Privacy policy
1. Controller and scope
The controller responsible for data processing on these websites and in our business operations is:
Lehm-Laden GmbH & Co. KG
Am Räsenberg 3
29456 Hitzacker, Germany
Phone: +49 5862 987850
Email: info@lehm-laden.de
Commercial register: Lüneburg Local Court, HRA 203718
This privacy policy applies to the websites www.lehm-laden.de and hanf-kalksteine.de and to communication with us by email, phone, chat and video consultation. Both websites run on the same shop and inventory management system. Where the websites differ, this is stated in the relevant section.
We have not appointed a data protection officer, as we are not legally required to do so. For any questions about data protection, please contact us using the details above.
2. Hosting and server log files
Our online shop, customer accounts, live chat and inventory management run on the Odoo software. The system is maintained by our IT service provider openfellas; the servers are located in a data centre operated by Hetzner Online GmbH in Germany. For automated processes (e.g. assigning incoming emails, internal reports) we also operate our own server at IONOS SE, Montabaur, Germany. All of these service providers act on our behalf under a data processing agreement (Art. 28 GDPR).
When you visit our websites, your browser automatically transmits data that is stored in server log files: IP address, date and time, page visited, referrer URL, browser and operating system. We need this data to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted automatically after a short period unless they are needed to investigate a security incident.
The connection to our websites is encrypted using TLS (indicated by “https://” and the padlock symbol in your browser).
3. Cookies and consent management
We use cookies and similar technologies. We set technically necessary cookies on the basis of Section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 6(1)(f) GDPR. These include:
session_id– session, shopping basket and login to your customer accountfrontend_lang,tz– selected language and time zonevisitor_uuid,im_livechat_history– linking your visit and live chat history- the cookie of our consent management tool, which stores your choice
We only use all other cookies and services for statistics and advertising (sections 13 to 16) if you have given your consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw or change your consent at any time with effect for the future by opening the cookie settings again. You will find an overview of all cookies in our cookie declaration.
For consent management we use CookieFirst (Digital Data Solutions B.V., Netherlands). CookieFirst stores your choice, a timestamp and an anonymised identifier so that we can demonstrate your consent (Art. 6(1)(c) GDPR). CookieFirst acts on our behalf.
On hanf-kalksteine.de we do not use any statistics or advertising services; only technically necessary cookies are used there.
4. