Privacy Policy

Server Log Files

You can visit our website without providing any personal information.

Each time you access our website, usage data is transmitted by your internet browser to us or our web host/IT service provider and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider. Processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in ensuring trouble-free operation of our website and improving our services.

Retention period: Server log files are automatically deleted after 14 days, unless longer retention is required for evidentiary purposes (e.g. in case of abuse incidents or security breaches).

Data Controller

Please contact us if you wish. The contact details of the person responsible for data processing can be found in our Legal Notice.

Customer-Initiated Contact by Email

If you contact us by email on your own initiative for business purposes, we collect your personal data (name, email address, message text) only to the extent you provide. Data processing serves the purpose of handling and responding to your contact request.

If the contact serves the implementation of pre-contractual measures (e.g. consultation on purchase interest, preparation of offers) or relates to a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6(1)(b) GDPR.

If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in handling and responding to your enquiry. In this case, you have the right to object at any time, for reasons arising from your particular situation, to processing of your personal data based on Art. 6(1)(f) GDPR.

We use your email address only to process your enquiry. Your data will be deleted after final processing of your enquiry, provided no contractual relationship is established — at the latest after 6 months. If a contractual relationship is established, the retention periods stated under “Duration of Storage” apply. Further storage only occurs if you have consented to further processing and use.

Data Collection and Processing When Using the Contact Form

When using the contact form, we collect your personal data (name, email address, message text) only to the extent you provide. Data processing serves the purpose of contacting you.

If the contact serves the implementation of pre-contractual measures (e.g. consultation on purchase interest, preparation of offers) or relates to a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6(1)(b) GDPR.

If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in handling and responding to your enquiry. In this case, you have the right to object at any time, for reasons arising from your particular situation, to processing of your personal data based on Art. 6(1)(f) GDPR.

We use your email address only to process your enquiry. Your data will be deleted after final processing of your enquiry, provided no contractual relationship is established — at the latest after 6 months. If a contractual relationship is established, the retention periods stated under “Duration of Storage” apply. Further storage only occurs if you have consented to further processing and use.

Customer Account

When opening a customer account, we collect your personal data to the extent specified. Data processing serves the purpose of improving your shopping experience and simplifying order processing. Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the lawfulness of processing carried out on the basis of consent before its revocation. Your customer account will then be deleted.

Collection, Processing and Disclosure of Personal Data for Orders

When placing an order, we collect and process your personal data only to the extent necessary for the fulfilment and handling of your order and for processing your enquiries. The provision of data is required for the conclusion of the contract. Failure to provide it means that no contract can be concluded. Processing is carried out on the basis of Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you.

Your data may be shared with, for example, the shipping companies and dropshipping providers you have selected, payment service providers, order processing service providers and IT service providers. In all cases, we strictly comply with legal requirements. The scope of data transfer is limited to a minimum.

Use of Email Address for Newsletter Distribution

We use your email address, independently of contract processing, exclusively for our own advertising purposes for newsletter distribution, provided you have expressly consented. Our newsletter is published under our Which Sourcing brand; details on how it is sent are in the Which Sourcing privacy policy. Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can revoke your consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its revocation. You can unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the distribution list.

Google Ads Conversion Tracking

We use the conversion tracking of the online advertising service “Google Ads” by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) on our website. Google is a company affiliated with Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Data processing serves the purpose of evaluating the effectiveness of our advertisements. If you reach our website via a Google ad, a cookie is set. If you subsequently perform a certain action on our website (e.g. a contact enquiry or an order), Google can attribute this action to your click on the ad. The following information may be processed: IP address, date and time, an identifier of the ad, and information about the browser and device you use. We receive statistical evaluations from Google showing the total number of users who clicked on our ad. We do not receive any information that personally identifies users.

Your data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the EU Commission determined an adequate level of data protection by decision of July 10, 2023. In addition, the data transfer is carried out on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, available at: policies.google.com/privacy/frameworks.

Conversion tracking only takes place with your consent on the basis of § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. The Google Ads component is only loaded after your express consent via our cookie banner. You can revoke your consent at any time with effect for the future, without affecting the lawfulness of processing carried out before revocation.

