Note: This translation is for informational purposes only. The only legally binding version is the German version.
Privacy Policy of GeBE Elektronik und Feinwerktechnik GmbH
Last updated: 1 October 2026
General part
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
GeBE Elektronik und Feinwerktechnik GmbH
Industriestraße 9
82110 Germering
Germany
Phone: +49 89 894141-0
Email: info@gebe.net
2. External Data Protection Officer
Mr. Oliver Kunert
Sunny Systems GmbH
Blumenweg 1
82229 Seefeld
Email: aneid@gebe.net
3. General information about data processing
We generally process personal data only to the extent necessary for the performance of our business activities, the provision of our services, communication with customers, interested parties, suppliers, service providers and business partners, and for the provision and use of our website.
In addition, personal data may be processed, in particular in the context of initiating, executing and concluding contractual relationships, in the processing of inquiries and offers, for the fulfilment of legal obligations and to safeguard legitimate interests.
Where the processing of personal data requires consent, the processing will only take place after the relevant person has given their consent.
Personal data of applicants and employees may also be processed as part of the establishment, implementation and termination of employment relationships. More information about specific processing operations will be provided – where necessary – in the relevant sections of this privacy policy or in additional privacy information.
When using our website, personal data is generally processed only to the extent necessary to provide a functional website, as well as the content and services offered there, or when there is a corresponding legal basis for the respective processing.
The respective purposes and legal bases of the processing are explained in more detail in the following sections of this privacy policy.
4. Purpose and legal basis for the processing of personal data
We process personal data only when there is a legal basis for doing so. Depending on the purpose and nature of the processing, the following legal bases are particularly applicable:
Consent – Art. 6(1)(a) GDPR
As far as we obtain consent from the data subject for the processing of personal data, the processing takes place on the basis of Art. 6(1)(a) GDPR. If special categories of personal data are processed within the meaning of Art. 9(1) GDPR, the processing may be based on explicit consent pursuant to Art. 9(2)(a) GDPR.
A given consent can be revoked at any time with effect for the future in accordance with Article 7(3) of the GDPR. The legality of processing carried out up to the revocation remains unaffected by this.
Contract and pre-contractual measures – Art. 6(1)(b) GDPR
If the processing of personal data is necessary to fulfill a contract with the data subject or to perform pre-contractual measures requested by the data subject, the processing is based on Art. 6(1)(b) GDPR.
Legal obligations – Art. 6(1)(c) GDPR
To the extent that the processing of personal data is necessary to fulfill a legal obligation to which we are subject, the processing takes place on the basis of Art. 6(1)(c) GDPR.
Legitimate interests – Art. 6(1)(f) GDPR
To the extent that processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party and the interests, fundamental rights and fundamental freedoms of the data subject do not override them, processing shall be carried out on the basis of Art. 6(1)(f) GDPR. The legitimate interest pursued in each case will be explained in more detail during the respective processing, as necessary.
Employment data
To the extent that personal data is processed in connection with the establishment, execution, or termination of an employment relationship, the processing takes place, in particular, in accordance with the applicable labor and data protection laws. The relevant legal bases are explained in more detail in the relevant privacy information for employees or applicants, as necessary.
Cookies and similar technologies
As far as information stored in the end device of a user or information already stored is read out, the permissibility is governed by § 25 of the Telecommunications Digital Services Data Protection Act (TDDDG).
Insofar as consent is required for this purpose, storage or access takes place in accordance with § 25(1) TDDDG. Consent is not required in particular in the legally provided cases of § 25(2) TDDDG.
If personal data are processed in connection with cookies or similar technologies, a legal basis under the GDPR is additionally required for this. The respective legal basis is explained in more detail for the respective processing.
5. Recipients of personal data
Within our company, those positions and individuals are given access to personal data that they need to fulfill their respective duties.
