Data Protection

Privacy Policy

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

It is generally possible to use our website without providing any personal data. Where personal data (such as your name, address or email address) is collected on our website, this is always done on a voluntary basis wherever possible. This data will not be passed on to third parties without your express consent.

Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to guarantee complete protection of data against access by third parties.

The data controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR) is:

WALTHER TROWAL GMBH & CO. KG
Rheinische Straße 35–37
D-42781 Haan
Germany

Tel.: +49 (0)2129 571-0
Fax: +49 (0)2129 571-225
Email: info@walther-trowal.de

The Data Protection Officer pursuant to Article 37 of the GDPR and Section 38 of the BDSG is:

WALTHER TROWAL GMBH & CO. KG
Data Protection Officer
Rheinische Straße 35–37
D-42781 Haan
Germany
Email: datenschutz@walther-trowal.de

Overview of processing operations, purposes and legal bases

We process personal data on our website for the following purposes and on the following legal bases:

Cookies / Consent management

This website uses cookies. Cookies do not cause any damage to your computer and do not contain viruses. Cookies serve to make our website more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and saved by your browser.

We distinguish between technically necessary cookies (for which no consent is required) and analytics/marketing cookies (for which your consent is required). We obtain your consent via a consent management tool (cookie banner), which is displayed when you first visit the website. There, you can choose exactly which categories of cookies you consent to.

Most of the cookies we use are so-called ‘session cookies’. They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognise your browser the next time you visit.

You can withdraw or amend your consent at any time with future effect by clicking on the ‘Cookie settings’ link in the website footer or by adjusting the cookie settings in your browser. Withdrawing your consent is just as simple as giving it (Article 7(3) of the GDPR).

You can configure your browser so that you are notified when cookies are set and can choose to allow cookies only on a case-by-case basis, block the acceptance of cookies in specific cases or generally, and enable the automatic deletion of cookies when you close your browser. Disabling cookies may restrict the functionality of this website.

The legal basis for technically necessary cookies is Section 25(2)(2) of the TTDSG. The legal basis for analytics and marketing cookies (Google Analytics, Google Maps, YouTube) is your consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TTDSG.

Server log files

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• IP address
• Timestamp
• Path requested
• Protocol
• HTTP status code
• Size of the page served
• Detected operating system (with version)
• Detected browser (with version)
• Referrer (if applicable)

If the web server detects an error, the following information is logged in an error log file:

• Timestamp
• Web server process ID
• IP address and source port
• Specific error
• Referrer, if applicable

The server log information is retained by the system for 14 days and then automatically deleted. [NEW] It is only retained for a longer period where this is necessary to investigate security incidents or misuse (Article 6(1)(f) of the GDPR).

This data cannot be linked to specific individuals. This data is not combined with other data sources. We reserve the right to review this data retrospectively should we become aware of specific indications of unlawful use.

Legal basis: Article 6(1)(f) of the GDPR (legitimate interest in system security, stability and the prevention of misuse). Recipients: Our hosting provider as a data processor in accordance with Article 28 of the GDPR.

Contact form

If you send us enquiries via the contact form, the details you provide in the enquiry form – including the contact details you enter there – will be stored by us for the purpose of processing your enquiry and in the event of any follow-up questions. We will not pass on this data without your consent.

Legal basis: Article 6(1)(b) of the GDPR (pre-contractual measures) or Article 6(1)(f) of the GDPR (legitimate interest in processing enquiries).

Retention period: The data will be deleted as soon as it is no longer required for processing the enquiry and there are no statutory retention obligations (e.g. under tax or commercial law) that prevent this. As a rule, the data is deleted 6 months after your enquiry has been fully processed.

Recipients: Relevant internal departments (sales, technical support). The data will not be disclosed to third parties unless you have given your express consent or we are legally obliged to do so.

Google Analytics

This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter ‘Google’).

Google Analytics uses so-called ‘cookies’. These are text files that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie regarding your use of this website is usually transmitted to a Google server in the USA and stored there.

We have enabled IP anonymisation on this website. Your IP address will be truncated by Google within Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google.

Legal basis: Your consent pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TTDSG, which you can give via our cookie banner. Consent is voluntary and may be withdrawn at any time with future effect.

Transfer to third countries (USA): Google also processes data in the USA. Google is certified under the EU-US Data Privacy Framework, which ensures an adequate level of protection in accordance with Article 45 of the GDPR.

