Skip to content

Advent begins on 29 NovemberRegister interest, no obligation

Tannenglanz

Privacy

Only the German version is legally binding. This English translation is provided for convenience.

Read the German version

Version: 12 October 2026. The German version is the binding one.

1. Controller

Tannenglanz – Daniel Klöster, Vincent Smith, Dominik Gerstner, Severin Gutmann (partnership under German civil law (GbR), in formation)
Am Helleberg 10, 65779 Kelkheim (Taunus), Germany
Email: info@tannen-glanz.de · Contact form

The partnership has not yet been founded; the partners Daniel Klöster, Vincent Smith, Dominik Gerstner, Severin Gutmann are jointly responsible. We have not appointed a data protection officer because, as far as we know, we are not required to (Section 38 BDSG).

2. In brief

3. Hosting, server logs and storage locations (Cloudflare)

This website runs on the platform of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Workers). Cloudflare is our processor (Art. 28 GDPR). On every request Cloudflare processes technically necessary connection data, mainly your IP address, date and time, the address requested and the browser type, in order to deliver the page, repel attacks and keep the service stable. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR). Cloudflare keeps the operational logs (Workers Logs) for at most 3 days. We do not store your IP address ourselves (see section 10).

Our own data (registrations, measurement data, short links, error log) is kept in a Cloudflare D1 database in the EU jurisdiction, our images in a Cloudflare R2 store, also in the EU jurisdiction. Content is delivered through Cloudflare’s global network, which may involve a transfer to the USA based on the EU-US Data Privacy Framework adequacy decision (Art. 45 GDPR) and the standard contractual clauses in Cloudflare’s data processing agreement. Cloudflare is certified under the Data Privacy Framework; the database and the images are stored in the EU (EU jurisdiction).

4. Cookies, device storage and third parties

The public pages set no cookies and use neither local storage nor session storage. Only the password-protected internal area of our team uses a technically necessary login cookie. All fonts, images and scripts come from our own address or our storage at Cloudflare; there are no third-party scripts. We therefore do not currently need a consent banner. Should we later embed third-party services, we will do so only with your express consent and will update this notice beforehand.

5. Registration of interest (with confirmation by email)

By registering interest you tell us, without obligation, that you are interested in our sets. You buy nothing, and we are not selling anything at the moment. We want to find out whether there is enough interest, and to inform you once as soon as it works out.

Data: first name (required), last name (optional), email address (required), the configuration you designed including personalisation lettering (as a stored short link; not applicable to the waiting list), language of the page, time of registration, version of the consent text (currently 2026-10-12.1) and time of consent, time of confirmation, for registrations by the early-bird deadline its percentage and deadline, and the random session ID (see section 8). The first name is used to address you personally in our emails (“Hello Anna”). We do not need your last name for that, which is why it is optional. Without an email address and first name we cannot accept the registration.

Purpose: to accept and confirm your registration, to gauge interest and to inform you once by email as soon as it works out (with final price, delivery date and a link to your selection).

Legal basis: your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG for the one-off information email), given by ticking the box in the form. We store the proof of consent (text version, time, confirmation) on the basis of Art. 7(1) GDPR and Art. 6(1)(f) GDPR. You can withdraw your consent at any time with effect for the future (section 14); this does not affect the lawfulness of processing before withdrawal.

Double opt-in: We send you a confirmation email with a link valid for 7 days. Your registration only counts once you click (more precisely: press the button on the confirmation page). We delete unconfirmed registrations after 30 days. The confirmation email contains no advertising.

Retention: confirmed registrations, including the stored short link, for up to 6 months after the end of the season (31 January), i.e. for a registration in October 2026 until 31 July 2027; we then delete them automatically (hourly maintenance). We delete them sooner if you unsubscribe via the link in the information email or ask us to.

No newsletter: We do not send a newsletter. Apart from the confirmation email and a one-off information email as soon as it works out, we do not write to you in connection with your registration.

6. Contact form and emails to us

If you write to us through the contact form, we process your name, email address and message in order to answer it. The form sends the message by email (via Brevo, section 7) to our team mailbox; there is no separate database for contact messages. To protect against spam there is an invisible field and a limit on requests per time window (section 10). The same applies if you email us directly.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to a registration or a later contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). Retention: until the enquiry is dealt with and statutory periods require nothing else, at most 6 months after completion. Our team mailbox info@tannen-glanz.de is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, which stores the messages and the short notifications in section 7 on our behalf as a processor (Art. 28 GDPR).