In addition, personal data may be transmitted or made accessible to the following categories of recipients within the framework of the respective processing:
- IT, hosting and cloud service providers,
- Providers of communication and telecommunications services,
- Payment, financial and billing service providers,
- Shipping, logistics and other service providers commissioned to process the contract,
- external consultants and service providers, in particular tax advisors, auditors, lawyers or similar professional groups,
- Public authorities, courts and other public bodies, insofar as there is a legal obligation to transmit data or the transmission is otherwise legally permissible,
- Customers, suppliers, business partners or other third parties, insofar as this is necessary for the implementation of the respective business relationship or otherwise legally permissible.
As far as we use order processors in accordance with Art. 28 GDPR, these processors process personal data primarily only on documented instruction and on the basis of a contract or another legal instrument in accordance with Art. 28 GDPR.
Further information about recipients or service providers used will be provided, where necessary, in the respective processing operations in this privacy policy or in additional privacy information.
6. Transfer of personal data to third countries
As part of individual processing operations, personal data may be transmitted to recipients in countries outside the European Union (EU) or the European Economic Area (EEA) – so-called third countries – or access to personal data may be made from such countries.
The transmission of personal data to a third country shall be carried out in accordance with the requirements of Articles 44 ff. of the GDPR.
To the extent that a European Commission adequacy decision exists for the relevant third country, territory or specific sector pursuant to Article 45 of the GDPR, data transmission can be carried out on the basis thereof.
If no corresponding adequacy decision exists, a transfer can take place, in particular, based on appropriate guarantees in accordance with Article 46 GDPR. These may include, in particular, the standard contractual clauses issued by the European Commission. Where necessary, the data protection level in the recipient country is reviewed and additional technical, organizational, or contractual protective measures are taken.
In legally prescribed exceptional cases, a transfer may also be carried out based on the requirements of Article 49 of the GDPR.
To the extent that personal data is transferred to third countries as part of individual processing operations, more detailed information about the respective recipient, the third country and the relevant basis for the transfer will be provided for the respective processing, insofar as this is legally required.
7. Provision of personal data
As part of our business relationships, the provision of certain personal data may be required by law or contract, or may be necessary for the conclusion or execution of a contract.
Without the required personal data, we may, in particular, not be able to process requests or orders, conclude or execute contracts, or fulfill legal obligations.
Where the provision of personal data is voluntary, we will indicate this when processing it, if necessary. Further information regarding the obligation or voluntary nature of the provision, as well as the possible consequences of non-provision, will be provided, as necessary, in the respective processing procedures.
8. Data deletion and storage duration
We generally store personal data only for as long as is necessary for the respective processing purposes or as required by legal retention obligations.
If the purpose of the processing no longer applies and there is no other legal basis for further storage, the personal data will be deleted or, unless deletion is not possible or not permitted, blocked from further processing or restricted accordingly.
Legal retention obligations may arise, in particular, from commercial, tax, labor, or other legal regulations. The respective retention periods depend on the nature and purpose of the processed data as well as the applicable legal provisions at any given time. Examples of legal retention periods include, in particular:
- Business books, inventories, opening balances and annual financial statements: generally 10 years,
- Receipts and invoices: generally 8 years,
- received and sent commercial or business letters: generally 6 years.
The stated deadlines refer to the respective records subject to retention and do not mean that all personal data of a customer, supplier, employee or other affected person may be stored for this period.
Further storage beyond that may be permissible, in particular insofar as personal data is still required for the assertion, exercise or defense of legal claims or on the basis of other statutory requirements.
Where specific deletion or retention periods apply for individual processing operations, these will be explained in more detail in the relevant sections of this Privacy Policy or in additional privacy information.
9. Data security
Taking into account the state of the art, the implementation costs, as well as the nature, scope, circumstances and purposes of the processing, we take appropriate technical and organizational measures to ensure a level of protection for personal data that is appropriate to the respective risk. The connection to our website is encrypted using TLS (recognizable by the "https://" in the address bar).
The security measures taken are reviewed in accordance with technological developments and taking into account the respective risks, and are adjusted if necessary.