Browser plugin

You can prevent cookies from being stored by adjusting the settings in your browser software; however, we would like to point out that, in this case, you may not be able to make full use of all the functions of this website. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available via the following link: https://tools.google.com/dlpage/gaoptout?hl=de

Objection to data collection

You can prevent Google Analytics from collecting your data by clicking on the following link. An opt-out cookie will be set, which will prevent your data from being collected during future visits to this website: Disable Google Analytics

Alternatively, you can withdraw your consent at any time via the ‘Cookie settings’ link in the footer.

Further information on how Google Analytics handles user data can be found in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de

Retention period: The cookies set by Google Analytics are valid for up to 24 months (_ga cookie) or 24 hours (_gid cookie). User and event data linked to cookies, user identifiers or advertising IDs are automatically deleted by Google after 14 months.

Google Maps

On this website, we use the Google Maps service. This enables us to display interactive maps directly on the website and allows you to use the map function conveniently. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Maps is integrated in a privacy-friendly manner via a ‘two-click solution’: the map is not loaded automatically when you first visit the page. Only when you actively click on the ‘Load map’ or ‘Activate Google Maps’ button do you consent to the transfer of data to Google, and the map is then loaded. No data is transferred to Google without your active action.

By visiting the website (after activation), Google receives the information that you have accessed the relevant subpage of our website. In addition, the data listed under ‘Server log files’ (in particular your IP address) is transmitted. This occurs regardless of whether Google provides a user account through which you are logged in, or whether no user account exists. If you are logged in to Google, your data will be directly associated with your account. If you do not wish your data to be associated with your Google profile, you must log out before activating the map.

Legal basis: Your consent pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TTDSG, which you give by actively clicking the ‘Load map’ button. Consent is voluntary and may be withdrawn at any time with future effect (by reloading the page without activating the map).

Transfer to third countries (USA): Google also processes data in the USA. Google is certified under the EU-US Data Privacy Framework.

Further information on the purpose and scope of data collection and its processing by the plug-in provider can be found in the provider’s privacy policy: policies.google.com/privacy. There you will also find further information on your rights in this regard and the settings available to protect your privacy.

Retention period: Google stores your data as usage profiles for a period of 18 months (by default) or until you withdraw your consent.

YouTube

Our website uses plugins from YouTube, a site operated by Google. The operator of the site is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (represented by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

YouTube videos are embedded in a privacy-friendly manner using a ‘two-click solution’ (enhanced privacy mode / ‘no-cookie’ domain): when you first visit a page containing an embedded YouTube video, the video is not loaded automatically. Only a thumbnail is loaded from YouTube’s servers. Only when you actively click the play button do you consent to the transfer of data to YouTube/Google, and the video is then loaded. Without your active action, no data is transferred to YouTube (apart from the loading of the thumbnail).

When you visit one of our pages featuring a YouTube plugin (after activation), a connection is established with YouTube’s servers. In doing so, the YouTube server is informed which of our pages you have visited.

If you are logged into your YouTube account, you allow YouTube to link your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account before playing the video.

Legal basis: Your consent pursuant to Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TTDSG, which you give by actively clicking the play button. Consent is voluntary and may be withdrawn at any time with future effect.

Transfer to a third country (USA): YouTube/Google also processes data in the USA. Google is certified under the EU-US Data Privacy Framework.

Further information on the handling of user data can be found in YouTube’s privacy policy at: https://policies.google.com/privacy

Retention period: YouTube stores data until consent is withdrawn or in accordance with its own retention policies (usually 18 months for pseudonymised usage data).

SSL encryption

This website uses SSL encryption for security reasons and to protect the transmission of confidential content, such as the enquiries you send to us as the website operator. You can recognise an encrypted connection by the fact that the address bar of your browser changes from “http://” to “https://” and by the padlock icon in your browser bar.

When SSL encryption is enabled, the data you transmit to us cannot be read by third parties.

Legal basis: Article 6(1)(f) of the GDPR (legitimate interest in data security) in conjunction with Article 32 of the GDPR (security of processing).

