# Privacy policy Quelle: > Privacy policy of MVG Metallverkaufsgesellschaft mbH & Co. KG: which data we process when you order, pay and receive a shipment, and your rights. **Only the German version is legally binding.** This page is a translation of [Datenschutzerklärung](https://mvg-frankfurt.de/datenschutz) for your convenience (German source version 3f0bde569df0). This policy describes which personal data we process when you visit this website and when you place an order. Version: October 2026. ## 1. Controller MVG Metallverkaufsgesellschaft mbH & Co. KG Hanauer Landstraße 421, 60314 Frankfurt am Main Telephone: [+49 69 94 21 30 - 0](tel:+496994213000) Email: [info@mvg-frankfurt.de](mailto:info@mvg-frankfurt.de) We have not appointed a data protection officer: fewer than 20 persons in our company are constantly engaged in the automated processing of personal data (section 38(1) of the German Federal Data Protection Act, Bundesdatenschutzgesetz, BDSG). Please direct any questions about data protection to the address above. ## 2. Accessing the website Each time you access the website, your browser transmits technically necessary data to our server. In doing so, we process the IP address, date and time, the address accessed, the amount of data transferred, the status code, the referring page and the browser identifier. We need this data to deliver the page, detect faults and fend off attacks. The legal basis is our legitimate interest in secure operation (Article 6(1)(f) of the General Data Protection Regulation, GDPR). We delete the logs after 14 days, unless an incident makes longer retention necessary for investigation. To prevent overload, we also count how many computationally intensive requests come from an IP address within one minute. This counter is held only in working memory and expires after one minute. ## 3. Cookies and storage in the browser We do **not** set cookies for advertising, audience measurement or user profiles. There are no advertising networks, no social media plug-ins and no external fonts; all components of the page come from our own server. The only function that requires your consent is the optional usage analysis (section 19); it is switched off until you switch it on yourself. On your first visit, a small notice with two equivalent buttons asks for your choice; you can change your choice at any time via the “Usage analysis” entry in the footer. We set technically necessary cookies only when you use the corresponding function: - **bw_customer** — sign-in to the customer account (section 6), valid until you sign out, for a maximum of 90 days; - **bw_punchout** — ordering from your company’s purchasing system (punchout, section 15), for a maximum of 8 hours; - **bw_session** — sign-in of employees to internal interfaces, for a maximum of 30 days. This cookie is of no relevance to visitors of the website. In your browser’s local storage (localStorage), we also store your basket (discarded after 30 days without changes) and a number of settings, for example gross/net display, last material selected, list view, language, light or dark appearance, your choice regarding usage analysis and drafts from the part designer. The order details you enter are held only in session storage (sessionStorage) and are deleted when you close the tab. This data leaves your computer only when you trigger a price calculation or place an order. These cookies and storage entries are strictly necessary to provide the service you have expressly requested (section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). The legal basis for the associated processing is Article 6(1)(b) and (f) GDPR. ## 4. Configurators, file upload and price calculation When you configure a part, draw in the part designer or upload a STEP file, we transmit the geometry to our server and use it to calculate the price and manufacturability. We store uploaded files in a content-addressed manner so that the order later refers to exactly the same file and production receives it. This calculation runs **on our own system**. We do not pass on your drawings and models to any external service for this purpose. The legal basis is the performance of pre-contractual measures at your request (Article 6(1)(b) GDPR). If a calculation does not lead to an order, we delete the file after twelve months at the latest. Your files remain your property. We use them only for the quotation and production of your order (see also section 4 of our [terms and conditions](https://mvg-frankfurt.de/en/terms)). The transmission is encrypted with TLS (section 23). At your request, we will also delete uploaded files earlier; an email to [info@mvg-frankfurt.de](mailto:info@mvg-frankfurt.de) is sufficient. If you send a part to our sales team using “Manuell bepreisen lassen” (“Request manual pricing”) (review request), we store the files together with your contact details with the request and send them for processing to our sales team’s mailbox (for the provider, see section 17). We delete the files of the request after 12 months at the latest, or earlier at your request; we delete the email in the sales team’s mailbox at your request. If the request results in an order, we retain the order documents in accordance with the statutory retention periods. The legal basis is Article 6(1)(b) GDPR. ## 5. Order For an order, we process your name, your email address, the billing address and, where applicable, a different delivery address, as