Privacy Policy

1. Overview and controller

The protection of your personal data matters to us. We process your data exclusively on the basis of the statutory provisions (General Data Protection Regulation — GDPR, German Federal Data Protection Act — BDSG, German Telecommunications Digital Services Data Protection Act — TDDDG). This privacy policy explains which data we collect when you visit our website and place orders in our online shop, what we use it for and what rights you have.

Controller within the meaning of Art. 4 (7) GDPR:

Euro Bearing Deutschland GmbH
Alexe-Altenkirch-Str. 2a
50739 Köln, Germany
Represented by the Managing Director Pouya Yasavand
Phone: 0221 9171750
E-Mail: info@eurobearing.de

A data protection officer has not been appointed, as the statutory conditions for a mandatory appointment (Sect. 38 BDSG: as a rule, at least 20 persons permanently engaged in the automated processing of personal data) are not met.

2. Hosting and server log files

We operate our website and our inventory management system ourselves, on a server we administer. The server infrastructure is provided by Hostinger International Limited; the server is located in the Netherlands and therefore within the European Union. No transfer to a third country takes place in this respect.

When you access our website, the server automatically stores information in so-called server log files that your browser transmits automatically:

• IP address of the requesting device
• Date and time of access
• Name and URL of the file retrieved
• Website from which access was made (referrer URL)
• Browser used and, where applicable, operating system

This data is processed to ensure trouble-free operation, to improve stability and security, and to defend against attacks. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in technical provision and security). The log files are deleted after 14 days, unless a specific security incident requires longer retention.

3. Cookies and local storage (Sect. 25 TDDDG)

We use only technically necessary cookies and comparable storage technologies. Under Sect. 25 (2) no. 2 TDDDG, no consent is required for these; a cookie banner with a consent prompt is therefore not needed. No marketing, profiling or tracking cookies are used. In detail:

Legal basis for the subsequent processing of personal data: Art. 6 (1) (b) GDPR (performance of the contract, e.g. cart) or Art. 6 (1) (f) GDPR (functional provision of the website).

4. Web analytics with Plausible (cookieless)

We use Plausible Analytics to gather statistical insights into visitor traffic. Plausible is a privacy-friendly, cookieless analytics tool that we self-host on servers located within the European Union.

Plausible uses no cookies and collects no personal data. No cross-device profiles are created. Your IP address is processed in an anonymized form and is not stored: to recognize a visitor within a single day, only a cryptographic hash is generated, whose daily-rotating salt is deleted after 24 hours. Identification of individual persons is therefore not possible.

Certain events (e.g. add-to-cart, begin-checkout, newsletter signup) are sent to Plausible server-side. In those cases your IP address is used solely to compute the same daily-rotating anonymous hash and is not stored; no personal content (e.g. email addresses) is transmitted.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in statistical analysis and improvement of our offering). Because Plausible neither sets cookies nor processes personal data, no consent (no cookie banner) is required. Your browser's Do-Not-Track setting is respected. For more information see plausible.io/data-policy.

5. Order process and contract fulfilment

To process your order, we process the data you provide during the order process:

• Name, company (for business customers), billing and delivery address
• E-mail address, telephone number (optional, for queries and delivery notification)
• Order and contract data (items ordered, prices, order number, order date)
• Payment method and payment-related data (no complete credit card data — this is processed exclusively by the payment service provider)
• for business customers: VAT ID

The purpose is the performance of the purchase contract, including shipping, invoicing, payment processing and the handling of any warranty cases and withdrawals. Legal basis: Art. 6 (1) (b) GDPR (performance of the contract) and Art. 6 (1) (c) GDPR (statutory retention obligations).

For order and inventory management we use the ERP system Odoo. We run Odoo self-hosted on our own server (server location Netherlands, EU — see section 2). Your order data is not transferred to Odoo S.A. as a processor; it is processed and stored exclusively on that server.

After the contract has been fully performed, your data is blocked from further use and deleted upon expiry of the retention periods under commercial and tax law (see section 14), unless you have expressly consented to further use.

6. Customer account

We do not currently offer a customer account. Orders can be placed without registering; we store no login credentials or passwords from you, and no order history is kept in a user account.

7. Payment service providers

Depending on the payment method chosen, we pass on the data required for payment processing (name, billing data, payment amount) to the respective payment service provider. Legal basis: Art. 6 (1) (b) GDPR. The payment service providers are in part independently responsible for processing your payment data; their privacy notices apply in addition.

PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. When paying via PayPal, credit card via PayPal or, where offered, "Pay Later", your payment data is transmitted to PayPal. Privacy policy: paypal.com/de/legalhub/privacy-full

Credit card payment: processing is handled by our payment service provider Stripe (Stripe Payments Europe). Credit card data is collected and processed exclusively there (PCI-DSS); we do not receive complete card data. Privacy policy: stripe.com/de/privacy

Klarna: when paying via Klarna, the data required for processing is transmitted to Klarna; Klarna is independently responsible in this respect. Privacy policy: klarna.com/de/datenschutz

SEPA direct debit: when paying by SEPA direct debit, we process your account data (IBAN, account holder) and the mandate granted for collecting the invoice amount. Legal basis: Art. 6 (1) (b) GDPR. Pre-notification is given with the invoice.

