Privacy Policy

1. Introduction

The protection of your personal data is important to us. In this privacy policy we explain which data we collect from you, why we do so and how we use it. We also show you which rights you have and how you can exercise them. Our goal is that you always know exactly what happens with your data.

2. Controller

The controller responsible for processing your personal data is:

Contact details of the data protection officer

You can reach our data protection officer using the following contact details:

3. Scope

This privacy policy applies to all pages of our website that you can access at https://www.holzboden-direkt.de/. It explains which personal data we collect from you when you visit our website, use the contact form, sign up for our newsletter or use other online services provided by us.

This policy applies regardless of whether you use our website on a computer, tablet or smartphone.

4. Your rights

• Art. 15 GDPRRight of access – You have the right to request a copy of the data we have stored about you at any time.
• Art. 16 GDPRRight to rectification – You have the right to have incorrect or incomplete data corrected at any time.
• Art. 17 GDPRRight to erasure (right to be forgotten) – Under certain conditions you may request erasure. We will not delete data where we are legally obliged to retain it.
• Art. 18 GDPRRight to restriction of processing – In certain cases you may restrict our processing of your data.
• Art. 19 GDPRRight to notification of recipients in the event of rectification, erasure or restriction of processing.
• Art. 20 GDPRRight to data portability – You have the right to have the personal data we process about you transmitted to another organisation.
• Art. 21 GDPRRight to object – You can object to certain processing purposes, such as direct marketing.
• Art. 7(3) GDPRRight to withdraw – You can withdraw consent once given at any time.
• Art. 22 GDPRRight to object to automated processing, including profiling.

5. Principles we adhere to

When processing your data, we adhere to the rules of the General Data Protection Regulation (GDPR). This means: we collect only the data that is really necessary, we use it only for the purposes we have told you about, we store it only for as long as necessary, and we use technical and organisational measures to ensure that your data is protected.

6. Obligation to provide data (contract performance)

In some cases we are obliged to collect certain data from you – for example for invoices, taxes, accounting or when we conclude a contract with you. Without this information we cannot fulfil our legal obligations and cannot provide some services. We only request all other data where it is really necessary or where you give us your consent.

7. Data security (TOM)

We protect your personal data with appropriate technical and organisational measures. These include, for example, access restrictions, encryption and regular security checks. This ensures that your data is treated confidentially and protected against misuse.

Hosting – maxcluster

When you visit our website, our hosting provider maxcluster GmbH automatically records technical information and stores it in so-called server log files. In particular, IP addresses and other technical access data are processed. This data is generated automatically when your browser establishes a connection to our website.

The processing is carried out to ensure a stable, secure and high-performance provision of our website. Legal basis: Art. 6(1)(f) GDPR.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock symbol in your browser bar. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent already given at any time. The lawfulness of the data processing carried out up to the withdrawal remains unaffected by the withdrawal.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

Cookies

Our website uses cookies. Cookies are small text files that are stored on your device.

You can change your settings or withdraw your consent at any time via our cookie selection window (consent tool).

Server log files

The website provider automatically collects information in server log files that your browser automatically transmits. This data includes information such as the browser type and version, the operating system used, the referrer URL, the hostname of the accessing computer, the time of the server request and the IP address. This information is not merged with other data sources.

This processing serves the technically error-free presentation and the security of the website. The stored information is deleted after seven days, unless there is a legitimate suspicion of unlawful use. It is not possible for us to identify you on the basis of the stored information. Therefore, Articles 15 to 22 GDPR do not apply pursuant to Art. 11(2) GDPR, unless you provide further information that enables your identification.

Contact form

You can contact us quickly and easily via our contact form. In doing so, we process the data you enter, in particular first name, surname, address (street, house number, postal code, city), email address, telephone number and the information in your message.

Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (initiation/performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient communication).

Storage period: until the purpose ceases to apply, at most 6 months. No transfer to a third country takes place.

Enquiry by email, telephone or fax

If you contact us by email, telephone or fax, we process the information you provide, in particular your name and the content of your enquiry.

Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest).

Storage period: at most 6 months, unless statutory retention obligations apply. A transfer to a third country is not envisaged.

Contact via WhatsApp

On our website we offer you the option of contacting us via a WhatsApp button. This button is a simple link – only when you actively click it are you forwarded to WhatsApp and a connection to the servers of WhatsApp/Meta is established. Merely visiting our website does not transmit any data to WhatsApp and does not set any WhatsApp cookies.

If you write to us via WhatsApp, we process the information you transmit (in particular your mobile number, your displayed name and the content of your message) in order to answer your enquiry. Please note that WhatsApp is a service of Meta Platforms Ireland Ltd. and that data may also be transferred to the USA in this context. We have no influence on the data processing carried out by WhatsApp itself; WhatsApp’s own privacy policy applies. For confidential or particularly sensitive matters, we recommend contacting us by email, telephone or via our contact form.

Legal basis: Art. 6(1)(a) GDPR (consent through active contact), Art. 6(1)(b) GDPR (initiation/performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient communication).

AI-powered chatbot – Anthropic Claude

We use an AI-powered chatbot based on Anthropic Claude on our website to provide you with fast, efficient support that is available at any time for questions about our services and offers. As part of its use, the content you enter (e.g. chat messages, enquiries, contact details where applicable) as well as technical data such as IP address, device and browser information are processed.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in modern and efficient customer communication) and – where consent has been requested – Art. 6(1)(a) GDPR. Consent given can be withdrawn at any time.

Use of AI services

To provide certain functions, we use AI services via an application programming interface (API). Insofar as personal data is processed in this context, processing takes place exclusively on the basis of the applicable data protection provisions and – where necessary – a data processing agreement pursuant to Art. 28 GDPR. The transmitted data is processed solely to provide the requested function and is only transferred to the extent necessary for this purpose. We ensure data-minimising processing and do not transmit any personal data unless this is required for the respective function.

