Privacy policy

1 Controller and contact

The controller responsible for processing personal data in our online shops is Schorb Netzwerktechnik GmbH, An der Alaunhütte 20, 53842 Troisdorf, Germany, represented by Managing Director Frank Schorb. You can contact us at info@schorb-gmbh.de or by telephone on +49 2241 9171-82.

This policy applies to schorb-gmbh.de, schorb-led.de and shop.schorb-dmx.de. It explains the purposes, legal bases, recipients and retention of your data and your rights.

2 Website and server logs

When you access our pages, the web server processes technical data, particularly your IP address, date and time, the requested address, response status, and browser and connection information. This processing serves secure and reliable operation, troubleshooting and prevention of abuse. Its legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting and reliably providing our online shops.

Regular access logs on the production server are deleted within seven days. Restricted backup copies follow the rolling backup cycles described in section 10. Where particular data are needed to investigate a specific security incident or establish, exercise or defend legal claims, the necessary data may be retained longer for that purpose. The need for continued retention is assessed separately.

We use hosting services provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Where the provider processes personal data on our behalf, this constitutes processing under Article 28 GDPR. The necessary agreements and actual processing locations form part of our data protection management.

3 Orders and customer accounts

To process your order, we process in particular names, billing and delivery addresses, email addresses, ordered items, payment and delivery information and, where applicable, company details and VAT identification numbers. Mandatory fields are identified. Without the data necessary for an order, we cannot perform the contract.

The legal basis is Article 6(1)(b) GDPR. Where statutory retention or documentation duties apply, further processing is based on Article 6(1)(c) GDPR.

If you create a customer account, we process the details you supply to provide and manage it. You may request deletion of the account. Contract records that must legally be retained are unaffected.

4 Contact and withdrawal forms

If you contact us by email, telephone or form, we process your information to handle your enquiry. For pre-contractual or contractual enquiries, the legal basis is Article 6(1)(b) GDPR; otherwise, it is Article 6(1)(f) GDPR. Our legitimate interest is answering enquiries and maintaining traceable communications.

When you use the electronic withdrawal function, we process your name, information identifying the contract, your contact address and any further voluntary details to handle the withdrawal and acknowledge receipt. The legal bases are Article 6(1)(b) and (c) GDPR in conjunction with the relevant consumer-law duties.

Enquiries without a further retention purpose are deleted after they have been dealt with. Where they constitute contract or business records or are needed for legal claims, the corresponding retention and limitation periods apply.

5 Delivery and payment

For delivery, we transmit the necessary address and shipment data to the carrier concerned, generally DHL. The legal basis is Article 6(1)(b) GDPR. Additional transfers, such as for an optional delivery notification, take place only on an appropriate legal basis.

We use Shopware Payments, based on PayPal's payment infrastructure, for electronic payments. This involves in particular PayPal Europe S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Depending on the selected payment method, other payment or wallet providers may be involved, such as Klarna, Google Pay or Apple Pay. The actual selection is displayed during checkout.

The necessary order, contact and payment information is transmitted to the providers involved to process your chosen payment. The legal basis is Article 6(1)(b) GDPR. Integrating payment components may itself technically transmit connection data such as your IP address and browser information to their providers. Providing secure payment functions and preventing abuse are legitimate interests under Article 6(1)(f) GDPR. Where consent is required, processing only takes place on that basis.

Payment providers may also process data as independent controllers, for example for fraud prevention or statutory obligations. Their privacy information accessible for the relevant payment method also applies. PayPal acts as an independent controller for payment processing, fraud prevention and its own statutory duties. If you select Klarna, this involves in particular Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For Apple Pay and Google Pay, their providers also process the relevant wallet's payment and device information. Details and contact options are available at https://www.paypal.com/de/legalhub/paypal/privacy-full, https://www.klarna.com/de/datenschutz/, https://www.apple.com/de/legal/privacy/data/de/apple-pay/ and https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice. See section 10 for international transfers.

6 Cookies and similar technologies

We use technically necessary storage and access functions, for example for the basket, session, language and your privacy choices. Where strictly necessary for a service you explicitly request, access takes place without separate consent under section 25(2), no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). Subsequent personal-data processing is based in particular on Article 6(1)(b) or (f) GDPR, depending on the purpose.

Non-essential analytics or marketing functions are used only with your consent where required. The legal bases are section 25(1) TDDDG and Article 6(1)(a) GDPR. You can change your choice using "Cookie settings" in the shop footer and withdraw consent for the future. Withdrawal does not affect the lawfulness of processing before it was withdrawn.