Purchase on account: we process your billing data for invoicing and receivables management. For the bank transfer you receive our bank details; your bank’s privacy provisions apply.

8. Disclosure to shipping providers

To deliver your order, we pass on your name, your delivery address and — where required for delivery notification — your e-mail address and telephone number to the commissioned carrier:

• DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg
• United Parcel Service Deutschland S.à r.l. & Co. OHG (UPS), Görlitzer Straße 1, 41460 Neuss
• Deutsche Post AG (merchandise mail/letter), Charles-de-Gaulle-Straße 20, 53113 Bonn

The legal basis for transmitting name and delivery address is Art. 6 (1) (b) GDPR (performance of contract). The transmission of e-mail address and telephone number serves solely to enable delivery notification by the carrier.

We transmit your e-mail address or telephone number to the shipping provider for delivery notification or to arrange a delivery date only if you have expressly consented to this during the order process (Art. 6 (1) (a) GDPR). Consent can be revoked at any time with effect for the future.

9. Order status, dispatch confirmation and tracking

After the contract is concluded, you receive transaction-related e-mails (order receipt, order confirmation, dispatch confirmation with a tracking link, and where applicable a delivery confirmation). The order-tracking link in the e-mail contains a random, unguessable access token; the status page shows only the order status and shipping data of your own order. Legal basis: Art. 6 (1) (b) GDPR.

10. Contact (form, e-mail, telephone)

If you contact us via the contact form, by e-mail or by telephone, we process your details (name, contact data, content of the enquiry) to handle the enquiry and for possible follow-up questions. Legal bases: Art. 6 (1) (b) GDPR (pre-contractual or contractual communication) and Art. 6 (1) (f) GDPR (general enquiries). We delete enquiry data as soon as it is no longer required for processing and no statutory retention obligations (e.g. for business letters) stand in the way.

11. Newsletter (double opt-in)

For our newsletter we process your e-mail address and — for verification purposes — the time of registration and confirmation and the IP address used. The newsletter is only sent after express confirmation via the double opt-in procedure. Legal basis: Art. 6 (1) (a) GDPR (consent); logging of the registration process is based on Art. 6 (1) (f) GDPR (proof of consent).

The newsletter is sent from our own self-hosted system on our own server (see section 2). No external sending provider is involved; your e-mail address is not passed to any third party for this purpose.

You can unsubscribe from the newsletter at any time via the unsubscribe link at the end of each e-mail or by sending a message to info@eurobearing.de (revocation with effect for the future). After unsubscribing, your e-mail address is deleted from the mailing list; we may store the address in a suppression list to prevent unwanted future contact (Art. 6 (1) (f) GDPR).

12. Sales via online marketplaces (eBay)

We also sell our products via the eBay marketplace. Orders you place there are additionally subject to the privacy provisions of eBay GmbH and eBay Marketplaces GmbH. We process the order and shipping data transmitted to us by eBay as described in sections 5, 8 and 9.

13. Data transfers to third countries

Where we use service providers whose parent companies are based in the USA (e.g. PayPal, UPS), it cannot be ruled out that personal data is transferred to the USA. The transfer is based on an adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework, Art. 45 GDPR), insofar as the respective provider is certified, and additionally on EU standard contractual clauses (Art. 46 (2) (c) GDPR). Copies of the safeguards can be requested from us.

14. Storage periods and deletion

We store personal data only for as long as is necessary for the stated purposes or as statutory retention obligations exist:

• Accounting records and invoices: 8 years (Sect. 147 (3) AO, Sect. 257 HGB as amended by the Fourth Bureaucracy Relief Act; periods that expired before 2025 were 10 years)
• Commercial and business letters (including business e-mail correspondence): 6 years (Sect. 257 (1) nos. 2, 3 HGB; Sect. 147 (1) nos. 2, 3 AO)
• Annual financial statements, books, inventories: 10 years
• Proof of consent (e.g. newsletter double opt-in): for the duration of the consent plus limitation periods
• Server log files: see section 2

After expiry of the respective period, the data is routinely deleted.

15. Your rights as a data subject

You have the following rights vis-à-vis us with regard to your personal data:

• Access (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Revocation of consent given (Art. 7 (3) GDPR) — with effect for the future, without affecting the lawfulness of processing carried out before the revocation

To exercise your rights, an informal message to info@eurobearing.de is sufficient.

16. Right to object (Art. 21 GDPR)

Insofar as we process your data on the basis of Art. 6 (1) (f) GDPR (legitimate interest), you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to direct marketing at any time without stating reasons.

17. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf
Phone: 0211 38424-0
E-Mail: poststelle@ldi.nrw.de

18. No automated decision-making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

19. Obligation to provide data

The provision of personal data is neither legally nor contractually required. However, the provision of the data listed in section 5 is necessary for the conclusion and performance of a purchase contract; without this data, we cannot fulfil your order.

20. Data security (SSL/TLS)

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser address bar changing from "http://" to "https://" and by the lock symbol in your browser bar. Fonts and other resources are embedded locally; no requests are made to US CDNs (e.g. Google Fonts) when the page loads.

21. Validity and amendment of this privacy policy

This privacy policy is currently valid (last updated: 21 September 2026). It may become necessary to amend it as our website evolves or due to changed legal or regulatory requirements. The current version can be accessed at any time at eurobearing.de/rechtliches/datenschutz.