Privacy Policy
This privacy policy informs you, in accordance with Art. 13 and Art. 14 of the General Data Protection Regulation (GDPR) and Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), which personal data we process when you visit this website, for what purpose, and what rights you have.
Scope
This policy covers the use of this website only. Separate privacy information applies to processing within our business relationships, that is the initiation and handling of orders as well as supplier and applicant data. We provide that information on request or in the course of the respective business relationship.
We do not sell personal data and do not pass it on to third parties for advertising purposes.
1. Controller
The controller within the meaning of the GDPR is Hauler & Hermann GmbH, Neuffener Weg 25, 70794 Filderstadt, Germany.
Managing directors: Joachim Hauler and Yannick Wille. Commercial register: Stuttgart Local Court, HRB 222653. VAT identification number: DE147820238.
Phone: (+49) 0 71 58 / 90 90-30, fax: (+49) 0 71 58 / 90 90-50, email: info@hauler-hermann.de.
For any questions about data protection, to exercise your rights or for any other data protection matter, you can contact this address at any time.
2. Principles of processing
2.1 Legal bases
Where we obtain consent, the legal basis is Art. 6(1)(a) GDPR. For storing information on your device and accessing it, Section 25(1) TDDDG applies in addition.
Where we process data to perform a contract or to take pre-contractual steps, for example when you send an enquiry through our contact form, the legal basis is Art. 6(1)(b) GDPR.
Where we are legally obliged to process data, for example due to commercial or tax retention periods, we rely on Art. 6(1)(c) GDPR.
Where we process data to protect legitimate interests, the legal basis is Art. 6(1)(f) GDPR. Wherever we rely on this, we name the interest in the relevant section.
2.2 Storage period and deletion
We delete personal data as soon as the purpose of processing no longer applies and no statutory retention obligation prevents deletion. We name the specific periods in the respective sections. Where a retention obligation applies, in particular under Section 257 HGB and Section 147 AO, we restrict processing instead of deleting.
2.3 Recipients and processors
We use the following service providers to operate this website. All of them act as processors under Art. 28 GDPR, and a data processing agreement is in place with each of them.
| Service provider | Location | Service | Legal basis |
|---|---|---|---|
| Vercel Inc. | Walnut, California, USA | Hosting and delivery of the website | Art. 6(1)(f) GDPR |
| Plus Five Five, Inc. (Resend) | San Francisco, USA, processing on servers in Ireland | Delivery of contact form messages to us | Art. 6(1)(b) and (f) GDPR |
| Google Ireland Limited | Dublin, Ireland | Google Analytics 4 and Google Tag Manager | Art. 6(1)(a) GDPR |
| Neon Inc. | USA, processing on servers in Frankfurt am Main | Database for the statistical evaluation of enquiries | Art. 6(1)(f) GDPR |
2.4 Transfers to third countries
Vercel Inc. and Google LLC in the USA are certified under the EU-US Data Privacy Framework. Transfers to these companies are therefore covered by an adequacy decision of the European Commission under Art. 45 GDPR.
Contact form messages are delivered by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, which operates the Resend service. Processing takes place on servers in Ireland and therefore within the European Union. Where access from the USA nevertheless occurs in an individual case, it is covered by the European Commission Standard Contractual Clauses under Art. 46(2)(c) GDPR.
We point out that US authorities may access data under certain conditions and that legal protection fully equivalent to European standards is not guaranteed there in every case.
3. Visiting the website
3.1 Server log files
Every time this website is accessed, data transmitted by your browser is collected automatically:
- IP address of the requesting device
- Date and time of access
- Address requested and HTTP status code
- Volume of data transferred
- Previously visited page, where transmitted
- Browser type and version
- Operating system
3.2 Purpose and retention of log data
This data is technically necessary to deliver the website to you. It is stored in the log files of our hosting provider and serves operational security, error analysis and the defence against attacks. This constitutes our legitimate interest under Art. 6(1)(f) GDPR.
This data is not combined with other data sources and is not evaluated for advertising purposes. Log data is deleted after 30 days at the latest.
