Last updated: October 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Daniel Maas, trading as Baustoffheld
Lindenstraße 56
47623 Kevelaer
Germany
Phone: +49 (0)2831 9167703
Email: info@baustoff-held.de

No data protection officer has been appointed, because the statutory requirements for this are not met. For all questions about data protection you can reach us using the contact details above.

2. Principles of processing

We process personal data solely on the basis of the GDPR, the German Federal Data Protection Act (BDSG) and the German Digital Services Data Protection Act (TDDDG). Personal data means all information relating to an identified or identifiable natural person.

Depending on the processing, we rely on one of the following legal bases:

• Art. 6(1)(a) GDPR – your consent, for example for the newsletter or for non-essential cookies
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures, for example for an order
• Art. 6(1)(c) GDPR – compliance with legal obligations, for example tax retention obligations
• Art. 6(1)(f) GDPR – our legitimate interests, for example in a secure and functioning shop

We delete personal data as soon as the purpose of the processing ceases to apply and no statutory retention obligations stand in the way. We state the specific periods with the individual processing operations and in section 14.

3. Hosting and provision of the website

Our website is hosted by an external service provider in Germany: ALL-INKL.COM – Neue Medien Münnich. The provider processes the data arising when you visit the website on our behalf; a data processing agreement under Art. 28 GDPR is in place for this.

When you open our pages, your browser automatically transmits data for technical reasons, which are stored in server log files:

• date and time of access
• the file or page requested
• amount of data transferred and notification of successful retrieval
• browser type and version, operating system
• referrer URL, that is the page visited before
• IP address

Purpose: provision of the website, system security, detection and prevention of attacks, and error analysis.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in technically faultless and secure operation.
Storage period: the log files are deleted after 30 days at the latest, unless they are needed longer to investigate a specific security-related incident.

The connection to our website is encrypted throughout with TLS. You can tell by the padlock symbol and by the address beginning with https.

4. Cookies and consent management

We use cookies and comparable techniques. Cookies are small text files stored on your device.

Technically necessary cookies are required to operate the shop – for session management, the basket, signing in to the customer account and storing your cookie choice, for instance. Without them the shop does not work.
Legal basis: § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.

Non-essential cookies we set only with your consent. We obtain this via our cookie notice.
Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

You can withdraw or change your consent at any time with effect for the future by opening the cookie settings again via the “Cookie-Einstellungen” link at the bottom of every page. You can also delete cookies in your browser or restrict their storage; the functionality of the shop may be limited as a result.

The technically necessary cookies in detail: session-… (session, until the browser is closed); cookie-preference and cookie-config-hash (your cookie choice and the state of our cookie settings at the time you decided, 180 days each), bh-consent-google and bh-consent-microsoft (your choice regarding Google and Microsoft, 180 days); bh-cart (a random identifier under which we keep the contents of your basket available on this device; it is only set once you put something in the basket and expires after 4 hours); bh-cart-merken (only set if you choose “Remember cart on this device” in the basket – then bh-cart and your basket are kept for 90 days; with “Stop remembering” you can cancel this at any time).

So that your choice is also kept in browsers that delete script-set cookies after a short time (Safari, for instance), our server sets these choice cookies again when the page is loaded, with the same lifetime. No further data are collected in the process.

If you agree to the convenience functions, we store the fact that embedded videos from YouTube and Vimeo (youtube-video, vimeo-video) and the wish list (wishlist-enabled) are allowed, for 180 days each. For a transitional period, twt-local-storage may also be set (permission to store display settings in the browser, 180 days).

Beyond the technically necessary cookies, we use services for audience measurement and advertising. Which these are, which data are processed and for how long, is set out in section 4a. These services run only if you have given your consent in the cookie notice. We do not embed social media plugins.

4a. Audience measurement and advertising

The following services run only with your consent. You can allow or refuse each category individually in the cookie notice and change your decision at any time with effect for the future via the cookie settings in the footer.
Legal basis: § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR (consent).

Google Tag Manager

The Tag Manager is a tool for managing the services listed below. It does not itself collect personal data, but loads those services for which you have given consent. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics 4

We measure which pages are opened, how long visits last and which steps lead to an order. The data processed are a randomly assigned identifier, the shortened IP address, details of device and browser, the approximate location at city level, and the pages opened and events triggered.
Cookies: _swag_ga_ga and _swag_ga_ga_N1L4DR1N3Q (up to 24 months), _gcl_au (90 days).

Google Ads

If you came to us via a Google ad, we attribute a later order to that ad click. The click identifier is stored for this purpose.
Cookies: _gcl_aw and _gcl_au (90 days) and our own cookie bh_gclid (90 days).

Microsoft Advertising (Universal Event Tracking)

The same for ads on Bing: we measure whether an ad click led to an order, and transmit the pages opened, the items viewed and the order value for this purpose.
Cookies: _uetsid (30 minutes), _uetvid (13 months), _uetmsclkid (90 days) and our own cookie bh_msclkid (90 days).

Microsoft Clarity

Clarity records the course of a visit – mouse movements, clicks and scrolling – so that we can see where visitors get stuck. Entries in form fields are technically masked and not transmitted; this applies in particular to names, addresses, email addresses, telephone numbers and payment data.
Cookies: _clck and _clsk.

PostHog

PostHog analyses the use of the shop. The processing takes place on servers in the European Union.
Cookie: ph_phc_…_posthog.

Our own cookies for consent

bh-consent-google and bh-consent-microsoft (180 days each) store only your decision, so that we can observe it.

Recipients and transfer to third countries

The providers are Google Ireland Limited (Ireland) and Microsoft Ireland Operations Limited (Ireland). Processing by the parent companies Google LLC and Microsoft Corporation in the United States cannot be ruled out. Both companies are certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses under Art. 46(2)(c) GDPR are in place. Despite these safeguards, access by US authorities cannot be completely ruled out.

Withdrawal of consent

Possible at any time via the cookie settings in the footer. Processing that has already taken place remains unaffected.

4b. Anonymous audience measurement without consent

In addition to the services named in section 4a, we count ourselves how many visits arrive at which point of the shop: listing page, product page, search (including without results), basket, address entry, order summary and completed order. When a product, listing or search page is opened, your browser sends a short message to our own server containing only the page type and, on product pages, the item number – both of which are in the page you are looking at anyway. Basket, checkout and order completion are counted by our server itself when they are opened. Nothing is stored on your device and nothing is read from your device.

From the details your browser sends automatically with every request, our server derives only two coarse characteristics: whether you are using a mobile device or a desktop browser, and whether the visit came about via an ad, a free product listing, a newsletter or an AI assistant (recognisable from the page address). Your IP address is neither stored nor converted by the counter. So that reloading the same page is not counted twice, we use your browser's session, which is necessary for the basket in any case; we do not set a further cookie for this and do not store a session identifier.

Only daily totals are stored, for example “on 10/10 there were 120 visits with a mobile device that reached the basket”. We also count, per day, how often a search term returned no results (terms that look like names, addresses, numbers or email addresses are discarded beforehand; terms occurring fewer than three times are deleted after seven days), how often a form field reported an error in the checkout or a technical error occurred (without content, addresses or numbers) and – when the checkout is reached and when an order is placed – the delivery country, shipping method and value range of the basket as a total. Nobody is recognised, no usage profiles are created, and no data are transmitted to third parties.

Legal basis: as this measurement neither stores anything on your device nor reads anything from it, § 25 TDDDG does not apply. In so far as your IP address is processed briefly when the message is received, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in identifying and fixing errors and obstacles in the ordering process; your interests are safeguarded by the absence of any identifier, of any storage of the IP address and of any disclosure.
Storage period: daily totals for up to 26 months.
Objection: you can object to this processing (Art. 21 GDPR). As we do not recognise you, we cannot attribute an objection to any person. The reporting of product, listing and search pages does not take place if you disable JavaScript; the counting of basket, checkout and order by our server does not capture any personal data.