AI room visualiser – Google Gemini

On our website we offer an AI-powered room visualiser that lets you combine a photo of your room that you upload with our floor coverings. For image processing we use the AI model Google Gemini via an application programming interface (API). In doing so, the image you upload and technical data (e.g. IP address) are transmitted to Google and processed exclusively to create the requested visualisation. Please do not upload any images showing identifiable persons or other sensitive content.

Legal basis: Art. 6(1)(a) GDPR (consent through active use) and Art. 6(1)(f) GDPR (legitimate interest in an illustrative product presentation).

Registration in the online shop

You have the option of registering in our online shop in order to use additional functions (e.g. managing your orders, saving delivery addresses). We use the data entered exclusively to provide the customer account and to process your orders.

We use a double opt-in procedure. This means that after entering your data you will receive an email asking you to confirm your registration. Your customer account is only activated after this confirmation.

Legal basis: Art. 6(1)(b) GDPR (user relationship/contract performance) and Art. 6(1)(a) GDPR (consent in the double opt-in). The data is stored for as long as your customer account exists. After deletion, the data is removed, unless statutory retention obligations apply.

Payment providers

We offer various payment options: prepayment, purchase on account or via the following payment service providers.

Social media

First-party analytics

We measure the use of our shop using our own procedure operated on our own servers. What is recorded includes page views, search queries and result counts, filters, product views, cart and checkout steps, and technical errors. In this context the time, type of page, path, device category, product identifier, amount and advertising origin may be processed. The purpose is to improve functionality, usability and our range of products.

Without consent to statistics, a session identifier is formed on the server side from the IP address, selected browser characteristics and a secret value that changes daily. The IP address is not stored; no information is stored on or read from your terminal equipment. The legal basis is Art. 6(1)(f) GDPR. Recognition across several days is not provided for without consent.

If you consent to Statistics, we additionally use a random browser identifier for statistical recognition. The legal bases are Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be withdrawn at any time via the cookie settings. Measurement data is not linked to customer accounts.

Search queries and form entries are automatically cleaned of possible personal details before being stored. The measurement data is used neither for personalised advertising nor to create advertising profiles. Recognition identifiers are deleted or anonymised after 90 days, and all measurement data after 400 days at the latest.

Individual session histories may be evaluated by authorised staff manually and exclusively on the basis of already cleaned event data via the Anthropic API. IP addresses, customer and session identifiers are not transmitted in this process. The processing takes place on the basis of a processing relationship pursuant to Art. 28 GDPR and in compliance with the requirements for any transfers to third countries.

You may object at any time, pursuant to Art. 21 GDPR, to processing based on Art. 6(1)(f) GDPR — via the privacy settings or the contact details given under Controller. After that, no further measurement data is processed; data that can still be attributed to you is deleted or anonymised.

Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited, on our website to evaluate visitor behaviour and optimise our online offering. Google Analytics uses technologies to recognise users, in particular cookies and device fingerprinting, in order to analyse usage behaviour.

Processing is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can prevent collection by installing the browser plug-in provided by Google.

Google Ads

We use Google Ads. The application uses Google cookies to recognise which pages you have visited on our site and whether you have clicked on one of our ads. This only happens with your consent. In particular, we process your IP address and information about your usage behaviour.

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (legitimate interest). Data transfers to third countries are carried out on the basis of the EU standard contractual clauses.

Google Tag Manager

We use Google Tag Manager. Google Tag Manager is a management tool with which we can centrally control tracking, analytics or marketing tools on our website. Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any independent analyses.

Legal basis: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interest) and § 25(1) TDDDG.

Microsoft Clarity

We use Microsoft Clarity, a web analytics service provided by Microsoft Ireland Operations Limited, to understand how visitors use our website. Clarity records how pages are used — mouse movements, clicks, scrolling and the sequence of pages visited — and reconstructs this as a session that we can replay. In addition, aggregated figures such as scroll depth, dwell time and repeated clicks on unresponsive elements are collected. This allows us to find and fix operating problems.

Entries in form fields, contact details and payment data are masked before transmission and are not visible in the recording. The data is pseudonymous: we do not learn your name or email address from it.

Processing is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without consent, Clarity is not loaded. You can withdraw your consent at any time with effect for the future via the cookie settings at the bottom left of any page.

Shipping providers

When you order goods from us, the data required for shipping (in particular first and last name as well as address) is transmitted to our shipping service providers. Legal basis: Art. 6(1)(b) GDPR. Storage period: at most 6 months.

Newsletter

If you would like to receive the newsletter offered on the website, we require an email address from you as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter. Registration takes place using the double opt-in procedure.

Processing is carried out exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw the consent given at any time, for example via the “unsubscribe” link in the newsletter.

After you unsubscribe, your email address may be stored in a blacklist in order to prevent future mailings. Storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest. Legal basis: Art. 6(1)(f) GDPR.

Plugins and tools

Handling of applicant data

We offer you the opportunity to apply to us (e.g. by email, by post or via an online application form). We assure you that the collection, processing and use of your data is carried out in accordance with applicable data protection law and that your data is treated in strict confidence.

If you send us an application, we process the personal data associated with it (e.g. contact and communication data, application documents, notes from job interviews) insofar as this is necessary for the decision on establishing an employment relationship. Legal basis: § 26 BDSG (initiation of an employment relationship), Art. 6(1)(b) GDPR and – where consent has been given – Art. 6(1)(a) GDPR.

If we are unable to make you a job offer, we reserve the right to retain the data submitted on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for up to 6 months from the end of the application procedure. The data is then deleted and physical application documents are destroyed.

Last updated: May 2026