10. Rights of the data subject
If personal data is processed by you, you have the following rights, subject to the legal requirements:
Right of information (Art. 15 GDPR)
You have the right to request information about whether and what personal data we process about you, as well as any other legally required information about this processing.
Right to rectification (Art. 16 GDPR)
You have the right to request the correction of incorrect data and the completion of incomplete personal data.
Right to erasure (Art. 17 GDPR)
You have the right, under the legal requirements, to request the deletion of your personal data. This applies in particular if the data is no longer required for the purposes for which it was collected or processed. Legal retention obligations or other legal reasons may preclude deletion.
Right to restrict processing (Art. 18 GDPR)
You have the right, under the legal requirements, to request the restriction of the processing of your personal data.
Communication to the recipient (Art. 19 GDPR)
If we have disclosed personal data to recipients, we will provide them with a correction or deletion of personal data or a restriction of processing, unless this is impossible or involves disproportionate effort. Upon request, we will inform you about these recipients.
Right to data portability (Art. 20 GDPR)
Provided that the legal requirements are met, you have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format or, where technically feasible, to request its direct transmission to another controller.
Right of objection (Art. 21 GDPR)
To the extent that the processing of your personal data is based on Art. 6(1)(e) or (f) of the GDPR, you have the right, for reasons arising from your particular situation, to object to the processing at any time.
If personal data are processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes. After your objection, your personal data will no longer be processed for direct marketing purposes.
Right to revoke a consent (Art. 7(3) GDPR)
You may revoke a given consent at any time with effect for the future. The revocation will not affect the legality of the processing carried out based on the consent until the revocation.
Automated decisions including profiling
Pursuant to Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, unless one of the statutory exceptions applies.
Right to complain to a supervisory authority
In accordance with Article 77 of the GDPR, without prejudice to any other administrative or judicial remedies, you have the right to complain to a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.
The following supervisory authority is generally responsible for non-public entities in Bavaria:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
Phone: +49 981 180093-0
Email: poststelle@lda.bayern.de
Internet: https://www.lda.bayern.de/
Online complaint: https://www.lda.bayern.de/de/beschwerde.html
The Federal Commissioner for Data Protection and Information Freedom (BfDI) also provides an overview and a contact finder to identify the respective competent data protection supervisory authority: https://www.bfdi.bund.de/DE/Service/Kontakt/Kontaktfinder/kontaktfinder_node.html
Special section – Processing on this website
11. Hosting and provision of the website / server logs
Description of the processing and processed data
Our website is hosted by the following service provider: Kinsta Inc., 8605 Santa Monica Blvd #92581, West Hollywood, CA 90069, USA (Data Protection Information: https://kinsta.com/legal/privacy-policy/). Kinsta operates the website in a Google Cloud Platform data center and uses the Cloudflare, Inc. content delivery network for fast and secure delivery.
When you visit our website, the web server processes data that is technically necessary for this purpose. This includes in particular:
- IP address of the calling end device,
- Date and time of the access,
- requested page or file,
- Referrer URL, insofar as it is submitted;,
- used browser and browser version,
- used operating system,
- HTTP status code as well
- Amount of data transmitted.
The processing of the IP address during page access is technically necessary to be able to deliver the website’s content to the user’s device. Furthermore, server log files are processed to detect and defend against attacks, to analyze errors, and to ensure the stable and secure operation of the website.
Purpose and legal basis of the processing
The processing takes place, in particular, for the following purposes: technical provision and delivery of the website, ensuring stability and functionality, detecting and correcting technical errors, ensuring the security of our information technology systems, and detecting and repelling abuse, attacks, malware, or automated access.
The legal basis for processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, stable and technically error-free provision of our website as well as in the protection of our information technology systems.
Recipients and service providers used
As part of hosting, personal data is processed by the aforementioned hosting provider. Kinsta processes the data on our behalf based on a contract for order processing pursuant to Article 28 of the GDPR.
