Privacy policy

1. Controller

The controller within the meaning of Article 4(7) GDPR is:

Herdi GmbH
Altcrange 19
44653 Herne
Email: info@herdi-group.de

No data protection officer has been appointed under section 38(1) BDSG (German Federal Data Protection Act); appointment is not mandatory for a company with our number of staff.

2. General information on data processing

We process visitors’ personal data only insofar as it is necessary to provide a functioning website and our content and services. Processing is based on Article 6(1) GDPR, in particular point (a) (consent), point (b) (contracts and enquiries) and point (f) (legitimate interests).

3. Hosting (Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit the website, technically necessary data is processed in server log files (IP address, date and time, browser and operating system information, referrer URL and volume of data transferred). Vercel automatically deletes the logs after no more than 30 days.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in technically reliable delivery). We have a data processing agreement (DPA) with Vercel pursuant to Article 28 GDPR.

Vercel is based in the USA. Data transfers to the USA rely on two safeguards: Vercel is a certified member of the EU-US Data Privacy Framework (DPF), for which the European Commission has established an adequate level of protection (adequacy decision of 10 July 2023, Article 45 GDPR). In addition, EU Standard Contractual Clauses are used (Article 46(2)(c) GDPR). This website is served primarily through Vercel’s Frankfurt region (fra1).

DPA: vercel.com/legal/dpa

4. Contact and enquiry form

Our enquiry form collects the following data: company name, location, the contact person’s name and role, phone number, email address, information on the plant or component type, material and welding process, and optionally a specification file (drawing or photo). We use this data solely to process your enquiry.

Legal basis: Article 6(1)(b) GDPR (steps prior to entering into a contract at the request of the data subject). The data is sent by email to info@herdi-group.de. We delete it once it is no longer needed to process your enquiry and no statutory retention obligation applies. We retain received business correspondence, including emails, for six years (section 257(1) no. 2 and (4) HGB, German Commercial Code), and documents relevant to taxation for up to ten years (section 147 AO, German Fiscal Code).

Certificate requests. The “Request certificates” dialog collects your email address and selection so that we can send the documentation you request. Legal basis: Article 6(1)(b) GDPR. Emails are sent through Resend (section 5). We delete the data once the request is completed, unless statutory retention obligations apply.

To prevent misuse of either form, we store a hash of your IP address and email address in the server’s working memory to count requests over a ten-minute period. After that period, it is deleted the next time a form is used, or at the latest when the server restarts (Article 6(1)(f) GDPR).

5. Email delivery (Resend)

We use Resend, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA, to send enquiry and confirmation emails. We have a data processing agreement (DPA) with Resend pursuant to Article 28 GDPR.

Resend stores data in the USA. Only the data entered in the forms is transferred. Email content and delivery logs are stored there for 30 days. Resend is certified under the EU-US Data Privacy Framework (Article 45 GDPR); EU Standard Contractual Clauses also apply (Article 46(2)(c) GDPR).

DPA: resend.com/legal/dpa

6. Cookies

We use technically necessary cookies and browser storage required to operate this website, for example to save your cookie consent in the localStorage entry herdi-consent-v1. Legal basis: Article 6(1)(f) GDPR and section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act; strictly necessary to provide a service expressly requested by the user).

We store your choice of light or dark theme in the localStorage entry herdi-ansicht, also under section 25(2) no. 2 TDDDG.

With your express consent, we also use optional statistics cookies (Article 6(1)(a) GDPR, section 25(1) TDDDG). You can withdraw consent at any time using the Cookie settings link in the footer.

7. Google Analytics 4 (optional, with consent)

If you consent to “Statistics”, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor. Data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Your browser loads the Google script and sets cookies only after you consent.

We collect: page views; scroll depth (25, 50, 75 and 90 per cent); button clicks and clicks on phone and email links (only the type of click); form starts and submissions with success or error, without your entries; opening of the certificate request dialog; technical details such as device, browser, screen size, approximate location (country, region, city) and referring page. According to Google, Google Analytics 4 does not store IP addresses.

Retention: the _ga and _ga_… cookies are stored for up to two years. In Google Analytics, we retain event data for two months and user data for no more than 14 months. Google Signals and linking to Google Ads are disabled. Legal basis: section 25(1) TDDDG and Article 6(1)(a) GDPR. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023, Article 45 GDPR). We use Google Consent Mode v2: without consent, all storage types for statistics, advertising and personalisation are set to “denied”; only storage necessary for security is permitted. When you withdraw consent, we disable Google Analytics on the current page and in other open tabs and delete Google cookies. You can withdraw consent at any time with effect for the future using the Cookie settings link in the footer.

8. Your rights

You have the following rights in relation to your personal data held by the controller:

• Right of access (Article 15 GDPR)
• Right to rectification (Article 16 GDPR)
• Right to erasure (Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability (Article 20 GDPR)
• Right to object to processing (Article 21 GDPR)
• Right to withdraw consent for future processing (Article 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Article 77 GDPR; competent authority in NRW: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2 bis 4, 40213 Düsseldorf)

9. Withdrawing consent

You can withdraw or adjust your cookie consent at any time with effect for the future using the Cookie settings link in the footer.

Open cookie settings

10. Changes to this privacy policy

We reserve the right to update this privacy policy to reflect changed legal requirements or changes to our services. The current privacy policy will apply when you visit again.