Data Protection
In accordance with the statutory requirements of data protection law (in particular the German Federal Data Protection Act (BDSG) as amended and the European General Data Protection Regulation (GDPR)), we provide the following information regarding the nature, scope and purpose of the processing of personal data by our company. This privacy policy also applies to our websites and social media profiles. For the definitions of terms such as ‘personal data’ or ‘processing’, please refer to Article 4 of the GDPR.
Name and contact details of the data controller(s):
Our data controller within the meaning of Article 4(7) of the GDPR is the managing director, as listed at the beginning of the legal notice.
The data protection officer is also listed there.
Types of data, purposes of processing and categories of data subjects
Below, we provide information on the nature, scope and purpose of the collection, processing and use of personal data.
1. Types of data we process
Master data (name, address, etc.), contact details (telephone number, email, fax, etc.), payment details (bank details, account details, payment history, etc.), contract details (subject matter of the contract, term, etc.),
2. Purposes of processing pursuant to Article 13(1)(c) of the GDPR
Processing of contracts, optimising the website technically and economically, facilitating easy access to the website, fulfilling contractual obligations, complying with statutory retention obligations, making the website user-friendly, ensuring the cost-effective operation of advertising and the website, marketing / sales / advertising, handling of the recruitment process, customer service and customer care, handling contact enquiries, providing websites with functions and content, ensuring the uninterrupted and secure operation of our website,
3. Categories of data subjects pursuant to Article 13(1)(e) of the GDPR
Visitors/users of the website, customers, prospective customers, job applicants, employees,
Data subjects are collectively referred to as ‘users’.
Legal bases for the processing of personal data
Below, we provide information on the legal bases for the processing of personal data:
Where we have obtained your consent to the processing of personal data, Article 6(1), first sentence, point (a) of the GDPR forms the legal basis.
If the processing is necessary for the performance of a contract or for the implementation of pre-contractual measures taken at your request, the legal basis is Article 6(1), first sentence, point (b) of the GDPR.
If the processing is necessary to comply with a legal obligation to which we are subject (e.g. statutory retention obligations), the legal basis is Article 6(1), first sentence, point (c) of the GDPR.
Where processing is necessary to protect the vital interests of the data subject or of another natural person, the legal basis is Article 6(1), first sentence, point (d) of the GDPR.
Where processing is necessary to safeguard our legitimate interests or those of a third party, and your interests or fundamental rights and freedoms do not override those interests, the legal basis is Article 6(1), first sentence, point (f) of the GDPR.
Disclosure of personal data to third parties and data processors
As a general rule, we do not disclose any data to third parties without your consent. Should this nevertheless be the case, the disclosure will take place on the basis of the aforementioned legal grounds, e.g. when data is disclosed to online payment providers for the fulfilment of a contract, or pursuant to a court order, or due to a legal obligation to disclose the data for the purposes of criminal prosecution, to prevent danger or to enforce intellectual property rights.
We also engage data processors (external service providers, e.g. for the web hosting of our websites and databases) to process your data. Where data is disclosed to data processors under a data processing agreement, this is always done in accordance with Article 28 of the GDPR. We select our data processors carefully, monitor them regularly and have secured the right to issue instructions regarding the data. Furthermore, the data processors must have implemented appropriate technical and organisational measures and must comply with data protection regulations in accordance with the BDSG (as amended) and the GDPR
Data transfers to third countries
The adoption of the European General Data Protection Regulation (GDPR) has created a uniform framework for data protection in Europe. Your data is therefore primarily processed by organisations to which the GDPR applies. Should processing nevertheless take place via third-party services outside the European Union or the European Economic Area, these must fulfil the specific requirements of Articles 44 et seq. of the GDPR. This means that processing takes place on the basis of specific safeguards, such as the EU Commission’s official recognition that a country offers a level of data protection equivalent to that of the EU, or compliance with officially recognised specific contractual obligations, known as ‘standard contractual clauses’.
Insofar as, due to the ineffectiveness of the so-called ‘Privacy Shield’, we obtain your explicit consent to the transfer of data to the USA in accordance with Article 49(1), first sentence, point (a) of the GDPR, we draw your attention to the risk of covert access by US authorities and the use of the data for surveillance purposes, possibly without any means of redress for EU citizens.
