Privacy Policy
This translation is provided for information purposes only; the legally binding version is the German one.
We are pleased that you are visiting our website. The protection of your personal data is an important concern to us. In the following, we inform you in accordance with Art. 13 of the General Data Protection Regulation (GDPR) about the processing of personal data in connection with this website.
1. Controller
The controller within the meaning of the GDPR is:
Promaris Service GmbH
Philipp-Reis-Str. 5
45659 Recklinghausen
Germany
E-mail: kontakt@promaris.nrw
2. Processing when visiting the website
Each time our website is accessed, information is automatically transmitted to the server and temporarily stored in what are known as server log files. The following are recorded: IP address, date and time of access, the page retrieved, the browser and operating system used, and, where applicable, the previously visited page (referrer). The upstream servers pass the IP address of your connection on to our gateway unchanged (see the “Hosting” section).
This processing serves the technical delivery of the page, the safeguarding of system security and stability. The legal basis is our legitimate interest in a secure and functional web presence (Art. 6(1)(f) GDPR). The log files are deleted as soon as they are no longer required for these purposes.
Our pages do not embed any resources from third-party servers: no external fonts (e.g. Google Fonts), no external script, analytics or tracking services, and no third-party content delivery networks for fonts or scripts. Only the native fonts of your device and files delivered by our own infrastructure are used. Merely accessing our pages therefore does not result in any data being transferred to third parties.
3. Hosting
Our website is hosted on an infrastructure operated and controlled by ourselves, on our own premises. There the application runs as a WebAssembly component (WASI) on our company’s own network gateway. It is not operated via third-party container or cloud platforms.
Connections to our website reach that gateway via three upstream servers operated by Hetzner Online GmbH (Gunzenhausen, Germany). These servers hold none of our website’s content and do not decide on its delivery; they pass the traffic through at the transport layer without decrypting it or altering its content — the transport encryption is only terminated on our own gateway. The only thing added is a technical preamble (the PROXY protocol), which hands the IP address of your connection to our gateway unaltered; without it, those servers would replace it with their own. In doing so, Hetzner processes technical connection data, in particular the IP address of the accessing device. The same company also operates the name servers for our domain and thereby answers the queries with which your device resolves our address. The data centers involved are located in Nuremberg and Falkenstein (Germany) and in Helsinki (Finland); no processing takes place outside the EU or the EEA. We use no third-party content delivery network and no third-party reverse proxy; the only software in front of our gateway is a TCP forwarder operated by us, which does not break the connection open. The legal basis is our legitimate interest in a secure, high-performance and available provision of our website (Art. 6(1)(f) GDPR).
4. Encryption
For security reasons, this website uses TLS encryption (recognizable by the “https” in the address bar). This protects your data in transit from access by third parties.
In addition, the data transmitted via the contact form is encrypted end-to-end, on top of the TLS encryption, using a post-quantum-secure method (key exchange via ML-KEM-1024 pursuant to FIPS 203, content encryption with ChaCha20-Poly1305). As a result, your form data is additionally protected against being read along the entire transmission path — including vis-à-vis intermediary systems along that path. The server key used for this is certified with a long-lived signing key whose public verification key is embedded in the delivered application; an intermediary system therefore cannot slip in a key of its own.
5. Recipients and processors
For certain processing activities we use service providers. Insofar as these process personal data on our behalf, this is done in accordance with the requirements of Art. 28 GDPR. In detail:
• Hetzner Online GmbH (Gunzenhausen, Germany) — operation of the servers through which connections to this website are routed, and operation of the name servers for our domain (authoritative DNS); in doing so it processes technical connection data including the IP address. The data centers involved are located in Nuremberg and Falkenstein (Germany) and in Helsinki (Finland) — exclusively within the EU (see the “Hosting” section).
• Infomaniak (Switzerland) — operation of our e-mail service; processes the contents of our e-mail communication. Switzerland is recognized, by an adequacy decision of the European Commission, as a third country with an adequate level of data protection.
• Zammad — our ticket and inquiry system for handling contact requests. We operate this on our own infrastructure; the request data processed there does not leave our area of responsibility.
• Google Ireland Limited / Google LLC — operation of Google Search Console, which we use to analyze how our website is found in search. A verification file is stored on our server for this purpose; no third-party scripts are embedded in our pages and no visitor data is transmitted to Google. Google only receives the data generated when its own search crawler retrieves our pages.
