Privacy Policy

As of: October 2026

2.1 Hosting

Our website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Nuremberg, Germany. Hetzner processes the data on our behalf based on a data processing agreement in accordance with Art. 28 GDPR. We deliver fonts, stylesheets, scripts, and images from this own server; we do not integrate any external content delivery networks or third-party font services.

2.2 Technically Necessary Processing

For the page to be delivered, your browser technically transmits your IP address, the requested address, date and time, browser type and version, and the previously visited page (referrer) to our server. We only use the IP address temporarily in a buffer on our server to prevent misuse of forms and chat (limiting requests per address); these counters expire after a few minutes. Our server logs accesses without an IP address; the log files are overwritten on a rolling basis.

Legal basis: Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure and stable operation of the website.

Without your consent, we only store what is technically necessary for the site (§ 165 Abs. 3 TKG 2021):

• kx_cookie_consent (Cookie, 365 days): stores your selection in the cookie banner, so that we don't have to ask again with every visit.
• gf_session (Session cookie, 7 days): only if you add something to your shopping cart in the shop or log into your customer account; it stores the content of the shopping cart and, if you are logged in, the ID of your account (Section 5.9).

Only if you agree in the cookie banner, the following will be added:

• kx_gclid, kx_utm_source, kx_utm_campaign (Browser session storage, deleted when the tab is closed): remember which ad or campaign led you to the site, so that we can attribute a later inquiry to this channel.
• _gcl_au, _gcl_aw and other cookies from Google (see Section 6).
• Cookies and storage from YouTube, as soon as you start a video (see Section 8).

You can change or revoke your selection at any time via “Cookie settings” in the footer of every page.

We count page views on our own server, without cookies and without transmitting data to third parties. The called page and its title, the previously visited page, campaign parameters in the address (utm), device type, browser, operating system, the country (from your browser's language setting or the origin information of our upstream network service) as well as a truncated browser identifier are stored. To detect multiple views by the same visitor on a given day, we generate a checksum from the IP address using a daily changing key; we do not store the IP address itself (pseudonymization). Furthermore, we record dwell time and scroll depth, as well as events such as your decision in the cookie banner, the use of forms, and clicks on phone numbers, email addresses, or data sheets.

We automatically delete this data after 90 days. Legal basis: Art. 6 para. 1 lit. f GDPR; our legitimate interest is the improvement of our offer.

5.1 Contact Form

If you write to us via the contact form, we process your first name, last name, company, email address, phone number, the type of inquiry, and your message, as well as the language of the page and the channel through which you reached us (e.g., Google ad, provided you have given your consent). We store your inquiry in our own customer management system, which runs on our server, and process it there. We reject a repeated inquiry with the same email address within ten minutes as a duplicate. The form contains invisible protection against automated submissions; no data is transmitted to third parties for this purpose.

Depending on the region and device, we forward your inquiry to our responsible sales partner (dealer) so that they can advise you and make you an offer. The dealer receives your contact details and your inquiry via a protected partner area.

If you have agreed in the cookie banner, we will also transmit your email address and phone number as a non-reversible verification value to Google (see Section 6.3) when submitting.

Legal basis: Art. 6 para. 1 lit. b DSGVO (processing your inquiry and pre-contractual measures) as well as Art. 6 para. 1 lit. f DSGVO (forwarding to the responsible dealer, assignment of the channel).

5.2 Inquiries via Facebook and Instagram

We run ads with inquiry forms on Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Irland). If you fill out such a form, Meta transmits the data provided there to us, and we incorporate it as an inquiry into our customer management system; Section 5.1 applies accordingly. Meta is responsible for the processing on Facebook and Instagram itself: www.facebook.com/privacy/policy.

