Privacy policy
Information about the processing of your data on our website as well as in the Shopify checkout and customer account. Status: 10. October 2026.
1 Responsible and contact
The controller is R.v.Klier Werkstoffprüftechnik e.K., proprietor Martin Ziegner, Hansaallee 190, 40547 Düsseldorf, Germany. For questions about data protection and to exercise your rights, contact us at shop@georg-petzoldt.de or +49 2331 78 87 20.
2 Website and hosting
When you visit our website, we process technically necessary access data, in particular your IP address, the address requested, time of access, browser information and technical errors. This serves to deliver the website, analyse errors and prevent misuse. The legal basis is our legitimate interest in providing a secure and functional service under Article 6(1)(f) GDPR.
The website is hosted using Vercel. Vercel and its subprocessors may process technical access data. Vercel provides information about processing, recipients and international data transfers in its privacy notice.
3 Ordering and Shopify
We use Shopify for the basket, order processing, customer accounts and payments. The information necessary for each operation is processed, in particular names, contact and address details, ordered items, quantities, payment method and order status. The technically necessary IP address is also processed when you are transferred to checkout. Processing is carried out to take steps prior to entering into a contract and to perform the contract under Article 6(1)(b) GDPR, and to comply with legal obligations under Article 6(1)(c) GDPR.
Shopify processes data with the involvement of affiliated companies and subprocessors. Processing may also take place outside the EU or EEA. Shopify describes the relevant information and contractual safeguards in its privacy information.
4 Customer account and previous orders
When you use your customer account, you sign in through Shopify using a one-time code sent to your email address. We do not collect a password or security questions for this shop account. Passwords from the previous shop are not transferred. Once signed in, you can view orders clearly assigned to your customer profile. Previous orders retain their original order information. Orders with an unresolved assignment or belonging to someone else are not assigned to your account.
We use encrypted, technically necessary session cookies to secure sign-in. A sign-in attempt is limited to ten minutes; an account session requires a new sign-in after no more than 30 days. You can sign out at any time. Processing serves to provide the account access you requested under Article 6(1)(b) GDPR.
5 Shopping cart and storage on your device
The basket is stored locally in your browser so that your selection remains available as you navigate and when you visit again. It contains items, variants, quantities and any product details you have entered. You can empty it in the shop or delete the website data in your browser.
Storage on your device that is strictly necessary for the basket and sign-in is based on Section 25(2) TDDDG. Where personal data is processed to provide the requested function, Article 6(1)(b) GDPR applies. Shopify may use additional necessary cookies for its own account and checkout pages.
6 Payment and shipping
The payment provider you select receives the information required to process your payment. For payment in advance by bank transfer, the bank involved processes the transfer details. The appointed carrier receives the recipient and delivery details needed for delivery. The legal basis is Article 6(1)(b) GDPR. You can also find information about each payment method at checkout and in the privacy information of the provider identified there.
7 Contact and external links
If you contact us by email, through the contact form or by telephone, we process your details to deal with your enquiry. Article 6(1)(b) GDPR applies to contract-related enquiries; otherwise, processing is based on our legitimate interest in answering enquiries under Article 6(1)(f) GDPR.
External services, such as route planning, are opened only when you follow the relevant link. Fonts and website images are provided without embedded requests to Google Fonts.
Google Maps
The Google map on our website loads automatically when you access the map area. A connection to Google is established without prior approval. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google receives, in particular, your IP address, browser and device information and information about map usage, and may use cookies or similar technologies. If you are signed in to Google, Google may associate information with your account. Processing by Google LLC in the USA is possible. You can also open directions using an external route link.
Shopify Network Intelligence and consent
We do not embed our own analytics or advertising trackers on the website we provide through Vercel. This is distinct from the checkout and account functions hosted by Shopify: Shopify Network Intelligence is enabled in the shop. Shopify processes customer data together with information from interactions with Shopify and other merchants to provide enhanced services, such as personalisation, product improvements and advertising-related functions. Data is transferred to Shopify and the service providers involved; recipients may also be located outside the EU or EEA.
Prior consent is required for non-essential cookies and the analytics, personalisation and advertising enabled by them: Article 6(1)(a) GDPR and Section 25(1) TDDDG. In the Shopify checkout, you can decline or manage your choices in the cookie banner. Placing an order, accessing an account or simply using the shop does not constitute consent to advertising. Processing necessary for orders, account access and security takes place independently on the legal bases stated in this notice.
Shopify also processes data for its own purposes as an independent controller. Its consumer privacy policy provides details of data categories, purposes, legal bases, recipients, retention and international transfers.
Privacy Choices at Shopify
You can change your cookie choices through the privacy settings on Shopify pages. You can also use the Shopify privacy portal to request access or deletion, object to processing or withdraw consent in relation to Shopify. You can exercise your data protection rights in relation to us using the contact details above.
Contact form and newsletter about Brevo
We use Brevo to send contact enquiries, withdrawal notices, acknowledgements of receipt and newsletter confirmations. For a contact enquiry, your name, email address, selected subject and message are transferred to Brevo for delivery to our shop mailbox. For an electronic withdrawal, your name, the email address provided, your contract details, and the content and time of receipt of the notice are sent through Brevo to our shop mailbox and to you as an acknowledgement of receipt. Processing serves to handle your notice and fulfil the statutory confirmation obligation under Article 6(1)(b) and (c) GDPR. Your details are not automatically used for advertising.
You will receive the Georg Petzoldt newsletter only with your consent under Article 6(1)(a) GDPR. After you sign up, we send an email containing a confirmation link. Your address is added to the newsletter list only after this confirmation (double opt-in). Brevo processes your email address and technical evidence of sign-up and confirmation on our behalf. You can withdraw your consent at any time with effect for the future using the unsubscribe link in the newsletter or by emailing shop@georg-petzoldt.de.
We do not transmit consent to personal open or click tracking with the double opt-in request. Further information about the email service and its data processing is available in Brevo’s privacy notice.
Misuse protection of forms
To protect against automated and repeated requests, we limit the number of form submissions. For this purpose, IP addresses and email addresses are converted on the server into identifiers generated with a secret key. These pseudonymous identifiers and counters, and, for withdrawals, a process status protected against duplicate sending, with a timestamp and an HMAC identifier derived from the input, are stored at Upstash in the configured Frankfurt region for no more than 24 hours. We do not store messages, names or readable email or IP addresses there. The legal basis is our legitimate interest in secure operation under Article 6(1)(f) GDPR.
8 Storage period and international processing
We store personal data for as long as it is needed for the relevant purpose. Once a process is complete, data is deleted or its processing restricted insofar as statutory retention obligations or the establishment or defence of claims require continued storage. Technical logs and service providers are subject to their respective purpose-specific deletion and retention rules.
Transfers to countries outside the EU or EEA must meet the requirements of Articles 44 et seq. GDPR. Depending on the recipient, adequacy decisions or appropriate safeguards such as the EU Standard Contractual Clauses are used. You can obtain details about the service providers through the links above or by contacting us.
9 Your rights
Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time with effect for the future. You can lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, place of work or our registered office.
Where we process data on the basis of legitimate interests, you can object on grounds relating to your particular situation. You have the right to object to direct marketing at any time. To exercise your rights, simply contact us.