Transfers to third countries
Kinsta is based in the USA. This means that the transfer of personal data to the USA or access from the USA is possible. This is done based on the standard contractual clauses issued by the European Commission (Article 46(2)(c) GDPR), which are part of the order processing agreement with Kinsta.
Storage duration
Server log files are stored for up to 30 days and then deleted, unless longer storage is required in individual cases for the clarification or defense of specific security incidents or due to other legal reasons.
Objection and other means of influence
To the extent that processing is based on Art. 6(1)(f) GDPR, pursuant to Art. 21 GDPR, you have the right to object to the processing for reasons arising from the particular situation of the data subject. The processing of certain technical data, in particular the IP address during page access, is technically necessary for the provision of the website. As long as compelling legitimate reasons for the processing exist that outweigh the interests, rights and freedoms of the data subject, the processing may be continued in accordance with Art. 21 GDPR despite an objection.
12. Contact and request forms
Description of the processing and processed data
On our website, we provide several forms through which you can contact us: contact form, support form, OEM inquiry, print system finder, and product filter. When you use a form, we process the data you enter there and transmit to us. This may include, in particular:
- Name,
- Contact information, in particular email address and, if applicable, telephone number,
- Company or organization,
- The subject, the content, and the purpose of your message,
- in the support form, the affected device model, serial numbers, and optionally uploaded photos or videos,
- Your selection in the print system finder and in the product filter, as well as
- any other information you voluntarily provide.
In addition, technically necessary data is transmitted during the transmission, in particular the date and time of the transmission, the page from which the form was sent, and the IP address. Required fields are marked; they are limited to the information we need to process the respective request.
Purpose and legal basis of the processing
We process the personal data submitted via the forms for the processing and answering of your request as well as for the related communication.
If your request relates to the initiation or execution of a contract with us, the processing will be based on Art. 6(1)(b) GDPR. For other inquiries, the processing will be based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper processing and answering of the inquiries we receive as well as the related communication.
Recipients and service providers used
Within our company, only those positions and individuals have access to the data submitted that are required to process the respective request.
The form data is transmitted encrypted to our request and customer system on a separate GeBE server (apps.gebe.net) and processed there. The forms are technically provided by our hosting provider Kinsta (section 11). We send the automatic confirmation of receipt by email via the Bird service of MessageBird B.V., Trompenburgstraat 2C, 1079 TX Amsterdam, the Netherlands, on servers in the EU; Bird processes the recipient address and the content of the email based on a contract for order processing pursuant to Art. 28 GDPR.
Transfers to third countries
With regard to the provision of the forms via our hosting provider, the information provided in section 11 applies. Furthermore, no data is transmitted to third countries during the processing of the form data.
Storage duration
The website's web server does not permanently store the form data. A log of the emails sent by the website is kept there for 14 days to detect delivery problems. Photos or videos from the support form are stored in a randomly named, not publicly listed directory and deleted from the web server no later than one day later.
In our request and customer system, the data are stored for as long as is necessary for processing the respective request and for any subsequent communication. If the request leads to a contractual relationship or the data are required for the execution of a contract, the data may be stored for longer in accordance with the applicable statutory retention periods. Any further storage may take place insofar as there is a legal obligation or another legal basis for this.
Objection and other means of influence
To the extent that processing is based on Art. 6(1)(f) GDPR, pursuant to Art. 21 GDPR, you have the right to object to the processing for reasons arising from your particular situation. Where processing is necessary for the implementation of pre-contractual measures or the performance of a contract, termination of the processing may result in your request not being processed further or the relevant service not being provided.
13. Contacting us by email and phone
Description of the processing and processed data
You can contact us via email or phone. As part of the contact process, we process the personal data you provide, insofar as this is necessary for processing and answering your request. This may include, in particular, your name, contact details (especially email address and telephone number), company or organization, the date and content of the communication, as well as any other information you provide. When communicating by email, the sender and recipient information, as well as technical transmission data, are also processed due to technical requirements.
