Privacy Policy

This privacy policy explains how PTS Group GmbH ("we" or "us") processes personal data when you visit our website and online shop at www.pts-group.de, use a customer account, place an order, request a quote, or contact us in any other way. It also explains the rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

The controller within the meaning of Art. 4 (7) GDPR is:

PTS Group GmbH
Kruppstr. 23
41540 Dormagen, Germany
Phone: +49 221 7029 10
Email: info@pts-group.de

Further information about our company is available in the legal notice.

2. Overview

We process personal data only to the extent necessary to operate this website, to process orders and quote requests, to manage customer accounts, and to respond to your inquiries, or where you have consented to a specific processing activity. Depending on the activity, the legal bases are Art. 6 (1)(a) (consent), (b) (contract and pre-contractual steps), (c) (legal obligation), and (f) (legitimate interest) GDPR. The individual processing activities are described in the sections below.

3. Hosting and server log files

Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA ("Vercel"). When you access the website, Vercel processes technical access data on our behalf (IP address, date and time, requested page, browser and device type) as required to deliver the page and to keep the service stable and secure. The legal basis is our legitimate interest in the secure and performant operation of the website (Art. 6 (1)(f) GDPR). Log data is stored only for a short period.

Vercel is certified under the EU-U.S. Data Privacy Framework; in addition, EU standard contractual clauses are in place. More information: Vercel privacy policy.

We also use the cookie-less services Vercel Analytics and Vercel Speed Insights to measure loading performance and usage of our website. These services set no cookies, store no persistent identifiers on your device, and build no cross-site profiles; evaluation is aggregated. The legal basis is our legitimate interest in improving our services (Art. 6 (1)(f) GDPR).

4. Cookies and consent management

We use technically necessary cookies without which the shop does not work (sign-in, cart, language preference). The legal basis is Section 25 (2) no. 2 of the German TDDDG together with Art. 6 (1)(b) and (f) GDPR. The most important cookies we set:

Cookies and similar technologies that are not technically necessary (in particular for analytics and marketing, section 8) are used only with your consent (Section 25 (1) TDDDG, Art. 6 (1)(a) GDPR). You make your choice in our consent dialog on your first visit; your decision is stored locally in your browser. You can change or withdraw your consent at any time with effect for the future via "Privacy settings" in the page footer.

For consent management we use the service of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany. Usercentrics processes your consent status, the time of your decision, and a pseudonymous identifier in order to prove that consent was given. The legal basis is Art. 6 (1)(c) GDPR in conjunction with Art. 7 (1) GDPR.

5. Shop platform, customer account, and checkout (Shopify)

Our online shop runs on the Shopify platform. The contracting entity and processor for the European region is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. On our behalf, Shopify processes your customer and company account data (name, email address, company, contacts, locations), your order and cart data (billing and shipping address, ordered items), and, during checkout, the payment method you select. You enter payment details in the checkout provided by Shopify directly with the respective payment provider.

The legal basis is the performance of the contract or pre-contractual steps (Art. 6 (1)(b) GDPR) and our legitimate interest in account security and abuse prevention (Art. 6 (1)(f) GDPR).

Data may also be transferred to the parent company Shopify Inc., 150 Elgin Street, Ottawa, ON K2P 1L4, Canada, and to data centers in the USA. An adequacy decision of the European Commission exists for Canada; transfers to the USA are safeguarded by Shopify through standard contractual clauses. More information: Shopify privacy policy.

6. Order and contract processing

To process orders, quote requests, invoices, and deliveries, we process your order and contact data in our internal merchandise management systems, which we operate using cloud services of Microsoft Ireland Operations Limited (Dublin, Ireland). We share the data required for delivery (name, shipping address, phone number where applicable) with shipping and logistics providers. The legal bases are Art. 6 (1)(b) GDPR and Art. 6 (1)(c) GDPR to the extent commercial and tax law obligations apply.

We retain business and accounting records for the statutory periods of six to ten years (Section 257 of the German Commercial Code, Section 147 of the German Fiscal Code).

7. Product search (Algolia)

For product search in our shop we use the search service Algolia, provided by Algolia SAS (Paris, France). Your search queries are sent directly from your browser to Algolia; for technical reasons, Algolia also processes your IP address and browser information. The legal basis is our legitimate interest in a fast, relevant product search as a core function of the shop (Art. 6 (1)(f) GDPR). Only if you have given consent via our consent banner are pseudonymous click and selection events additionally recorded (for example which search result was opened) to improve search quality (Sec. 25 (1) TDDDG, Art. 6 (1)(a) GDPR); this uses a random session identifier that is not permanently stored on your device. This data is not linked to your customer account, and you can withdraw your consent at any time via the cookie settings in the footer. Where data is transferred to the USA, this is based on standard contractual clauses. More information: Algolia privacy policy.

8. Analytics and marketing (Google Tag Manager, Google Analytics 4)

We load Google Tag Manager on all pages and measure the usage of our website with Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Pseudonymous usage data is collected, such as pages viewed, devices used, and shop events such as adding an item to the cart. Google Analytics 4 does not store complete IP addresses. If you have additionally consented to marketing, Google marketing services (such as Google Ads conversion measurement) may also be loaded via the Tag Manager.

