1. Data protection at a glance
General information
The following notes give a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to identify you personally. For detailed information on data protection, please refer to our privacy policy set out below this text.
Data collection on our website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the legal notice of this website.
How do we collect your data?
Your data is collected in part because you provide it to us. This may be data that you enter into a contact form, for example.
Other data is recorded automatically by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system or time of the page view). This data is collected automatically as soon as you enter our website.
What do we use your data for?
Technical data is collected to provide the website securely and without errors. We use data submitted through forms to process your enquiry. In addition, we measure the use of our website in a data-minimising, aggregated form so that we can improve its content and accessibility. This does not create individual user profiles.
What rights do you have regarding your data?
You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request that this data be corrected, blocked or deleted. You can contact us at any time at the address given in the legal notice regarding this and any other questions on data protection. You also have the right to lodge a complaint with the competent supervisory authority.
2. General information and mandatory disclosures
Data protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection provisions and this privacy policy.
When you use this website, various items of personal data are collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.
We point out that data transmission over the internet (e.g. when communicating by e-mail) can have security gaps. Complete protection of data against access by third parties is not possible.
Note on the responsible body
The body responsible for data processing on this website is:
Pavel Gerätebau GmbH Gewerbestraße 4 33790 Halle (Westfalen) Germany
Phone: +49 (0) 52 01 / 8 59 96-0 E-mail: info@pavel-gmbh.de
The responsible body is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, e-mail addresses or similar).
Withdrawal of your consent to data processing
Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. An informal notification to us by e-mail is sufficient. The lawfulness of the data processing carried out up to the withdrawal remains unaffected by the withdrawal.
Right to lodge a complaint with the competent supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. For our registered office, the competent authority is in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia: PO Box 20 04 44, 40102 Düsseldorf, Germany, telephone +49 (0)211 38424-0, e-mail poststelle@ldi.nrw.de. Further information and the complaint form are available on the contact page of the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.
SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser address bar changes from http:// to https:// and by the padlock symbol in your browser bar.
When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Information, blocking, deletion
Within the framework of the applicable statutory provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients and the purpose of the data processing, and, where applicable, a right to have this data corrected, blocked or deleted. You can contact us at any time at the address given in the legal notice regarding this and any other questions on personal data.
Objection to advertising e-mails
The use of contact data published as part of the legal notice obligation to send advertising and information material that has not been expressly requested is hereby objected to. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example by spam e-mails.
3. Data collection on our website
Language assistance and tracking
When a German-language page is opened, the website asks an endpoint on the same domain for a language recommendation. The endpoint first evaluates the standard Accept-Language HTTP header sent by your browser with the request and checks its ordered language preferences against the German, English, Turkish, French, Spanish, Italian and Polish versions we offer. If a language matches, the website may offer you a switch to that version. If the endpoint cannot be reached or an error occurs, no suggestion is displayed.
Only if the header contains none of these languages does the endpoint process the request IP address temporarily in working memory and assign the server connection address (REMOTE_ADDR) to a country using an IP-to-country database stored locally on our Alfahosting server. Only one of the available language versions is derived from the country and returned to the browser. The language service does not store the country or IP address, link the result to other data or transmit it to DB-IP or any other third party. Independently of this, the request may generate the hosting provider’s server log files described below. IP assignment is imprecise and therefore serves only as a fallback for a non-binding language suggestion; it does not result in an automatic redirect, profiling or tracking. The legal basis for the temporary server-side processing is Art. 6 (1) (f) GDPR. Our legitimate interest is to provide an understandable, user-friendly language choice while processing as little data as possible. You may object to this processing on grounds relating to your particular situation using the contact details in the legal notice.
You are not redirected automatically and can continue to open any language-specific address or use the manual language selection directly. Closing the notice applies only to the current page view. The language assistant does not set cookies or use Local Storage or Session Storage. It stores neither the suggestion nor the closing of the notice or a manually selected language. On a later visit to a German-language page, the endpoint is therefore queried again.
For the local country assignment, we use the IP to Country Lite database from DB-IP, licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). Modification: the source data is separated into IPv4 and IPv6 and losslessly converted to a binary search format without adding content. The data is used locally only for the broad assignment described above; DB-IP receives no visitor requests and does not endorse PAVEL.
