Free shipping from €80 within Germany Handmade in Crimmitschau, Saxony For dealers DEEN
My account Shopping cart

Privacy Policy

This English translation is provided for convenience only. The German version is legally binding.

This notice describes which data this website (ERM Holzmanufaktur, operated by ERM scs GmbH) actually processes from a technical standpoint.

1. Controller

ERM scs GmbH (ERM Holzmanufaktur)
Fichtestraße 1-4, 08451 Crimmitschau
Email: kontakt@e-r-m.de · Phone: 03762 9470440

2. Hosting and Server Log Files

When this website is accessed, the web server automatically collects the date and time of access, the page accessed, the amount of data transferred, browser type/version, operating system, referrer URL, and the (shortened or full) IP address. This data is used for the technical provision and security of the website (Art. 6 Abs. 1 lit. f GDPR) and is stored in server log files. The hosting provider and the exact retention period will be added here once the website is running live with a hosting provider; in the local test environment, no log files are generated at an external provider.

3. Cookies

This website and the online shop use only technically necessary cookies (Art. 6 Abs. 1 lit. f GDPR or § 25 Abs. 2 TDDDG), no tracking, analytics or marketing cookies, and no third-party cookies:

  • grav-site (website session cookie): form protection (CSRF) and language setting; deleted when the session ends.
  • OCSESSID (shop session cookie): required for the shopping basket, checkout and login to the customer account; deleted when the session ends.

No external fonts, analytics/tracking services or advertising networks are used. Videos and social media profiles are embedded in a privacy-friendly manner (see section 9).

4. Orders (End Customers and Dealers)

To process an order we process name, address, email address, phone number, company and VAT ID (where applicable), and the order data (products, quantities, prices, payment method). The legal basis is the performance or initiation of a contract (Art. 6 Abs. 1 lit. b GDPR). The data is stored for the duration of the statutory retention periods (generally 6–10 years under commercial and tax law). Order data is stored in the shop database (MariaDB) on the server and is not publicly accessible.

5. Customer Database

In addition to individual orders, we maintain a customer database in which contact details, billing/delivery address, VAT ID (for dealers), order history, and classification as an end customer or dealer are stored. This database is used to process current and future orders, for dealer management (discount, payment terms) and for customer support (Art. 6 Abs. 1 lit. b and f GDPR). Only authorised staff of ERM scs GmbH have access; the database is located exclusively on this website's server and is not transferred to third parties.

6. Payment Processing

  • Payment in advance (bank transfer): We only provide our bank details and your order number as the payment reference; you carry out the transfer itself through your own bank, and we are not the controller in that respect.
  • secupay AG (Goethestraße 6, 01896 Pulsnitz, Germany): When paying via secupay, the data required for payment processing (name, company if applicable, address, email, telephone, order amount and basket) is transmitted to secupay AG; for purchase on account, secupay may carry out an identity and credit check. secupay AG acts as an independent controller in this respect (Art. 6 Abs. 1 lit. b GDPR). Information on data processing by secupay can be found in secupay AG's privacy policy (secupay.com).

7. Contact, Dealer and Custom Order Enquiries

Details from the contact form, the dealer access request, and the custom order enquiry form (custom gifts, candle arches, window pictures) are sent to us by email for processing the relevant enquiry, and are additionally stored in our merchandise management system (shop database) (Art. 6 Abs. 1 lit. a and b GDPR). Dealers register directly in the shop; the account is only activated after review. All forms are protected against automated abuse by security tokens, a honeypot method, and a limit on the number of requests per hour; for this purpose the IP address is stored only in shortened form as a hashed check value.

8. Dealer Account

A user account (login name, email, company, hashed password) is created for approved dealers so that dealer prices are shown automatically in the catalogue (Art. 6 Abs. 1 lit. b GDPR).

9. Videos (YouTube) and Social Media

Videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) are embedded in enhanced privacy mode (youtube-nocookie.com) and are only loaded after you click on the preview image (a "two-click solution"). No connection to YouTube is established beforehand. Only once you click is data (including IP address, page accessed, and device information) transmitted to Google, potentially also to the USA (legal basis: your consent, Art. 6 Abs. 1 lit. a GDPR; Google is certified under the EU-US Data Privacy Framework). Information: policies.google.com/privacy.

Our profiles on YouTube, Instagram and, where applicable, Facebook are merely linked (no plug-ins, no "Like" buttons). The share buttons on product pages are simple links; data is only transmitted once you click such a link and the relevant network's page opens.

10. No Disclosure for Advertising Purposes

Your data is not sold or rented to third parties for advertising purposes. It is only disclosed to the recipients named in this notice (payment service providers and, where applicable, delivery service providers) and to authorities, insofar as we are legally obliged to do so.

11. Your Rights

You have the right to information (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21) to the processing of your personal data. Please contact the address given above for this purpose. You also have the right to lodge a complaint with a data protection supervisory authority.

Competent supervisory authority:
Saxon Commissioner for Data Protection and Transparency (Sächsische Datenschutz- und Transparenzbeauftragte)
Postfach 11 01 32, 01330 Dresden, Germany
Phone: +49 351 85471-101 · Email: post@sdtb.sachsen.de

This notice describes the actual technical processing carried out by this website. It does not replace a legal review in individual cases – in particular, once a hosting provider, a newsletter, or further payment methods are added, this notice must be extended accordingly.