Grüner Baum GmbH · Vorstädter Str. 32, 55276 Oppenheim – Germany
Contact
← Back to Home

Privacy Policy

Pursuant to GDPR Art. 13 & 14 · As of: 19 October 2026

1. Controller

Controller within the meaning of the GDPR: Grüner Baum GmbH, Vorstädter Str. 32, 55276 Oppenheim, Germany. Managing Director: Hatice Muazzez Bodur. E-mail: info@grunerbaumtex.de

2. Hosting & Infrastructure

This website is hosted via Cloudflare Workers (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare processes technically necessary connection data (IP address, timestamp, requested URL). The processing is carried out to ensure security based on our legitimate interest (Art. 6(1)(f) GDPR). A data processing agreement under Art. 28 GDPR with Standard Contractual Clauses (SCC) for third-country transfers is in place with Cloudflare.

3. Server Logs

When you visit our website, technical data is automatically recorded: IP address, date and time, requested URL, browser type, HTTP status code. Legal basis: Art. 6(1)(f) GDPR. Logs are deleted after a maximum of 7 days.

4. Contact

When you contact us by e-mail, phone, or contact form, we process your details (name, e-mail, message) solely to handle your enquiry. Legal basis: Art. 6(1)(b) GDPR. Data is deleted once the purpose is fulfilled.

4b. Risk Assessment Form (risk.eugpsr.de)

At risk.eugpsr.de we provide a free form for estimating the GPSR risk level of your products. When you submit the form we process the details you enter: company name, tax or commercial register number, name and role of the contact person, email address, telephone number, country and city, and (where provided) website, number of employees, number of items (SKUs), product categories and countries of origin. We also process the answer options you select and the risk class derived from them. In addition, your IP address, browser identifier (user agent) and the time of submission are logged for technical purposes; these are used solely to prevent misuse and to limit the submission rate.

The purpose of the processing is to determine the risk class of your products at your request, to send you the result, and to prepare an offer tailored to you. The legal basis for processing your form details is the consent you give by ticking the consent box (Art. 6(1)(a) GDPR). You may withdraw this consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before withdrawal remains unaffected. If contract negotiations follow, we process your details on the basis of Art. 6(1)(b) GDPR. We process the technical log data on the basis of our legitimate interest in operating the form free of misuse (Art. 6(1)(f) GDPR).

After submission you receive the result of your assessment as a PDF report by email; an internal copy goes to our specialist team. Delivery takes place via our email service provider Brevo. The assessment itself runs exclusively on our own server, operated by Hetzner Online GmbH in Finland (EU); the page is delivered via Cloudflare (see section 2). Your details are not transferred to any further third parties. The cooperation is based on the respective providers' data processing agreements, which form part of the contractual terms we have accepted (Art. 28 GDPR).

The risk class is calculated automatically according to a fixed scheme defined by us. It expressly constitutes a preliminary estimate only: the final classification is always determined by expert human review before any contract is concluded and may differ from the automated calculation. There is therefore no automated decision within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

We store your details for as long as they are required for the stated purpose. If no contract is concluded, we delete the record including the technical log data no later than 24 months after the last contact. If a contract is concluded, the statutory retention periods apply (§ 257 HGB, § 147 AO). On request we will delete your details earlier, an informal message to hello@eugpsr.de is sufficient.

The form sets no cookies and neither stores nor reads any information on your device (§ 25 TDDDG). It embeds no third-party content. Your rights under section 8 of this policy apply to this processing without restriction.

4c. EU Company Pre-Check (risk.eugpsr.de/eu-check)

At risk.eugpsr.de/eu-check we offer a free pre-check for companies established in the EU. When you complete the pre-check you answer questions about your product families; no personal data is requested during the check itself. We store your answers and the calculated result without any personal data under a randomly generated token for 30 days, so you can view the result again and generate the PDF report; the data is then deleted automatically. We process your IP address transiently for rate limiting and abuse protection. The legal basis for this is our legitimate interest in operating the tool free of misuse (Art. 6(1)(f) GDPR).

Like the risk assessment form described in section 4b, the pre-check runs exclusively on our own server, operated by Hetzner Online GmbH in Finland (EU); the page is delivered via Cloudflare (see section 2). Technical access logs are deleted after a maximum of 7 days, as described in section 3.

You may optionally share your result with us: only once you actively enter your name, company and email address and tick the initially unchecked consent box do we process these details. The consent text reads: "I agree that this report and my contact details are shared with Grüner Baum GmbH and that Grüner Baum may contact me by email with an offer of support regarding these gaps." The legal basis is your consent under Art. 6(1)(a) GDPR.

Sharing uses a double opt-in process: you receive a confirmation email with a single-use link valid for 7 days. If you do not confirm within this period, your unconfirmed details are deleted automatically after 7 days.