Purpose and legal basis of the processing
We process the personal data provided as part of the contact process to process and answer your request and related communications. If your contact relates to initiating or executing a contract with us, processing is based on Art. 6(1)(b) GDPR. For other inquiries, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper processing and response to inquiries directed to us, as well as the related communication.
Recipients and service providers used
Within our company, only those positions and individuals have access to the communication data that they need to process the respective request. External IT and telecommunications service providers may be used to provide and use our email and telecommunications services, through which personal data may be processed.
Storage duration
The personal data processed as part of the contact process will be stored for as long as necessary to process the respective request and for any subsequent communication. If the contact leads to a contractual relationship or the data are required for its execution, the data may be stored for longer in accordance with the applicable legal retention periods. Any further storage may take place insofar as there is a legal obligation or another legal basis for this.
Objection and other means of influence
To the extent that processing is based on Art. 6(1)(f) GDPR, pursuant to Art. 21 GDPR, you have the right to object to the processing for reasons arising from your particular situation. To the extent that processing is necessary for the implementation of pre-contractual measures or for the performance of a contract, the termination of the processing may result in your request not being processed further or the relevant communication not being continued.
14. Cookies, local storage and consent management
We use the Borlabs Cookie consent tool. It runs on our own web server; consent data is not transmitted to the manufacturer. On your first visit, you can choose which categories you consent to. Services that require consent are only loaded after you have given your consent. Detailed information about each service (provider, purpose, cookies, storage duration) can be found in the cookie settings under "Settings".
Without consent (strictly necessary)
- Your cookie selection (Cookie "borlabs-cookie"): stores which categories you have agreed to so that we can take your decision into account. Storage period: 60 days.
- Your choice of language (local browser storage): remembers the language you selected, or the language chosen on your first visit based on your browser language, so that you continue to see the website in that language.
- Login: WordPress sets session cookies for logged-in editors. This does not apply to regular visitors.
The legal basis is Article 25(2), No. 2 of the TDDDG; insofar as personal data is processed in this context, Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing the functions you request and in proving your decision to consent.
Only with consent
- Statistics: anonymous support statistics (section 16) and web analysis (section 20).
- External mediaContent from YouTube, Vimeo, Google Maps, Facebook and Instagram (Section 18).
The legal basis is your consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR. By "Accept all", you agree to all categories; with "Essential only", you only agree to the strictly necessary ones. Under "Settings", you can select them individually.
Change cookie settings
You can view, adjust, or revoke your current selection at any time with effect for the future:
Change cookie settings
15. Newsletter
To subscribe to our newsletter, we use the double opt-in procedure: After registration, you will receive an email with a confirmation link. Only after confirmation will your address be added to the distribution list. With the newsletter, we inform you about products, new features, and company news from GeBE.
We process your email address, the language of the page on which you registered, as well as the time and IP address of registration and confirmation. The time and IP data serve to verify your consent. The legal basis is your consent (Art. 6(1)(a) GDPR), for the verification of consent Art. 6(1)(c) GDPR.
Unconfirmed registrations are deleted after 7 days. After confirmation, your address is transferred to our distribution list on a separate server of the GeBE (apps.gebe.net) and deleted from the web server. We send the confirmation email via the Bird service (section 12).
You can revoke your consent at any time, in particular via the unsubscribe link in each newsletter. After unsubscribing, your address will be blocked immediately for further delivery and deleted no later than 7 days after the request, unless we need proof of previous consent to defend against claims.
16. Support assistant and anonymous support statistics
To improve the help texts in our support assistant, we count anonymously which topics and answers are viewed there, how often visitors answer the question "Did this help?" with yes or no, and on which topics support requests are submitted.
Only daily counters are stored: date, topic, type of event and number. No cookies are set or read, and no IP addresses, device or session identifiers are stored. These data cannot be linked to any individual person.
