Privacy Policy

JH Internet GmbH / VENDY1 – Last updated: 14 July 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

JH Internet GmbH

Oskar-von-Miller-Str. 5, 92507 Nabburg, Germany

Phone: +49 160 97959441 · Email: info@vendy1.de

Website: https://www.vendy1.de

A data protection officer has not been appointed, as the legal requirements for mandatory appointment (Section 38 BDSG) are not met. For data protection enquiries, please contact us using the details above.

2. General Information on Data Processing

2.1 Personal Data

Personal data means any information relating to an identified or identifiable natural person, in particular name, address, email address, telephone number, customer and order data, payment data, communication content, IP address, device information, online identifiers as well as usage and interaction data.

2.2 Legal Bases

Processing is carried out, depending on the operation, on the basis of Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interests). Where cookies or similar technologies that are not technically necessary are used, access to your device is only carried out with your consent pursuant to Section 25(1) TDDDG; technically necessary technologies are used on the basis of Section 25(2) TDDDG.

2.3 Recipients and Data Processing

We engage service providers who support us in the areas of hosting, shop operations, payment processing, shipping, CRM, support, appointment scheduling, analytics, advertising, automation and IT security. Where these providers process data on our behalf, we enter into data processing agreements pursuant to Art. 28 GDPR. Where providers pursue their own purposes or are jointly responsible with us, we provide separate information accordingly.

2.4 Third-Country Transfers

In the case of certain services, data may be transferred to countries outside the EU or EEA, in particular the USA. Such transfers only take place where the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision, certification under the EU-US Data Privacy Framework, EU standard contractual clauses or your explicit consent.

3. Data Collection When Visiting the Website

3.1 Server Log Files

When you visit our website for purely informational purposes, we collect data that your browser automatically transmits: page/file accessed, date and time, amount of data transferred, referring page, browser, operating system, IP address, requesting provider and HTTP status code. This processing is necessary to display the website and to ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR.

3.2 SSL/TLS Encryption

For security reasons, our website uses SSL or TLS encryption, recognisable by "https://" and the lock symbol in the browser bar.

4. Hosting, Infrastructure and Content Delivery

4.1 Hosting (Mittwald)

We host our website and online shop with Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany. Mittwald processes website, shop, server and log data required for operation, security, maintenance and delivery on our behalf. The legal basis is Art. 6(1)(f) GDPR; a data processing agreement is in place.

4.2 Cloudflare (CDN and Security)

We use Cloudflare by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, for faster, more stable and secure delivery of the website and to defend against attacks. IP address, access, device and security data may be processed. The legal basis is Art. 6(1)(f) GDPR; for transfers to the USA, appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place.

4.3 Cloudflare Turnstile (Spam and Bot Protection)

To protect forms against spam and automated abuse, we use Cloudflare Turnstile (Cloudflare, Inc.). Technical data such as IP address, browser and device information and interaction data may be processed. The legal basis is Art. 6(1)(f) GDPR; where consent pursuant to Section 25(1) TDDDG is required, we obtain it.

5. Cookies and Consent Management

5.1 General

Our website uses cookies and similar technologies. Technically necessary technologies (e.g. shopping cart, login, security, consent documentation) are used on the basis of Section 25(2) TDDDG and Art. 6(1)(f) GDPR. Non-essential technologies (analytics, marketing, embedded content) are only used with your consent (Section 25(1) TDDDG and Art. 6(1)(a) GDPR).

5.2 Cookiebot CMP (Usercentrics)

To obtain and document consent, we use "Cookiebot CMP" by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Data processed includes consent ID, consent decision, date/time, browser and device information, anonymised IP address and information about the services used. The legal basis is Art. 6(1)(c) and (f) GDPR; access to technically necessary consent cookies is based on Section 25(2) TDDDG. You can change or revoke your consent at any time via the cookie settings with effect for the future.

6. Contact, CRM and Support

6.1 Contact Form, Email and Phone

When you contact us, we process the data you provide (in particular name, contact details, company, enquiry, order or customer number, communication content). The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR.

6.2 WhatsApp Business

You can contact us via WhatsApp Business. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (Meta group of companies). Data processed includes mobile phone number, profile name, communication content and time of communication. The legal basis is Art. 6(1)(b) or (f) GDPR. Data may also be transferred to Meta Platforms, Inc. in the USA; appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place.

6.3 Pipedrive (CRM)

To manage enquiries, leads, quotes and sales processes, we use Pipedrive by Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia. Data processed includes name, company, contact details, communication history as well as quote and order data. The legal basis is Art. 6(1)(b) and (f) GDPR; a data processing agreement is in place.