Deletion of data and retention period
Unless expressly stated in this privacy policy, your personal data will be deleted or blocked as soon as you withdraw the consent you have given for processing, or the purpose for storage ceases to apply, or the data is no longer required for that purpose, unless their continued retention is necessary for evidential purposes or is precluded by statutory retention obligations. These include, for example, commercial law retention obligations for business correspondence under Section 257(1) of the German Commercial Code (HGB) (6 years) and tax law retention obligations under Section 147(1) of the German Fiscal Code (AO) for supporting documents (10 years). Once the prescribed retention period has expired, your data will be blocked or deleted, unless its storage is still required for the conclusion or performance of a contract.
Existence of automated decision-making
We do not use automated decision-making or profiling.
Provision of our website and creation of log files
If you use our website purely for information purposes (i.e. without registering or otherwise providing any information), we only collect the personal data that your browser transmits to our server. When you view our website, we collect the following data:
• IP address;
• User’s internet service provider;
• Date and time of access;
• Browser type;
• Language and browser version;
• Content of the request;
• Time zone;
• Access status/HTTP status code;
• Data volume;
• Websites from which the request originates;
• Operating system.
This data is not stored together with any other personal data relating to you.
This data serves the purpose of providing you with a user-friendly, functional and secure website, including its features and content, as well as optimising and statistically analysing the site.
The legal basis for this is our legitimate interest in data processing, which is also based on the purposes set out above, in accordance with Article 6(1), first sentence, point (f) of the GDPR.
For security reasons, we store this data in server log files for a period of 8 days. Once this period has expired, the data is automatically deleted, unless we need to retain it for evidential purposes in the event of attacks on the server infrastructure or other legal infringements.
Cookies
We use so-called cookies when you visit our website. Cookies are small text files that your internet browser places and stores on your computer. When you visit our website again, these cookies transmit information to automatically recognise you. Cookies also include so-called ‘user IDs’, where user data is stored via pseudonymised profiles. When you visit our website, we inform you via a link to our privacy policy about the use of cookies for the aforementioned purposes and how you can object to this or prevent them from being stored (‘opt-out’).
The following types of cookies are distinguished:
• Necessary, essential cookies: Essential cookies are those that are absolutely necessary for the operation of the website in order to store certain website functions such as logins, shopping baskets or user preferences, e.g. regarding the website’s language.
• Session cookies: Session cookies are required to recognise when the same user accesses a service multiple times (e.g. when you have logged in, to determine your login status). When you visit our site again, these cookies provide information to automatically recognise you. The information obtained in this way is used to optimise our services and make it easier for you to access our site. When you close your browser or log out, the session cookies are deleted.
• Persistent cookies: These cookies remain stored even after you close your browser. They are used to store your login details, measure website reach and for marketing purposes. They are automatically deleted after a specified period, which may vary depending on the cookie. You can delete cookies at any time via your browser’s security settings.
• Third-party cookies (in particular from advertisers): You can configure your browser settings according to your preferences and, for example, refuse to accept third-party cookies or all cookies. However, we would like to point out here that you may then not be able to use all the features of this website. Please read more about these cookies in the respective privacy policies of the third-party providers.
Data categories: User data, cookies, user ID (including pages visited, device information, access times and IP addresses).
Purposes of processing: The information obtained in this way is used to optimise our website offerings from a technical and commercial perspective and to enable you to access our website more easily and securely.
Legal basis: Where we process your personal data using cookies on the basis of your consent (‘opt-in’), the legal basis is Article 6(1), first sentence, point (a) of the GDPR. Otherwise, we have a legitimate interest in the effective functionality, improvement and economic operation of the website, in which case Article 6(1), first sentence, point (f) of the GDPR is the legal basis. The legal basis is also Article 6(1), first sentence, point (b) of the GDPR if the cookies are set for the purpose of entering into a contract, e.g. when placing orders.
Retention period/deletion: The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this is the case once the relevant session has ended.
Otherwise, cookies are stored on your computer and transmitted from there to our site. As a user, you therefore have full control over the use of cookies. By changing the settings in your web browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to make full use of all the website’s features.
Here you will find information on how to delete cookies by browser as at the time this website was created:
Chrome: https://support.google.com/chrome/answer/95647
Safari: https://support.apple.com/de-at/guide/safari/sfri11471/mac
Firefox: https://support.mozilla.org/de/kb/cookies-und-website-daten-in-firefox-loschen
Internet Explorer: https://support.microsoft.com/de-at/help/17442/windows-internet-explorer-delete-manage-cookies
Microsoft Edge: https://support.microsoft.com/de-at/help/4027947/windows-delete-cookies
Objection and ‘opt-out’: You can generally prevent cookies from being stored on your hard drive, regardless of consent or legal authorisation, by selecting ‘do not accept cookies’ . However, this may result in a reduction in the functionality of our services. You can opt out of the use of third-party cookies for advertising purposes via this US website (https://optout.aboutads.info) or this European website (https://www.youronlinechoices.com/de/praferenzmanagement).
