Privacy Policy

This notice covers krauspapersgmbh.com, the Kraus Papers website. For privacy enquiries, write to info@krauspapersgmbh.com or Kahlaker Str 2, 47228 Duisburg, Germany.

The registered identity of the organisation responsible for processing your information must be confirmed before this draft is finalised. Our Legal Notice contains the available business contact information.

The website is prepared for hosting on Netlify; the business mailbox uses Hostinger email. The hosting service processes connection information needed to deliver pages, such as your IP address, request time, requested URL and browser information. Server and security logs may record this information to operate the service and investigate abuse.

Our legitimate interest in operating and protecting the website is the basis for this processing under Article 6(1)(f) GDPR. Hosting log retention and the applicable processor arrangements must be confirmed before this draft is finalised.

The enquiry form collects your name, email address and message, together with the selected product when applicable. We send these details to our business mailbox to review your request and reply. Your email address is used as the reply address. Please include only information relevant to your enquiry.

These fields are required to submit the form, but contacting us is voluntary. You may instead email us directly. Without suitable contact details, we may be unable to respond.

For steps you request before entering a contract with us, processing is based on Article 6(1)(b) GDPR. For general questions or correspondence with someone acting for a business, it is based on our legitimate interest in responding to business enquiries under Article 6(1)(f). Sending an enquiry does not subscribe you to marketing.

The website sets a first-party session cookie named kraus_session_next. It links your browser to security tokens, submission status and, when needed, temporarily retained form values. This protects the enquiry form and helps prevent duplicate messages. The cookie and associated form session expire after 24 hours. Expired server records are removed during later session cleanup.

The application also uses a hidden spam-trap field and limits repeated submissions. Its private server-side rate-limit record contains a hashed IP address, a request count and an expiry time, not your message. A hash is still treated as personal data, rather than anonymous information.

These measures support our legitimate interest in preventing abuse under Article 6(1)(f) GDPR. Necessary session storage supports the form service you request. Blocking cookies may prevent the form from working; direct email remains available.

The current website code does not include advertising cookies, analytics trackers, third-party CAPTCHA, embedded maps or remotely loaded fonts. We will review this notice and any required consent controls before introducing optional tracking.

Enquiries are available to the people handling business correspondence and to the hosting and email providers needed to operate those services. The intended setup uses Netlify for website hosting and private form-security storage, and Hostinger for email delivery and the mailbox.

Netlify Blobs holds form session tokens, submission status, hashed-address rate limits and temporarily retained failed-form values. It is not a public enquiry database. No accepted message body is retained there after sending. Information may also be disclosed where required by law or to establish, exercise or defend a legal claim.

Provider contracting entities, processing locations, subprocessors and safeguards for transfers outside the EEA require review against the actual service agreements. Read Netlify's privacy policy and Hostinger's privacy policy for provider information. These do not replace this notice.

Enquiry correspondence should be kept only while needed to answer the request, manage the resulting business relationship or meet applicable recordkeeping and legal-claim requirements. The mailbox deletion schedule and backup retention must be confirmed.

Form sessions and security tokens stop being valid after 24 hours. Failed submissions without JavaScript can temporarily retain bounded form values so they can be displayed again. Accepted enquiry bodies are not stored in the form-security service.

Rate limits apply for 15 minutes. Expired private storage records are removed by a daily scheduled cleanup of older date partitions. Logical expiry is enforced immediately; physical removal occurs later, normally within four days of creation when cleanup is running successfully. Hosting logs and email copies have separate retention settings.

Subject to the applicable conditions, you can request access, correction, erasure, restriction and portability of your personal data. You may object to processing based on legitimate interests for reasons relating to your situation. Where processing relies on consent, you may withdraw it for future processing.

Use the contact details above to exercise your rights. You can also complain to a data protection authority, including the authority where you live or work. For North Rhine-Westphalia, see the LDI NRW complaints page.

The enquiry form does not make automated decisions with legal or similarly significant effects, or create marketing profiles. Its automated security checks can reject or temporarily limit submissions; you can contact us by email instead.

We will update this notice when the website, service providers or processing arrangements change. The review date appears at the top of this page.