3.3 Hosting
This website is hosted on the platform of Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Delivery takes place via the provider global network, with requests from Europe generally served from European locations. Vercel processes the data listed under 3.1 on our behalf.
3.4 Fonts, images and video
All fonts on this website are served from our own server. There is no connection to Google Fonts or any other external font provider, and no IP address is transmitted to third parties in the process.
The same applies to all images, our company film and the certificates offered for download. This content resides on our own server. In particular, we do not embed videos from YouTube or other video platforms.
4. Cookies and consent
A cookie is a small text file stored on your device. We distinguish two cases.
4.1 Strictly necessary cookie
We set a single cookie without your consent:
| Name | Purpose | Content | Lifetime |
|---|---|---|---|
| cookie_consent | Stores your decision made in the cookie banner so that we do not have to ask you again on every visit | only the value accepted or rejected | 180 days |
4.2 Legal basis for the necessary cookie
This cookie contains no identifier that makes you identifiable and is not used for analysis. It is strictly necessary so that we can document and respect your data protection decision. The legal basis is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR.
4.3 Cookies that require consent
All other cookies and comparable technologies are only set after your express consent through the cookie banner. As long as you have not consented, the services concerned are not loaded at all. Before your consent there is therefore no connection to their servers and no transmission of your IP address.
4.4 Withdrawal and refusal
You can withdraw consent at any time with effect for the future. You will find the Cookie settings entry in the footer of every page.
If you refuse or withdraw, analytics cookies already set are actively deleted from your device. The lawfulness of processing carried out before withdrawal remains unaffected.
5. Reach measurement
5.1 Google Tag Manager
We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is a tool for managing website components. It does not itself set cookies or collect personal data, but it delivers the analytics described under 5.2.
Tag Manager is only loaded after your consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
5.2 Google Analytics 4
After your consent we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics uses cookies that enable an analysis of your use of this website. The data collected includes the pages visited, time spent, approximate geographic origin, browser and operating system used, and the page from which you reached us. Google Analytics 4 truncates your IP address before any storage and does not combine it with other data.
We use this evaluation solely to understand the use of our website statistically and to improve our content. We do not create user profiles assigned to a specific person and do not use features for personalised advertising.
The cookies typically set are _ga and _ga with an identifier, each with a lifetime of up to two years, and _gid with a lifetime of 24 hours. Usage data stored in Google Analytics is deleted automatically after 14 months.
The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
In addition to withdrawing consent through our cookie settings, you can prevent collection by Google Analytics in general by installing the browser add-on offered by Google. Further information on how Google handles user data is available in the Google privacy policy.
6. Contacting us
6.1 Contact form
You can reach us through a contact form on our website. In doing so we process:
- your name, if you provide it
- your email address, so that we can reply to you
- your message
- the page from which you submitted the form, so that we can route your enquiry to the right specialists
6.2 Legal basis and retention
The details are transmitted by email to our order processing team and handled there. Technical delivery is carried out by our processor Plus Five Five, Inc., operator of the Resend service, on servers in Ireland.
If your enquiry aims at concluding or preparing a contract, the legal basis is Art. 6(1)(b) GDPR. In all other cases we process your details on the basis of our legitimate interest in answering enquiries under Art. 6(1)(f) GDPR.
We delete your enquiry with all personal details it contains once it has been dealt with conclusively and no statutory retention periods apply. For enquiries without a business context this is regularly the case after six months at the latest. If your enquiry leads to a business relationship, the commercial and tax retention periods of six and ten years respectively apply.
Independently of this, we store the statistical entry described under 6.5, which contains no personal details, for a maximum of 24 months.
6.3 Protection against misuse
To prevent automated bulk submissions through the form, we briefly check the number of requests per IP address on submission. The IP address is processed solely in the memory of our server, is not stored permanently and is not combined with your message. The form also contains a field invisible to you that is only filled in by automated programs. The legal basis is our legitimate interest in the security and functioning of our systems under Art. 6(1)(f) GDPR.