7 Shopware Analytics

We use Shopware Analytics to analyse and improve our shop. The provider is shopware AG, Ebbinghoff 10, 48624 Schöppingen, Germany. Analysis of business data must be distinguished from consent-dependent tracking of visits and interactions in the storefront.

After you give the corresponding consent, data processed for storefront analytics may include pages visited, click paths, searches, time and duration of visits, and browser, device and referral information. The legal bases for this consent-dependent tracking are section 25(1) TDDDG and Article 6(1)(a) GDPR. Consent can be withdrawn through the cookie settings.

Consent-dependent tracking uses identifiers and local browser storage. For logged-in customers, the account identifier, name, email address and customer-group assignment may also be processed in local browser storage. Of these details, the installed tracking interface transmits customer-group information and guest status to the analytics service, rather than names or email addresses. IP and connection data arise for technical reasons when connecting. If you withdraw consent, the corresponding local tracking storage is removed.

Separately, under Shopware's agreement on the use of non-personal data, non-personal or anonymised business analyses and technical usage data are used for analysis and product improvement. Details are available at https://www.shopware.com/de/rechtliches/data-use-details/ and https://www.shopware.com/de/datenschutz/. This does not authorise personal storefront tracking independently of your consent. Consent continues until withdrawn or until the stored choice expires or is deleted; you can end it at any time through the cookie settings.

8 Advertising and review requests

We occasionally place Google search advertisements. This does not in itself mean that remarketing is used on our shop pages. No remarketing service or etracker is used on our shop pages. If consent-dependent conversion or advertising tracking is added in future, we will inform you before activation and obtain the necessary consent.

We send promotional emails, newsletters or review requests only where the necessary consent or another applicable statutory permission exists. Consent-based messages rely on Article 6(1)(a) GDPR. You may withdraw consent at any time for the future, for example by writing to info@schorb-gmbh.de or using an unsubscribe link provided. Messages solely concerned with performing your order are unaffected.

9 Retention and archiving

We retain personal data for as long as required for the relevant purpose or by statutory retention duties. The legal basis for legally required retention is Article 6(1)(c) GDPR in conjunction with the relevant commercial and tax provisions.

Business correspondence generally has to be retained for six years, accounting vouchers generally for eight years, and certain books, records and financial statements for ten years. These periods generally begin at the end of the relevant calendar year. Special statutory extensions and necessary retention for legal claims remain unaffected. Not every email is subject to a retention duty.

Electronic business records are stored in a restricted archive with deletion protection. A protection period of 3650 days is currently configured technically. This setting does not in itself establish a legal retention duty for all messages. Requests for deletion or restriction are assessed against the applicable statutory duties and rights. Assigning archived records to different statutory periods and implementing justified deletions require separate assessment; automatic deletion after six or eight years is not currently configured.

10 Backups and data transfers

We create restricted backups to prevent data loss and restore operations. The legal bases are our statutory security obligations and legitimate interest in reliable and secure data processing, Article 6(1)(c) and (f) GDPR. Backups are not used for ongoing business use of deleted data. Necessary deletion and restriction instructions are reapplied after restoration.

The shop server is backed up daily in encrypted form to a backup system we operate in Germany. Fourteen daily, eight weekly and six monthly restore points are retained on a rolling basis. Data may therefore remain in older backups longer than in the production system. Access is restricted and these copies serve only restoration. Further backup copies of our local storage are held on a Hetzner Storage Box. Hetzner Online GmbH provides hosting and external backup services. Where providers process personal data on our behalf, the requirements of Article 28 GDPR apply.

Where services actually used transfer data to recipients outside the European Economic Area, this must meet the requirements of Articles 44 et seq. GDPR. In particular, PayPal and the selected wallet providers may process data internationally. In its current privacy notice linked above, PayPal describes in particular adequacy decisions, standard contractual clauses and, where applicable, statutory exceptions. The particular basis depends on the recipient and processing operation. Information and, where applicable, a copy of the relevant safeguards may be requested from the provider concerned or through our contact address.

11 Your rights

Where the statutory conditions are met, you have rights of access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction of processing under Article 18 and data portability under Article 20. You may withdraw consent at any time for the future.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority particularly relevant to our company is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia. You may also contact another competent supervisory authority.

Where we process data on the basis of legitimate interests, you may object under Article 21 GDPR on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons. We will then no longer process the data for direct marketing. In other cases, we assess whether compelling legitimate grounds or the establishment, exercise or defence of legal claims justify continued processing.

To exercise your rights, please contact info@schorb-gmbh.de. Statutory restrictions, particularly existing retention duties, remain unaffected.

Last updated: 3 November 2026