Privacy

1. Name and contact details of the controller

No data protection officer is currently appointed. If you have any questions regarding data protection, please contact the controller named above directly by email at info@stoffmarktholland.de.

2. Overview of legal bases

The processing of personal data on our website is always carried out in accordance with the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG). The individual legal bases are: consent (Art. 6 para. 1 lit. a GDPR), performance of a contract and pre-contractual measures (Art. 6 para. 1 lit. b GDPR), legitimate interest (Art. 6 para. 1 lit. f GDPR), and § 25 TDDDG for accessing information on end devices (cookies). The respective legal basis is specified for each processing operation.

3. Hosting

This website and backend are operated on a root server provided by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. The server location is Vienna, Austria. The server processes, in particular, website files, market and newsletter data, contact requests, technical logs, and backend data required for operation. We use netcup on the basis of Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the secure, stable, and economical provision of the website and related form services. A data processing agreement pursuant to Art. 28 GDPR is in place with netcup.

Server log files

When our website and API endpoints are accessed, technically required server log files are processed. These may include:

• IP address
• Date and time of access
• Requested URL or file
• HTTP status code
• Amount of data transferred
• Browser type and browser version
• Operating system used
• Referrer URL
• User agent and technical header data

This processing is necessary to deliver the website, operate the systems, analyze errors, and detect misuse or attacks. The legal basis is Art. 6 para. 1 lit. f GDPR.

Server log files are stored only for as long as required for operation, security, and error analysis. Longer retention takes place only where necessary to investigate misuse, attacks, or legal violations.

4. Cloudflare (DNS, CDN, reverse proxy and security)

Our domain and website are secured and delivered via services provided by Cloudflare Germany GmbH, Munich, Germany, and Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare is used as DNS provider, CDN, reverse proxy, and for protection against attacks and abusive access. Requests to our website may therefore first be routed through Cloudflare's network and then forwarded to our origin server.

Cloudflare may process, in particular, IP address, requested URL, date and time of the request, HTTP headers, browser and device information, referrer, TLS information, and technical diagnostic and security events. This processing is necessary to deliver the website reliably and securely, defend against attacks, detect abusive access, and pass the real visitor IP address to our server.

Cloudflare may set technically necessary cookies or comparable identifiers where required for security functions, for example in connection with bot detection, managed challenges, firewall checks, or rate limiting. These cookies serve website security and availability and are not used by us for advertising or audience measurement.

The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure, stable, and performant delivery of the website, protection against attacks, and protection of the origin server. Where Cloudflare accesses or stores information on your device, this is done for technically necessary security and delivery functions on the basis of § 25 para. 2 TDDDG.

For our Cloudflare account, the Cloudflare Data Processing Addendum forms part of the Cloudflare Self-Serve Subscription Agreement. Processing by Cloudflare companies and sub-processors outside the EU/EEA, in particular in the USA, cannot be excluded. Cloudflare refers to the EU-US Data Privacy Framework and, additionally, to EU Standard Contractual Clauses for this purpose.

5. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as contact requests or newsletter sign-ups, this site uses SSL/TLS encryption. You can recognize an encrypted connection by the browser address bar changing from „http://“ to „https://“ and by the lock icon in your browser bar. When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

6. Cookies and consent management

We use cookies and comparable technologies on our website. This includes technically necessary cookies, storage of your cookie choice, and optional cookies or external content where you expressly allow them.

When you first visit our website, a cookie banner is displayed where you can choose which optional cookie categories you want to allow. You can choose between necessary cookies, analytics cookies, and external media. Your cookie preference is stored in the cookie „stfmhc“ for 12 months. You can change your settings at any time via the „Cookie Settings“ link in the footer of our website.

The legal basis for technically necessary cookies is § 25 para. 2 TDDDG (no consent required) in conjunction with Art. 6 para. 1 lit. f GDPR (legitimate interest). For analytics cookies and external media, the legal basis is your consent pursuant to § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR.

7. Google Analytics 4

We use Google Analytics 4 on our website, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics 4 uses cookies (in particular _ga and _ga_*, each with a default storage period of 2 years) that enable an analysis of your use of our website.