well as voluntary information such as company, telephone number and comments. In addition, we process the items with geometry, material, quantity and price, the selected delivery and payment method and the reference number. The legal basis is the performance of the contract (Article 6(1)(b) GDPR). You do not need a customer account to place an order. We assign each order to a customer number in our customer management system; where necessary, we create it there automatically. We send the order confirmation, delivery note and invoice to your email address. We retain these documents for ten years in accordance with commercial and tax law (section 147 of the German Fiscal Code, Abgabenordnung, AO; section 257 of the German Commercial Code, Handelsgesetzbuch, HGB); the legal basis for this is compliance with a legal obligation (Article 6(1)(c) GDPR). Within this period, processing is restricted to retention. If you order parts that we manufacture to your dimensions, you confirm before completing the order that you have checked the dimensions and drawings. As evidence, we store the time, the confirmed text, the items with dimensions, a checksum of the drawings, the customer type and your shortened IP address (last block removed). Before dispatch, we record an inspection note on dimensions, quantity and condition, where applicable with a photograph of the goods. The legal basis is our legitimate interest in being able to prove and defend against claims (Article 6(1)(f) GDPR); we store this evidence for as long as the order documents. If you order as a company on account, we check your VAT identification number via the VAT Information Exchange System (VIES) of the European Commission. In doing so, we transmit only the VAT ID. The legal basis is Article 6(1)(b) and (c) GDPR. ## 6. Customer account and company account You may use a customer account on a voluntary basis. Sign-in works without a password: you enter your email address and receive a code that is valid for 10 minutes. We store your email address, your name (if provided), the code only as a check value, the sign-in (time, browser identifier) and your saved projects, parts and saved lists. In the account, you can see the orders, documents and quotations associated with your email address. If you sign in with a passkey, we store only its public key, name and times of use; your fingerprint, facial image or device PIN never leave your device. For a company account, we additionally store which persons belong to the company, their role and the approval limit per person; orders above the limit are approved by a second person. The legal basis is Article 6(1)(b) GDPR. You can delete the account at any time in the customer account; after that, we retain documents relating to orders only in accordance with the statutory periods (section 5). ## 7. Payment Online orders are processed by payment in advance. If you choose an online payment method, we redirect you to the relevant payment service provider and transmit to it the amount, a transaction identifier and your email address. You enter your payment data — card number, access credentials for the payment account — exclusively there; we do not see or store them. We receive back only the payment status. Depending on the payment method selected, the payment service providers are SumUp Limited, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, Ireland (card payment), and PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (PayPal). For card payment on site, we use a card terminal from SumUp. If you pay by bank transfer, we match your payment using our bank’s account transactions. In doing so, we process the payer’s name and IBAN, the amount, the date and the payment reference. The invoice may contain a QR code for the bank transfer (GiroCode); it is generated by us and contains only our bank details, the amount and the invoice number. The legal basis is the performance of the contract (Article 6(1)(b) GDPR) and, for bookkeeping, compliance with legal obligations (point (c)). ## 8. Shipping For shipping, we transmit your delivery address and, if you have provided them, your telephone number and email address to the commissioned transport company. Depending on size and weight, these are DHL Paket GmbH, Cargoboard GmbH & Co. KG, GEL Express Logistik GmbH or FedEx Express Deutschland GmbH. Already for the shipping cost enquiry, we transmit the postcode and town to the freight portal — without names. So that you do not have to type the town and street in full, we query the postcode, town and the beginning of the street name from the open directory OpenPLZ API (openplzapi.org) as you type — without names and without house numbers. This does not apply in the case of collection. The legal basis is the performance of the contract (Article 6(1)(b) GDPR). ## 9. Order status After placing your order, you can check the status of your order using the reference number and the postcode or email address. Only your own order is visible; you do not need an account. The legal basis is the performance of the contract. ## 10. Enquiries by email and telephone If you write to us or call us, we process your information in order to respond. If the enquiry leads to a contract, Article 6(1)(b) GDPR applies; otherwise, our legitimate interest in responding (point (f)). We delete enquiries without a business transaction as soon as they have been dealt with and there is no retention obligation. ## 11. Sending of