Google in accordance with their privacy policy.

Disclosure, social media and access protection

Social media

Our website contains links to our profiles on external platforms. These are pure hyperlinks – no social media plugins or embedded content from these providers are integrated into our pages, apart from the videos described above. Simply visiting our website therefore transmits no data to these providers. Only when you actively click such a link will your browser connect to the respective platform, which may then collect data in accordance with its own privacy policy.

Purpose-specific usage and disclosure

We follow the principle of purpose-specific data usage: we collect, process and store your personal data only for those purposes for which you provided it or to which you have consented. We only pass data on to third parties where this is necessary to fulfil those purposes – for example to the service providers named above, who act as processors on our behalf and are contractually bound to confidentiality. We only disclose personal data to state institutions and authorities within the scope of statutory disclosure obligations or on the basis of a court decision.

Access protection

Our website and our internal systems are protected against loss, destruction and unauthorised access by appropriate technical and organisational measures. We continuously adapt the processes we use to the state of the art and to applicable data protection regulations. We also take data protection seriously internally: our staff and external service providers are bound to confidentiality and to compliance with data protection rules.

Retention period

We store personal data only for as long as it is required for the purposes described or as long as statutory retention periods apply. Server log files are deleted automatically after a short period. Enquiry data is kept for as long as it is needed to support the business relationship and to fulfil legal obligations.