Privacy policy

1. Data protection at a glance

This notice explains what happens to your personal data when you visit plantplast.com. Personal data is any data by which you can be personally identified.

In short: this website uses no advertising services. It embeds no third-party fonts, maps, videos or social media components. It keeps no access logs of your visit. It sets no cookies that require consent. For basic visitor statistics we use a service operated for us that works without cookies and without any identifier in your browser, and to which you may object at any time (section 6). We mainly collect personal data when you write to us through the inquiry form.

2. Controller

The controller for data processing on this website is:

Wefapress Beck + Co. GmbH, Up de Hacke 21/31, 48691 Vreden, Germany

Phone: +49 2564 932915 · Email: info@plantplast.com

The operation and maintenance of this website is commissioned to

Con Radius Design, DBA of AHLER LLC, 3833 Powerline Rd, Suite 201, 33309 Fort Lauderdale, FL, USA

which acts as a processor under Art. 28 GDPR in that respect. The provider has administrative access to the content management system and therefore to the details submitted through the form. It in turn engages further providers, which are bound as sub-processors under Art. 28(4) GDPR; they are listed in section 14. As this is a company based in the USA, a transfer to a third country takes place in this respect. The basis is the data processing agreement and the standard contractual clauses of the European Commission; a copy of the safeguards is available on request (section 14).

3. Hosting, database and storage location

This website runs on a dedicated server operated by

netcup GmbH, Emmy-Noether-Strasse 10, 76131 Karlsruhe, Germany

The server is located in the Nuremberg data centre in Germany. The application and the database reside exclusively there. The database is self-hosted; no external database service is involved.

The database holds the editorial content of this website, the user accounts of the editorial team, and the details submitted through the inquiry form (section 7).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing this website securely and reliably. netcup GmbH is bound as a sub-processor under Art. 28(4) GDPR.

4. Connection data when you access this website

So that your browser can reach this website, the upstream reverse proxy on our server processes the technically necessary connection data, including your IP address. This happens transiently in memory only, for the duration of delivery and to fend off automated mass requests.

No access logging takes place. Logging in the reverse proxy is switched off; neither the database nor the application logs store visitor IP addresses. No log files are created from which your visit could be traced, so no retention period applies. The application's technical operating logs record the program flow.

No profiling takes place. We do not pass this connection data from our web server on to the visitor statistics; the analytics server in section 6 receives your IP address through your browser's own measurement request.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and trouble-free operation of the website.

5. Images and media files

The images and media files of this website are not stored on the web server but in an object store operated by

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA

They are delivered via a media domain operated by our service provider (plantplast-media.conradiusdesign.org), served through Cloudflare's network.

The storage location of the files is restricted to the European Union by the provider's jurisdictional restriction, not merely placed there as a matter of fact. Delivery to your browser, by contrast, takes place through the provider's global network, normally from a location near you. There is no assurance beyond this that all processing takes place exclusively within the EU.

As soon as your browser loads an image from this website, Cloudflare processes your IP address, along with the time, the file requested, your browser identification and, where applicable, the referring page.

As access from the USA in the course of operation and maintenance cannot be ruled out, a transfer to a third country takes place. The basis is the data processing agreement with Cloudflare including the standard contractual clauses of the European Commission and its binding as a sub-processor under Art. 28(4) GDPR. A copy of the safeguards is available on request (section 14).

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in fast and reliable delivery of the content.

6. Visitor statistics

To understand which content is found and read, we keep basic visitor statistics. For this we use the open-source software Rybbit, which our service provider Con Radius Design (section 2) operates for us on a server run exclusively for this purpose. No third-party analytics service is embedded, and no data is used or shared for advertising purposes.

The analytics server runs at

Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany

in the Falkenstein data centre in Germany; the analytics data is held on that server. As our service provider Con Radius Design is based in the USA, access from a third country is possible in the course of operation and maintenance; the basis is the data processing agreement and the standard contractual clauses of the European Commission (section 14).

Recorded per page view: the address requested including its query string, the page title, the previously visited page, your device's screen resolution, your browser language setting, and two values calculated from device characteristics that serve to detect automated access. In addition, it is recorded when you follow a link leading away from this website, including its destination.