Any disclosure beyond this takes place only in accordance with the “Disclosure to third parties” section.
6. Cookies
The publicly accessible part of this website does not use any cookies for analytics, tracking or advertising purposes.
Should we in future offer a protected login area (customer area), we will use there exclusively technically necessary cookies (session cookies). These are required in order to recognize you after login and to manage your session; they contain no information for advertising or analytics purposes and are not passed on to third parties. The legal basis for the use of technically necessary cookies is our legitimate interest in the secure provision of the login area (Art. 6(1)(f) GDPR) or the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR); storage takes place pursuant to § 25 Abs. 2 TDDDG without separate consent, as it is strictly necessary for the function expressly requested by you. We will inform you of further details as soon as the login area is available.
Independently of cookies, this website stores a single technical item in your browser’s local storage: a note on whether the introductory animation of the home page has already been shown. This note contains no personal data, is never transmitted and serves presentation only. You can delete it at any time via your browser’s site data.
7. Contacting us
You can send us a message via the contact form on this website. In doing so, we process the data you provide — name, e-mail address and the content of your message. The transmission is encrypted (see the “Encryption” section). From your inquiry we create a case in our self-operated ticket system (Zammad) in order to handle your inquiry and respond to it in a traceable manner.
If you instead write to us directly by e-mail (for example to kontakt@promaris.nrw), we process the information from your e-mail (in particular e-mail address, name and the content of your message). Our e-mails are handled and stored via our mail service provider Infomaniak (Switzerland).
The legal basis is Art. 6(1)(b) GDPR, insofar as the inquiry is aimed at a contract, otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR). We delete this data as soon as it is no longer required for processing and no statutory retention obligations stand in the way.
8. Checking electronic invoices
Under “Check e-invoice” we offer a free tool that validates an electronic invoice (XRechnung, ZUGFeRD/Factur-X) against the EN 16931 standard. The file you upload or paste is transmitted to our server and checked there. Such invoices may contain personal data — names, addresses, bank details and amounts, including those of third parties.
The check runs in a sandboxed environment started for that purpose, without file-system or network access, which is discarded afterwards. We do not store the transmitted file and do not evaluate its contents. Independently of this, the request itself and the technical connection data it generates are recorded in server log files like any other page request (see “Processing when visiting the website”). The legal basis is our legitimate interest in providing this tool (Art. 6(1)(f) GDPR). If you wish to avoid transmitting third-party personal data, please only check documents you are entitled to pass on.
9. Location display on the technology page
On our “Technology” page, the section “How this page reached you” shows the path of your page request on a map. So that this line can start where your request comes from, we derive an approximate geographic position from the IP address of your connection — the country and approximate coordinates. This information serves solely the display on that one page; we do not use it for any other purpose.
The lookup is performed by our own gateway: it looks the IP address up in a database held on our own hardware. No third-party service is embedded or queried for this; your IP address is not transmitted to anyone for this purpose and does not leave our infrastructure. Only the result — country and approximate coordinates — is sent to your browser so that it can be displayed there.
The processing is transient: it takes place exclusively while your request is being answered. Neither the IP address nor the position derived from it is stored, written to any log — not even for troubleshooting — or combined with other data. Once the response has been sent, none of it still exists; there is therefore no storage period. Independently of this, the request itself is recorded in the server log files like any other page request (see the “Processing when visiting the website” section).
The legal basis is our legitimate interest in making the origin and the path of the page request comprehensible in this display (Art. 6(1)(f) GDPR). The lookup is inherently imprecise: the country is correct as a rule, whereas the place shown can be far off — for example with mobile connections, corporate lines or connections with shared addresses (CGNAT). The map does not show a location reported by your device; we do not query your browser’s location permission.
10. Disclosure to third parties
Your personal data is not transmitted to third parties unless we are legally obliged to do so. This does not affect the service providers named in the “Recipients and processors” section who act on our behalf. Your data is not sold.
11. No automated decision-making
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
12. Your rights
Within the framework of the statutory provisions, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) as well as the right to object to processing (Art. 21 GDPR). You can withdraw any consent given at any time with effect for the future.
To exercise your rights, an informal message to kontakt@promaris.nrw is sufficient.
13. Right to lodge a complaint with the supervisory authority
Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.
14. Changes to this privacy policy
We adapt this privacy policy as soon as changes to the data processing we carry out make this necessary — for example upon introduction of the planned login area.
Last updated: October 2026