The language assistant does not use external analytics, marketing or tracking services. External fonts and maps are not loaded when a page is opened.
Cookie-free audience measurement
We measure, under our own responsibility and exclusively on our own servers, how the published language sections of our website are used. We do not set cookies on the public website, store identifiers in your browser or use an external analytics, marketing or tracking provider.
External fonts and maps are not loaded when a page is opened.
Under the current technical design, no cookie or consent banner is envisaged. If the measurement is later extended to include storage on your device, additional identifiers, further purposes or external recipients, we will reassess whether consent is required and update this privacy policy before activating the change.
We record the requested page path without query parameters or fragments, the language of the requested page, the date, weekday and hour of the request, the broad device category (desktop, mobile device or tablet), the primary browser language and the technical source of the visit. The page language is determined by the language section requested. The primary browser language is derived from the language preference transmitted by your browser with the HTTP request; these two values may differ and are evaluated separately. For external sources, we store only the domain name, not the full referrer path. For navigation within our website, the source and destination pages are stored directly as an aggregated counter. For the duration of the current visit window, the server retains only the entry page, the most recently requested page, the source category and, where applicable, an approved campaign code. Complete individual browsing histories are not stored. Entry and exit pages and frequent internal navigation paths appear in the administration area only as totals.
In aggregated form, we also count visits to the contact page, clicks on telephone, e-mail and predefined action links, downloads of publicly available documents, and the first focus on a form field, start and technically confirmed transmission of a form. Only the form type is counted. Form content and input values are not included in the statistics. Confirmed form transmissions may be shown in aggregated reports by entry page, source domain, device category, weekday, hour and approved campaign code. Scroll depth and active use time are recorded only in broad bands. Loading and display quality (LCP, CLS and INP) is stored only as “good”, “needs improvement” or “poor”. For errors, we count only technical categories such as a 404 page or script, image or stylesheet errors, together with the relevant page and device category; error messages and the addresses of affected resources are not stored.
For campaigns that have been expressly configured, a previously approved campaign code may be counted. Free-form campaign names, other query parameters and the complete requested URL are not included in the statistics.
To group page views and the events described above into an estimated visit within a 30-minute window, our server temporarily processes the IP address and browser type. The IP address is immediately shortened to a broad network prefix and combined with the device category, calendar date and a secret key to create a daily identifier that cannot be reverse-engineered. No geographic location is derived from or stored for the IP address. The raw IP address and full browser identification string are not stored in the statistics database. The daily identifier and its minimal visit state change each day and are deleted no later than after 48 hours. Aggregated statistics are deleted after 760 days.
We respect signals rejecting this type of measurement (“Do Not Track” and “Global Privacy Control”) both in the browser and on the server. The statistics are not combined with the content of contact enquiries, customer data, Instagram or other data sources and are not used for advertising or profiling.
The processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest is to understand the reach, discoverability and use of our own website with as little data as possible and to adapt our offering accordingly. You may object to the processing at any time, on grounds relating to your particular situation, using the contact details provided in the legal notice.
Server log files
The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:
- Browser type and browser version
- Operating system used
- Referrer URL
- Host name of the accessing computer
- Time of the server request
- IP address
This data is not merged with other data sources.
The processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest is the secure, stable and technically error-free provision of the website. Alfahosting anonymises the last block of the IP address no later than after 24 hours and deletes server logs no later than after seven days.
Hosting and processing on our behalf
This website and its form endpoint are hosted by Alfahosting GmbH, Edmund-von-Lippmann-Straße 13–15, 06112 Halle (Saale), Germany. Alfahosting processes connection and form data generated when pages are opened or forms are submitted on our behalf in accordance with Art. 28 GDPR. Our legal basis is Art. 6 (1) (f) GDPR for the secure provision of the website and Art. 6 (1) (b) or (f) GDPR for handling your enquiry.
Contact and enquiry forms
On the contact page we offer three forms: the guided quotation or project enquiry, the request for data sheets and brochures, and the general enquiry. Data is only transmitted if you actively submit a form; the transmission is TLS-encrypted to our form endpoint on the same domain. The forms do not set cookies and do not embed third-party scripts.
