Privacy policy

1. Controller

Storeline Consulting GmbH
Erlengrund 16, 49179 Ostercappeln, Germany
Managing Directors: Patrick Petry, Jennifer Petry, Joel Petry
Email: info@storeline-consulting.de

See our Imprint for full company details, including our commercial register entry and VAT identification number.

We are not required to appoint a data protection officer under Art. 37 GDPR or § 38 BDSG. For any question concerning your personal data, please use the contact details above.

2. General information on data processing

The protection of your personal data is important to us. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Personal data is only processed where this is legally permitted or where you have given your consent.

3. Hosting and server log data

This website is hosted by 1&1 IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, which acts as our processor under a data processing agreement pursuant to Art. 28 GDPR.

When you visit this website, the browser on your device automatically sends technical information to the server, which is temporarily stored in a log file. This includes:

• the IP address of the requesting device;
• date and time of the request;
• the name and URL of the file retrieved;
• the website from which access is made (referrer URL); and
• the browser used and, where applicable, the operating system of your device.

This data is processed to ensure a smooth connection, a comfortable use of our website, and the security and stability of our systems. The legal basis is Art. 6(1)(f) GDPR (legitimate interest). This data is not merged with any other data source and is deleted after 14 days.

4. Fonts

This site uses the Montserrat and Open Sans typefaces. These fonts are delivered together with the website by our hosting provider (see section 3). They are not loaded from Google Fonts or any other third-party font service, so no separate font request and no transmission of your IP address to a font provider takes place.

5. The "Tell us about your product" form

When you submit the "Tell us about your product" form, the data you enter (your name, email address, industry and message) is sent to our web server at our hosting provider (see section 3). No third-party script is loaded to display the form, and no tracking or CAPTCHA service is used. To keep out automated spam, the form contains a hidden field that people do not see, and we temporarily store a one-way hash of your IP address for up to one hour to limit the number of submissions.

Your enquiry is then emailed to us via 1&1 IONOS SE (see section 6) and transferred to our customer-relationship-management (CRM) system, provided by Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia, where it is stored on our behalf under a data processing agreement pursuant to Art. 28 GDPR. We use this data to assess your enquiry and to contact you about it.

Pipedrive stores data within the European Union. Where Pipedrive engages sub-processors outside the European Economic Area, appropriate safeguards under Chapter V GDPR apply (see section 8).

Legal basis. Art. 6(1)(b) GDPR (taking steps prior to entering into a contract at your request) and, where no contract results, our legitimate interest in handling and following up on business enquiries (Art. 6(1)(f) GDPR).

Provision of data. Providing the data marked as mandatory in the form is necessary for us to process your enquiry. There is no statutory or contractual obligation to provide it, but without it we cannot respond. You are free to contact us by email instead (see section 6).

Retention. We retain enquiry data for as long as necessary to handle your request and to pursue any resulting business relationship. Where a business relationship results, statutory German commercial and tax retention periods apply (generally between six and ten years, depending on the document type). Enquiries that do not lead to a business relationship are deleted no later than 12 months after the last contact.

For details on Pipedrive's own processing as a controller, see Pipedrive's privacy policy at pipedrive.com/en/privacy.

6. Contacting us by email or telephone

If you contact us by email or telephone, the data you provide (including your name, contact details and the content of your message) is stored and processed by us in order to handle your request. Our email is hosted by 1&1 IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, acting as our processor under Art. 28 GDPR. Enquiries received by email may be transferred into our CRM system (see section 5) for further processing.

The legal basis is Art. 6(1)(b) GDPR where your message relates to a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). The retention rules in section 5 apply accordingly.

7. Cookies and analytics

Strictly necessary storage. To remember whether you accepted or declined analytics, we store your choice in your browser's local storage under the name storeline-consent. This is strictly necessary to respect your decision and is based on § 25(2) TDDDG; it does not require your consent. The entry stays until you clear your browser data.

Google Analytics 4 (only with your consent). If you click "Accept" in the cookie banner, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Without your consent, Google Analytics is not loaded and no data is sent to Google.

Google Analytics helps us understand how visitors use this website, for example which pages are viewed, how visitors arrive here and whether the enquiry form is sent, so that we can improve the content. For this purpose, Google Analytics sets the cookies _ga and _ga_<ID> (storage period: up to 2 years) and processes usage data such as pages visited, time and duration of the visit, referring website, approximate location (country, region, city), device type, browser and operating system. Your IP address is used by Google to determine the approximate location; according to Google, IP addresses are not logged or stored in Google Analytics 4 for users in the EU. We do not merge this data with other data about you and do not use it to identify you.

The legal basis is your consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by clicking "Cookie settings" at the bottom of every page and choosing "Decline"; the Google Analytics cookies are then deleted.

We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR. Google may also process data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). Data collected by Google Analytics is deleted after 14 months. Further information: Google Privacy Policy and Google Analytics and data protection.

8. Data recipients and international transfers

We do not sell personal data. It is not disclosed to third parties unless you have expressly consented, disclosure is legally permitted, or it is required to fulfil a contractual obligation.

Beyond that, data may be shared with service providers who process it on our behalf and under a data processing agreement pursuant to Art. 28 GDPR. These currently are:

• 1&1 IONOS SE, Germany, for hosting (section 3) and email (section 6);
• Pipedrive OÜ, Estonia, for enquiries submitted through the form (section 5);
• Google Ireland Limited, Ireland, for Google Analytics, only if you have consented (section 7).

Where one of these providers engages a sub-processor that processes data outside the European Economic Area, an appropriate safeguard under Chapter V GDPR is in place before any transfer takes place, in particular the European Commission's Standard Contractual Clauses or an adequacy decision.

9. Data security

We use SSL/TLS encryption for this website in the highest strength supported by your browser, so that data you transmit to us cannot be read by third parties in transit.

10. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

11. Your rights

Under the GDPR, you have the right to:

• request access to the personal data we hold about you (Art. 15);
• request correction of inaccurate data (Art. 16);
• request erasure of your data (Art. 17);
• request restriction of processing (Art. 18);
• receive your data in a portable format (Art. 20); and
• withdraw, at any time, any consent you have previously given (Art. 7(3)), without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, contact us using the details in section 1.

Right to object (Art. 21 GDPR). Where we process your personal data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to that processing at any time on grounds relating to your particular situation. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. An objection requires no particular form and can be sent to the contact details in section 1.

Right to lodge a complaint. You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany. You may also contact the supervisory authority in your own country of residence or place of work.

12. Current version and changes to this policy

This privacy policy is valid as of October 2026. We may update it as the website or our processing activities change, to ensure it always meets current legal requirements. The version published here is always the current one.