We use Google Consent Mode for this. For as long as you have not given consent, no analytics or marketing cookies are set and no identifiers are stored on or read from your device. In that state, only a cookieless signal without identifiers is transmitted to Google (such as the page viewed, the time, and an approximate region), from which Google derives statistical model values only; you are not re-identified in the process. The legal basis for this cookieless transmission is our legitimate interest in privacy-preserving reach measurement (Art. 6 (1)(f) GDPR); Section 25 (1) TDDDG does not apply, because no information is stored on or read from your device. You may object to this processing at any time under Art. 21 GDPR.

Only with your consent (Art. 6 (1)(a) GDPR, Section 25 (1) TDDDG) are cookies set and usage data evaluated on a personal basis. You can withdraw it at any time with effect for the future via "Privacy settings" in the page footer. User-level data in Google Analytics is deleted after 14 months at the latest. Data may be transferred to servers of Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. More information: Google privacy policy.

9. Contact, quote, and service requests

When you contact us via a form on this website, request a quote, report a product data issue, or invite a team member as a company account administrator, we process the data you provide (for example name, email address, phone number, company, your message, and any attachments) to handle your request. To organize these requests we use the ticket system of Zendesk, Inc. (USA) as a processor. Zendesk is certified under the EU-U.S. Data Privacy Framework; in addition, standard contractual clauses are in place.

The legal basis is the performance of pre-contractual steps or of the contract (Art. 6 (1)(b) GDPR) and our legitimate interest in handling requests efficiently (Art. 6 (1)(f) GDPR). Quote requests from the cart are additionally processed in our shop platform (section 5) and our internal systems (section 6). We delete request data once the matter has been fully resolved and no statutory retention obligations apply.

10. Newsletter

To send our newsletter we process your email address based on your consent (Art. 6 (1)(a) GDPR). Dispatch is handled by Brevo GmbH, Köpenicker Straße 126, 10963 Berlin, Germany, as a processor. You can unsubscribe at any time via the link in every newsletter or by contacting us; your email address will then be removed from the mailing list. More information: Brevo privacy policy.

11. Careers portal

Open positions on our careers page are loaded from the applicant management system of Factorial (Barcelona, Spain). Simply viewing the job listings does not transmit any of your personal data to Factorial. You submit your application on the application portal operated externally by Factorial; the portal's privacy notice additionally applies there. We process application data to run the application process (Art. 6 (1)(b) GDPR, Section 26 of the German BDSG) and delete it no later than six months after the process has ended, unless you have consented to longer storage.

12. Security, abuse prevention, and error diagnostics

To protect our forms against abuse, we limit how frequently requests can be made. For this purpose we briefly store technical identifiers (IP address, email address, or customer identifier) in a cloud database; these entries expire automatically after a short time. If a technical error occurs on the website, we record details of the error (error message, affected page, browser type) in our server logs for diagnostics. The legal basis is our legitimate interest in the security and stability of the website (Art. 6 (1)(f) GDPR).

13. Recipients and data sharing

We share personal data only as described in this privacy policy or where a legal basis exists. Recipients are in particular:

• processors supporting us with the purposes described above (hosting and cloud infrastructure, shop platform, search service, ticket system, newsletter dispatch, analytics), in each case under contracts pursuant to Art. 28 GDPR,
• payment providers as part of the checkout process,
• shipping and logistics providers for delivering your order,
• companies of our corporate group where necessary for the purposes described (Art. 6 (1)(f) GDPR),
• authorities and other bodies where we are legally obliged to do so (Art. 6 (1)(c) GDPR).

We do not sell personal data.

14. Transfers to third countries

Some of the service providers named above also process data outside the European Union, in particular in the USA and Canada. Transfers take place only on the basis of the safeguards of Art. 44 et seq. GDPR: an adequacy decision of the European Commission (Canada; the USA for companies certified under the EU-U.S. Data Privacy Framework) or the European Commission's standard contractual clauses.

15. Retention

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations. After that, the data is deleted or anonymized. Specific periods are stated with the individual processing activities in this policy.

16. Your rights

Under the GDPR you have the following rights:

• Access to the personal data we process about you (Art. 15 GDPR),
• Rectification of inaccurate data (Art. 16 GDPR),
• Erasure of your data (Art. 17 GDPR),
• Restriction of processing (Art. 18 GDPR),
• Data portability (Art. 20 GDPR),
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR).

Right to object (Art. 21 GDPR): Where we process your data based on a legitimate interest, you have the right to object to the processing at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without stating reasons.

To exercise your rights, an informal message to info@pts-group.de is sufficient. For your protection, we may ask you to verify your identity before responding.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de. You may also contact the supervisory authority of your place of residence; an overview of the authorities in the EEA is available here.

17. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

18. Links to external websites

Our website contains links to third-party websites (for example manufacturer sites). The respective operators are responsible for their content and data processing; their privacy notices apply.

19. Changes to this privacy policy

We update this privacy policy when our data processing or the legal situation changes. The version published on this page applies; the effective date is shown at the top of the page.