2. Principles and legal bases
We process personal data for specified purposes, transparently and limited to what is necessary. Depending on the processing, we rely in particular on Article 6(1)(b) GDPR for pre-contractual and contractual processes, Article 6(1)(c) GDPR for legal obligations and Article 6(1)(f) GDPR for the secure and economical operation of our digital services. Where consent is required, processing is based on Article 6(1)(a) GDPR and consent may be withdrawn with effect for the future.
3. Hosting und technische Infrastruktur
When the website and portal are accessed, connection data required for provision and security are processed. This may include, in particular, the IP address, time of access and browser and device information. The purposes are delivery of the pages, stability, error analysis and protection against misuse. The legal basis is Article 6(1)(f) GDPR.
Für Hosting und technische Bereitstellung setzen wir Hostinger ein. Für Datenbank-, Authentifizierungs-, Speicher- und serverseitige Anwendungsfunktionen nutzen wir Supabase. Dabei werden nur die für den jeweiligen technischen Zweck erforderlichen Daten verarbeitet. Soweit ein Anbieter als Auftragsverarbeiter tätig wird, erfolgt die Verarbeitung auf Grundlage der geltenden datenschutzrechtlichen Vereinbarungen; erforderliche Drittlandübermittlungen werden nur auf Basis der vorgesehenen Garantien durchgeführt.
4. Required storage in the browser
We do not use analytics, advertising or social-media tracking cookies. For functions that are explicitly used, only the information required for those functions is stored in the browser.
- Shopping cart: Product numbers and quantities so that the selection is retained.
- Order enquiry: a one-time identifier to prevent duplicate enquiries.
- Contact form: after successful sending, information is stored for a short time to prevent immediate duplicate submissions.
- Voluntarily activated functions: the selected status may be stored in the browser so that the function remains available as requested.
- Portal login: the information required for the signed-in session so that the requested portal access functions.
This storage is necessary for the respective requested function and is based on Section 25(2) no. 2 TDDDG. Without the voluntary storage option, a partner/referral assignment applies only to the current visit. Storage for up to 30 days takes place only if the user expressly activates this option; the legal basis is Section 25(1) TDDDG.
5. Contact form
For contact and consultation enquiries, we process the information entered in the form, in particular name, email address and message, as well as optional information such as telephone number, company and area of use. Information required for sending, such as the time and page address, may also be processed.
We use an email delivery service to send and deliver the message. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and otherwise Article 6(1)(f) GDPR. Our legitimate interest is the efficient and secure handling of incoming enquiries. Data-protection consent is not the legal basis for sending a normal enquiry; the privacy information is provided with the form.
If the email service used or its subcontractors process data outside the European Economic Area, the transfer takes place only on the basis of the data-protection safeguards provided for this purpose.
To protect the contact form against automated submissions and abuse, we use Cloudflare Turnstile. For this purpose, Turnstile processes technically necessary security and connection signals, in particular IP address, TLS/browser characteristics, user agent, site key and request origin. Turnstile does not process form entries as form content. The check is used exclusively to prevent bots and abuse and is based on Art. 6(1)(f) GDPR. Further information is available in Cloudflare’s Turnstile Privacy Addendum.
6. Warenkorb und Bestellung
Im Checkout verarbeiten wir die eingegebenen Stamm- und Kontaktdaten, Rechnungs- und gegebenenfalls Lieferadresse, Warenkorbpositionen, gegebenenfalls eine Partner-/Empfehlungszuordnung, die dokumentierte Kenntnisnahme der Rechtstexte sowie eine einmalige Anfragekennung. Preise, Steuer und Summe werden serverseitig anhand der aktuellen Produktdaten erneut ermittelt; vom Browser übermittelte Preiswerte sind nicht maßgeblich.
Wird eine Zahlung gestartet, legen wir die für Bestellung und Zahlungsart erforderlichen Vorgänge an. Bei PayPal wird der Zahlungsstatus erst nach serverseitiger Bestätigung durch PayPal als bezahlt geführt. Bei Vorkasse wird die Bestellung mit offenem Zahlungsstatus gespeichert; Bankverbindung, Betrag und Bestellreferenz werden für die Überweisung bereitgestellt. Die Verarbeitung erfolgt zur Durchführung vorvertraglicher Maßnahmen und des Bestell-/Zahlungsvorgangs auf Grundlage von Art. 6 Abs. 1 Buchstabe b DSGVO; gesetzliche Dokumentationspflichten beruhen zusätzlich auf Art. 6 Abs. 1 Buchstabe c DSGVO und Maßnahmen zum Schutz vor Missbrauch auf Art. 6 Abs. 1 Buchstabe f DSGVO.