Contract processing
We process master data (e.g. company, title/academic degree, names and addresses, as well as users’ contact details and email addresses), contractual data (e.g. services used, names of contact persons) and payment data (e.g. bank details, payment history) for the purpose of fulfilling our contractual obligations (identifying the contracting party; establishing the the substance and execution of the contract; checking the plausibility of the data) and to provide services (e.g. contacting customer services) in accordance with Article 6(1), first sentence, point (b) of the GDPR. The fields marked as mandatory in online forms are required for the conclusion of the contract.
As a general rule, this data is not disclosed to third parties, unless it is necessary to pursue our claims (e.g. transfer to a solicitor for debt collection) or to fulfil the contract (e.g. transfer of data to payment service providers), or where there is a legal obligation to do so in accordance with Article 6(1), first sentence, point (c) of the GDPR.
We may also process the data you provide in order to inform you about other interesting products from our portfolio or to send you emails containing technical information.
The data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. This applies to customer and contract data once the data is no longer required for the performance of the contract and no further claims arising from the contract can be asserted because they are time-barred (warranty: two years / standard limitation period: three years). We are obliged under commercial and tax law to store your address, payment and order details for a period of ten years. However, upon termination of the contract, we restrict the processing of your data after three years; in other words, your data will only be used to comply with legal obligations. Information in your user account remains there until it is deleted.
Contact via the contact form
/ email / fax / post
When you contact us via the contact form, by fax, post or email, your details will be processed for the purpose of handling your enquiry.
The legal basis for the processing of data, where you have given your consent, is Art. 6(1), first sentence, point (a) of the GDPR. The legal basis for processing data transmitted in the course of a contact enquiry or via email, letter or fax is Article 6(1), first sentence, point (f) of the GDPR. The data controller has a legitimate interest in processing and storing the data in order to respond to users’ enquiries, to preserve evidence for liability purposes, and, where applicable, to comply with its statutory retention obligations regarding business correspondence. If the contact is aimed at concluding a contract, the additional legal basis for the processing is Article 6(1), first sentence, point (b) of the GDPR.
We may store your details and contact enquiry in our Customer Relationship Management system (“CRM system”) or a comparable system.
The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. For personal data entered via the contact form and that sent by email, this is the case once the relevant conversation with you has ended. The conversation is deemed to have ended when it is clear from the circumstances that the matter in question has been conclusively resolved. Enquiries from users who have an account or contract with us are stored until two years have elapsed since the termination of the contract. In the case of statutory archiving obligations, deletion takes place once these have expired: at the end of the retention periods under commercial law (6 years) and tax law (10 years).
You may withdraw your consent to the processing of personal data pursuant to Article 6(1)(a) of the GDPR at any time. If you contact us by email, you may object to the storage of your personal data at any time.
Contacting us by telephone
When you contact us by telephone, your telephone number is processed for the purpose of handling your enquiry and its resolution, and is temporarily stored in the RAM or cache of the telephone device or displayed on the screen. This storage is carried out for liability and security reasons, to provide evidence of the call, as well as for commercial reasons, to enable us to call you back. In the event of unauthorised marketing calls, we will block the telephone numbers.
The legal basis for the processing of the telephone number is Article 6(1)(f) of the GDPR. If the purpose of the contact is to conclude a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR.
The device cache stores calls for 10 days and gradually overwrites or deletes old data; when the device is disposed of, all data is deleted and the storage medium is destroyed where necessary. Blocked telephone numbers are reviewed annually to assess whether the block is still necessary.
You can prevent your telephone number from being displayed by calling with your number withheld.
Data protection in relation to job applications and the recruitment process
Applications sent to the data controller electronically or by post are processed electronically or manually for the purpose of handling the recruitment process.
We expressly point out that application documents containing ‘special categories of personal data’ as defined in Article 9 of the GDPR (e.g. a photograph that reveals your ethnic origin, religion or your marital status), with the exception of any severe disability which you may wish to disclose of your own free will, are not required. You should submit your application without including this information. This will not affect your chances of being selected.
The legal basis for the processing is Article 6(1), first sentence, point (b) of the GDPR and Section 26 of the Federal Data Protection Act (BDSG) as amended.
If, following the conclusion of the recruitment process, an employment relationship is entered into with the applicant, the applicant’s data will be stored in accordance with the relevant data protection regulations. If you are not offered a position following the conclusion of the application process, your submitted application letter and supporting documents will be deleted 6 months after the rejection letter is sent, in order to comply with any claims and obligations to provide evidence under the AGG.
