Privacy policy

1. Controller

Ochmann Holzbearbeitungsmaschinen GmbH
Ernst-Bauer-Straße 3+5
97941 Tauberbischofsheim
Germany

Phone: +49 (0)9341 1776
Email: info@ochmann-maschinen.de
Managing director: Arno Ochmann

2. Purposes and legal bases

We process personal data to provide and secure this website, respond to enquiries, prepare and perform contracts, and meet legal obligations. Depending on the purpose, the legal basis is Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (pre-contractual steps and contracts), Article 6(1)(c) GDPR (legal obligations), or Article 6(1)(f) GDPR (legitimate interests).

3. Website access and server logs

Technical access data may include your IP address, access time, requested page, transferred data volume, referring page, browser, operating system and error information. Our legitimate interest under Article 6(1)(f) GDPR is the secure and reliable operation of this website.

Access logs are rotated daily, with 14 daily archive files configured. Incident-related information may need to be retained longer to investigate abuse. Security and error information is retained only for as long as required to resolve errors or investigate an incident.

4. Contact forms and machine enquiries

We process the information you provide, such as name, company, email address, phone number, country, message and the requested machine reference, to handle your enquiry and communicate with you. The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contract or pre-contractual steps, and Article 6(1)(f) GDPR for the orderly handling of other enquiries.

5. Email, phone and WhatsApp

We use your contact details and message contents to handle your request. A WhatsApp link takes you to an external provider, whose privacy rules apply to its service. Please do not send sensitive information that is unnecessary for your enquiry.

6. Newsletter and abuse prevention

We process your email address and optional details such as name and country to send information about woodworking machinery, tools, accessories and offers. Your subscription is activated only after you confirm the link in the confirmation email. We record request and confirmation times, the source of consent and the consent text as evidence.

The legal basis is your consent under Article 6(1)(a) GDPR. You can withdraw it at any time, for example using the unsubscribe link in each newsletter or contacting us. Unconfirmed signups are removed in the daily cleanup after 14 days without confirmation since the latest signup request. For existing customer contacts, only the pending newsletter registration is cleared; the business contact remains. Confirmed registrations remain until withdrawal. A minimal suppression record and necessary consent evidence may remain after unsubscribing.

Our own security question, signed forms and rate limits protect the signup service against automated abuse. We use a secret key to derive pseudonymous identifiers from IP and email addresses. Access counters are valid for at most 24 hours. Expired identifiers are deleted on subsequent signup attempts and during daily cleanup, within 48 hours of creation. Form authorisation lasts at most two hours. No external CAPTCHA provider is loaded. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is preventing abuse and unsolicited confirmation emails.

At most one confirmation email is triggered per address in 24 hours. Incident-related backups of removed pending signups are removed during daily cleanup after 30 days.

7. Offers and attachments

We may send the requested machine details, images, data sheets and technical information to contact details from your enquiry or business relationship. Processing is based on Article 6(1)(b) GDPR and, where applicable, Article 6(1)(f) GDPR.

8. Cookies, statistics, advertising and YouTube

Necessary cookies and storage support form security, sessions where required and saving your privacy choices. Where storage or access is strictly necessary for a service you explicitly request, Section 25(2)(2) of the German TDDDG applies. Associated personal-data processing relies on Article 6(1)(b) or (f) GDPR, depending on the function.

Statistics, advertising and YouTube are separate, optional choices. Google measurement tags load only after you permit statistics or advertising. If you decline all Google measurement services, we load neither their tags nor their measurement requests. Optional storage requires consent under Section 25(1) TDDDG; associated personal-data processing relies on Article 6(1)(a) GDPR.

Google Analytics 4: With statistics consent, we measure page views, technical browser and device information, approximate origin and website interactions to analyse and improve our service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Our integration disables Google Signals features.

Google Ads: With advertising consent, we use conversion measurement and advertising features connected with the Google tag. These can analyse ad attribution, page views, technical information and interactions such as enquiries, and enable personalised advertising. The provider is Google Ireland Limited. Without advertising consent, our enquiry and order functions do not trigger Google Ads conversions.

YouTube: Preview images come from our own server. A player from youtube-nocookie.com loads only after separate video permission and pressing Play. Google Ireland Limited may process IP address, browser information, the page visited and video use, and employ its own storage technologies. Privacy-enhanced mode does not prevent all data transfers. Video permission does not enable our Analytics or Ads measurement.

You can change or withdraw your choices at any time using Cookie settings in the footer. We store your choices, timestamp and policy version in LocalStorage for 180 days, then ask again. Withdrawal blocks our Google measurement services on subsequent page loads, stops active YouTube players and removes relevant Google storage on our domain where technically accessible. You can also remove third-party-domain cookies in your browser. Withdrawal does not affect the lawfulness of earlier processing.

Actual optional storage depends on your choices, ad attribution, browser and loaded service. Further information: Google Privacy Policy and Google cookie information.

9. External links

Links to Google Maps, WhatsApp, Instagram, our separate shop or machine portals take you to external services. Their providers are responsible for processing within their own services. These links do not automatically load a corresponding external player or map on our website.

10. Hosting and email service providers

A technical hosting provider operates the server and processes access and operational information needed for hosting, security, maintenance and delivery. Providers acting on our behalf are subject to Article 28 GDPR.

We use Microsoft 365 through Microsoft Graph for email communication, newsletter confirmations and newsletter delivery. Microsoft provides the service; Microsoft Ireland Operations Limited is relevant for its European business. Data may include recipient addresses, necessary contact information, email contents and technical delivery information. Depending on the message, the legal basis is Article 6(1)(a), (b) or (f) GDPR. See the Microsoft Privacy Statement.

11. Recipients

Within our company, access is limited to staff who need information to handle your request or contract. Data is disclosed to other parties only where necessary for these purposes, legally required, consented to, or justified by a legitimate interest. Relevant recipient categories include hosting, email and necessary transaction or logistics providers, and permitted Google services.

12. Retention

We retain personal data for as long as needed for its purpose. Specific periods for browser storage, pending newsletter signups and abuse prevention are listed above. Enquiry, offer, order and invoice records may additionally be retained under applicable commercial and tax obligations and where necessary to establish, exercise or defend legal claims. Where no retention obligation or other necessary purpose remains, information is deleted.

13. Your rights

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, data portability and objection, and may withdraw consent for future processing. Contact info@ochmann-maschinen.de to exercise your rights.

14. Complaints

You may complain to a data-protection supervisory authority. The authority responsible for our place of establishment is normally the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Germany.

15. Updates

We update this policy when our technical functions, processing activities or applicable requirements change. The current version published on this website applies.

16. Orders and possible international transfers

Orders involve the contact, company, billing and delivery information provided, a VAT number where applicable, and payment and delivery preferences. Processing is based on Article 6(1)(b) GDPR for handling the order and Article 6(1)(c) GDPR for legal obligations. Necessary information may be shared with transaction, delivery or logistics service providers.

Google and Microsoft services may process information outside the EU or EEA, particularly in the USA. Articles 44 onwards GDPR therefore also apply. Depending on the recipient, transfers require an adequacy decision or appropriate safeguards such as standard contractual clauses. Providers describe their measures in their privacy notices. Optional Google permissions are voluntary; the remaining website remains usable without them.