For the quotation enquiry we collect:
- Name and e-mail address (mandatory)
- Company, telephone number and country (voluntary)
- Depending on your request, details of the desired machine (model, line type, film speed, material volume, installation site) or of the manufacturing job (desired processes, material, material thickness, quantity, requested date) as well as additional notes
- Voluntary attachments, such as photos, installation drawings, hall layouts or technical drawings (JPG, PNG, PDF, MP4 or DXF, DWG, STEP, PDF; up to 20 MB in total)
For the data sheet request we collect the documents you require, the desired language, your name and your e-mail address. For the general enquiry we collect your message, your name and your e-mail address (mandatory) as well as, voluntarily, company and telephone number.
Unsolicited job applications also reach us via the general enquiry form. The same details are collected as for any general enquiry. You may also voluntarily attach application documents such as your CV, cover letter and references as PDF, JPG or PNG files; a total limit of 20 MB applies to all files combined. We use information and attachments from an application exclusively for the application procedure.
In addition, the form transmits technical details that serve to allocate and process it: the form type, the language and the address of the page called up, as well as a version identifier for the form. No analysis of your user behaviour takes place in this process.
To protect against automated spam submissions, every form contains a field that is invisible to humans and contains no personal data. If it is filled in by a program, the submission is discarded without being delivered. The basis for this is our legitimate interest in trouble-free operation pursuant to Art. 6 (1) (f) GDPR.
Before sending, you confirm with a mandatory checkbox that you have taken note of this privacy policy. The checkbox documents this acknowledgement only; it is not consent and does not create an additional legal basis.
Recipients of your information are the employees responsible for handling the respective enquiry. We use our hosting and e-mail service providers as processors for technical transport and e-mail delivery. We do not disclose your information to sales partners or other third parties without an applicable legal basis or prior information to you.
We use your information solely to process your enquiry, prepare a quotation or send you the requested documents. The legal basis is Art. 6 (1) (b) GDPR where your enquiry serves to initiate a contract. For other enquiries, the basis is Art. 6 (1) (f) GDPR; our legitimate interest is responding to the enquiry that you have addressed to us. We process unsolicited applications for decisions concerning the establishment of an employment relationship on the basis of Section 26 (1) of the German Federal Data Protection Act (BDSG).
We delete form data and attachments once the relevant enquiry has been fully processed and no statutory retention obligation or legitimate interest requires continued storage. Documents subject to commercial or tax-law retention requirements are stored for the applicable statutory period and their processing is restricted to that purpose. Data from unsuccessful unsolicited applications is deleted no later than six months after the application process has ended unless you have expressly consented to longer storage.
4. Plugins and tools
Fonts
The fonts used on this website are delivered together with the page from our own server. They are not loaded from an external font service — such as Google Fonts; your browser therefore does not establish a connection to Google.
Google Maps
Our contact and company pages contain an external link to route planning in Google Maps. No map, Google script or other Google content is embedded on our website. Only when you actively open the link do you leave our website and establish a connection to Google. Google may then process your IP address, device and location information in particular and may associate the use with your Google account. The provider in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Further information is available in Google’s privacy policy.
Instagram gallery
On the “Surface finishing” page we show current posts from our Instagram profile @pavelcoatings. The post link, image or preview image, media type, caption and publication time are retrieved and cached server-side via a feed endpoint controlled by us. The feed is normally refreshed hourly; a cached version retained during an outage is discarded no later than after seven days. When the gallery is merely loaded, your browser therefore does not establish a direct connection to Instagram or Meta. The feed endpoint receives technically necessary connection data such as IP address, time and browser information; this is not merged with an Instagram account and is not used for tracking.
Only when you actively open a post or the profile link do you leave our website and establish a direct connection to Instagram. In doing so, Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, may process personal data and, where applicable, assign the visit to your Instagram account. Further information can be found in the Instagram privacy policy.
The provision of the server-side cached gallery takes place on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest lies in the up-to-date presentation of our work and services. If the feed endpoint fails, no third-party content is loaded; instead, a local notice appears with a link to the Instagram profile that you can open voluntarily.