Rights of the data subject
Objection to or withdrawal of consent for the processing of your data
Where the processing is based on your consent in accordance with Article 6(1), first sentence, point (a), and Article 7 of the GDPR, you have the right to withdraw your consent at any time. This does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal.
Where we base the processing of your personal data on a balancing of interests pursuant to Article 6(1), first sentence, point (f) of the GDPR, you may object to the processing. This is the case, in particular, where the processing is not necessary for the performance of a contract with you, as set out by us in the subsequent description of the functions. Should you exercise such a right to object, we ask that you explain the reasons why we should not process your personal data in the manner described. In the event of a justified objection, we will examine the circumstances and either cease or adjust the data processing, or explain to you our compelling legitimate grounds on the basis of which we will continue the processing.
You may object at any time to the processing of your personal data for the purposes of advertising and data analysis. You may exercise this right to object free of charge. You can inform us of your objection to advertising using the contact details provided at the beginning of the legal notice.
Right of access
You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to obtain information about your personal data stored by us in accordance with Article 15 of the GDPR. This includes, in particular, information on the purposes of processing, the categories of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period, and the origin of your data, provided that these were not collected directly from you.
Right to rectification
You have the right to have inaccurate data rectified or accurate data completed in accordance with Article 16 of the GDPR.
Right to erasure
You have the right to have your data stored by us erased in accordance with Article 17 of the GDPR, unless this is prevented by statutory or contractual retention periods or other legal obligations or rights requiring further storage.
Right to restriction
You have the right to request a restriction on the processing of your personal data if any of the conditions set out in Article 18(1)(a) to (d) of the GDPR are met:
• Where you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and you object to the erasure of the personal data and instead request the restriction of its use;
• the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims, or
• if you have objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether the controller’s legitimate grounds override your interests.
Right to data portability
You have a right to data portability under Article 20 of the GDPR, which means that you may receive the personal data we hold about you in a structured, commonly used and machine-readable format, or request that it be transferred to another controller.
Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority in the Member State where you reside, where you work, or where the alleged infringement took place.
Data security
In order to protect all personal data transmitted to us and to ensure that data protection regulations are complied with not only by us but also by our external service providers, we have implemented appropriate technical and organisational security measures. For this reason, amongst other things, all data is transmitted between your browser and our server via a secure SSL connection.
As none of the information provided constitutes an officially certified and sworn translation, only the German information on this website is legally binding.
Last updated: 11 September 2026
Contract processing
Contact via contact form / email / fax / post
Contacting us by telephone
Data protection in relation to job applications and the recruitment process
Rights of the data subject
Objection to or withdrawal of consent regarding the processing of your data
Where the processing is based on your consent in accordance with Article 6(1), first sentence, point (a), and Article 7 of the GDPR, you have the right to withdraw your consent at any time. This does not affect the lawfulness of the processing carried out on the basis of your consent up until the time of withdrawal.
Where we base the processing of your personal data on a balancing of interests in accordance with Article 6(1), first sentence, point (f) of the GDPR, you may object to the processing. This is the case, in particular, where the processing is not necessary for the performance of a contract with you, as we will explain in each instance in the following description of the functions. Should you exercise such a right to object, we ask that you set out the reasons why we should not process your personal data as we have been doing. In the event of a justified objection, we will review the circumstances and either cease or adjust the data processing, or explain to you our compelling legitimate grounds on the basis of which we will continue the processing.
You may object at any time to the processing of your personal data for the purposes of marketing and data analysis. You may exercise this right to object free of charge. You can inform us of your objection to marketing using the following contact details:
European Certification Council B.V.
Avenue Ceramique 221
6221KX Maastricht
Telephone: +49 (0)2403-720 4231
Email: certcouncil@certcouncil.eu
Represented by:
Dipl.-Ing. Natascha Jahansouzi
Registration details:
Entered in the Commercial Register.
Registering court: 6221KX Maastricht
Registration number: 98492888
VAT number:
VAT identification number pursuant to Section 27a of the Value Added Tax Act:
NL868518438B01
Responsible for the content:
Dipl.-Ing. Natascha Jahansouzi
Data security
To protect all personal data transmitted to us and to ensure that data protection regulations are complied with not only by us but also by our external service providers, we have implemented appropriate technical and organisational security measures. For this reason, amongst other things, all data is transmitted between your browser and our server via a secure SSL connection.
Last updated: 11 September 2026