6.4 Zapier (Automation)

To connect systems and automate internal workflows, we may use Zapier by Zapier, Inc., San Francisco, USA. Depending on the workflow, data processed may include name, email address, telephone number, company as well as enquiry, appointment or order data. The legal basis is Art. 6(1)(b) or (f) GDPR; a data processing agreement is in place; for transfers to the USA, appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place.

7. Online Appointment Scheduling (Cal.com)

For online appointment scheduling (e.g. consultation appointments, live demos), we use Cal.com by Cal.com, Inc., San Francisco, CA, USA. Data processed includes name, email address, telephone number, company, preferred appointment, time zone and your enquiry. The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR. Cal.com is an open-source platform; appointment scheduling takes place via infrastructure hosted by Cal.com. For transfers to the USA, appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place.

8. Customer Account and Shop Functions (Shopware)

Our online shop is based on Shopware by shopware AG, Ebbinghoff 10, 48624 Schöppingen, Germany. When creating a customer account and placing orders, we process name, address, email address, password, order history, billing and delivery addresses, shopping cart, payment and shipping status as well as technical session data. The legal basis is Art. 6(1)(b) GDPR; for technically necessary shop cookies, Section 25(2) TDDDG applies. Where Shopware acts as a data processor, a corresponding agreement is in place.

9. Advertising to Existing Customers

If you purchase goods or services from us and provide your email address, we may send you offers for similar goods or services by email, provided you have not objected. The legal basis is Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG. You may object to this use at any time without incurring any costs other than the transmission costs at basic rates.

10. Order Processing, Shipping, Payment and Financing

10.1 Contract and Order Processing

To process your order, we process name, billing and delivery address, contact details, order, payment, shipping and invoice data, customer number and, where applicable, company data. The legal basis is Art. 6(1)(b) GDPR; where retention obligations exist, additionally Art. 6(1)(c) GDPR.

10.2 Shipping Service Providers

For delivery, we pass on the necessary data to shipping and logistics service providers, in particular name, delivery address, email address, telephone number, shipment and scheduling data. Providers used include Cargoboard GmbH & Co. KG, Technologiepark 22, 33100 Paderborn, and United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss. The legal basis is Art. 6(1)(b) GDPR; the sharing of email address or telephone number for delivery notification is based on Art. 6(1)(a) or (f) GDPR.

10.3 Payment Service Providers (PayPal, Stripe, Klarna)

Depending on the payment method chosen, payment, contact, billing and transaction data, shopping cart contents, IP address and, where applicable, credit data are transmitted to the respective provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland; Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. The legal basis is Art. 6(1)(b) GDPR; for credit or fraud prevention checks, Art. 6(1)(f) GDPR. The respective provider may be independently responsible for certain processes; their own privacy policies apply in addition.

10.4 Credit Checks (Creditreform)

Where we provide services in advance (e.g. purchase on account, instalment payments, hire purchase or leasing initiation), we reserve the right to conduct a credit check. For this purpose, we may transmit the necessary data (name, address, company and contact details, contract and payment information) to Creditreform Regensburg, Villastraße 4, 93055 Regensburg. The legal basis is Art. 6(1)(f) GDPR.

The report may contain probability values (scores). Where such a score leads to an exclusively automated decision with legal effect or similarly significant impact (e.g. automatic rejection of a payment method), this only occurs under the conditions of Art. 22 GDPR; you have the right to human intervention, to state your own point of view and to contest the decision.

10.5 Debt Collection

In the event of outstanding debts, we may pass on the data required for enforcement to a debt collection agency or legal service provider, in particular to Creditreform Regensburg. The legal basis is Art. 6(1)(b) and (f) GDPR.

10.6 Financing and Leasing Partners (LeasFinanz, finyo)

If you enquire about a leasing, hire purchase or financing solution, we transmit the data required for this purpose (in particular company, contact, object, credit and financing data) only upon your request or with your consent to the respective partner. Partners include: LEASFINANZ GmbH & Co. KG, Siemensstraße 56, 59199 Bönen; finyo GmbH, Roonstraße 23a, 76137 Karlsruhe (Mannheim District Court, HRB 749746). These partners process your data in the course of financing initiation and processing as independent controllers and may forward it to leasing companies, banks and credit agencies for identity and credit checks; automated decisions (Art. 22 GDPR) may occur. Their own privacy policies apply to further processing. The legal basis for our transmission is Art. 6(1)(b) GDPR and, where necessary, Art. 6(1)(a) GDPR.

