Privacy­policy

1. Controller and contact

The controller responsible for data processing on this website within the meaning of Article 4(7) GDPR is:
Mustermann Carpentry, owner Korbinian Mustermann
Musterweg 12, 83xxx Musterdorf, Germany
Phone 08641 0000, email info@mustermann.de

We have not appointed a data protection officer, because the legal requirements for one don’t apply to a business of our size. If you have questions about data protection, please contact us directly at the address above. You’ll also find all details about the business in the Legal notice.

2. General information on data processing

We only process personal data as far as it’s needed for a working website and for our work as a joinery. As a rule, processing only takes place with your consent or on one of the legal bases in Article 6(1) GDPR.

• Article 6(1)(a) GDPR: You have consented to the processing, for example when you send us photos of your room voluntarily.
• Article 6(1)(b) GDPR: The processing is necessary to perform a contract or to take steps before entering into one, for example for measuring up, a quote or an installation.
• Article 6(1)(c) GDPR: We are legally required to process data, for example because of retention obligations under commercial and tax law.
• Article 6(1)(f) GDPR: The processing is necessary to protect our legitimate interests, for example to run the website securely or to answer general enquiries.

3. Hosting and server log files

This website is hosted by a provider with servers in Germany. Each time a page is opened, the server automatically records data that your browser sends. These are:

• Shortened IP address
• Date and time of access
• Name and address of the requested file
• Amount of data transferred and whether the request was successful
• Browser type and browser version
• Operating system used
• Previously visited page, if your browser sends it

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in running the site without technical errors, delivering the page and fending off attacks. This data is not combined with other data sources, and we don’t analyze the log files for advertising purposes.

The log files are deleted automatically after seven days, unless a security incident makes keeping them longer necessary in a particular case. We have a data processing agreement with the hosting provider under Article 28 GDPR.

4. Contact by phone, email and enquiry form

When you write to us using the enquiry form, we process the details you enter: name, phone number, email address, project location, type of project, your rough budget and your own description.

You can choose to attach photos of the room to the form. These pictures help us estimate the work realistically before we come out to measure. The upload is voluntary. To that extent the legal basis is your consent under Article 6(1)(a) GDPR, and otherwise Article 6(1)(b) GDPR, because the processing serves steps taken before entering into a contract. Please only upload photos that don’t show any other people.

When you call us or send an email, we store your details to deal with your request and in case of follow-up questions. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries, and otherwise Article 6(1)(f) GDPR based on our legitimate interest in answering you.

We delete the enquiry and any photos sent with it once your request has been fully dealt with and no retention periods under commercial or tax law apply. If no order comes about, we delete the documents no later than six months after our last contact. You can also ask us to delete them sooner. A phone call is enough.

5. Retention periods under commercial and tax law

If an order comes about, we are required to keep the business records. The legal basis is Article 6(1)(c) GDPR in conjunction with the provisions of the German Commercial Code (Handelsgesetzbuch) and the Fiscal Code (Abgabenordnung).

• Six years for business letters, for example quotes, order confirmations and business correspondence
• Ten years for invoices, accounting vouchers and bookkeeping records

The periods start at the end of the calendar year in which the document was created. During this time, processing of the data is restricted, which means we only use it to meet these obligations. Once the period ends, it is deleted.

6. Applications for internships and apprenticeships

If you apply for an internship or an apprenticeship, we process the data you send us, in particular contact details, CV, certificates and your cover letter. The legal basis is Article 6(1)(b) GDPR in conjunction with § 26 of the Federal Data Protection Act (Bundesdatenschutzgesetz), because the processing is necessary to decide whether to enter into an apprenticeship.

If we don’t make you an offer, we delete or destroy the application documents no later than six months after the process ends. If you’d like us to keep your documents for future positions, just let us know. We then store them on the basis of your consent under Article 6(1)(a) GDPR, which you can withdraw at any time. If we do make you an offer, the documents go into your personnel file.

7. Cookies, analytics and external content

This website doesn’t set any cookies beyond what is technically necessary. We don’t use analytics tools, no Google Analytics, no ad networks, no social media plugins, no external fonts and no embedded maps from third parties.

Every part of the site, meaning fonts, images, styles and scripts, is loaded from our own server. That’s why no connection to third parties is made when you visit, and that’s also why you won’t see a cookie banner here. Where a directions map is shown, it’s an image placeholder without a map service. If a map service is added in a later version, it will only load after you click on it, and there will be a separate note about it in this section.

8. Recipients and processors

We only pass on your data if it’s needed to fulfil the contract, if there is a legal obligation or if you have consented. Recipients may be:

• Our hosting provider, who runs the website and the email inbox on the technical side
• Our tax advisor and, in the event of an audit, the tax office
• Trade businesses we bring into a project with your knowledge, for example for electrical, stone or painting work
• Suppliers, if a delivery is to go directly to your address

With service providers who process data on our behalf, we have signed data processing agreements under Article 28 GDPR. These state that the providers may only use the data on our instructions and only for the agreed purpose. We do not sell data.

9. No transfer to third countries

Your data is not transferred to countries outside the European Union and the European Economic Area. Our servers are in Germany, and our service providers are based in Germany or elsewhere in the European Union.

10. Your rights

You have the following rights with regard to your personal data at any time:

• Right of access under Article 15 GDPR to find out whether we process data about you and which data
• Right to have incorrect or incomplete data corrected under Article 16 GDPR
• Right to erasure under Article 17 GDPR, unless a legal retention obligation stands in the way
• Right to restriction of processing under Article 18 GDPR
• Right to data portability under Article 20 GDPR in a common, machine-readable format
• Right to object to processing based on a legitimate interest under Article 21 GDPR
• Right to withdraw consent you have given, with effect for the future, under Article 7(3) GDPR

A phone call or an email is enough, we don’t need a form for it. We reply within one month. Withdrawing consent doesn’t affect the lawfulness of the processing carried out up to that point.

11. Right to lodge a complaint with the supervisory authority

If you believe that the processing of your data violates the GDPR, you can lodge a complaint with a supervisory authority, without prejudice to any other legal remedies. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority)
Promenade 27
91522 Ansbach

We’d appreciate it if you gave us a quick call first. A lot of things can be cleared up in five minutes.

12. No automated decision-making

There is no automated decision-making, including profiling, under Article 22 GDPR. A person in the workshop decides on your enquiry, and a person works out your quote too.

13. Data security

This site uses TLS encryption, formerly known as SSL. You can tell by the padlock in your browser’s address bar and by the address starting with https. This means data you send us through the form can’t easily be read by third parties.

On top of that, we protect our systems with current updates, access restrictions and regular backups. Paper documents such as measuring sheets and drawings are kept locked in the office. Complete protection of data sent over the internet is technically not possible.

14. Changes to this policy

We update this privacy policy when our website, our processes or the law change. The version published on this page always applies. Last updated: September 2026.