The use of Google Analytics is based exclusively on your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG. The Google Analytics script is only loaded after your explicit consent in the cookie banner. Before your consent, we do not set Google Analytics cookies and do not load the Google Analytics script.

The information generated by cookies about your use of this website is generally transferred to a Google server in the USA and stored there. Data transfer to the USA is based on the adequacy decision of the EU Commission of 10 July 2023 on the EU-US Data Privacy Framework (DPF). Google LLC is certified under the DPF.

We have concluded a data processing agreement with Google in accordance with Art. 28 GDPR.

Google Analytics 4 does not use full IP addresses by default. IP anonymization is automatic, so your IP address is truncated within the EU/EEA before being transferred to Google servers.

We have configured the retention period for event data in Google Analytics to 2 months. Google Signals and personalized advertising are disabled.

You can revoke your consent at any time with effect for the future by changing your cookie settings via the link in the footer of our website. Upon revocation, the Google Analytics cookies set by us (_ga and _ga_*) are automatically deleted where technically possible via the browser. Additionally, you can prevent data collection by Google Analytics by installing the browser add-on for disabling Google Analytics (available at https://tools.google.com/dlpage/gaoptout).

We use Google Consent Mode V2, which communicates the consent decisions from our cookie banner to Google. Without your consent, no analytics cookies are set and no Google Analytics script is loaded.

8. Google Maps

On our market pages, we use Google Maps to display directions. The embedded Google Maps map is only loaded after you have consented to the „External Media“ category in our cookie banner (two-click solution). Without this consent, no Google Maps map is loaded as an embed. An additional external directions link leads directly to Google Maps; if you click it, Google is opened as the destination site.

When the embedded map is loaded or when the external directions link is opened, data such as your IP address, location information, and browser data may be transferred to Google LLC (USA). Data transfer to the USA is based on the EU-US Data Privacy Framework (DPF). The legal basis for the embedded map is your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG. The external link is opened only by your active choice; once the Google page is opened, Google's privacy policy applies.

You can revoke your consent at any time by deactivating the „External Media“ category in your cookie settings. Revocation prevents embedded Google Maps maps from loading, but not external Google Maps links that you click yourself. For more information, see Google's privacy policy at https://policies.google.com/privacy .

9. Newsletter

We offer you the option to subscribe to our newsletter to receive regular updates about fabric market dates and news. To receive the newsletter, you need to provide an email address. Optionally, you can specify your preferred location to receive targeted reminders for markets near you.

We use the so-called double opt-in procedure. This means that after you sign up, we send a confirmation email to the email address you provided. Your subscription only becomes active after you click the confirmation link in this email. This procedure serves as proof of your consent.

During sign-up, we store the time of registration, confirmation status, selected language, confirmation token, and selected regions. Technical access data such as IP address and user agent may additionally be processed in server and security logs. This data is used for operation, misuse prevention, and proof of consent.

The legal basis for sending the newsletter is your consent pursuant to Art. 6 para. 1 lit. a GDPR.

Newsletter performance measurement

Manual newsletters and market reminders may be evaluated via Amazon SES using delivery, open, and click events. In particular, delivery status, bounces, complaints, opens, clicks, and clicked links are processed. Double opt-in and welcome emails are sent without open/click tracking. We use this evaluation for delivery control, troubleshooting, misuse prevention, and improving relevant market reminders. The legal basis for performance measurement is your consent pursuant to Art. 6 para. 1 lit. a GDPR where this evaluation forms part of your newsletter consent. We also process delivery, bounce, and complaint data on the basis of Art. 6 para. 1 lit. f GDPR to detect sending errors, misuse, and deliverability problems.

Your email address, optional name and location details, language, region selection, and status data are stored for as long as you are subscribed to the newsletter. After unsubscribing, your record is deactivated or deleted unless statutory proof, defense, or suppression obligations apply. Email addresses that have caused a hard bounce or spam complaint may be stored in a suppression list so they are not contacted again.

You can revoke your consent at any time with effect for the future. Unsubscribing is possible at any time, for example via the unsubscribe link at the end of each newsletter or by email to info@stoffmarktholland.de. The lawfulness of data processing carried out prior to the revocation remains unaffected by the revocation.

