Grüner Baum GmbH · Vorstädter Str. 32, 55276 Oppenheim – Germany
Contact
← Back to Home

Privacy Policy

Pursuant to GDPR Art. 13 & 14 · As of: August 2026

1. Controller

Controller within the meaning of the GDPR: Grüner Baum GmbH, Vorstädter Str. 32, 55276 Oppenheim, Germany. Managing Director: Hatice Muazzez Bodur. E-mail: info@grunerbaumtex.de

2. Hosting & Infrastructure

This website is hosted via Cloudflare Workers (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare processes technically necessary connection data (IP address, timestamp, requested URL). The processing is carried out to ensure security based on our legitimate interest (Art. 6(1)(f) GDPR). A data processing agreement under Art. 28 GDPR with Standard Contractual Clauses (SCC) for third-country transfers is in place with Cloudflare.

3. Server Logs

When you visit our website, technical data is automatically recorded: IP address, date and time, requested URL, browser type, HTTP status code. Legal basis: Art. 6(1)(f) GDPR. Logs are deleted after a maximum of 7 days.

4. Contact

When you contact us by e-mail, phone, or contact form, we process your details (name, e-mail, message) solely to handle your enquiry. Legal basis: Art. 6(1)(b) GDPR. Data is deleted once the purpose is fulfilled.

4b. Risk Assessment Form (risk.eugpsr.de)

At risk.eugpsr.de we provide a free form for estimating the GPSR risk level of your products. When you submit the form we process the details you enter: company name, tax or commercial register number, name and role of the contact person, email address, telephone number, country and city, and — where provided — website, number of employees, number of items (SKUs), product categories and countries of origin. We also process the answer options you select and the risk class derived from them. In addition, your IP address, browser identifier (user agent) and the time of submission are logged for technical purposes; these are used solely to prevent misuse and to limit the submission rate.

The purpose of the processing is to determine the risk class of your products at your request, to send you the result, and to prepare an offer tailored to you. The legal basis for processing your form details is the consent you give by ticking the consent box (Art. 6(1)(a) GDPR). You may withdraw this consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before withdrawal remains unaffected. If contract negotiations follow, we process your details on the basis of Art. 6(1)(b) GDPR. We process the technical log data on the basis of our legitimate interest in operating the form free of misuse (Art. 6(1)(f) GDPR).

After submission you receive the result of your assessment as a PDF report by email; an internal copy goes to our specialist team. Delivery takes place via our email service provider Brevo. The assessment itself runs exclusively on our own server, operated by Hetzner Online GmbH in Finland (EU); the page is delivered via Cloudflare (see section 2). Your details are not transferred to any further third parties. The cooperation is based on the respective providers' data processing agreements, which form part of the contractual terms we have accepted (Art. 28 GDPR).

The risk class is calculated automatically according to a fixed scheme defined by us. It expressly constitutes a preliminary estimate only: the final classification is always determined by expert human review before any contract is concluded and may differ from the automated calculation. There is therefore no automated decision within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

We store your details for as long as they are required for the stated purpose. If no contract is concluded, we delete the record including the technical log data no later than 24 months after the last contact. If a contract is concluded, the statutory retention periods apply (§ 257 HGB, § 147 AO). On request we will delete your details earlier — an informal message to hello@eugpsr.de is sufficient.

The form sets no cookies and neither stores nor reads any information on your device (§ 25 TDDDG). It embeds no third-party content. Your rights under section 8 of this policy apply to this processing without restriction.

5. AI-Powered Chat Assistant (LumaNodes)

This website integrates an AI-powered chat assistant provided by LumaNodes. The assistant may process: entered chat messages, anonymous usage metadata (timestamps, session duration), technical connection data (IP address, browser ID). Please do not enter sensitive personal data (e.g. passwords, health data) in the chat. Legal basis: Art. 6(1)(f) GDPR.

6. Google Analytics

We use Google Analytics 4 (Google Ireland Limited, Dublin) for anonymised analysis of website usage. IP addresses are anonymised before transmission (IP masking). Legal basis: Art. 6(1)(f) GDPR. You can object to data collection by installing the Google browser add-on.

6b. Microsoft Clarity

With your explicit consent (Art. 6(1)(a) GDPR) we use Microsoft Clarity (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA) to better understand the use of our website. Clarity processes anonymized interaction data such as clicks, scrolls, mouse movements and session recordings; personal content (e.g. form inputs) is masked. Project ID: wdvg0hr96a. The retention period is up to 1 year. A data processing agreement under Art. 28 GDPR and additional Standard Contractual Clauses (SCC) for third-country transfers are in place with Microsoft. You can withdraw your consent at any time via the cookie settings; Clarity will not be loaded in that case.

7. Cookies

We use two categories of cookies: (1) Technically necessary cookies (language preference, session management, consent record) — required for the website to function, legal basis: Art. 6(1)(f) GDPR. (2) Consent-based analytics cookies (Google Analytics 4 and Microsoft Clarity) — loaded only with your explicit consent (Art. 6(1)(a) GDPR) via Consent Mode v2. A cookie banner is shown on your first visit; you can withdraw your consent at any time via the link at the bottom of this page.

8. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure – right to be forgotten (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw given consent

You also have the right to lodge a complaint with the competent data protection supervisory authority (Art. 77 GDPR). Competent authority: State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz.

9. Retention Period

Personal data is deleted as soon as it is no longer required for the purposes for which it was collected, unless statutory retention obligations apply (e.g. § 147 AO: 10 years).

10. Changes to this Privacy Policy

We reserve the right to update this privacy policy when changes occur. The current version is always available at eugpsr.de (TR: /tr/datenschutz, DE: /de/datenschutz, EN: /en/datenschutz). As of: August 2026.