What does not happen. For these statistics nothing is stored on your device, neither a cookie nor an entry in your browser's local storage. No persistent identifier is assigned that could recognise you over time. Your IP address is not stored in the analytics data; it is used transiently only, together with your browser identification, to form a check value by which page views belonging to one visit are recognised. That value is recalculated daily, so recognition beyond a single day is ruled out.

Also switched off: recording of your session or screen, capture of button clicks within a page, capture of copy actions or form entries, and error and performance measurement.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in aligning the content of this website with actual use.

Retention: the analytics data is deleted after twelve months.

Your right to object. You may object to the visitor statistics at any time, without giving reasons and with effect for the future (Art. 21 GDPR). Please use the switch below. Your choice is recorded in your browser only and is not transmitted to us; that entry is then the only one the statistics leave on your device, and it serves solely to respect your objection on every visit.

Disable visitor statistics

The measurement script itself is still loaded from our analytics server for technical reasons; after your objection it no longer collects or transmits any data.

Your objection applies to this browser and this device only. If you clear your local storage or switch browsers, please set it again. Because the statistics do not recognise you, we cannot record an objection on your behalf; write to us at info@plantplast.com nonetheless and we will look into your request.

7. Inquiry form and sample requests

Through the form on the page "Request a sample and start a project inquiry" and through the contact page you can describe your project and request a material sample.

We collect:

The checkbox is stored together with your inquiry in order to document that you took note of this notice. It is not a consent; we do not base the processing on your consent. The shorter contact form collects only name, email address, message and the same checkbox.

Are you obliged to provide this data? No. Providing your data is neither required by law nor by contract. We need the fields marked as mandatory in order to process and answer your inquiry; without them we cannot accept the form. The remaining details are optional; leaving them out puts you at no disadvantage. To send a material sample we additionally need a delivery address, which we request from you separately.

Purpose and legal basis. We process these details in order to handle your inquiry, reply to you and, if requested, send you a sample. The legal basis is Art. 6(1)(b) GDPR where your inquiry relates to entering into or performing a contract; for all other inquiries Art. 6(1)(f) GDPR, our legitimate interest in answering questions about our material.

Storage. Your details are stored in the database of this website in Germany (section 3) and are additionally sent to us by email (section 9). Only the field contents you entered, the language of your submission and an internal processing status are stored. Your IP address and details about your browser are not stored. No backup copies containing your details exist (section 10).

Deletion. Your form submission is deleted automatically from this website's database no later than six months after receipt; a daily process does this. We delete earlier once your inquiry has been finally dealt with and no further questions are to be expected. Section 8 applies to the copy delivered by email. If your inquiry has become a business transaction, we retain the associated correspondence in accordance with commercial and tax law retention periods; during that time processing is limited to fulfilling those obligations. You can request deletion at any time; an informal message to info@plantplast.com is sufficient, and we will then delete the database entry and the email in our mailbox.

Protection against automated submissions. The form contains a field invisible to you and a check of how long the form was open before submission. The longer inquiry form additionally uses a computational task that your browser solves in the background. That task is issued and verified by our own server; no third-party service is embedded, in particular no service such as Google reCAPTCHA, and no identifier is assigned. The protection fields are evaluated solely to fend off automated submissions and are removed before your submission is stored. Nothing is stored on or read from your device for this purpose. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the form and our mailbox against misuse.

8. Inquiries by email, telephone or post

You can also reach us directly, using the contact details given in section 2. In that case we process the details you provide, that is, depending on the channel, your email address, your name, your telephone number or your postal address, along with the content of your message. Providing this data is neither required by law nor by contract; without it, however, we cannot answer your inquiry.

Purpose and legal basis correspond to section 7: Art. 6(1)(b) GDPR where a contract is being entered into or performed, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in handling your inquiry and in being reachable through these channels.

Retention. We keep your message for as long as it is needed to handle it and to deal with any follow-up questions, and delete it afterwards. Statutory retention obligations, in particular under commercial and tax law, remain unaffected.

9. Sending of form emails

To send the notifications that reach us when a form inquiry is submitted, we use

Resend, Inc., USA

In doing so, the sender and recipient address, subject, the content of your form entry, the delivery status and the time are processed. The notification is sent to info@plantplast.com. According to the provider, account data, metadata and sending logs are stored in the USA; the provider does not state how long it keeps the sending logs. We delete the notification received by us in accordance with section 8.