5. Customer account and registration

You can order from us without creating a customer account. If you decide on an account, we process the data you provide – in particular salutation, name, billing and delivery address, email address, and where applicable telephone number and company details – as well as your password in encrypted form.

Purpose: managing your account, viewing orders, simplified future orders.
Legal basis: Art. 6(1)(b) GDPR.
Storage period: until you delete the account. Data from completed orders remain unaffected by this and are subject to the statutory retention periods.

If you ordered as a guest and would later like to turn that into a customer account, we transfer the existing order data to your new account. This merging takes place only at your instigation.

5a. Transfer of customer accounts from the online shop “Baustoffhandel NRW”

Until the changeover to baustoff-held.de in autumn 2026, our online shop was operated under the name “Baustoffhandel NRW” (baustoffhandel-nrw.de). The controller was the same as it is today (see section 1). With the changeover to baustoff-held.de we transferred the existing customer accounts – salutation, name, address, contact details and customer number – and the associated order and invoice data into the new shop system. Order and invoice data from orders without a customer account (guest orders) were also transferred, in so far as they are subject to the statutory retention periods. This is a continuation by the same controller; no transfer to third parties takes place. Passwords were not transferred.

Legal basis: Art. 6(1)(b) GDPR for the continuation of the existing customer account, and for order and invoice data additionally Art. 6(1)(c) GDPR in conjunction with § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB). We inform the holders of transferred customer accounts about the changeover and the password to be newly set once by email; the legal basis is Art. 6(1)(b) and (f) GDPR (legitimate interest in maintaining the existing customer relationship). That message contains no advertising.
Storage period: as in sections 5 and 6. If you do not wish to continue using your transferred customer account, an informal message to info@baustoff-held.de is enough; we then delete it, in so far as no statutory retention obligations stand in the way.

Transferred customer accounts that are not used again by 31.12.2027 (no new password, no order) will be deleted. Transferred order data we delete after the statutory retention periods have expired, or anonymise them so that no reference to a person can be established any more; anonymised, we keep only which items were ordered together, in order to show matching product recommendations.

6. Order and performance of the contract

For an order we process your master and contract data: name, address, email address, telephone number, chosen payment and shipping method, items ordered, prices and the time of the order.

Purpose: performance of the contract, shipping, invoicing, customer service, handling of withdrawal and warranty.
Legal basis: Art. 6(1)(b) GDPR, and for tax retention additionally Art. 6(1)(c) GDPR.
Storage period: we keep the commercial and tax-relevant data for six, eight or ten years depending on the document (§ 147 AO, § 257 HGB). After the contract has been completed, the data are restricted for further active use and deleted once the periods have expired.

To process your order we use a merchandise management system in which orders, invoices and delivery notes are processed.

Details submitted via the online withdrawal function (“Vertrag widerrufen”) – name, email address, order number, message – we process in order to handle your withdrawal (Art. 6(1)(b) and (c) GDPR, § 356a of the German Civil Code, BGB) and confirm receipt by email.

7. Payment methods

Which data are transmitted to whom depends on the payment method chosen. In each case only the data required to process the payment are transmitted.

Advance payment, purchase on account and SEPA direct debit

With these payment methods we process your payment data – with SEPA direct debit also IBAN and mandate data – and transmit them to our bank in order to execute the payment.
Legal basis: Art. 6(1)(b) GDPR.

PayPal

If you pay via PayPal, your payment data are transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal is independently responsible for this processing. A credit and fraud check may take place, in which PayPal also involves credit agencies. You can find details in PayPal's privacy notice at paypal.com.
Legal basis: Art. 6(1)(b) GDPR.

Stripe – credit card, Apple Pay, Google Pay and other methods

For credit card payment, Apple Pay, Google Pay, SEPA direct debit via Stripe and for iDEAL, EPS, Bancontact and Przelewy24 we use Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

You enter your payment data – card details in particular – directly with Stripe. We neither receive nor store complete credit card details. Stripe transmits to us only the result of the payment and a transaction identifier. For fraud prevention, Stripe additionally processes technical data of your device. You can find details in Stripe's privacy notice at stripe.com.

