Privacy policy
Last updated: 13 October 2026
1. Controller
Controller for the processing of personal data on this website: Sindomat GmbH, Rosmarweg 201, 50226 Frechen, Germany, email: info@sindomat.net.
2. Hosting and server logs
This website is operated on a server of Hetzner Online GmbH. On every request our servers automatically log access data: IP address, date and time, requested page, transferred data volume, browser type and operating system.
The purpose is the secure and stable operation of the website and the detection and prevention of attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation).
To detect errors of the website, a script on our pages reports technical errors to our server. The report itself contains only the type of error (two fixed values) and the page area, no texts and no input from you; we store these two details with the time, without IP address and browser identification. As with every request, the server logs record the access data listed above. To limit abusively frequent reports, a hash value of your IP address is used (retention as in section 9). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in error detection).
4. Contact form and email
When you write to us through the contact form, we process the details you enter: name, email address and message and, if you provide them, subject, company and phone number. Required fields are marked in the form; without them we cannot handle your enquiry. The phone number is optional; we call you only if you wish. We also process the time of your enquiry, a technical reference for it and, to limit abusively frequent requests, a hash value of your IP address; only this hash is stored, not the IP address itself. To verify the security check, our server transmits your IP address to Cloudflare (section 6).
The purpose is to answer your enquiry. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling business enquiries) and, where you consider a contract with us as an individual, additionally Art. 6(1)(b) GDPR.
If you write to us by email (for example via the email link), your email program opens. We receive your email address and the details in your message and use them to handle your enquiry; the legal basis is the same.
We transfer your details from the form into our customer management system (Odoo Online of Odoo SA). For sending and receiving email we use email service providers that act on our behalf (processors). More on recipients is in section 8, on retention in section 9.
We do not take any decision based solely on automated processing that produces legal effects concerning you.
5. AI readiness check
In the AI readiness check you answer questions about your business and, to receive your result, enter first name, last name, company name, email address and phone number. Required fields are marked in the form; the others are optional. We transmit your answers and these details to our server and store them in our customer management system (Odoo Online) as a contact record, so that a member of our team can review them and get in touch with you. A score is calculated from your answers; no decision with legal effect for you is linked to it.
The legal basis for providing your result is Art. 6(1)(b) GDPR; for keeping the data and for contacting you about your result it is Art. 6(1)(f) GDPR (legitimate interest in looking after business contacts). We call you only if you wish. You receive your result without a phone number as well.
6. Security check (Cloudflare Turnstile)
We protect our forms against automated abuse with Cloudflare Turnstile. For this, a script from Cloudflare is loaded on pages with a form; Cloudflare processes your IP address, a TLS fingerprint, your browser identification and the identifier of our website to check whether the request comes from a human. The provider is Cloudflare, Inc. (USA). Cloudflare acts for us as processor and, to improve its bot detection, also processes these signals under its own responsibility. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protection against abuse).
7. Appointment booking
When you book an appointment, the Microsoft booking page (Microsoft Bookings) opens in a new tab after your click. Data is transferred to Microsoft only from that click; the details you enter there are processed by Microsoft under its own privacy notices. We receive your appointment request and your contact details to hold the appointment. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in appointments with business contacts) and, where you consider a contract with us as an individual, additionally Art. 6(1)(b) GDPR (pre-contractual measures at your request).
8. Recipients and third countries
Depending on use, recipients of your data are: Hetzner Online GmbH (hosting); Odoo SA (customer management, Odoo Online); Cloudflare, Inc. (security check); email service providers (processors); Google Ireland Limited and Microsoft (see sections 3 and 7).
According to Odoo, it processes the data in data centres in France and Belgium. Backups are held in France, the Netherlands and Sweden and, for existing databases, additionally in Canada until the transition is complete (expected in the fourth quarter of 2026 according to Odoo); the location of the backups cannot be chosen. For Canada there is an adequacy decision of the European Commission for commercial organisations.
Cloudflare, Inc. is based in the USA and, according to its own statements, relies on standard contractual clauses and the EU-US Data Privacy Framework for transfers.
9. Retention
Entries from the contact form and the AI readiness check are stored for delivery in a temporary store on our server and deleted there 30 days after receipt.
We keep enquiries and contact records in the customer management system for up to 12 months after the last contact, unless an order results. If an order results, statutory retention periods apply to the related documents (commercial letters 6 years, accounting vouchers 8 years, books and annual accounts 10 years; § 257 HGB, § 147 AO). We treat emails to us and appointment bookings like enquiries from the form. We need the hash value of your IP address only for the time window of the rate limit (currently one hour); we delete it automatically with the first form request or error report received after two time windows (currently two hours) have passed.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can withdraw a given consent at any time with effect for the future (Art. 7(3) GDPR).
An email to info@sindomat.net is enough for access, rectification and erasure; we then also delete your record in our customer management system unless a statutory retention period applies. You are not obliged to give us any details; without the fields marked as required we cannot handle your enquiry or your result. You also have the right to lodge a complaint with the competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Postfach 20 04 44, 40102 Düsseldorf, Germany.
Official GDPR text: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679