Privacy notice

1. Controller

• Handelskontor Fieberg GmbH
• Dornenbusch 21
• 32805 Horn-Bad Meinberg
• Germany
• Telephone: +49 (0)179 4709011
• Electronic contact: via the contact form on wehrdich.org

2. Website access and server logs

When you access the website, the web server and security systems process data including IP address, date and time, requested address, data volume, referrer, browser, operating system, and status and error codes. This is needed to deliver content, diagnose faults, prevent attacks and demonstrate secure operation.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the availability, integrity and security of the service. Logs are generally retained only as long as needed for security analysis and troubleshooting, unless a specific incident or legal obligation requires longer retention.

3. Contact form and spam protection

If you use the contact form, we process your name, email address, subject, message, consent status and technical metadata. Spam protection may additionally process IP address, timestamps, completion time, rate-limit data, honeypot result, challenge token and answer. This information is not published.

Processing is based on Article 6(1)(b) GDPR for enquiries relating to a contract or pre-contractual steps, and Article 6(1)(f) GDPR for other enquiries and abuse prevention. Required details allow us to allocate and answer the enquiry and limit automated misuse.

We delete enquiry data when processing is complete unless statutory retention duties, legal claims or security requirements apply.

4. Registration and customer account

When you register, we process title, first name, surname, email address, a password stored only as a hash, privacy confirmation, registration time and security logs. Login involves the email address, password verification, timestamp, IP and session data. Plain-text passwords must not be retained.

This is necessary to create and use the account, associate orders and prevent unauthorised access under Article 6(1)(b) and (f) GDPR. Account data is retained until the account is deleted; statutory order and accounting records remain unaffected.

5. Cart and LocalStorage

Your cart is stored in your browser's LocalStorage. It may contain product identifiers, variants, quantities and local timestamps. It remains on your device until removed in the cart, browser settings or website data controls. It is required for the cart and is sent to our shop API only when checkout begins.

6. Checkout, session cookie and orders

At checkout we process cart contents, email address, name, billing and shipping address, country, selected payment method, prices, order status and technical transaction data. A strictly necessary session cookie may hold a random identifier to associate the cart, CSRF protection and checkout securely. It is not used for advertising.

Processing is based on Article 6(1)(b) GDPR. Commercial, tax and accounting records are generally retained for the statutory six- or ten-year periods. Abandoned checkout data is deleted when no longer needed for troubleshooting, abuse prevention or legal claims.

7. Payments

For bank transfers, the participating banks provide information such as account holder, IBAN, amount, reference and booking date. If an external payment provider is actually enabled and selected at checkout, it receives the order, contact and payment information needed for payment and additionally processes data under its own privacy notice.

The legal bases are Article 6(1)(b) GDPR for contract performance and Article 6(1)(c) GDPR for tax and commercial-law duties. WEHRDICH does not retain complete card verification data.

8. Recipients and processors

Data is disclosed only to parties that need it for operation, hosting, security, shipping, payment, accounting or legal defence. Service providers are bound as processors under Article 28 GDPR where required. Authorities receive data only where there is a legal obligation.

9. International transfers

Data is transferred outside the European Economic Area only where required for a service and the conditions of Articles 44 et seq. GDPR are met, for example through an adequacy decision or appropriate safeguards. Any affected external payment service depends on the actual checkout configuration and your selection.

10. Legal bases, required information and automated decisions

Consent is based on Article 6(1)(a) GDPR and can be withdrawn for the future at any time. Contractual and pre-contractual processing is based on Article 6(1)(b), legal obligations on point (c), and security and abuse prevention on point (f).

Fields marked as required are necessary for the relevant enquiry, account or order. Without them, we cannot provide that function. We do not make solely automated decisions producing legal or similarly significant effects.

11. Your rights

• Access to your personal data (Article 15 GDPR)
• Rectification of inaccurate data (Article 16 GDPR)
• Erasure where no retention duty applies (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Objection to processing under Article 6(1)(e) or (f) GDPR (Article 21 GDPR)
• Withdrawal of consent with future effect
• A complaint to a data protection supervisory authority, particularly at your residence, workplace or the place of an alleged infringement

12. Security and updates

We use appropriate technical and organisational measures including transport encryption, access controls, password hashing, CSRF protection, logging and automated-abuse protection. No process can guarantee absolute security.

We update this notice when functions, service providers or legal requirements change. The current version is available on this page.