11. Analytics and Tracking

11.1 Google Tag Manager

We use Google Tag Manager by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for centralised management of website tags. Non-essential tags are only triggered with your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG). For third-country transfers, appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place.

11.2 Google Analytics 4 and Consent Mode

We use Google Analytics 4 by Google Ireland Limited to analyse website usage (including page views, session duration, clicks, conversions, technical device information, approximate location data). IP addresses are processed in truncated form; nevertheless, data may be transferred to Google LLC in the USA. Use is only carried out with your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG). Via Google Consent Mode, your consent status is transmitted to Google and non-essential functions are only activated with your consent. A data processing agreement is in place; for transfers to the USA, appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place.

12. Online Advertising

12.1 Google Ads

We use Google Ads including conversion tracking and remarketing by Google Ireland Limited. Cookies, online identifiers, IP address, device and browser information, click and conversion data, pages visited, shopping cart contents and order values may be processed. Where we use Enhanced Conversions, data you provide (e.g. email address) may be hashed before transmission. Use is only carried out with your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG); for transfers to the USA, appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place.

12.2 Meta Pixel (Facebook/Instagram)

We use the Meta Pixel by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (Meta group of companies) to measure the effectiveness of our advertising on Facebook and Instagram and to create target audiences (Custom Audiences, Lookalike Audiences). Cookies may be set and online identifiers, IP address, device and browser information, pages visited and interaction data may be processed. Data may also be transferred to Meta Platforms, Inc. in the USA; appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place. Use is only carried out with your consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG).

13. Embedded Content and Features

13.1 Videos (YouTube, Vimeo)

We embed videos from YouTube (Google Ireland Limited; enhanced privacy mode "youtube-nocookie") and Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA). When playing videos, IP address, device and browser information, referrer and interaction data may be transmitted to the respective provider. Embedding is only activated with your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); for transfers to the USA, appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place.

14. Social Media Presences

We maintain online presences on social networks, in particular Facebook and Instagram (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) and YouTube (Google Ireland Limited). When interacting with our profiles, we process the data provided (profile/username, public profile information, messages, comments, interaction data). The legal basis is Art. 6(1)(f) GDPR, for contract-related enquiries additionally Art. 6(1)(b) GDPR. The platform operators also process data for their own purposes; joint responsibility may exist for statistical functions.

15. Job Applications

For job applications, we process the submitted application data (name, contact details, cover letter, CV, certificates, qualifications, communication data) for the purpose of conducting the application process. The legal basis is Section 26 BDSG and Art. 6(1)(b) GDPR; for longer storage, Art. 6(1)(a) GDPR. After conclusion of the process, data is deleted unless retention obligations exist, no legal claims are asserted and no consent to longer storage has been given.

16. Legal Obligations and Retention

We process and store data insofar as this is necessary for the fulfilment of legal obligations, in particular commercial and tax law retention obligations. The legal basis is Art. 6(1)(c) GDPR. Documents relevant under commercial and tax law are generally retained for six or ten years. Data for the assertion, exercise or defence of legal claims may be stored for the duration of the applicable limitation periods.

17. Storage Duration

We store personal data only for as long as is necessary for the respective purposes or statutory retention obligations exist. For consent, until revocation; for contractual data, for the duration of the contract plus statutory periods; for legitimate interests, until an effective objection or the interest ceases to apply.

18. Your Rights

Subject to the statutory requirements, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), notification (Art. 19), data portability (Art. 20), withdrawal of consent (Art. 7(3)) and objection (Art. 21) as well as the right not to be subject to a decision based solely on automated processing (Art. 22). To exercise these rights, a message to: JH Internet GmbH, Oskar-von-Miller-Str. 5, 92507 Nabburg, Email: info@vendy1.de is sufficient.

19. Withdrawal of Consent

You may withdraw any consent given at any time with effect for the future; the lawfulness of the processing carried out prior to the withdrawal remains unaffected. You can change or withdraw your consent to cookies and tracking at any time via the cookie settings on our website.

20. Right to Object under Art. 21 GDPR

Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, or the processing serves the assertion, exercise or defence of legal claims. You may object to direct marketing at any time.

21. Right to Lodge a Complaint with the Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority generally responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)

Promenade 18, 91522 Ansbach, Germany

Phone: +49 981 180093-0 · Email: poststelle@lda.bayern.de · https://www.lda.bayern.de

22. Currency and Changes to this Privacy Policy

We update this privacy policy when our website, processes, service providers used or legal requirements change. The current version published on our website applies.