A transfer to a third country therefore takes place. The basis is the data processing agreement with Resend including the standard contractual clauses of the European Commission and its binding as a sub-processor under Art. 28(4) GDPR. A copy of the safeguards is available on request (section 14).

The legal basis is Art. 6(1)(b) or (f) GDPR, in line with section 7; our legitimate interest lies in the reliable delivery of the notification to our mailbox.

10. Backups

No separate backup copies are created of this website's database or of its media files. The details you submit through the form are therefore not contained in any backup; if you request deletion, no copies remain in backups either.

Only the internal database of the operating platform used to run this website is backed up. It holds configuration and access data of the platform, but no personal data of visitors. That backup is created weekly; only the most recent one is retained. The storage location is an object store of Cloudflare, Inc. (address see section 5) located in the EU. Transfer is TLS-encrypted, and storage is encrypted server-side by the provider.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in operational resilience, and additionally Art. 32 GDPR.

11. Cookies and storage on your device

For visitors to this website we set a single cookie:

This cookie is set on your first visit, with the language in which the page is delivered to you, and changes when you switch language. It is necessary so that we can deliver the website in the chosen language, serves no analytical purpose and is not passed on to third parties. The legal basis for the storage is Section 25(2) no. 2 TDDDG and for the subsequent processing Art. 6(1)(f) GDPR; our legitimate interest lies in delivering the website in your language without you having to select it again.

In your browser's local storage this website stores only what you set yourself: the accessibility controls (larger font, reduced animation), the light or dark appearance, and your objection to the visitor statistics under section 6. These entries are only created if you change the setting yourself; they contain no personal data and are not transmitted. When a page is loaded, we merely check whether such a setting exists so that it can be respected. The legal basis is Section 25(2) no. 2 TDDDG. You can clear your browser's local storage at any time; doing so also removes an objection you have set against the visitor statistics.

Accessing the media domain sets no cookie, last verified on 4 August 2026.

We do not set cookies requiring consent.

12. What this website does not do

This website uses:

• no advertising or retargeting services
• no third-party statistics services; the visitor statistics in section 6 run on a server operated for us in Germany
• no fonts loaded from external servers; all fonts are delivered by our own server
• no embedded maps, videos or social media components
• no access logs of your visit on our own server
• no disclosure of your data for advertising purposes and no sale of data
• no automated decision-making and no profiling within the meaning of Art. 22 GDPR
• no persistent identifier in your browser

When a page is loaded, two addresses outside the main domain are contacted: the media domain from section 5 and the analytics server from section 6. If a network error occurs while media files are loading, your browser may additionally send a technical error report to a Cloudflare reporting service (a.nel.cloudflare.com).

13. Encryption

This website uses encryption in line with current technical standards (TLS). The data you transmit to us therefore cannot, according to the current state of the art, be read by third parties.

14. Recipients and transfers to third countries

The following table lists our processor Con Radius Design (section 2) and the sub-processors engaged through it under Art. 28(4) GDPR:

The IT service providers engaged for development and maintenance are stated as a category because they may change. A current list naming all sub-processors is available on request, as is a copy of the safeguards on which the transfers to third countries are based. An informal message to info@plantplast.com is sufficient.

Apart from the recipients named in this table, we disclose your data only where we are legally obliged to do so.

15. Your rights

You have the right at any time to obtain information free of charge about the data stored about you, including the purposes of processing, the categories of data, the recipients, the envisaged storage period and the origin of the data, and to receive a copy of that data (Art. 15 GDPR). You further have the rights to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

Please contact us informally at info@plantplast.com, by telephone at +49 2564 932915, or in writing at the address given in section 2. We will respond without undue delay and at the latest within one month (Art. 12(3) GDPR).

Right to object (Art. 21 GDPR)

Where we base processing on a legitimate interest under Art. 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms. You may object to the visitor statistics in section 6 without giving any reasons.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestrasse 2 to 4, 40213 Düsseldorf, Germany.

16. Changes to this notice

We will adapt this privacy notice whenever processing on this website changes, for example because a new service is added. The version published here applies.

Version date: ‹ENTER PUBLICATION DATE›