7. Partner and referral assignment
If a partner link or partner number is used, we process the assignment in order to verify the referral and, in the event of a later order, assign it to the correct partner. Temporary protection data may be processed to prevent misuse. Evaluations are subsequently maintained only in aggregated form.
Without the voluntary storage option, the specific assignment remains active in the browser only for the current page visit. If the user activates the option “store for 30 days in this browser”, the assignment is stored locally until the stated expiry date and can be removed at any time by disabling the option or deleting the browser data.
8. Customer portal and user account
In the customer, partner and administration portal, we process the data required for registration, login, permissions and the functions enabled in each case. This may include profile and contact data, addresses, orders, documents, messages, partner/commission data and uploaded files.
Depending on the function, processing is based on Article 6(1)(b), (c) or (f) GDPR. Access is restricted to the respective authorised users. Information required for a signed-in session is retained for the duration of use.
9. Zahlungen: PayPal und Vorkasse
PayPal wird auf der Landingpage nicht bereits beim bloßen Aufruf oder beim Öffnen des Checkouts als Browser-SDK geladen. Erst wenn Du die PayPal-Zahlung ausdrücklich auswählst und den zahlungspflichtigen Bestellvorgang auslöst, erzeugt unser Server eine PayPal-Bestellung und leitet Deinen Browser zur sicheren PayPal-Zahlungsseite weiter. Ab diesem Zeitpunkt erhält PayPal die für den Zahlungsaufruf technisch erforderlichen Verbindungs- und Geräteinformationen.
When payment is started, we transmit in particular a technical checkout reference, the amount calculated server-side and the currency to PayPal. If you use PayPal Express, you choose the shipping address and payment method in your PayPal account. After your approval, PayPal provides us with the buyer and shipping data made available for processing the order, in particular name, email address and shipping address; a telephone number is only used if PayPal provides it for the specific payment transaction. Manual entry remains available for companies or a different billing address.
After your approval and return, the payment status is checked server-side directly with PayPal and the payment is captured if required; only a successfully confirmed payment is recorded as paid in OPTILeMO. The client secret and server-side PayPal credentials are not exposed to the browser. Buyer and shipping data confirmed by PayPal are then processed in OPTILeMO to create the customer, order, invoice and shipping workflow.
PayPal processes additional data required for payment under its own responsibility. This may include account, payment, device, connection and transaction data. We do not receive PayPal passwords or complete card or bank access details stored with PayPal. In our system we store in particular the payment provider, PayPal order and payment references, payment status, amount, currency, contact and shipping data provided by PayPal for the order, and timestamps required for evidence, accounting and error handling.
The provider for users in the European Economic Area is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal processes personal data arising at PayPal as an independent controller in accordance with its privacy statement. The legal basis for data we process for payment handling is Art. 6(1)(b) GDPR; legally required payment and accounting records additionally rely on Art. 6(1)(c) GDPR, and fraud and abuse prevention measures on Art. 6(1)(f) GDPR.
PayPal may also process data outside the European Economic Area in accordance with its privacy statement and describes the safeguards used for this there. Further information: PayPal Privacy Statement.
Bei Vorkasse verarbeiten wir die für Bestellung, Rechnung, Zahlungszuordnung und Buchhaltung erforderlichen Daten. Der Zahlungsstatus bleibt bis zur tatsächlichen Verbuchung des Zahlungseingangs offen. Es werden keine Bankzugangsdaten des Kunden durch unsere Website erhoben.
10. Elektronische Widerrufsfunktion
Wenn Du die elektronische Widerrufsfunktion nutzt, verarbeiten wir Deinen Namen, die Bestell- oder Rechnungsreferenz, die von Dir angegebene E-Mail-Adresse, gegebenenfalls die Bezeichnung eines nur teilweise widerrufenen Vertragsteils sowie Datum und Uhrzeit des Eingangs. Die Angaben werden zur Entgegennahme, Dokumentation und Bestätigung des Widerrufs verarbeitet. Rechtsgrundlage ist Art. 6 Abs. 1 Buchstabe c DSGVO in Verbindung mit den gesetzlichen Pflichten zum Widerruf sowie Art. 6 Abs. 1 Buchstabe b DSGVO für die Rückabwicklung des Vertrags.
Die Daten werden nur so lange gespeichert, wie sie für die Abwicklung des Widerrufs, die gesetzlichen Aufbewahrungspflichten und die Geltendmachung, Ausübung oder Verteidigung von Rechtsansprüchen erforderlich sind. Die elektronische Eingangsbestätigung wird an die vom Verbraucher angegebene E-Mail-Adresse gesendet.
