Privacy, in two threads.

Controller within the meaning of Art. 4(7) GDPR and the German Federal Data Protection Act (BDSG):

Schäfer GmbH, Oststr. 17, 77855 Achern, Germany. Phone +49 151 8374 6798.

This policy covers visitors to this website and anyone who contacts us via the brief form, by phone or by email.

• Enquiries: name, company, phone, email (optional), selected service and message text.
• Clients: contact persons, project correspondence, contracts and invoices.
• Visits: IP address, date and time, page requested, browser and referrer, logged by our hosting provider.

The knitting loom on the home page runs entirely in your browser. Your pattern is never transmitted.

• Enquiries and proposals: Art. 6(1)(b) GDPR, and Art. 6(1)(a) for consent given via the form.
• Project delivery: Art. 6(1)(b) GDPR.
• Accounting and tax obligations: Art. 6(1)(c) GDPR.
• Operation and security of the site: Art. 6(1)(f) GDPR, our legitimate interest in a stable service protected from attacks.

Providing data is voluntary, but without it we cannot respond.

We do not sell personal data or use it for third-party advertising. Processors acting under Art. 28 GDPR agreements:

• hosting and content delivery, including attack protection;
• the service that receives form submissions and forwards them;
• email and project-management tools used by our team;
• our tax adviser; public authorities where disclosure is legally required.

Transfers to countries outside the European Economic Area rely on a European Commission adequacy decision or on Standard Contractual Clauses under Art. 46 GDPR, with additional technical measures where appropriate.

We use only strictly necessary storage, which does not require consent under § 25(2) of the Telecommunications Digital Services Data Protection Act (TDDDG). Any optional tool added later will stay disabled until you consent, and this page will be updated beforehand.

• Enquiries without a resulting project: erased no later than 12 months after the last contact.
• Client data: for the duration of the project, then for the statutory retention periods, generally 6 years for business letters (§ 257 HGB) and up to 10 years for accounting documents (§ 147 AO).
• Server logs: retained briefly and not merged with other data.

• Access (Art. 15 GDPR)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interest (Art. 21)
• Withdrawal of consent at any time, with effect for the future (Art. 7(3))

Requests go to the contact details in point 01.

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Stuttgart.

Technical and organisational measures under Art. 32 GDPR include TLS encryption, role-based access to enquiries and regular updates. No method of transmission over the internet is completely secure.

We do not knowingly process personal data of persons under 16.

We amend this policy when our processing or the legal framework changes. The date at the top identifies the current version.