Once you confirm, we store the report, your contact details and a consent record (timestamp, version of the consent text, IP address at the time of confirmation) as a contact request. Grüner Baum may then send you a single offer email regarding the gaps identified; no newsletter is sent. If there is no further contact afterwards, we delete these details no later than 12 months later.

You can withdraw your consent at any time with effect for the future; an informal message to hello@eugpsr.de is sufficient. Withdrawal leads to deletion of your details.

Confirmation and offer emails are sent via our email service provider Brevo (see section 4b). Your rights under section 8 of this policy apply to this processing without restriction.

4d. Referral to ReinstateAMZ (Amazon account and listing cases)

If you select “Amazon account or listing blocked” in our contact form and tick the consent box, we pass your request together with the contact details you entered (name, company, email address, telephone number and your message) by email from hello@eugpsr.de to our partner Reinstate Amz Ltd, trading as ReinstateAMZ and incorporated in England and Wales, so that ReinstateAMZ can contact you about your Amazon case. The legal basis is your consent (Art. 6(1)(a) GDPR). The United Kingdom is covered by an adequacy decision of the European Commission (Art. 45 GDPR). ReinstateAMZ processes the data as an independent controller under its own privacy policy. Without your consent nothing is passed on, and we handle your enquiry ourselves as described in section 4. You may withdraw your consent at any time with effect for the future; a short message to hello@eugpsr.de is enough. The lawfulness of any transfer made before the withdrawal remains unaffected; we will inform ReinstateAMZ of your withdrawal.

5. AI-Powered Chat Assistant (LumaNodes)

This website integrates an AI-powered chat assistant provided by LumaNodes. The assistant may process: entered chat messages, anonymous usage metadata (timestamps, session duration), technical connection data (IP address, browser ID). Please do not enter sensitive personal data (e.g. passwords, health data) in the chat. Legal basis: Art. 6(1)(f) GDPR.

6. Google Analytics

We use Google Analytics 4 (Google Ireland Limited, Dublin) for anonymised analysis of website usage. IP addresses are anonymised before transmission (IP masking). Legal basis: Art. 6(1)(f) GDPR. You can object to data collection by installing the Google browser add-on.

6b. Microsoft Clarity

With your explicit consent (Art. 6(1)(a) GDPR) we use Microsoft Clarity (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA) to better understand the use of our website. Clarity processes anonymized interaction data such as clicks, scrolls, mouse movements and session recordings; personal content (e.g. form inputs) is masked. Project ID: wdvg0hr96a. The retention period is up to 1 year. A data processing agreement under Art. 28 GDPR and additional Standard Contractual Clauses (SCC) for third-country transfers are in place with Microsoft. You can withdraw your consent at any time via the cookie settings; Clarity will not be loaded in that case.

6c. YouTube videos

Some pages show videos from our YouTube channel. Until you press play, no connection to YouTube is made: the preview image is stored on our own server. Only when you press play is the video loaded in YouTube's privacy-enhanced mode (youtube-nocookie.com), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. YouTube then receives at least your IP address and information about your device and the page you are on, and may store cookies or similar identifiers on your device. Google may also transfer data to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. Legal basis: your consent given by pressing play (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). If you do not start the video, this processing does not take place. More information: https://policies.google.com/privacy.

6d. Trustpilot review button

On our review page (/referans) we show the official “Review us on Trustpilot” button of Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen K, Denmark. The button is loaded from widget.trustpilot.com only after you accept cookies in our cookie banner. Trustpilot then receives at least your IP address and information about your browser and the page you are on, and may store cookies or similar identifiers on your device. Without your consent the page only shows a plain link to our Trustpilot profile, and no connection to Trustpilot is made unless you click it. If you write a review, Trustpilot processes your data as an independent controller under its own privacy policy. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time via the cookie settings. More information: https://corporate.trustpilot.com/legal/for-reviewers/privacy-policy-end-user.

7. Cookies

We use two categories of cookies: (1) Technically necessary cookies (language preference, session management, consent record), required for the website to function, legal basis: Art. 6(1)(f) GDPR. (2) Consent-based analytics cookies (Google Analytics 4 and Microsoft Clarity), loaded only with your explicit consent (Art. 6(1)(a) GDPR) via Consent Mode v2. A cookie banner is shown on your first visit; you can withdraw your consent at any time via the link at the bottom of this page.

8. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure – right to be forgotten (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw given consent

You also have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR). Competent authority: State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz.

9. Retention Period

Personal data is deleted as soon as it is no longer required for the purposes for which it was collected, unless statutory retention obligations apply (e.g. § 147 AO: 10 years).

10. Changes to this Privacy Policy

We reserve the right to update this privacy policy when changes occur. The current version is always available at eugpsr.de (TR: /tr/datenschutz, DE: /de/datenschutz, EN: /en/datenschutz). As of: 25 September 2026.