5.3 Inquiries via the Online Shop

In our shop, you submit an order inquiry; no payment takes place on the website. For this purpose, we process name, email address, phone number, company, your billing address (street, postal code, city, country), your UID number if you provide it, the desired products including article number, and your message. We create the inquiry with an order number in our system and send you the offer separately by email. Our system also informs our office by email about the receipt of the inquiry; Microsoft 365 handles the dispatch (Section 5.10). We immediately confirm the receipt of your inquiry by email; if its status changes (confirmed, shipped, cancelled), we will also inform you by email — both even without a customer account (Section 5.10). We need the billing address and UID number to create an offer for you and to store it in our accounting system. Legal basis: Art. 6 para. 1 lit. b DSGVO.

5.4 Storage Period

Inquiries that do not lead to a business relationship are deleted three years after the last contact; entries in the internal change log that mention the name expire 14 days later. If an inquiry results in an order, we store the data for as long as required by statutory retention obligations (usually seven years, § 132 BAO). For order inquiries from the shop (Section 5.3), we calculate the period from the day of the inquiry instead of the last contact and delete them, including their items: inquiries without an order (new or cancelled) after three years, inquiries with an order (confirmed or shipped) after seven years (§ 132 BAO).

5.5 Dealer Search on the Website

On the 'Dealer Search' page, you enter your postal code and select your country. Our server then searches for the sales partner (dealer) responsible for this area; if there isn't one, we provide you with our own contact. We only use the postal code for this search and do not store it together with any personal data. In our own visitor statistics (Section 4), the page view appears without the entered postal code. Because the search also works without JavaScript, the postal code is included in the address of the results page. Our application writes this address to the access log without the part after the question mark (i.e., without the postal code) and without an IP address; the logs are overwritten on a rolling basis (Section 2.2). To protect against misuse, we limit the number of searches per IP address; these counters expire after a few minutes (Section 2.2).

For a dealer, there is also a 'Route' button. Only when you click on it, Google Maps opens in a new window, with the dealer's address as the destination; we do not transmit anything from you in this process, not even your postal code. From the moment you click, Google's privacy policy applies: policies.google.com/privacy. Similarly, you leave our website if you click on the link to a dealer's website.

Legal basis: Art. 6 para. 1 lit. f DSGVO. Our legitimate interest is to provide you with the responsible contact person.

5.6 Inquiry from the Dealer Search

If you send us an inquiry from the dealer search, we process your name, your contact details (email address or phone number), your message, and the postal code and country from your search. The inquiry goes to us, not directly to the dealer. Our sales department decides whether the responsible dealer processes it; in this case, they receive your contact details and your inquiry via a protected partner area (as in Section 5.1). We notify the dealer about the assignment by email (dispatch via Microsoft 365, Section 5.10) and, if they have allowed browser notifications, also there; it only contains your name or company name and your city or country, all other information is only in the partner area. For storage duration and legal basis, Sections 5.1 and 5.4 apply.

5.7 Information about our Dealers

In the dealer search, we display for each dealer the company name, address, phone number, possibly an email address and website, and, if the dealer wishes, the name of a contact person (then with their phone number and email address, if provided). We publish this information only with the dealer's consent. We only show the name of a contact person if that person has also given their consent. Consent can be withdrawn at any time; the entry will then immediately disappear from the website.

Legal basis: Art. 6 para. 1 lit. a DSGVO (consent), for company details additionally Art. 6 para. 1 lit. f DSGVO (legitimate interest in mediating customers to our sales partners).

5.8 Map (OpenStreetMap)

The dealer search functions entirely without a map. Only when you click on 'Show map', your browser loads map images from the servers of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, Vereinigtes Königreich. In doing so, the OpenStreetMap Foundation receives your IP address, date and time, the requested map sections, and information about your browser. We deliver the map's program library (Leaflet) from our own server. For the transfer to the Vereinigtes Königreich, there is an adequacy decision by the EU Commission (Art. 45 DSGVO). More information: osmfoundation.org/wiki/Privacy_Policy.

Legal basis: Your consent by clicking on 'Show map' (Art. 6 para. 1 lit. a DSGVO, § 165 para. 3 TKG 2021). Nothing is loaded without a click.