Stripe may also transfer data to third countries outside the EU, in particular to the USA. The transfer takes place on the basis of the European Commission's standard contractual clauses and additional safeguards.
Legal basis: Art. 6(1)(b) GDPR, and for the third-country transfer Art. 46(2)(c) GDPR.

8. Shipping

We do not ship from a warehouse of our own. To carry out your order we transmit your name, the delivery address and – in so far as necessary for delivery notification or queries – telephone number and email address to the supplier who packs the goods on our behalf and ships them to you (currently Birtel KG, 66687 Wadern, and individual manufacturers), and to the shipping company engaged by them.
Legal basis: Art. 6(1)(b) GDPR.

To deliver your order we pass on your name, the delivery address and – in so far as required for delivery or notification – your email address and telephone number to the shipping company engaged. We work with DHL, UPS and DPD, and with freight forwarders for freight shipments.

For deliveries to countries outside the European Union we transmit the data required for customs clearance to the competent authorities and the transport service provider.

Legal basis: Art. 6(1)(b) GDPR, and for customs clearance additionally Art. 6(1)(c) GDPR.

9. Checking the VAT identification number

If you provide a VAT identification number as a business, we check its validity. For this we transmit the number and, where applicable, company name and address to:

• the German Federal Central Tax Office (BZSt) for the qualified confirmation request,
• the VAT Information Exchange System (MIAS/VIES) of the European Commission for numbers from other EU member states,
• for deliveries to Switzerland or the United Kingdom, the respective competent national body.

Purpose: correct VAT treatment, in particular for intra-Community supplies.
Legal basis: Art. 6(1)(c) GDPR in conjunction with the VAT substantiation obligations.
Storage period: we keep the result of the check within the framework of the tax substantiation obligations.

10. Quotations, enquiries and material lists

Quotations

If you request a quotation, we process your contact details and the items requested. We make a prepared quotation available to you via a personal link with which the items can be transferred straight into the basket. This link is limited in time and intended for you alone – please do not pass it on.
Legal basis: Art. 6(1)(b) GDPR.

Enquiry instead of order

For certain delivery countries we offer an enquiry instead of a direct order. In doing so we process the contact and company details you provide in order to prepare an individual quotation.
Legal basis: Art. 6(1)(b) GDPR.

Wish list and material lists

You can save items on a wish list or in a material list. If you decide to share a list, we generate a link for it. Anyone who knows this link can open the list. We recommend passing it on only to the people it is intended for.
Legal basis: Art. 6(1)(b) GDPR when used in the customer account, otherwise Art. 6(1)(f) GDPR in convenient use of the shop.

10a. Basket and reminder about uncompleted orders

Saved basket. When you put items in the basket, we store the items, quantities and prices so that your basket is still there on your next visit. The legal basis is Art. 6(1)(b) GDPR (preparation of an order). The saved basket is deleted after 90 days.

Internal analysis. We analyse at which point orders are abandoned, in order to improve our ordering process. If your email address is known to us from the ordering process, authorised staff can also see which basket belongs to your customer account. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in improving the shop. The reference to you as a person is removed after 30 days at the latest (after a reminder, or with your consent, after 90 days at the latest). You can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR), for example in your customer account under “Warenkorb-Erinnerung” or by email to info@baustoff-held.de.

Reminder about your basket (only with your consent). If you have given consent during the ordering process or in your customer account and have confirmed your email address via the confirmation link, we send you up to two emails that remind you of the items in your basket, contain a link for continuing the order and ask about the reason for abandoning it. For this we process your email address, the contents of your basket, and the time and (shortened) IP address of the consent and the confirmation as evidence. The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, via the link in every reminder, in your customer account or by email to info@baustoff-held.de. We store the evidence data until three years after the withdrawal (limitation period, Art. 17(3)(e) GDPR). Our reminders contain no tracking pixel and no links by which the opening of the email is measured.