Further information on data protection at Google can be found at policies.google.com/privacy.

Our website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on the user’s computer system. When a user visits a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string that enables unique identification of the browser when the website is visited again.

Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can be notified before cookies are set and decide individually whether to accept them, as well as prevent the storage of cookies and transmission of the data they contain. Cookies that have already been stored can be deleted at any time. However, we point out that you may then not be able to use all functions of this website to their full extent.

You can find out how to manage (including disabling) cookies in the most common browsers at the following links:

• Chrome: support.google.com
• Internet Explorer: support.microsoft.com
• Mozilla Firefox: support.mozilla.org
• Safari: support.apple.com

Technically Necessary Cookies

We use technically necessary cookies to make our website more user-friendly, effective and secure. These include:

• Session cookie — enables login and use of your customer account.
• Cookie consent cookie (ws_consent) — stores your decision regarding analytics and marketing cookies so you are not asked again on each visit.
• Leadfeeder objection cookie (ws_lf_objection) — stores your objection to Leadfeeder so the service is no longer loaded.

These cookies are required for the operation of the website. Processing is carried out on the basis of § 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR based on our overriding legitimate interest in ensuring optimal functionality of the website.

You have the right to object at any time, for reasons arising from your particular situation, to processing of your personal data.

Consent Banner (Cookie Banner)

When you first visit our website, a banner is displayed through which you can consent to or decline the use of analytics and marketing cookies. Your decision is stored in the ws_consent cookie and is valid for 12 months. You can withdraw your consent at any time with effect for the future: the “Cookie settings” button in the footer of every page reopens this banner. If you choose “Decline” there, we delete the analytics and marketing cookies we have set and no longer load the corresponding services. Alternatively, you can delete the ws_consent cookie in your browser — the banner will be displayed again on your next visit.

Use of PostHog

We use the web analytics service PostHog by PostHog Inc. (2261 Market Street #4008, San Francisco, CA 94114, USA; “PostHog”) on our website.

Data processing serves the purpose of analysing this website and its visitors. The following information may be collected: IP address, date and time of page access, click path, information about the browser and device you use, pages visited, referrer URL (website from which you accessed our website) and location data.

PostHog uses cookies and comparable technologies that enable analysis of your use of the website. The analytics data is transmitted to PostHog via our proxy server (g.whichsensor.com). There is no adequacy decision by the EU Commission for the USA. The data transfer is carried out on the basis of Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The use of PostHog cookies only takes place with your consent on the basis of § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. PostHog is only loaded after your express consent via our cookie banner. You can revoke your consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its revocation.

Further information on data protection at PostHog can be found at posthog.com/privacy.

Use of Leadfeeder

We use the service Leadfeeder by Dealfront Group GmbH (Durlacher Allee 73, 76131 Karlsruhe, Germany) and its group company Liidio Oy (Finland; together “Leadfeeder”) on our website.

Data processing serves the purpose of finding out which companies are interested in our products, so that we can address them in our B2B sales. To this end, Leadfeeder compares the IP address of your visit with a database of known company networks. The following information may be processed: IP address, date and time of page access, pages visited, duration of the visit, referrer URL and information about the browser and device you use. Visits are attributed to companies, not to individual persons.

Without your consent, Leadfeeder runs without cookies and uses the IP address only to attribute the visit to a company. The legal basis is our legitimate interest in identifying companies interested in our products for B2B sales (Art. 6(1)(f) GDPR).

Only if you consent via our cookie banner does Leadfeeder additionally set the first-party cookie _lfa (lifetime one year), which recognises your browser on later visits, and store a copy in your browser’s local storage. This takes place on the basis of § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can revoke your consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its revocation.

You can object to processing by Leadfeeder at any time (Art. 21 GDPR). After you click the button below, we no longer load Leadfeeder in this browser. Your objection is stored for 12 months in the technically necessary cookie ws_lf_objection.

Object to Leadfeeder

Further information on data protection at Leadfeeder can be found at leadfeeder.com/privacy.

