Privacy policy

1. Data protection at a glance

Richard Kablitz GmbH takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations (in particular the GDPR, the German BDSG and TDDDG) and this privacy policy.

The public pages of this website use no cookies, no analytics or tracking tools and no advertising services. Fonts, images and videos are loaded from our own server. A connection to Google is only made if you explicitly load the map or a YouTube video (section 5).

2. Controller and data protection officer

The controller responsible for data processing on this website is:

Richard Kablitz GmbH
Bahnhofstraße 72–78
97922 Lauda-Königshofen
Germany

Represented by the Managing Director Michele Vigna
Phone: +49 (0) 9343 7901-0
Email: service@kablitz.de

You can reach our company data protection officer at:
Richard Kablitz GmbH – Data Protection Officer
Bahnhofstraße 72–78, 97922 Lauda-Königshofen, Germany
Email: datenschutz@kablitz.de

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The website's server functions run in the Frankfurt am Main data centre; static content is delivered through Vercel's global network, usually from a location close to you.

When you visit the website, Vercel automatically processes information transmitted by your browser: IP address, date and time of the request, page requested, referrer URL, browser type and version and operating system. This data is technically necessary to deliver the website, keep it secure and detect faults and misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable provision of the website. Vercel deletes the logs automatically after a short period.

Vercel processes the data as a processor under Art. 28 GDPR. Vercel is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision of 10 July 2023 and additionally on standard contractual clauses.

4. Project and service inquiries

If you contact us via an inquiry form (project inquiry, heat exchanger questionnaire or spare parts and service inquiry), we process your details to handle the inquiry, clarify questions and, where applicable, prepare a quotation. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and, where you inquire on behalf of a company, Art. 6(1)(f) GDPR (legitimate interest in handling business inquiries).

Name, business email address and company are required; without them we cannot answer your inquiry. All other details, such as phone number, location, fuel, operating parameters, budget, dates or scope of supply, are optional and used for technical clarification. Please do not submit personal data about other people.

Your entries remain only in the working memory of the open page until you submit them; we do not store drafts in your browser. Submitted inquiries are stored in a database in the Frankfurt am Main data centre (provider: Neon LLC, a Databricks, Inc. company, San Francisco, USA, as processor). Only authorised employees have access in the protected administration area. Neon is a US company; where access from the USA cannot be ruled out, it is based on the parent company's EU-U.S. Data Privacy Framework certification and on standard contractual clauses.

To protect the forms against abusive mass submissions, we store a hash of your IP address generated with a secret key when you submit a form. The IP address itself is not stored. The hash is used to limit submissions only within a window of at most 15 minutes. Expired entries are deleted on subsequent requests or during the next daily cleanup, even if no further submission occurs. If a technical failure prevents deletion, it is completed during the next successful cleanup. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the forms against misuse.

We delete inquiries once they have been fully handled and no further questions are expected, and in any case automatically twelve months after they were last handled. If an inquiry leads to a contract, we retain the resulting business records in accordance with the statutory retention periods (in particular § 257 HGB and § 147 AO, up to ten years).

5. Google Maps and YouTube videos (only after your click)

On the home page and the contact page you can display a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded when you click “Load Google map”. Only then does your browser connect to Google's servers; in particular your IP address, browser data and the page visited are transmitted to Google, possibly also to Google LLC in the USA. Google may use cookies or similar technologies.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, which you give by clicking. You can withdraw it at any time with effect for the future by hiding the map via “Close Google map” or reloading the page; your choice is not stored. Google LLC is certified under the EU-U.S. Data Privacy Framework. More information: https://policies.google.com/privacy

On individual technology pages you can play animation videos from YouTube (Google Ireland Limited, address as above). The video is loaded in privacy-enhanced mode (youtube-nocookie.com) only when you click “Load video”; before that there is no connection to YouTube. After that, in particular your IP address, browser data and the page visited are transmitted to Google, possibly also to Google LLC in the USA, and YouTube may use cookies or similar technologies. Legal basis and withdrawal as for the map: consent by clicking, withdrawal via “Close video” or by reloading the page; your choice is not stored.

6. Job applications

If you apply to us by email, we process your application documents and contact details to carry out the application procedure. The legal basis is Art. 6(1)(b) GDPR in conjunction with § 26 BDSG. If you are employed, the data is transferred to your personnel file. Otherwise we delete your documents no later than six months after the procedure ends, unless you have consented to longer storage or we need the data to defend against legal claims.

7. Business partners

In business relationships with customers, suppliers and other partners, we process the data of the respective contact persons: name, form of address and title where applicable, address, phone and fax numbers, email address, bank and payment details where applicable, and other information we receive directly from you for performing the contract.

The purposes are initiating, performing and handling the contractual relationship including correspondence, fulfilling our contractual and statutory obligations as manufacturer and supplier, and handling mutual claims (e.g. invoicing, warranty, liability). The legal bases are Art. 6(1)(b) GDPR (contract), Art. 6(1)(c) GDPR (legal obligations), Art. 6(1)(f) GDPR (legitimate interest in conducting the business relationship with your company) and, where you have given consent, Art. 6(1)(a) GDPR.

Where required for the respective order, recipients are our processors (e.g. IT service providers), engineering firms and experts, banks and insurers, and public bodies such as permitting authorities and courts where there is a legal or official obligation. We transfer data to countries outside the European Economic Area only where this is necessary for performing the contract, for example for projects abroad, or is otherwise permitted under Art. 44 to 49 GDPR.

We store the data for the duration of the business relationship and thereafter for the statutory retention periods (in particular under the German HGB and AO, up to ten years), and beyond that only where it is needed to establish, exercise or defend legal claims. You can object at any time, without giving reasons, to processing for direct marketing purposes (Art. 21(2) GDPR).

8. Recipients and transfers to third countries

Within our company, only the employees who need your data to handle your request have access to it. External recipients are exclusively our processors, who are contractually bound under Art. 28 GDPR:

– Hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
– Database: Neon LLC (a Databricks, Inc. company), San Francisco, USA, stored in Frankfurt am Main
– Technical support and maintenance of the website: ADSPIRE, Đorđe Mladenović, Niš, Serbia

There is no adequacy decision of the European Commission for Serbia. Transfers to the technical service provider are therefore based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). For transfers to the USA see sections 3 to 5. You can obtain a copy of the safeguards on request at the address above.

9. Your rights as a data subject

Within the scope of the statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing (Art. 15 GDPR), as well as the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.

For this and any other data protection questions, you can contact us at any time at service@kablitz.de, our data protection officer (datenschutz@kablitz.de) or the address above. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart
poststelle@lfdi.bwl.de
www.baden-wuerttemberg.datenschutz.de

10. Right to object under Art. 21 GDPR

Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. No particular form is required, for example an email to service@kablitz.de.

11. Further information

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

For security reasons this website uses TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar.

The protected administration area is intended only for employees of Richard Kablitz GmbH; the sign-in required there sets technically necessary cookies that are not used on the public pages.

Service inquiry attachments

You may optionally attach photographs or technical drawings to your service inquiry. File contents, names and sizes are processed in private Vercel Blob storage to handle your inquiry. Only authorised employees can download linked attachments in the protected administration area. Please provide only necessary technical documents and avoid personal information about other people; image files may also contain embedded metadata.

Uploads that are not submitted are marked for deletion after 24 hours and removed by a regular cleanup process; deletion is retried after technical failures. Attachments to submitted inquiries are managed together with the inquiry. Deleting an inquiry immediately blocks downloads and initiates removal of its stored files. No form or file draft is saved in local browser storage.