Privacy Policy

www.sferatec.de · SferaTec Gebäudetechnik GmbH · Last updated: 06.10.2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

SferaTec Gebäudetechnik GmbH
Cliev 16, 51515 Kürten, Germany
Represented by the Managing Director Ez-Zakri Mahmouh
Phone: +49 2207 84 64 491
Email:

For questions on data protection you can reach us at or via the contact details above. Under Section 38 of the German Federal Data Protection Act (BDSG) we are not required to appoint a data protection officer.

2. Principles

We process personal data only to the extent necessary to provide this website and our services, or where you have given your consent. Depending on the processing, the legal basis is Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) (contract and pre-contractual measures), Art. 6(1)(c) (legal obligation) or Art. 6(1)(f) (legitimate interest).

You can use this website without providing personal data. If you contact us, we process the data you transmit in doing so.

3. Provision of the website and server log files

Each time our website is accessed, data transmitted by your browser is collected automatically and stored in server log files:

  • browser type and browser version
  • operating system used
  • referrer URL, i.e. the page previously visited
  • subpages accessed
  • date and time of access
  • IP address
  • internet service provider of the accessing system

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free delivery of the website, system security and the defence against attacks. This data is not merged with other data sources. The log files are deleted as soon as they are no longer required for these purposes. The specific storage period depends on the specifications of the platform operator; we will inform you of it on request.

The website is built with the website builder of Duda and delivered via its platform. The provider is Duda, Inc., 1601 Elm Street, Suite 4360, Dallas, TX 75201, USA. Duda processes the technical data arising when a page is accessed on our behalf. As the provider is based in the USA, a transfer of personal data to a third country cannot be ruled out; section 9 applies in this respect.

The domain sferatec.de and its name resolution are managed by dogado GmbH, Dortmund, Germany. Processing is limited to domain and contact data as well as name server log data and is carried out on the basis of a data processing agreement under Art. 28 GDPR. This provider does not provide web hosting or email.

Our email service is operated via Microsoft 365. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The basis is Microsoft’s Data Protection Addendum, which meets the requirements of Art. 28 GDPR. Processing outside the European Union cannot be ruled out; section 9 applies in this respect.

4. Cookies and consent management

This website uses cookies and comparable technologies. Cookies are small text files stored on your device.

We use technically necessary cookies, which ensure the operation of the website and record your consent decision, on the basis of Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(f) GDPR. All other cookies and embedded services are only used once you have given your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

To obtain and manage your consent we use the consent management tool Termly of Termly, Inc., 1000 N West Street, Suite 1200, Wilmington, DE 19801, USA. When you first visit the website you can accept or reject individual categories. Your decision is stored locally in your browser so that you are not asked again on every visit. The legal basis for this storage is Section 25(2) TDDDG and Art. 6(1)(c) GDPR, as we are obliged to be able to demonstrate consent.

The cookies used in detail, with name, purpose, provider and lifetime, are listed in our cookie policy. It can be accessed via the link in the consent banner and via the footer of this website.

You can withdraw your consent at any time with effect for the future by reopening the settings of the consent banner. The lawfulness of the processing carried out until withdrawal remains unaffected. In addition, you can delete or block cookies via your browser settings; in that case not all functions of the website may be available.

5. Contacting us

If you contact us via the contact form, by email or by phone, we process the data you transmit in order to handle your enquiry. Which information is required is shown in the respective form; mandatory fields are marked. Entries from the contact form are delivered to us by email and processed in our email system in accordance with section 3.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at concluding or performing a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in answering enquiries.

We delete the data as soon as it is no longer required for handling the enquiry and no statutory retention periods apply. Enquiries that lead to a business relationship are subject to the retention periods under commercial and tax law.

5.1 Lead-free check

On our website we offer a self-assessment at sferatec.de/en-gb/lead-free/check (German version: sferatec.de/bleifrei/check) for classifying materials under RoHS and drinking water law. Before the result is displayed, we collect your name, your company and your email address as well as your answers to the six questions and the result derived from them. Name and company are optional.

The purpose of processing is to answer questions about your result and to advise you on suitable materials. The legal basis is your consent under Art. 6(1)(a) GDPR, which you give before submitting. You can withdraw your consent at any time with effect for the future, for example by email to .

The data is transmitted to us and stored via Google Forms, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A data processing agreement under Art. 28 GDPR is in place with Google. A transfer to the USA cannot be ruled out; Google is certified under the EU-U.S. Data Privacy Framework. We delete the data at the latest twelve months after the last contact, unless a business relationship has arisen.

6. Requests for quotation and business initiation

If you request a quotation via the website, we process your contact and project data to prepare the quotation and for further handling. The legal basis is Art. 6(1)(b) GDPR. If a contract is concluded, we process the data to perform the contract and, where necessary, pass it on to subcontractors, suppliers and shipping service providers commissioned by us.