our emails We send you quotations, order confirmations and invoices by email. For each message sent, we store the recipient address, subject, time and the sending receipt of our mail server. If the receiving side reports the message as undeliverable, we record this report together with the reason so that we can reach you by other means. The legal basis is the performance of the contract (Article 6(1)(b) GDPR). If the message contains a personal link to your quotation, we record the first access to this link on our website, together with the IP address and the identifier of your browser. This allows us to see that the quotation has reached you, and we do not need to follow up unnecessarily. The legal basis is likewise the performance of the contract. If you do not wish this, you may object informally (a short reply to the email is sufficient); we will then delete the entry. We currently do **not** measure whether you open an email. Our emails contain no tracking pixels and do not load any images from our server. Should we use such measurement in future, we will do so only with your prior consent and after supplementing this policy. We retain the information on sending and delivery for the duration of the business relationship and the statutory retention periods. ## 12. Withdrawal via the website If you declare a withdrawal using the function “Vertrag widerrufen” (“Withdraw from contract”), we store your name, email address, order number, your declaration, the date and time of receipt, the IP address and the browser identifier. We confirm receipt to you by email and create the case in our customer management system for processing. The legal basis is Article 6(1)(b) and (c) GDPR; we retain the information as evidence together with the order documents (section 5). ## 13. Customer management (CRM) We consolidate enquiries, quotations, orders, emails and telephone notes in our own customer management system on our server so that every employee knows the status of a transaction. Contact details, contact persons and the history of communication are stored. The legal basis is Article 6(1)(b) GDPR and our legitimate interest in orderly customer service (point (f)). We delete the information when it is no longer needed for the business relationship and there is no retention obligation. ## 14. Share links With “Teilen” (“Share”), we store the current state of a configurator (geometry, material, thickness, quantity) under a random short link on our server. In doing so, we do not store any names or contact details; anyone who knows the link can see this state. ## 15. Interfaces for businesses (API, punchout) Businesses can retrieve prices and place orders via our application programming interface (/v1) or from their own purchasing system (punchout). For access via OAuth, we store the registered application (name, redirect addresses), the link to the customer account, the rights and amount limits granted, the access keys issued (only as a check value) and the transactions triggered with them. The legal basis is Article 6(1)(b) GDPR. ## 16. Job applications If you apply by email (bewerbung@mvg-frankfurt.de), we process your information and documents for the decision on the employment relationship (Article 6(1)(b) GDPR). If no employment results, we delete the documents no later than six months after the conclusion of the procedure, unless you have consented to longer storage. ## 17. Recipients and processors Apart from the payment and transport service providers mentioned, your data is received by: our data centre provider Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (hosting of the website and the order system), and the provider of our email mailboxes, hostedoffice (mail.hostedoffice.ag), through which all emails to and from us are routed. Data processing agreements in accordance with Article 28 GDPR are in place with these service providers. We provide our product data (articles, prices, availability) to search engines such as Google as a product list; this list contains no personal data. We do not integrate any Google services on our website. Some service providers (PayPal, FedEx) belong to groups of companies headquartered in the USA. Insofar as data is transferred to the USA in this context, this takes place on the basis of an adequacy decision of the European Commission (EU-US Data Privacy Framework) or EU standard contractual clauses (Articles 45 and 46 GDPR). Beyond this, we do not transfer any data to countries outside the European Union. ## 18. Request for a Google review If you have previously given your express consent, we will ask you by email, after an order has been completed, for an honest review of our company on Google. The purpose is to receive feedback on our performance and to give other customers guidance. Without your consent, you will not receive such an email. For this purpose, we process your name, your email address and the reference to your order (order or document number and date of delivery or collection). We also record when and by what means you gave your consent and when we sent you a request. We send the email no earlier than three days after delivery or collection and no more than once within 90 days. We offer nothing in return for a review, and we do not ask only selected customers. The legal basis is your consent under Article 6(1)(a) GDPR; for the advertising email, section 7(2) of the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG) also