7. Email delivery (Brevo) and notification of the team

Confirmation emails, the one-off information email and contact messages are sent for us by Brevo (Sendinblue SAS, Paris, France) as our processor (Art. 28 GDPR). Brevo processes recipient address, sender, subject, content and delivery status for this. We hand Brevo no contacts or lists; only the individual send is triggered. Brevo stores the data on servers in the EU (France, Germany, Belgium). Brevo counts delivery, opens and clicks of the emails only anonymously in aggregate statistics, without reference to you.

In our own send log we keep the recipient, template, subject and status of each email (without content) for 30 days to detect delivery problems. The log is deleted along with the rest when data is erased by email address.

For every confirmed registration we also send a short internal email to our team mailbox with package, height and a running number. It contains neither your email address nor your name. Legal basis: Art. 6(1)(f) GDPR (overview of interest).

8. Audience measurement (our own, without cookies)

To understand which sets, colours, finishes and sizes are in demand and where the operation gets stuck, we measure usage ourselves, exclusively on our own server, without third parties and without passing data on.

How: Events of a visit to the configurator carry a random session ID that lives only in your browser tab’s memory. If you reload or open a new tab, a new one is created; there are no cookies, no local storage, no recognition beyond the visit and no cross-device matching. In the measurement we store neither your IP address nor your browser’s user agent, no screen or device characteristics, and we do no fingerprinting. Because our server technically sees your IP address on receipt, we speak of “pseudonymous, without recognition” rather than “anonymous”.

Purpose and legal basis: product and range planning, usability, troubleshooting; no advertising. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). We do not read any information from your device (no device, browser or screen data) and store nothing on it; only your selection steps in the configurator are transmitted. You can switch the measurement off at any time.

Link to the registration: If you register interest, we store the session ID with the registration to see which paths lead to a registration. The measurement data of that one session can thereby be attributed to your registration and is deleted along with it. The measurement data does not contain your name.

Retention: raw measurement data and page views 395 days (about 13 months), error log 30 days.

Objection (Art. 21 GDPR): at any time. If your browser sends the Global Privacy Control (GPC) signal, we store no measurement data and no page views from you. For the current visit you can also switch the measurement off here:

Applies to this visit (until you reload).

9. Sharing by short link and shortlist

If you tap “Create short link” or “Save”, we store the configuration (with lettering, if any) under a random code. The link contains no name. The shortlist can only be reached via its link; we do not remember it on your device. We count visits to a short link. We delete stored configurations 180 days after the last visit; if a configuration belongs to a registration, it stays as long as the registration. Legal basis: Art. 6(1)(b) or (f) GDPR (function you asked for). The configurator address (?c=…) contains your configuration in encoded form, including lettering; it therefore appears in your browser history and in server logs. Please use the short link for sharing.

10. Protection against misuse

To protect forms and interfaces against spam and overload, we form a check value from your IP address (SHA-256 with a random secret that is regenerated every day) and use it to count requests per time window. We do not store the IP address itself. We delete check values and secrets after about 24 hours at the latest; after that, check values can no longer be attributed. Legal basis: Art. 6(1)(f) GDPR. The invisible fields in the forms serve the same purpose.

11. Error log and internal area

We keep technical errors (type of error, page, a shortened message without email addresses and identifiers) for 30 days to notice faults and lost registrations (Art. 6(1)(f) GDPR). Our team members see the registrations in a password-protected area; information requests, deletions, exports and maintenance are logged there without email addresses (13 months) to be able to trace who did what (Art. 5(2) GDPR).

12. Recipients and third countries

Recipients of your data are: Cloudflare (hosting, database, image storage), Brevo (email delivery), Google (team mailbox, section 6) and the members of our team. A transfer to a country outside the EU/EEA is possible with Cloudflare (USA) and possibly Google, and is based on the EU-US Data Privacy Framework (Art. 45 GDPR) or standard contractual clauses (Art. 46 GDPR). Beyond that we pass no data on to third parties unless legally obliged.

13. No automated decision-making

There is no automated decision-making, including profiling, under Art. 22 GDPR.

14. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You can withdraw a given consent at any time: via the unsubscribe link in our information email or informally by email to info@tannen-glanz.de or through the contact form. We will then delete your registration together with the stored configuration, send log and linked measurement data. A short message with the email address you registered with is enough for access and erasure.

You may also lodge a complaint with a data protection supervisory authority. The competent one for us (provisionally, given the controller’s address in Hesse) is: the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Wilhelmstraße 7, 65185 Wiesbaden (since 16 March 2026; PO box 3163, 65021 Wiesbaden unchanged), datenschutz.hessen.de.