Visits Referred by AI Assistants

If you reach our website through a link in an AI assistant (for example ChatGPT, Perplexity, Claude or Gemini), your browser sends us the name of that assistant and the address of the page you land on. We count these visits to learn how often AI assistants recommend our products. No cookie is set for this, and neither your IP address nor any other identifier is stored with the count. The legal basis is our legitimate interest in understanding how customers find us (Art. 6(1)(f) GDPR).

Only if you consent via our cookie banner do we additionally store the name of the assistant for 30 days in the first-party cookie ws_ai_src. If you send a quote request or place an order during this time, we record that it came from this assistant, together with the request or order number and its net value. This takes place on the basis of § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. If you decline or withdraw consent in the cookie banner, we delete the cookie.

Product Catalogue for AI Assistants (MCP)

Customers can connect an AI assistant to their customer account so that it can query our product catalogue through an interface (Model Context Protocol, /api/public-mcp). The assistant only gets access after you allow it in your customer account, and you can disconnect it there at any time. For each call we log the customer account, the tool used, the search term or part number, the number of results and the client's name and User-Agent. We store the IP address only as a keyed hash that cannot be reversed. We use these records to enforce rate limits per customer, to show the prices agreed with your company and to understand how the interface is used. Product links returned by this interface carry the parameter utm_source=mcp, so a visit via such a link is counted as referred by the interface. The legal basis is our legitimate interest in operating the interface securely and understanding its use (Art. 6(1)(f) GDPR).

If you ask an AI assistant to send us a quote request through this interface, the assistant transmits the items and, if you provide them, a reference, desired date and message. Company, name, e-mail address, phone number, address and VAT ID are taken from your customer account. We process the request exactly like a quote request from our website form, to prepare a quote, on the basis of Art. 6(1)(b) GDPR, and record that the request came via the interface together with its number and net value. The provider of the AI assistant you use processes your input under its own privacy policy.

Use of YouTube

We use the YouTube video embedding function by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “YouTube”) on our website. YouTube is a company affiliated with Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).

This function displays videos stored on YouTube in an iFrame on the website. The “Enhanced Privacy Mode” option is enabled. This means that YouTube does not store any information about visitors to the website. Only when you watch a video is information transmitted to and stored by YouTube. This may include: IP address, date and time of the video access, device information and information about your YouTube account (if you are logged in).

Your data may be transferred to the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the EU Commission determined an adequate level of data protection by decision of July 10, 2023. In addition, the data transfer is carried out on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, available at: policies.google.com/privacy/frameworks.

YouTube content is only loaded with your consent. The use of cookies or comparable technologies is carried out on the basis of § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. YouTube content is only loaded after your express consent via our cookie banner. You can revoke your consent at any time with effect for the future, without affecting the lawfulness of processing carried out before revocation.

Further information on the collection and use of data by YouTube and Google, as well as your related rights, can be found in YouTube’s privacy policy at youtube.com/t/privacy.

Duration of Storage

After complete contract processing, data is initially stored for the duration of the warranty period, then taking into account statutory retention periods, particularly under tax and commercial law, and then deleted after the expiry of the period, unless you have consented to further processing and use.

The following retention periods apply in detail:

• Server log files: 14 days (unless security-related retention is required)
• Contact enquiries (email / contact form): at the latest 6 months after final processing, unless a contractual relationship is established
• Contract data and invoices: 10 years (§ 257 HGB, § 147 AO)
• Commercial and business correspondence: 6 years (§ 257 HGB)
• Customer account: until revocation of your consent or deletion of the account

Rights of the Data Subject

Where the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR: right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability.

You also have the right under Art. 21(1) GDPR to object to processing based on Art. 6(1)(f) GDPR, as well as to processing for the purpose of direct marketing.

Right to Lodge a Complaint with the Supervisory Authority

You have the right under Art. 77 GDPR to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful.

The supervisory authority responsible for us is:

Right to Object

If the personal data processing listed here is based on our legitimate interest under Art. 6(1)(f) GDPR, you have the right to object at any time, for reasons arising from your particular situation, to such processing with effect for the future.

After an objection has been made, the processing of the data concerned will be terminated unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the assertion, exercise or defence of legal claims.