We hereby inform you, in accordance with the applicable data protection laws (in particular the German Federal Data Protection Act in its current version (BDSG) and the European General Data Protection Regulation (GDPR)), about the nature, scope, and purpose of the processing of personal data by our company. For the definitions of terms such as “personal data” and “processing,” we refer to Article 4 GDPR.
Name and Contact Details of the Data Controller
The controller within the meaning of Article 4(7) GDPR (hereinafter referred to as the “Controller”) is:
Lilarot GmbH
Oehleckerring 22-24
D-22419 Hamburg
Managing Director: Thieme Hitzler
Email address: info@lilarot.de
Data Protection Officer
Email address: privacy@lilarot.de
Types of Data, Purposes of Processing, and Categories of Data Subjects
Below, we provide information regarding the nature, scope, and purpose of the collection, processing, and use of personal data.
1. Types of Data We Process
- Usage data (access times, websites visited, etc.)
- Master data (name, address, etc.)
- Contact data (telephone number, email, fax, etc.)
- Communication data (IP address, etc.)
2. Purposes of Processing Pursuant to Article 13(1)(c) GDPR
We use your personal data for the following purposes:
- To provide the online services requested by you (contract processing, customer service, and customer relationship management)
- To ensure that our website is presented to you in the most effective and appealing manner possible (uninterrupted and secure operation of our website, prevention of spam and misuse, security measures)
- To fulfill our obligations arising from any contracts concluded between you and us
- To inform you about changes to our services
- To optimize and statistically analyze our services
3. Categories of Data Subjects Pursuant to Article 13(1)(e) GDPR
- Website visitors/users
- Customers
- Suppliers
- Prospective customers
- Employees
- Employees of customers or suppliers
The data subjects are collectively referred to as “Users.”
Legal Bases for the Processing of Personal Data
Below, we provide information about the legal bases for processing personal data:
- If we have obtained your consent for the processing of personal data, Article 6(1)(a) GDPR serves as the legal basis.
- If processing is necessary for the performance of a contract or for carrying out pre-contractual measures taken at your request, Article 6(1)(b) GDPR serves as the legal basis.
- If processing is necessary for compliance with a legal obligation to which we are subject (e.g., statutory retention obligations), Article 6(1)(c) GDPR serves as the legal basis.
- If processing is necessary to protect the vital interests of the data subject or another natural person, Article 6(1)(d) GDPR serves as the legal basis.
- If processing is necessary for the purposes of our legitimate interests or those of a third party, and your interests, fundamental rights, and freedoms do not override those interests, Article 6(1)(f) GDPR serves as the legal basis.
Disclosure of Personal Data to Third Parties and Data Processors
As a general rule, we do not disclose your data to third parties without your consent. If such disclosure does take place, it will be based on the legal grounds listed above, for example when data is transferred to online payment service providers for contract fulfillment, pursuant to a court order, or due to a legal obligation to disclose data for the purposes of criminal prosecution, hazard prevention, or the enforcement of intellectual property rights.
We also engage data processors (external service providers, e.g., for web hosting of our websites and databases) to process your data. Where data is transferred to processors under a data processing agreement, such transfer is always carried out in accordance with Article 28 GDPR. We carefully select our processors, regularly monitor them, and ensure that we have the right to issue instructions regarding the processing of data. Furthermore, processors must have implemented appropriate technical and organizational measures and comply with the data protection provisions of the BDSG and the GDPR.
Data Transfers to Third Countries
The adoption of the European General Data Protection Regulation (GDPR) has established a uniform framework for data protection throughout Europe. Therefore, your data is primarily processed by companies to which the GDPR applies. If, however, processing is carried out by third-party services outside the European Union (EU) or the European Economic Area (EEA), these services must comply with the special requirements set out in Articles 44 et seq. GDPR. This means that processing is only permitted on the basis of specific safeguards, such as an adequacy decision officially recognized by the European Commission confirming a level of data protection equivalent to that of the EU, or compliance with officially recognized contractual obligations known as the “Standard Contractual Clauses.”