5.9 Customer Account

You can continue to send an order inquiry in the shop without an account (Section 5.3). If you create a customer account, we process:

• your email address and a password, which we only store as a non-reversible verification value;
• when you created the account, whether and when you confirmed your email address, and when you last logged in;
• the content of your shopping cart, so that it remains available on every device;
• your wishlist (which items you have saved and when), so that it remains available on every device;
• your order inquiries with the information from Section 5.3 and their processing status. If you previously made inquiries without an account using the same email address, we will link these inquiries to your account — but only after you have confirmed your address, so that no one with a different address can see your inquiries;
• if you place an order for a company with which we already cooperate: the assignment of your account to this company. An employee of our sales department performs this assignment and records the time and decision on the account; as a decision-making aid, we suggest up to three companies based on the domain of your email address (excluding private providers like gmail.com) or, if the domain yields nothing, based on the company name from your last order inquiry. The decision is always made by an employee. Only then will you also see this company's orders, offers, and invoices from our accounting system in your account (read-only). This applies to all accounts assigned to this company; however, you will only see the order inquiries from the shop in your own account.

For login, we use a session cookie (Section 3); it contains your account ID and your shopping cart, is signed, and is valid for seven days. After an order inquiry without an account, it also remembers the email address of this inquiry so that we can suggest it to you when creating an account. If you add items to the wishlist without an account, the same technically necessary cookie also remembers this selection; we do not store anything on our servers for this purpose. If you log in, we transfer the wishlist to your account; it is deleted with the account and is included in your data extract. For a saved item, you can write a short note (max. 200 characters); without an account, it is only in this cookie, with an account, we save it together with the wishlist. If you have an account as a dealer in our partner area, we store your wishlist including notes in this account (Art. 6 para. 1 lit. b DSGVO); it is deleted when the account is deleted. If you change your password, all logins on other devices will be terminated. Login attempts, registrations, and emails to you are limited per IP address and email address; the counters for these expire after minutes.

Legal basis: Art. 6 para. 1 lit. b DSGVO (customer account at your request, processing of your orders) and Art. 6 para. 1 lit. f DSGVO (account security, assignment to your company).

5.10 Emails for the Account

We send you emails to confirm your address, to reset your password, as a notification that you already have an account if someone tries to create another one with your address after you have deleted your account yourself, 30 days before we delete an unused account (Section 5.11), and if the status of an order inquiry changes (confirmed, shipped, cancelled). You also receive emails regarding the status of an order inquiry if you have made an inquiry without an account. Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Irland) handles the dispatch as our processor (Art. 28 DSGVO). A transfer to Microsoft Corporation in the USA is possible; it is certified under the EU-US Data Privacy Framework (Art. 45 DSGVO). We do not send advertisements via these emails; a separate section applies to the newsletter.

5.11 Delete Account and Data Extract

In your account, you can at any time yourself

• download a data extract: all information we have stored about your account, in a machine-readable file (Art. 15 and 20 DSGVO);
• delete your account: we will then immediately delete your login data, your shopping cart, and the assignment to a company and log off all devices. Order inquiries that resulted in an order are retained without reference to the account for as long as required by statutory retention obligations (usually seven years, § 132 BAO); all other order inquiries are deleted according to Section 5.4.

An account whose email address is not confirmed within seven days is automatically deleted by us. An account with which you have not logged in for three years will be deleted by us after we have reminded you by email 30 days in advance; if you log in during this period, it will remain active.

6.1 Only with your consent

We use Google Ads and Google Tag Manager, services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. Both are only loaded if you agree in the cookie banner. Before that, the page does not load anything from Google.

6.2 Conversion Measurement

After your consent, we measure whether a visit came about via one of our ads and whether it resulted in an inquiry. For this purpose, Google sets the cookies _gcl_au and _gcl_aw (storage duration according to Google up to 90 days). In addition, we inform Google when you click on a phone number, an email address or a WhatsApp link, start writing in the contact form, download a data sheet or follow a link to another website. Only the fact that the event occurred is transmitted, not what you entered or which file you downloaded.