10. Contact form

For questions of any kind, we offer you the option to contact us using a form provided on the website. We process name, email address, optionally telephone number, subject, message, language, and technical metadata such as IP address and user agent. Providing a valid email address is required so that we can respond to your inquiry.

To protect against automated spam requests, we use Altcha, a proof-of-work method. A small computational task is solved locally in your browser. No personal data is transmitted to external services and no cookies are set.

Data processing for the purpose of contacting us is carried out on the basis of Art. 6 para. 1 lit. b GDPR (pre-contractual measures) and Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to inquiries).

The data transmitted during the contact process is deleted after your inquiry has been fully processed, unless statutory retention periods apply.

11. Email delivery (Amazon SES)

For sending newsletter emails and replies to contact inquiries, we use the service Amazon Simple Email Service (Amazon SES) by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (EU subsidiary). The parent company is Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA. We use Amazon SES in the EU region Frankfurt (eu-central-1), so that data processing takes place within the European Union.

As part of email delivery, we process in particular the recipient email address, email content, sending time, delivery status, message ID, bounce and complaint information, and for tracked newsletter emails open and click events.

We have concluded a data processing agreement (AWS Data Processing Addendum) with Amazon Web Services in accordance with Art. 28 GDPR.

As Amazon Web Services is a US-based company, access from the USA cannot be entirely excluded. In such cases, Amazon.com, Inc. is certified under the EU-US Data Privacy Framework (DPF) (adequacy decision of the EU Commission of 10 July 2023). Additionally, EU Standard Contractual Clauses (SCC) pursuant to Art. 46 para. 2 lit. c GDPR are in place as an additional safeguard.

12. Disclosure of data

Your personal data will not be transmitted to third parties for purposes other than those listed in this privacy policy. We only share your personal data with third parties if:

• you have given your express consent pursuant to Art. 6 para. 1 lit. a GDPR
• the disclosure is necessary for the assertion, exercise, or defense of legal claims pursuant to Art. 6 para. 1 lit. f GDPR and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data
• there is a legal obligation for disclosure pursuant to Art. 6 para. 1 lit. c GDPR
• this is legally permissible and required for the performance of contractual relationships with you pursuant to Art. 6 para. 1 lit. b GDPR

13. Links to social networks

Our website contains links to the social media profiles of Stoffmarkt Holland GmbH on the platforms Facebook, Instagram, and TikTok. These are simple hyperlinks – when you access our website, no data is transmitted to the platform operators. Only when you click on a link are you redirected to the respective platform and subject to their privacy policies.

Privacy policies of the platforms: Facebook , Instagram , TikTok .

14. Data subject rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request information about your personal data processed by us.
• Right to rectification (Art. 16 GDPR): You can request the correction of inaccurate or the completion of incomplete data.
• Right to erasure (Art. 17 GDPR): You can request the deletion of your stored personal data, unless processing is necessary for exercising the right to freedom of expression, for compliance with a legal obligation, or for reasons of public interest.
• Right to restriction of processing (Art. 18 GDPR): You can request the restriction of processing of your personal data.
• Right to data portability (Art. 20 GDPR): You can receive your personal data in a structured, commonly used, and machine-readable format or request the transfer to another controller.
• Right to withdraw consent (Art. 7 para. 3 GDPR): You can withdraw your consent at any time with effect for the future. The lawfulness of processing carried out on the basis of consent prior to the withdrawal is not affected.

Right to lodge a complaint with a supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR. The supervisory authority responsible for us is:

15. Right to object (Art. 21 GDPR)

16. Obligation to provide personal data

There is no legal or contractual obligation to provide personal data on our website. However, providing your email address is required for the contact form so that we can process and respond to your inquiry. For the newsletter, providing your email address is necessary. Without providing the respective data, the corresponding service cannot be used.

17. Data security

We employ appropriate technical and organizational security measures in accordance with Art. 32 GDPR to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments. Data transmission is secured via SSL/TLS encryption (see section 5).

18. Validity and changes to this privacy policy

This privacy policy is currently valid as of June 2026. Due to the further development of our website or changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current privacy policy can be accessed and printed at any time on the website at stoffmarktholland.de/en/privacy .