6.4 Contact by email, phone and fax
If you contact us directly by email, phone or fax, we process the details transmitted in order to handle your request. Legal basis and deletion periods correspond to 6.2.
6.5 Statistical evaluation of enquiries
In order to understand which pages of our website generate enquiries, we store a separate statistical entry for every enquiry sent. It consists solely of the time of submission, the address of the page it was sent from, and the language version.
Your name, email address, message and IP address are not stored in this entry. It is kept separately from your enquiry and is not linked to it. We evaluate it only in aggregate, for example the number of enquiries per page and month.
The legal basis is our legitimate interest in measuring and improving the performance of our website under Art. 6(1)(f) GDPR. Entries are deleted automatically after a maximum of 24 months.
The database is operated on our behalf by Neon Inc. on servers in Frankfurt am Main.
7. Job applications
Please send applications by email to bewerbung@hauler-hermann.de or by post to Hauler & Hermann GmbH, attn. Tamara Straub, Neuffener Weg 25, 70794 Filderstadt, Germany.
We process the application documents you submit solely for the purpose of the application procedure. The legal basis is Section 26(1) sentence 1 BDSG in conjunction with Art. 88 GDPR and Art. 6(1)(b) GDPR.
If no employment relationship results, we delete your documents no later than six months after the procedure has been completed. This period accounts for possible claims under the German General Equal Treatment Act. Longer retention, for example for future vacancies, only takes place with your express consent under Art. 6(1)(a) GDPR, which you can withdraw at any time.
Please do not send application documents through the general contact form, as it is routed to our order processing team.
8. External links and social media profiles
Our website contains links to our company profiles on Facebook and LinkedIn. These are plain links, not embedded content or social media plugins. As long as you do not click such a link, no data is transmitted to the respective provider.
Only when you click the link do you reach the pages of the respective provider, for whose data processing we bear no responsibility. The same applies to all other external links on our website.
9. Your rights
You have the following rights towards us. An informal message to the contact details given under section 1 is sufficient to exercise them.
- Access under Art. 15 GDPR: you can request information on whether and which personal data we process about you, for what purposes, for how long, to which recipients and from which source.
- Rectification under Art. 16 GDPR: you can request the correction of inaccurate data and the completion of incomplete data.
- Erasure under Art. 17 GDPR: you can request the deletion of your data, provided no statutory retention obligation or other ground for exclusion applies.
- Restriction of processing under Art. 18 GDPR: under certain conditions you can request that we only store your data and no longer use it.
- Notification under Art. 19 GDPR: if we have passed your data on to recipients, we inform them of every rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort.
- Data portability under Art. 20 GDPR: you can request that we hand over data you provided to us on the basis of consent or a contract in a common, machine-readable format.
- Withdrawal of consent under Art. 7(3) GDPR: you can withdraw consent at any time with effect for the future, without affecting the lawfulness of processing carried out beforehand.
- Objection under Art. 21 GDPR: you have the right to object at any time, on grounds relating to your particular situation, to processing of your data based on Art. 6(1)(f) GDPR. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish or defend legal claims.
10. Right to lodge a complaint
Without prejudice to other remedies, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Wuerttemberg, Lautenschlagerstrasse 20, 70173 Stuttgart, Germany, phone (+49) 0711 615541-0, email poststelle@lfdi.bwl.de.
You may also contact the supervisory authority of your habitual residence or place of work.
11. No automated decision making
We do not use automated decision making or profiling within the meaning of Art. 22 GDPR. Your enquiries are handled by people.
12. Data security
This website is transmitted exclusively in encrypted form. We use TLS encryption, recognisable by https and the lock symbol in your browser, and instruct browsers via HTTP Strict Transport Security to connect only in encrypted form.
In addition we use a Content Security Policy and further security measures in the delivery process which make it harder to inject foreign content or to read out data by third parties. We continuously adapt our technical and organisational measures to the state of the art.
13. Currency and changes to this privacy policy
This privacy policy is dated 31 August 2026.
Further development of our website, changed legal requirements or requirements imposed by authorities may make it necessary to amend this policy. The current version is available on this page at any time.