6.3 Enhanced Conversions

If you submit an inquiry after your consent, we also transmit your email address and phone number as an SHA-256 checksum (not in plain text) to Google. Google matches this value with logged-in Google accounts to attribute the inquiry to an ad.

6.4 Transfer to the USA

Google may transfer data (e.g., IP address, usage behavior) to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR).

6.5 Legal Basis and Revocation

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR, § 165 para. 3 TKG 2021). You can revoke it at any time via „Cookie-Einstellungen“ in the footer; after that, the page will no longer report anything to Google, and the Google cookies will be deleted. The revocation does not affect the lawfulness of the processing carried out until then.

On our website, you can ask questions to an AI-powered chat assistant. We send your question, along with the public content of our website, to the Gemini service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, which generates the answer. Google processes the request on our behalf according to the terms for the paid Gemini interface and does not use it to train its models. A transmission to the USA is possible (see section 6.4).

We do not store the conversation history on our server. The assistant does not have access to customer or request data. We only use your IP address briefly to limit the number of questions per address. Please do not enter any personal data in the chat. For personal advice, please use the contact form.

Legal basis: Art. 6 para. 1 lit. f GDPR; our legitimate interest is to quickly answer your questions about our products.

On some pages, we display videos from YouTube (Google Ireland Limited). Initially, you will only see a preview image from our own server; no connection to YouTube is established. Only when you start the video and agree to it, or if you have already agreed in the cookie banner, will we load it in the enhanced privacy mode from youtube-nocookie.com. From then on, your browser transmits data to YouTube (e.g., IP address, the visited page), and YouTube can set cookies or browser storage; data transmission to the USA is possible (see section 6.4). The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). Further information: policies.google.com/privacy.

If you subscribe to our newsletter, via the newsletter form or by ticking the box in the contact form, we will use your email address and, if applicable, your first and last name, to inform you about products, news, offers and events of KECKEX GmbH. The subscription will only become effective once you click the link in our confirmation email (double opt-in). We store the time of subscription and confirmation as proof.

The newsletter is sent via Brevo SAS (formerly Sendinblue), 106 boulevard Haussmann, 75008 Paris, France, on our behalf, based on a data processing agreement in accordance with Art. 28 GDPR. Brevo enables the analysis of whether a newsletter has been opened and which links have been clicked; we use this analysis to improve the newsletter. Data protection at Brevo: www.brevo.com/de/legal/privacypolicy.

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR, § 174 TKG 2021). To existing customers, we also send information about our own similar products based on Art. 6 para. 1 lit. f GDPR in conjunction with § 174 para. 4 TKG 2021; you can object to this at any time.

You can unsubscribe at any time via the link at the end of each newsletter or by email to office@keckex.com. After unsubscribing, we store your email address in a blocklist so that you no longer receive newsletters.

In the footer, we link to our presences on Facebook, Instagram, LinkedIn, YouTube, and WhatsApp. These are simple links without integrated plugins: Only when you click on a link, you leave our website, and the privacy policy of the respective provider applies.

According to the DSGVO, you have the right to

• Information about your stored data (Art. 15),
• Rectification of inaccurate data (Art. 16),
• Erasure (Art. 17),
• Restriction of processing (Art. 18),
• Data portability (Art. 20),
• Object to processing based on legitimate interests (Art. 21), at any time and without giving reasons for direct marketing,
• Withdrawal of granted consent with effect for the future (Art. 7 para. 3).

For this purpose, please contact the address mentioned above. You can also lodge a complaint with the Österreichische Datenschutzbehörde: Barichgasse 40–42, 1030 Wien, www.dsb.gv.at.

Automated decision-making, including profiling, within the meaning of Art. 22 DSGVO, does not take place.

Our website is transmitted exclusively encrypted (TLS). We protect the data on our server through technical and organizational measures, including access restrictions and backups on a separate storage in Deutschland, which are transmitted encrypted.

We update this privacy policy if our website or legal requirements change. The version currently published here applies.