Call counts are only carried out if you have agreed to them in our cookie settings under the category "Statistics" (service "Support Statistics") (§ 25, Para. 1 TDDDG, Art. 6, Para. 1 lit. a GDPR). We count your voluntary feedback ("Did this help? Yes / No") and submitted support requests based on our legitimate interest in improving our support (Art. 6, Para. 1 lit. f GDPR). Again, only anonymous counters are stored here. The counters are automatically deleted after 24 months.
17. Language versions
Our website is available in several languages. When you first visit, we select the language based on the language setting of your browser. Your choice is stored locally in your browser (section 14). The translations of our content are created using the TranslatePress plugin, partly automatically. Only the texts of our website are translated, not the data of visitors.
18. External media
On some pages, content from external providers may be included, such as videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Vimeo (Vimeo.com, Inc., USA), maps from Google Maps (Google Ireland Limited), and posts from Facebook or Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland).
These contents are only loaded when you have accepted the category "External media" or have allowed individual content to be accessed by clicking on it. Then, your IP address and information about your browser are transmitted to the respective provider, among other things. The provider may set cookies and process data in the USA. The aforementioned providers rely on the adequacy decision regarding the EU-US Data Privacy Framework or on EU standard contractual clauses for transfers to the USA. The legal basis is your consent (Art. 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can revoke at any time via the cookie settings.
19. Accessibility tool
For better readability, we offer a tool to customize the display (e.g., font size and contrast). It is loaded from servers of Elementor Ltd., Israel. Your IP address is transmitted to Elementor in the process. For Israel, there is an adequacy decision by the European Commission (Art. 45 GDPR). Your settings in the tool are stored locally in your browser. The legal basis is our legitimate interest in providing an accessible website (Art. 6(1)(f) GDPR) and, for local storage, § 25(2)(2) TDDDG.
20. Web analytics with Google Analytics
If you have consented to the "Statistics" category, we use Google Analytics from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics generates reports on the use of our website, for example which pages are visited and how visitors reach our website. Cookies are set and usage data is transmitted to Google. A transfer to the USA is possible; Google is certified under the EU-US Data Privacy Framework.
We use the reports to improve our website and online advertising. The legal basis is your consent (§ 25 para. 1 TDDDG, Art. 6 para. 1 lit. a GDPR), which you can revoke at any time via the cookie settings.
21. Company appearances in social and professional networks
We maintain company pages on Facebook, Instagram (both Meta Platforms Ireland Limited) and LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). We use these pages to present our company and to share content, including for advertising purposes. Our website only contains simple links to these pages. Data is only transmitted to the respective network when you click on such a link.
When visiting our corporate websites, the operators process your data in accordance with their own privacy protection regulations and provide us with statistical evaluations (e.g., "page insights"). The legal basis for operating our corporate websites is our legitimate interest in presenting our company (Art. 6(1)(f) GDPR).
We are responsible for the page insights together with Meta (Art. 26 GDPR). Meta assumes primary responsibility for the processing of the insights data and fulfills the obligations under the GDPR in this regard. The corresponding agreement ("Page Insights Controller Addendum") can be found at https://www.facebook.com/legal/terms/page_controller_addendum. Your rights can be exercised most effectively directly with the respective operator.
22. Google Ads, Google Company Profile and YouTube Channel
We advertise through Google Ads and operate a Google corporate profile as well as a YouTube channel. On these platforms, Google (Google Ireland Limited) processes user data in accordance with its own privacy policies and provides us with partial statistical analyses. There is no Google Ads tracking integrated into our website itself. The legal basis is our legitimate interest in promoting our company (Art. 6(1)(f) GDPR).
23. Job applications
We currently accept applications by email to sam@gebe.net. We process your application documents solely for the application process. The legal basis is Art. 6(1)(b) GDPR (initiating an employment relationship). If no employment relationship is established, we delete your documents no later than six months after the completion of the process, unless you have consented to a longer retention period.
24. Changes to this Privacy Policy
We adapt this privacy policy if our website or the legal requirements change. The version published here applies.