7. Job applications

We process application documents to carry out the application procedure. The legal basis is Section 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR. If an employment relationship is established, we process the data to perform the employment relationship.

Otherwise we delete the documents six months after the procedure has been completed. This period takes into account possible claims under the German General Equal Treatment Act (AGG). If you would like us to keep your documents for longer for future vacancies, we need your consent under Art. 6(1)(a) GDPR.

8. Embedded services

For the services listed below, the legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You give, change and withdraw your consent via the consent banner. Without consent, the respective functions are not available or only available to a limited extent.

8.1 Google Analytics

We use Google Analytics for the statistical evaluation of website use. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies that enable an analysis of your use of the website. Among other things, the pages visited, time spent, approximate location, device type and the origin of the visit are recorded.

The information generated is transmitted to and stored on Google servers; a transfer to the USA cannot be ruled out. See section 9 for details. We have concluded a data processing agreement with Google. Google’s privacy policy is available at https://policies.google.com/privacy. In addition, you can prevent collection by Google Analytics via the browser add-on at https://tools.google.com/dlpage/gaoptout.

8.2 Reach measurement by the website platform

The platform on which this website is operated additionally collects usage data for statistical purposes and to measure technical performance. The analytics services Snowplow and an evaluation of the so-called Core Web Vitals are used for this. Pseudonymous identifiers, session data and technical performance values of the pages accessed are recorded. The provider is Duda, Inc., 1601 Elm Street, Suite 4360, Dallas, TX 75201, USA.

8.3 Google Maps

To show our location, we embed a Google Maps map on the home page. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When the map loads, a connection to Google servers is established. Your IP address and, where applicable, further usage data are transmitted to Google; a transfer to the USA cannot be ruled out. See section 9 for details. The Google Maps terms of use at https://www.google.com/intl/en/help/terms_maps.html also apply.

8.4 Google Fonts

For a consistent display of fonts, fonts of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, may be used. If they are loaded from Google servers, a connection to Google is established when a page is accessed, giving Google knowledge of your IP address. See section 9 for details.

9. Data transfers to third countries

When using the services listed in sections 3 and 8, personal data may be transferred to the USA. The European Commission has adopted an adequacy decision under Art. 45 GDPR with the EU-U.S. Data Privacy Framework, on which certified companies can rely. Whether a provider is certified can be checked at https://www.dataprivacyframework.gov. In addition, we have agreed standard contractual clauses under Art. 46(2)(c) GDPR with the providers, where available.

Please note that despite these instruments, access to personal data by government authorities in the USA cannot be completely ruled out, and you may not have the same legal remedies available as within the European Union. Where the transfer is based on your consent, you can withdraw it at any time.

10. Recipients

Within our company, only those departments that need personal data to fulfil their tasks have access to it. In addition, we pass on data to:

  • the operator of the website platform, the provider of our email service, the domain administrator and other IT service providers as processors
  • the provider of our consent management
  • shipping and logistics service providers, where a delivery takes place
  • subcontractors commissioned by us, where necessary to provide our services
  • tax advisors, auditors and authorities within the scope of statutory obligations
  • the providers listed in section 8, if you have given your consent

We have concluded agreements under Art. 28 GDPR with processors.

11. Storage period

We store personal data only for as long as necessary for the respective purpose. It is then deleted unless statutory retention obligations apply. Retention periods under commercial and tax law are generally six or ten years. During this period, processing is restricted.

12. Your rights

With regard to the personal data concerning you, you have the following rights:

  • access under Art. 15 GDPR
  • rectification under Art. 16 GDPR
  • erasure under Art. 17 GDPR
  • restriction of processing under Art. 18 GDPR
  • data portability under Art. 20 GDPR
  • objection under Art. 21 GDPR
  • withdrawal of consent given under Art. 7(3) GDPR with effect for the future

A message to the contact details in section 1 is sufficient to exercise these rights.

You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, https://www.ldi.nrw.de

13. Right to object

Where we process personal data on the basis of legitimate interests under Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If we process personal data for direct marketing purposes, you can object at any time without giving reasons. We will then no longer process the data for this purpose.

14. Automated decision-making

Automated decision-making, including profiling under Art. 22 GDPR, does not take place.

15. Data security

We take technical and organisational measures to protect your data against loss, destruction, manipulation and unauthorised access. Transmission via our website is encrypted using TLS, which you can recognise in the address bar of your browser. Absolute protection of internet-based data transmission is nevertheless not possible; you can therefore also send us personal data by other means, for example by phone or post.

16. Changes to this privacy policy

We adapt this privacy policy when the legal situation, our processing operations or the services used change. The version available on this page applies.

This English version is provided for convenience. In the event of any discrepancy, the German version shall prevail.