To the extent that, due to the invalidity of the so-called “Privacy Shield,” we obtain your explicit consent for the transfer of data to the United States pursuant to Article 49(1)(a) GDPR, we would like to point out the risk of secret access by U.S. authorities and the use of the data for surveillance purposes, potentially without any effective legal remedies available to EU citizens.
Data Deletion and Retention Period
Unless expressly stated otherwise in this Privacy Policy, your personal data will be deleted or blocked as soon as you withdraw your consent to its processing, the purpose for which it was stored no longer applies, or the data is no longer required for that purpose, unless continued retention is necessary for evidentiary purposes or statutory retention obligations prevent deletion.
Such obligations include, for example, the retention of business correspondence under Section 257(1) of the German Commercial Code (HGB) for six years and the retention of accounting records under Section 147(1) of the German Fiscal Code (AO) for ten years. Once the applicable retention period has expired, your data will be blocked or deleted unless further storage is required for the conclusion or performance of a contract.
Existence of Automated Decision-Making
We do not use automated decision-making or profiling.
Provision of Our Website and Creation of Log Files
1. If you use our website for informational purposes only (i.e., without registering or otherwise transmitting information to us), we only collect the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data:
- IP address
- User's Internet service provider
- Date and time of access
- Browser type
- Browser language and version
- Requested content
- Time zone
- Access status/HTTP status code
- Data volume transferred
- Websites from which the request originates
- Operating system
This data is not stored together with any other personal data relating to you.
2. This data is processed for the purpose of providing you with a user-friendly, functional, and secure website, including its features and content, as well as for optimization and statistical analysis.
3. The legal basis for this processing is our legitimate interest pursuant to Article 6(1)(f) GDPR, as described in the purposes above.
4. For security reasons, we store this data in server log files for a period of 90 days. After this period, the data is automatically deleted unless its retention is required for evidentiary purposes in connection with attacks on the server infrastructure or other legal violations.
User Account
To place orders through this website, each customer must create a password-protected customer account. This account includes an overview of completed orders and active order processes.
The operator accepts no liability for misuse of passwords unless such misuse was caused by the operator itself.
Order Process
All data entered by customers as part of the order process will be stored. This includes:
- Gender
- First name and surname
- Address
- Email address
Data that is strictly necessary for delivery or order processing will be shared with third-party service providers. As soon as the retention of your data is no longer necessary or legally required, it will be deleted.
Cookies
1. We use so-called cookies when you visit our website. Cookies are small text files that your web browser stores on your computer. When you revisit our website, these cookies provide information that enables us to recognize you automatically. Cookies also include so-called “user IDs,” in which user information is stored using pseudonymized profiles. When you access our website, we inform you about the use of cookies for the purposes described above by means of a notice referring to this Privacy Policy. We also explain how you can object to their use or prevent their storage (“opt-out”).
The Following Types of Cookies Are Distinguished:
- Necessary / Essential Cookies: Essential cookies are cookies that are absolutely required for the operation of the website in order to provide certain functions, such as logins, shopping carts, or saving user preferences, for example regarding the website language.
- Session Cookies: Session cookies are required to recognize repeated use of a service by the same user (e.g., when you are logged in so that your login status can be identified). When you revisit our website, these cookies provide information that enables us to recognize you automatically. The information obtained in this way serves to optimize our services and make access to our website easier for you. Session cookies are deleted when you close your browser or log out.
- Persistent Cookies: These cookies remain stored even after the browser has been closed. They are used to save login information, measure reach and usage, and for marketing purposes. They are automatically deleted after a predefined period, which may vary depending on the cookie. You can delete cookies at any time through your browser’s security settings.
- Third-Party Cookies (particularly from advertisers): Depending on your preferences, you can configure your browser settings to reject third-party cookies or all cookies. Please note, however, that doing so may prevent you from using all functions of this website. Further information about these cookies can be found in the respective privacy policies of the third-party providers.
1. Categories of Data: User data, cookies, user IDs (in particular visited pages, device information, access times, and IP addresses).
2. Purposes of Processing: The information obtained in this way is used to technically and economically optimize our web services and to provide you with easier and more secure access to our website.
