Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

PACKWERT GmbH
Brügelmannstraße 5
50679 Köln (Cologne), Germany
Phone: +49 221 99983500
Email: hello​(at)​packwert.de

Represented by its Managing Director Werner Friedrich Schulte. Further details can be found in our legal notice.

2. Principles of processing

This website is a static website. There are no user accounts, no sign-in, and no contact form. Personal data is processed only to the technically necessary extent required for the secure and stable delivery of the pages. Personal data is any information relating to an identified or identifiable natural person (Art. 4 no. 1 GDPR).

3. Hosting and server log files

This website is hosted on Cloudflare Pages, a service provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes the data on our behalf as a processor; a data processing agreement (Cloudflare Data Processing Addendum) pursuant to Art. 28 GDPR is in place.

Each time the website is accessed, Cloudflare's servers automatically process access data in so-called server log files transmitted by your browser. This includes in particular:

• the IP address of the requesting device,
• the date and time of access,
• the specific page or file requested,
• the browser type and version as well as the operating system used,
• the previously visited page (referrer), if transmitted.

This processing is technically necessary to deliver the website, to ensure its stability and security, and to defend against attacks. The legal basis is our legitimate interest in a secure and reliable operation of the website (Art. 6(1)(f) GDPR).

This access data is not combined with other data sources and is not used to create user profiles. We do not keep any separate, persistent log of this data ourselves — in particular, we do not enable persistent log storage (Cloudflare Logpush or Logpull). Cloudflare keeps such edge log data only for a short, technically limited period: according to Cloudflare's own documentation, edge log data is retained for at least three and at most seven days and is deleted thereafter.

As Cloudflare may also process data on servers in the USA, a transfer to a third country takes place. This is safeguarded by the conclusion of the EU Standard Contractual Clauses together with supplementary measures under the Cloudflare Data Processing Addendum (Art. 46 GDPR).

4. Audience measurement with Cloudflare Web Analytics

To analyse the use of this website statistically, we use Cloudflare Web Analytics, a service provided by Cloudflare, Inc. This service is active on our website. Cloudflare Web Analytics works expressly without cookies: no cookies are set and no client-side storage (e.g. localStorage) is used for analytics purposes, no fingerprinting is performed, and neither the IP address nor any other immutable attributes are evaluated or stored for analytics purposes. No personal profiles are created, and users are not tracked across websites. Only aggregated metrics such as page views, approximate region of origin, and device category are collected.

No personal data is processed in a manner that would require consent; a cookie banner is therefore deliberately not required. The legal basis is our legitimate interest in a data-minimising, aggregated measurement of our website's reach (Art. 6(1)(f) GDPR).

5. Locally hosted fonts

For a consistent presentation, we embed fonts locally. They are loaded exclusively from this website's server. No request is made to Google Fonts or any other external provider; your IP address is not transmitted to third parties in this process.

6. No cookies, storage of your language preference

This website does not use cookies. To remember your preferred language (German or English) across visits, this technically necessary setting is stored in your browser's local storage (localStorage). This is not a cookie; no personal reference is established, and the information remains solely in your browser. You can delete this setting at any time via your browser's storage functions.

7. Contacting us

We deliberately do not offer a contact form. If you contact us by email or telephone, we process the information you provide (e.g. name, contact details, content of your message) solely to handle your request and for any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your request relates to the initiation or performance of a contract, and otherwise our legitimate interest in responding to your enquiry (Art. 6(1)(f) GDPR). We store this data until your request has been fully dealt with and then delete it, unless statutory retention obligations apply.

8. Data processing in the course of the business relationship

Beyond your visit to this website, we process personal data of contact persons at our customers, suppliers and business partners; our services are directed exclusively at businesses. We process in particular professional contact details (e.g. name, role, email address, telephone number), the content of our communication, and contract and billing data, insofar as this is necessary for the initiation, performance and settlement of the business relationship. The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures), Art. 6(1)(f) GDPR (our legitimate interest in communicating with the contact persons of our business partners) and Art. 6(1)(c) GDPR (legal obligations). Where we do not receive data directly from you, it generally originates from the company you work for or from publicly accessible sources (Art. 14 GDPR).

To handle the business relationship, we use carefully selected external service providers acting as processors (Art. 28 GDPR), in particular in the areas of email and office communication, email security, agency and project management, accounting, data backup, and AI-assisted tools. Where personal data is processed in third countries (in particular the USA), this takes place on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or an adequacy decision (Art. 45 GDPR). Beyond this, data is disclosed only to recipients such as tax advisors, banks or public authorities where this is necessary for the performance of the contract or where a legal obligation exists.

We store this data for the duration of the business relationship and beyond, insofar as statutory retention periods (in particular six or ten years pursuant to sec. 257 of the German Commercial Code (HGB) and sec. 147 of the German Fiscal Code (AO)) so require. The data subject rights described in this policy also apply to this processing.

9. AI-assisted tools

To support our internal workflows, we use AI-assisted tools, for example to summarise and prioritise incoming messages and to pre-draft texts and replies. In doing so, content of our business communication may be processed by the providers used, acting as processors (Art. 28 GDPR). We exclusively use business plans under which content is not used to train AI models. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place; all results are reviewed and approved by our staff before they are used. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in the efficient handling of our business communication). Where providers process data in the USA, the transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

10. Your rights as a data subject

Subject to the statutory requirements, the GDPR grants you the following rights:

• the right of access to the data processed about you (Art. 15 GDPR),
• the right to rectification of inaccurate data (Art. 16 GDPR),
• the right to erasure (Art. 17 GDPR),
• the right to restriction of processing (Art. 18 GDPR),
• the right to data portability (Art. 20 GDPR),
• the right to object to processing (Art. 21 GDPR).

To exercise your rights, an informal message to the controller named above is sufficient.

11. Right to object

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

12. Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR. The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany

13. Encryption (SSL/TLS)

For security reasons, this website uses TLS encryption (recognisable by https:// in the address bar). This protects the data transmitted between your browser and the server against being read by third parties.