Reminders to existing customers. If you have already ordered from us, we occasionally inform you by email about our own similar products, for example by a reminder about an uncompleted basket. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 7(3) of the German Act Against Unfair Competition (UWG); our legitimate interest is direct marketing to existing customers. You can object to this at any time and without giving reasons (Art. 21(2) GDPR), at no cost other than the transmission costs at the basic rates, for example via the link in each of these emails or by email to info@baustoff-held.de. After an objection we add your address to a suppression list, so that the objection is observed permanently.

Payment reminder with advance payment. If you ordered by advance payment and your payment has still not arrived after a few working days, we remind you once by email with our bank details. The legal basis is Art. 6(1)(b) GDPR (performance of the contract).

11. Contacting us

If you reach us via the contact form, by email or by telephone, we process your details in order to handle the enquiry and in case of follow-up questions.

Our contact form is protected by a technical spam prevention method that works without involving external services and without processing additional personal data.

Legal basis: for contract-related enquiries Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR in answering enquiries.
Storage period: we delete the enquiries as soon as they have been dealt with conclusively and no retention obligations stand in the way.

12. Newsletter

To receive our newsletter we need your email address. Registration uses the double opt-in procedure: after you register we send you an email with a confirmation link. Only after your confirmation do we add you to the distribution list. We log the time of registration, the time of confirmation and the IP address in order to be able to prove the registration.

Legal basis: Art. 6(1)(a) GDPR. For the logging, Art. 6(1)(c) GDPR.
Withdrawal: you can unsubscribe at any time – via the unsubscribe link in every newsletter or by sending us a message. After you unsubscribe we delete your data from the distribution list.

13. Product reviews

You can review products in our shop. We publish the review with the name you provide; we recommend not using your full real name. We do not publish your email address.

After delivery we send you a single email asking you to review the items you bought. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG (marketing to existing customers); you can object to this at any time, most easily via the link in the email. The review link is tied to your order; we store the review with a shortened name.

Legal basis: Art. 6(1)(a) GDPR.
Withdrawal: you can request the deletion of your review at any time.

14. Recipients and storage periods at a glance

We pass on personal data only in so far as this is necessary for the performance of the contract, you have given your consent, or we are legally obliged to do so. The recipients are in particular:

• our hosting service provider (processor)
• payment service providers and banks
• shipping companies and freight forwarders
• tax advisers and, in the event of an audit, the tax authorities
• authorities within the scope of legal obligations
• providers of the audience measurement and advertising services under section 4a, in so far as you have given your consent

We have concluded contracts under Art. 28 GDPR with processors.

As a guide to the storage period:

• server log files: at most 30 days
• contact enquiries: until conclusive handling
• customer account: until you delete it
• newsletter: until you unsubscribe
• basket analysis: personal reference removed after 30 days at the latest (after a reminder, or with consent, 90 days); evidence of consent until three years after withdrawal
• order, invoice and accounting data: six, eight or ten years depending on the document (§ 147 AO, § 257 HGB)
• cookies for audience measurement and advertising: 30 minutes to 24 months, individually listed in section 4a

15. Your rights

You have the following rights against us with regard to the personal data concerning you:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate or incomplete data (Art. 16 GDPR)
• erasure (Art. 17 GDPR), in so far as no retention obligations stand in the way
• restriction of processing (Art. 18 GDPR)
• data portability in a commonly used, machine-readable format (Art. 20 GDPR)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to the contact details given in section 1 is enough.

16. Right to lodge a complaint with a supervisory authority

Without prejudice to other remedies, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf
www.ldi.nrw.de

17. Obligation to provide data

Providing your data is neither legally nor contractually required. However, to conclude a contract of sale we need the details required to carry it out. Without these data we cannot execute your order.

18. No automated decision-making

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Payment service providers may carry out credit and fraud checks under their own responsibility; the respective providers give information about this in their privacy notices.

19. Links to other websites

Our pages contain links to the websites of other providers. We have no influence over their content or their data processing. The privacy notices of the respective provider apply to those.

20. Changes to this privacy policy

We adapt this privacy policy when our offerings or the legal requirements change. The version available on this page applies in each case. This English version is a translation provided for your convenience; the legally binding version is the German one at www.baustoff-held.de/datenschutz.