3. Legal Bases: If we process your personal data using cookies based on your consent ("opt-in"), the legal basis is Article 6(1)(a) GDPR. Otherwise, we have a legitimate interest in the effective functionality, improvement, and economic operation of the website, in which case Article 6(1)(f) GDPR serves as the legal basis. Article 6(1)(b) GDPR also serves as the legal basis where cookies are used to initiate or perform contractual relationships, for example in connection with orders.
4. Storage Period / Deletion: The data will be deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data collected for providing the website, this occurs when the respective session ends.
Cookies are otherwise stored on your computer and transmitted from it to our website. Therefore, as a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time, including automatically. If cookies are disabled for our website, it may no longer be possible to use all website functions to their full extent.
Information on Deleting Cookies by Browser
- Chrome: https://support.google.com/chrome/answer/95647
- Safari: https://support.apple.com/de-at/guide/safari/sfri11471/mac
- Firefox: https://support.mozilla.org/de/kb/cookies-und-website-daten-in-firefox-loschen
- Internet Explorer: https://support.microsoft.com/de-at/help/17442/windows-internet-explorer-delete-manage-cookies
- Microsoft Edge: https://support.microsoft.com/de-at/help/4027947/windows-delete-cookies
1. Objection and Opt-Out: Regardless of consent or statutory authorization, you can generally prevent cookies from being stored on your hard drive by selecting “do not accept cookies” in your browser settings. However, this may result in limitations to the functionality of our services. You may object to the use of third-party cookies for advertising purposes via an “opt-out” on the following websites:
https://optout.aboutads.info
http://www.youronlinechoices.com/de/praferenzmanagement/
Edit or Object to Cookie Settings
To change your cookie settings, click on “Cookie Settings” in the footer of the website.
Performance of Contracts
1. We process master data (e.g., company name, title/academic degree, names and addresses, as well as users’ contact details and email addresses), contract data (e.g., services used, names of contact persons), and payment data (e.g., bank account information, payment history) for the purpose of fulfilling our contractual obligations (identifying the contracting party, establishing, structuring, and performing the contract, and verifying the plausibility of the data) and providing services (e.g., customer service communication) pursuant to Article 6(1)(b) GDPR. Information marked as mandatory in online forms is required for the conclusion of a contract.
2. As a general rule, this data is not disclosed to third parties unless such disclosure is necessary to pursue our legal claims (e.g., forwarding data to a lawyer for debt collection), to perform the contract (e.g., forwarding data to payment service providers), or we are legally required to do so pursuant to Article 6(1)(c) GDPR.
3. We may also process the data you provide in order to inform you about additional products from our portfolio or to send you emails containing technical information.
4. The data will be deleted as soon as it is no longer required for the purpose for which it was collected. For master and contract data, this is the case when the data is no longer needed to perform the contract and no claims can be asserted under the contract because they have become time-barred (warranty period: two years; standard limitation period: three years). Due to commercial and tax law requirements, we are obliged to retain your address, payment, and order data for ten years. However, after termination of the contract, we restrict processing after three years, meaning your data will only be used to comply with legal obligations. Information stored in a user account remains until the account is deleted.
Contact via Contact Form / Email / Fax / Mail
1. When you contact us via contact form, fax, mail, or email, the information you provide will be processed for the purpose of handling your inquiry.
2. If you have given your consent, the legal basis for processing your data is Article 6(1)(a) GDPR. The legal basis for processing data transmitted in the course of an inquiry by email, letter, fax, or contact form is Article 6(1)(f) GDPR. The Controller has a legitimate interest in processing and storing the data in order to respond to user inquiries, preserve evidence for liability purposes, and, where applicable, comply with statutory retention obligations for business correspondence. If the contact is aimed at concluding a contract, an additional legal basis for processing is Article 6(1)(b) GDPR.
3. We may store your information and inquiry in our Customer Relationship Management system (“CRM system”) or a comparable system.
