Status: 1.07.2026

1. Responsible

The responsible party in terms of the General Data Protection Regulation (GDPR) is:

Saltmate Ltd, Untergasse 46D, 61184 Karben

Email: anastasia.reif@saltmate.de

2. General Information

We process personal data of our website visitors and customers only to the extent necessary for the provision of our website, our content and services, or where consent or another legal basis is present. Legal bases are in particular:

• Art. 6 para. 1 lit. a GDPR (consent),
• Art. 6 para. 1 lit. b GDPR (contract fulfilment and pre-contractual measures),
• Art. 6 para. 1 lit. c GDPR (legal obligation, e.g. commercial and tax retention obligations),
• Art. 6 para. 1 lit. f GDPR (legitimate interest).

3. Hosting and Technical Provision

Our website and our online shop are operated on the platform Odoo . The provider is Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium. The processing of data takes place on servers within the European Union. A contract for data processing in accordance with Art. 28 GDPR has been concluded with the provider.

Server Logfiles

When you access our website, information is automatically stored in so-called server log files: IP address, date and time of the request, accessed page, browser type and version, operating system, referrer URL. This data serves to ensure the uninterrupted operation, system security, and error analysis (Legal basis: Art. 6 para. 1 lit. f GDPR). There is no merging with other data sources. The log files are deleted after 14 days.

4. Cookies and Consent Management

Our website uses cookies. We use technically necessary cookies (e.g. shopping cart, login, language settings) on the basis of § 25 para. 2 TDDDG and Art. 6 para. 1 lit. f GDPR. All non-essential cookies (e.g. statistics, marketing) are only set with your explicit consent (§ 25 para. 1 TDDDG, Art. 6 para. 1 lit. a GDPR), which you provide via our consent banner and can revoke at any time with effect for the future.

5. Customer Account, Orders and Contract Processing

For the processing of orders in our online shop, we process the data you provide (name, address, email address, if applicable, telephone number, order and payment data) for the fulfilment of the contract in accordance with Art. 6 para. 1 lit. b GDPR. The creation of a customer account is voluntary; you can view the data stored there at any time and have the account deleted.

We store contract data as long as it is necessary for the processing of the contract, as well as beyond that to fulfill legal retention obligations under commercial and tax law (§ 257 HGB, § 147 AO — currently up to 8 or 10 years depending on the type of document).

6. Payment providers

For the processing of payments, we pass on the necessary data to the payment service provider you have chosen (Art. 6 para. 1 lit. b GDPR). The privacy notices of the respective provider also apply.

7. Shipping and transfer to logistics service providers

For the delivery of your order, we pass on your name and delivery address to the commissioned shipping company (Art. 6 para. 1 lit. b GDPR). We will only pass on your email address or telephone number for the purpose of shipping notification or announcement of the delivery date (Art. 6 para. 1 lit. a GDPR).

8. Newsletter

If you subscribe to our newsletter, we process your email address as well as your name based on your consent (Art. 6 para. 1 lit. a GDPR). Registration takes place in a double opt-in procedure: after registering, you will receive an email in which you must confirm the registration. You can revoke your consent at any time via the unsubscribe link in each newsletter or by email to us.

9. Contacting us

When contacting us via email or contact form, we process your information to handle the request (Art. 6 para. 1 lit. b or lit. f GDPR). The data will be deleted as soon as they are no longer necessary for processing and there are no legal retention obligations to the contrary.

10. Fonts and external content

The fonts used on our website (e.g. Marcellus, Jost) are locally embedded on our server. There is no connection to Google servers.

11. Social media presences (Optional)

We maintain profiles on Instagram and YouTube. When visiting these profiles, the respective platform operator processes your data under its own or joint responsibility. On our website, we do not use embedded social media plugins, but only links. 

12. Data Security

We transmit data on our website encrypted (TLS/SSL). Furthermore, we take technical and organisational measures in accordance with Art. 32 GDPR to protect your data against loss, destruction, access, alteration or dissemination by unauthorised persons.

13. Retention Period

Unless otherwise stated in this declaration, we only store personal data for as long as is necessary for the respective purposes. After the purpose has ceased, the data will be deleted, unless there are legal retention obligations (particularly from commercial and tax law) to the contrary; in this case, processing will be restricted.

14. Your Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR),
• Right to rectification (Art. 16 GDPR),
• Right to erasure (Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to data portability (Art. 20 GDPR),
• Right to withdraw consent given with effect for the future (Art. 7 para. 3 GDPR).

Right to object (Art. 21 GDPR): As far as we process data on the basis of legitimate interests, you have the right to object at any time for reasons relating to your particular situation. You can object to direct marketing at any time without giving reasons.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Responsible for us is: The Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden

15. Changes to this Privacy Policy

We will adjust this privacy policy as soon as changes to the data processing we carry out or the legal situation make this necessary. The current version published on the website applies.