Your rights as a data subject (data subject rights)

You have the following rights in relation to us, about which we are informing you in accordance with Article 13(2) of the GDPR:

1. Right of access (Article 15 of the GDPR): You have the right to request confirmation as to whether personal data concerning you is being processed; if this is the case, you have the right to access this personal data and to receive the information specified in Article 15(1) of the GDPR (purposes of processing, categories of personal data, recipients, intended storage period, existence of data subject rights, right to lodge a complaint, origin of the data, automated decision-making).
2. Right to rectification (Article 16 of the GDPR): You have the right to request the immediate rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data.
3. Right to erasure (Article 17 of the GDPR): You have the right to request the erasure of personal data concerning you if one of the grounds set out in Article 17(1) of the GDPR applies (e.g. data is no longer necessary, withdrawal of consent, objection to processing, unlawful processing).
4. Right to restriction of processing (Article 18 of the GDPR): You have the right to request the restriction of processing if one of the conditions set out in Article 18(1) of the GDPR applies (e.g. contesting the accuracy of the data, unlawful processing, data required for the purposes of legal proceedings).
5. Right to data portability (Article 20 of the GDPR): You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance, provided that the processing is based on consent or a contract and is carried out by automated means.
6. Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR. Where personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing for the purposes of direct marketing.
7. Right to withdraw consent (Article 7(3) of the GDPR): Where processing is based on consent, you have the right to withdraw your consent at any time with effect for the future. This does not affect the lawfulness of the processing carried out prior to the withdrawal.
8. Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR): You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. The supervisory authority responsible for us is: The State Commissioner for Data Protection and Freedom of Information in North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, https://www.ldi.nrw.de.

To exercise your rights, you may contact us at any time using the contact details provided in the legal notice or at the beginning of this privacy policy.

Automated decision-making and profiling

We do not use automated decision-making within the meaning of Article 22 of the GDPR.

However, within the framework of Google Analytics and YouTube, user profiles are created (profiling) in order to analyse user behaviour and optimise the service. This is carried out solely on the basis of your consent (Article 6(1)(a) of the GDPR). You may object to this processing at any time by withdrawing your consent (see cookie settings) or by exercising your right to object under Article 21 of the GDPR.

Retention period and deletion (overview)

Personal data will be deleted as soon as it is no longer required for the purposes for which it was collected or processed, provided that there are no statutory retention obligations (e.g. Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)) to the contrary. Below is an overview of the retention periods:

Recipients and categories of recipients / data processors

We transfer your personal data to the following categories of recipients:

1. Internal departments: Staff in the relevant specialist departments (sales, technical support, marketing, IT administration), insofar as they require the data to carry out their duties.
2. Data processors (Art. 28 GDPR):
   • Hosting providers: For the operation of the website and storage of server log files (data processing agreement in place).
   • Google Ireland Limited: For Google Analytics, Google Maps and YouTube (Standard Contractual Clauses + EU-US Data Privacy Framework).
   • Other IT service providers: For maintenance, support and security services (each with a data processing agreement in accordance with Article 28 of the GDPR).
3. Authorities and public bodies: To the extent that we are legally obliged to disclose information (e.g. law enforcement agencies, tax authorities).
4. No data will be passed on to third parties for advertising purposes without your express consent.

Data is only transferred to third countries (the USA) to Google (Google Analytics, Google Maps, YouTube) on the basis of the EU Standard Contractual Clauses (EU Commission Decision 2021/914) in conjunction with Google’s certification under the EU-US Data Privacy Framework (Article 45 of the GDPR).

Provision of personal data

The provision of personal data is in some cases required by law (e.g. tax-related retention obligations), in some cases contractually required (e.g. for processing enquiries via the contact form), or necessary for the conclusion of a contract.

Simply visiting the website (without using the contact form or consenting to cookies) does not require the provision of personal data. You may visit the website without providing any personal data (apart from the server log files that are technically necessary).

If you use the contact form, you must provide the data marked as mandatory fields (name, email address, message) so that we can process your enquiry. Without this data, we cannot process your enquiry.

Consent to analytics cookies (Google Analytics) and the embedding of external content (Google Maps, YouTube) is voluntary. Failure to give consent will not affect your use of the website, except that the relevant functions (web analytics, map display, video playback) will not be available.

Changes to this Privacy Policy

We reserve the right to amend this privacy policy to ensure it always complies with current legal requirements or to reflect changes to our Services in the privacy policy (e.g. when introducing new Services). The new privacy policy will then apply to your next visit. The latest version is available on this website.

Date of this Privacy Policy: July 2026