4. The data will be deleted as soon as it is no longer required for the purpose for which it was collected. For personal data entered into the contact form and data sent by email, this is the case when the respective conversation with you has ended. A conversation is deemed ended when the circumstances indicate that the matter has been conclusively resolved. Inquiries from users who have an account with us or an existing contractual relationship are stored for up to two years after termination of the contract. Where statutory archiving obligations apply, deletion takes place after the expiration of the respective retention periods: six years under commercial law and ten years under tax law.
You may revoke your consent to the processing of personal data pursuant to Article 6(1)(a) GDPR at any time. If you contact us by email, you may object to the storage of your personal data at any time.
Contact by Telephone
1. When you contact us by telephone, your phone number is processed for the purpose of handling and following up on your inquiry and is temporarily stored or displayed in the RAM/cache of the telephone device/display. Storage takes place for liability and security reasons in order to provide proof of the call and, for economic reasons, to enable us to return your call. In the event of unauthorized marketing calls, we block the corresponding phone numbers.
2. The legal basis for processing the telephone number is Article 6(1)(f) GDPR. If the contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.
3. The device cache stores call data for 90 days and gradually overwrites or deletes older data. When the device is disposed of, all data is deleted and the storage medium may be physically destroyed. Blocked phone numbers are reviewed annually to determine whether the blocking remains necessary.
4. You can prevent your telephone number from being displayed by calling with caller ID suppression enabled.
Rights of the Data Subject
1. Right to Object or Withdraw Consent to the Processing of Your Data
If the processing is based on your consent pursuant to Article 6(1)(a) and Article 7 GDPR, you have the right to withdraw your consent at any time. The lawfulness of the processing carried out on the basis of your consent before its withdrawal remains unaffected.
If we base the processing of your personal data on a balancing of interests pursuant to Article 6(1)(f) GDPR, you may object to such processing. This applies in particular where the processing is not necessary for the performance of a contract with you, as explained in the descriptions of the respective functions below. When exercising such a right of objection, we ask that you explain the reasons why we should not process your personal data as we have done. In the event of a justified objection, we will review the situation and either discontinue or adjust the processing or demonstrate compelling legitimate grounds that justify continuing the processing.
You may object at any time to the processing of your personal data for direct marketing and data analysis purposes. You may exercise your right of objection free of charge.
You may notify us of your objection to marketing activities using the following contact details:
Lilarot GmbH
Oehleckerring 22-24
D-22419 Hamburg
Managing Director: Thieme Hitzler
Email address: info@lilarot.de
1. Right of Access
You have the right to obtain information about the personal data we store about you pursuant to Article 15 GDPR. This includes, in particular, information about the purposes of processing, the categories of personal data concerned, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, and the source of the data where it was not collected directly from you.
2. Right to Rectification
You have the right to request the correction of inaccurate personal data or the completion of incomplete personal data pursuant to Article 16 GDPR.
3. Right to Erasure
You have the right to request the deletion of your personal data stored by us pursuant to Article 17 GDPR, unless statutory or contractual retention periods or other legal obligations or rights requiring continued storage prevent deletion.
4. Right to Restriction of Processing
You have the right to request the restriction of the processing of your personal data where one of the conditions set out in Article 18(1)(a) to (d) GDPR applies:
- If you contest the accuracy of the personal data concerning you, for a period enabling the Controller to verify the accuracy of the personal data;
- If the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of their use;
- If the Controller no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise, or defense of legal claims; or
- If you have objected to processing pursuant to Article 21(1) GDPR and it has not yet been determined whether the Controller’s legitimate grounds override your own.
5. Right to Data Portability
You have the right to data portability pursuant to Article 20 GDPR. This means that you may receive the personal data concerning you that is stored by us in a structured, commonly used, and machine-readable format, or request that it be transmitted to another controller.
6. Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
Data Security
To protect all personal data transmitted to us and to ensure compliance with data protection regulations by both us and our external service providers, we have implemented appropriate technical and organizational security measures. Among other things, all data exchanged between your browser and our server is transmitted in encrypted form via a secure SSL connection.
Version: 17 April 2025
Source: Sample Privacy Policy provided by JuraForum.de
Last updated: 24 April 2025
As of: 20.07.2026