applies. You may withdraw your consent at any time with effect for the future, for example by email to [info@mvg-frankfurt.de](mailto:info@mvg-frankfurt.de) or by replying to the review request. Withdrawal does not affect the lawfulness of the processing carried out up to that point. We store the information relating to the review request for as long as your consent remains in place. After that, we retain the evidence of consent, withdrawal and requests sent only for as long as we need it as proof towards you or the authorities. Whether you submit a review is entirely your decision. You write the review itself directly on Google; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is responsible for this. Its privacy policy applies ([policies.google.com/privacy](https://policies.google.com/privacy)). We receive from Google only the publicly visible review. ## 19. Product reviews Buyers of an article can review it via a personal, single-use link that we send by email after delivery or collection. Only customers who have consented to a review request receive the email (no. 18). The purpose is to give other customers guidance and to improve our articles. We process the review (stars, optionally a title and text), the display name you choose (suggestion: first name and initial of the surname), the article, the date of purchase and the date of review, and the reference to the order item. We do not store your email address for this purpose; to unsubscribe from further review emails, we record only a non-reversible check value of the address. The review is published with the label “Verifizierter Kauf” (“Verified purchase”) only with your express consent (Article 6(1)(a) GDPR). You may withdraw your consent at any time with effect for the future, for example by email to [info@mvg-frankfurt.de](mailto:info@mvg-frankfurt.de); the review will then be deleted and will no longer be included in the average rating. We store the review until you withdraw your consent. We retain a log of the review steps (who published or rejected it and when) as evidence. We delete unused links after they expire. ## 20. Optional usage analysis Only with your voluntary consent do we record, on our own server, order steps, article groups, a rough device class and waiting times. A random session identifier links these events to the completion of the order. Only fixed categories are recorded, such as “material selected”, “price displayed”, “manufacturability blocked”, the selected shipping and payment method or which mandatory field was still missing – never input content, dimensions, names, contact details, IP addresses, specific page addresses or drawings. No data is passed on to advertising providers. As regards the origin of the session, we store on the first page view, likewise only with consent, the campaign parameters from the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content; shortened and limited to simple characters) and the name of the referring website (domain name only, e.g. “google.de”, without page address). We do not store or transmit click identifiers of advertising providers (such as gclid or fbclid). Without consent, the origin is not stored. After you give consent, the session identifier is held in the browser’s session storage for a maximum of 24 hours. Your choice is stored in the browser. If you sign in to your customer account with consent given, we link the session identifier to your account. Under “Mein Konto” (“My account”), you can download the linked measurements as a file (JSON or CSV) at any time (Articles 15 and 20 GDPR) or delete them. We store measurement data with a session identifier for 24 months. After that, the daily deletion run aggregates it into anonymous monthly totals (month, device class, article group, step, count) without an identifier and deletes the individual data; these monthly totals are no longer personal data and are retained indefinitely. The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Via the “Usage analysis” entry in the footer (in the column with the privacy policy link), you can decline or withdraw your consent at any time; the associated measurement data and the data linked to your account are deleted upon withdrawal, as well as when the customer account is deleted. Withdrawal does not affect the lawfulness of the processing carried out up to that point. The shop also works without analysis. ## 21. Your rights You have the right of access to the data stored about you (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to data portability (Article 20) and to object to processing based on our legitimate interest (Article 21 GDPR). An email to [info@mvg-frankfurt.de](mailto:info@mvg-frankfurt.de) is sufficient. You may also lodge a complaint with a supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Postfach 3163, 65021 Wiesbaden. ## 22. No automated individual decision-making Our price calculation runs automatically but does not make decisions about you as a person. No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place. Orders whose price is flagged as unusual by our automatic plausibility check are reviewed by an employee before acceptance. ## 23. Data security The connection to this website is encrypted throughout with TLS; you can recognise this by the padlock in your browser’s address bar. Our systems are protected against unauthorised access, loss and alteration; we continuously adapt these measures to the state of the art.