11. OPTI – KI-Assistent
OPTI is an AI assistant. The transparency obligations for interactive AI systems under Article 50 of the EU AI Act have applied since 2 August 2026. Users are therefore clearly informed before, or at the latest at the first interaction, that they are interacting with an AI system. AI-generated answers are also identified as such in the interface. Answers may contain errors and do not replace medical, legal, tax or other professional advice.
When an enquiry is made, the message and the conversation and page context required to answer it are transmitted to the AI service provider we use. We do not store the content of the public OPTI chat as a permanent chat history. Data used to protect against misuse are deleted after two hours at the latest.
According to the contractual information provided by the AI service provider used, transmitted content is not used to train the provided models without the corresponding consent. Where data are processed outside the European Economic Area, this takes place on the basis of the data-protection safeguards provided for that purpose.
The legal basis is Article 6(1)(f) GDPR for providing secure, user-friendly digital guidance and Article 6(1)(b) GDPR insofar as OPTI provides pre-contractual product information on request. OPTI does not make solely automated decisions with legal or similarly significant effects within the meaning of Article 22 GDPR.
12. Externe Medien und Links
Einzelne Bilder oder Vorschaumedien können von externen Medienquellen geladen werden. Dabei erhält der jeweilige Anbieter die für die Übertragung erforderlichen Verbindungsdaten, insbesondere die IP-Adresse und Browserinformationen. Diese Einbindungen dienen der Darstellung und Quellenzuordnung und beruhen auf Art. 6 Abs. 1 Buchstabe f DSGVO. Externe Quellen- und Videolinks werden erst nach einer bewussten Nutzeraktion geöffnet. Bei einem von Dir ausdrücklich gestarteten Event-Video kann – je nach hinterlegter Quelle – ein Player von YouTube (Google) oder Vimeo geladen werden. Erst mit diesem Klick wird eine Verbindung zum jeweiligen Anbieter hergestellt; dabei können insbesondere IP-Adresse, Browser-/Geräteinformationen sowie die aufgerufene Seite an den Anbieter übermittelt werden. Für die weitere Verarbeitung gelten die Datenschutzinformationen des jeweiligen Anbieters.
13. Empfänger und Dienstleister
Personal data is received only by bodies and service providers that need it for the respective purpose. These may include providers for hosting, email delivery, user accounts and AI functions and, for a specific order, shipping and payment service providers. Payment service providers such as PayPal generally process data arising for their own payment services according to their own privacy information and not merely as technical processors acting for OPTILeMO.
Where service providers process data outside the European Economic Area, we use the safeguards provided for under the respective contractual relationship, in particular adequacy decisions, the EU-US Data Privacy Framework where applicable, or EU Standard Contractual Clauses. The processing and transfer terms of the providers used are regularly reviewed for currency.
14. Speicherdauer
We store personal data only for as long as they are required for the respective purpose or statutory retention obligations apply. Contact enquiries are reviewed regularly after communication has ended and deleted if there is no longer a business relationship or evidentiary obligation. Non-binding order enquiries and leads resulting from them are deleted or anonymised as soon as they are no longer required for initiating a relationship; where a contract is concluded, commercial and tax-law retention obligations apply. Portal account data are generally required for the duration of the account or business relationship and are subsequently deleted or blocked in accordance with statutory obligations.
Data used to protect the AI assistant against misuse are deleted after two hours at the latest; corresponding protection data for order enquiries and referral functions after 24 hours at the latest. A voluntarily activated partner assignment is valid for no more than 30 days. Data stored in the browser can be deleted using the respective functions or browser settings.
15. Rechte betroffener Personen
Subject to the statutory requirements, data subjects have in particular the right of access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, consent may be withdrawn at any time with effect for the future. To exercise these rights, a message to the following is sufficient: info@optilemo-vertrieb.de.
In addition, there is a right to lodge a complaint with a data protection supervisory authority. For the company’s registered office, the competent authority is in particular:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Straße 35, 70191 Stuttgart
Email: poststelle@lfdi.bwl.de
16. Pflicht zur Bereitstellung und automatisierte Entscheidungen
Required fields in contact, order and portal forms are necessary to provide the requested function. Without this information, the enquiry or portal function cannot be processed. No solely automated decision with legal or similarly significant effects takes place in the public processes described here.
17. Sicherheit und Aktualisierung
We take appropriate measures to protect personal data against unauthorised access, loss and misuse. This Privacy Policy is updated when relevant processing activities change.
Stand: 18. Oktober 2026.