Privacy Policy
Name and contact details of the controller pursuant to Article 4(7) GDPR
Crush + Size Technology GmbH & Co. KG
Kölner Straße 94
51702 Bergneustadt, Germany
Phone: +49 (0) 2261 80 47 300
Fax: +49 (0) 2261 80 47 301
E-mail: info@crush-size.de
Security and protection of your personal data
We regard it as our primary responsibility to preserve the confidentiality of the personal data you provide and to protect it against unauthorised access. We therefore apply the utmost care and current security standards to ensure the highest possible protection of your personal data.
As a company governed by private law, we are subject to the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). We have implemented technical and organisational measures to ensure that data protection rules are observed both by us and by our external service providers.
Definitions
The law requires that personal data be processed lawfully, fairly and in a manner that is transparent to the data subject. To that end, we explain below the statutory definitions that are also used in this privacy policy.
1. Personal data
“Personal data” means any information relating to an identified or identifiable natural person (the “data subject”). A natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more specific characteristics.
2. Processing
“Processing” means any operation performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, alignment, combination, restriction, erasure or destruction.
3. Restriction of processing
“Restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future.
4. Profiling
“Profiling” means any form of automated processing of personal data consisting of the use of that data to evaluate, analyse or predict certain personal aspects relating to a natural person.
5. Pseudonymisation
“Pseudonymisation” means processing personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately.
6. Filing system
“Filing system” means any structured set of personal data which is accessible according to specific criteria.
7. Controller
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
8. Processor
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
9. Recipient
“Recipient” means a natural or legal person, public authority, agency or another body to which personal data is disclosed, whether a third party or not.
10. Third party
“Third party” means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process personal data.
11. Consent
“Consent” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes, by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to them.
Lawfulness of processing
Processing of personal data is lawful only if there is a legal basis for it. Under Article 6(1)(a) to (f) GDPR, the legal basis may in particular be:
a) the data subject’s consent to processing for one or more specific purposes;
b) that processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract;
c) that processing is necessary for compliance with a legal obligation to which the controller is subject;
d) that processing is necessary to protect the vital interests of the data subject or of another natural person;
e) that processing is necessary for the performance of a task carried out in the public interest;
f) that processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the interests or fundamental rights of the data subject override those interests.
Information about the collection of personal data
Below we inform you about the collection of personal data when you use our website. As a rule, we process our users’ personal data only to the extent necessary to provide a functioning website and to deliver our content and services. Your data is passed on to third parties only in the cases described below.
Collection of personal data when visiting our website
If you use the website for information purposes only — that is, if you do not register or otherwise transmit information to us — we collect only the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure its stability and security:
– IP address
– date and time of the request
– time zone difference from Greenwich Mean Time (GMT)
– content of the request (specific page)
– access status / HTTP status code
– volume of data transferred in each case
– website from which the request originates
– browser, operating system and its interface
– language and version of the browser software
The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest follows from the purposes of data collection listed above. The data is deleted after seven days at the latest, unless it is required to investigate or pursue a specific security incident.
Hosting
Our website is hosted by an external service provider. The personal data collected on this website is stored on the host’s servers. The host processes this data exclusively on our behalf and in accordance with our instructions, on the basis of a data processing agreement pursuant to Article 28 GDPR. The legal basis is Article 6(1)(f) GDPR — our legitimate interest in providing this website securely and reliably.
Use of cookies
We use cookies on our website. Cookies are small text files that are stored on your device and assigned to your browser. They do no harm to your device and contain no viruses.
a) Transient cookies are deleted automatically when you close your browser. These include session cookies, which assign a session to your visit.
b) Persistent cookies are deleted automatically after a defined period, which may vary from cookie to cookie. You can delete cookies at any time in your browser’s security settings.
The following cookies in particular are set on this website:
– wp-wpml_current_language — stores the language version you have selected so that you stay in the same language when moving between pages. Technically necessary.
– _wpfuuid — set by our form system to recognise repeated submissions of the same form and to prevent misuse. Lifetime: several years.
We set technically necessary cookies on the basis of Section 25(2) TDDDG and Article 6(1)(f) GDPR. You can configure your browser to inform you about the setting of cookies and to decide individually whether to accept them, or to exclude their acceptance in general. If cookies are not accepted, the functionality of our website may be limited.
Contacting us by form or e-mail
Our website provides contact forms through which you can get in touch with us. The data you enter in the input mask is transmitted to us and stored — depending on the form, this includes in particular your name, company, address, telephone number, e-mail address and your message. Alternatively, you can contact us using the e-mail addresses provided; in that case, the personal data transmitted with your e-mail is stored.
The forms are operated by software running on our own server; form data is not passed on to third parties. The legal basis for processing is Article 6(1)(f) GDPR — our legitimate interest in responding to your enquiry. If your enquiry is aimed at concluding a contract, the additional legal basis is Article 6(1)(b) GDPR. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected and no statutory retention periods prevent deletion.
Job applications
Applications should be sent to the e-mail address given on our careers page. We process the application documents you submit, and the personal data they contain, exclusively for the purpose of conducting the application procedure. The legal basis is Section 26(1) BDSG in conjunction with Article 6(1)(b) GDPR. If no employment relationship is established, we delete your documents no later than six months after the procedure has been concluded, unless you have expressly consented to longer storage and no statutory retention obligations apply.
Third-party content embedded on our website
On some pages we embed content that is loaded from external servers. When you open such a page, your browser establishes a direct connection to the respective provider’s server, and your IP address is transmitted to that provider. We have no influence over what further data the provider collects or how it uses that data.
a) YouTube
Some pages contain embedded videos from the YouTube service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open a page containing an embedded video, a connection to YouTube’s servers is established and your IP address is transmitted. If you are logged in to YouTube during your visit, YouTube may associate your browsing behaviour with your personal profile. You can prevent this by logging out of your YouTube account beforehand. Further information on the handling of user data can be found in Google’s privacy policy at policies.google.com/privacy.
b) Vimeo
Some pages contain embedded videos from the Vimeo service. The provider is Vimeo Inc., 330 West 34th Street, 10th Floor, New York, New York 10001, USA. When you open a page containing an embedded video, a connection to Vimeo’s servers in the USA is established and your IP address is transmitted. The transfer to the USA is based on the European Commission’s standard contractual clauses and the EU-US Data Privacy Framework. Further information can be found in Vimeo’s privacy policy at vimeo.com/privacy.
c) External code library network (unpkg)
To ensure a consistent presentation, we load program libraries via the unpkg content delivery network. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When a page is opened, a connection to the provider’s servers is established and your IP address is transmitted.
The legal basis for embedding this content is Article 6(1)(f) GDPR — our legitimate interest in an appealing and technically flawless presentation of our offering. Where consent is requested, processing takes place exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG; consent may be withdrawn at any time.
Social networks
Our website links to our profiles on social networks, including LinkedIn, YouTube and Instagram. These are simple links, not embedded buttons. No data is transmitted to the respective provider until you actively click the link. The respective provider is responsible for processing your data after the click.
Children
Our offering is generally directed at adults. Persons under the age of 16 should not transmit personal data to us without the consent of a parent or guardian.
Rights of the data subject
(1) Withdrawal of consent
Where the processing of personal data is based on consent you have given, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.
(2) Right to confirmation
You have the right to obtain confirmation from us as to whether we are processing personal data concerning you.
(3) Right of access
You have the right to obtain, free of charge and at any time, information about the personal data stored about you and a copy of that data — including details of the purposes of processing, the categories of data, the recipients, the envisaged storage period, your further rights and the source of the data where it was not collected from you.
(4) Right to rectification
You have the right to obtain the rectification without undue delay of inaccurate personal data concerning you and to have incomplete data completed.
(5) Right to erasure (“right to be forgotten”)
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the grounds provided for by law applies and the processing is not necessary.
(6) Right to restriction of processing
You have the right to request the restriction of processing where one of the conditions set out in Article 18 GDPR applies.
(7) Right to data portability
You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit that data to another controller.
(8) Right to object
You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Article 6(1)(e) or (f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms.
(9) Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not take such decisions.
(10) Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.
(11) Right to an effective judicial remedy
Without prejudice to any other administrative or non-judicial remedy, you have the right to an effective judicial remedy if you consider that the processing of data concerning you infringes the GDPR.
Exercising your rights
To exercise your rights, please contact us at the address given above or by e-mail at info@crush-size.de.
Status of this privacy policy
This privacy policy is dated August 2026. As our website develops further, or as legal requirements change, it may become necessary to amend it.
TALK TO OUR EXPERTS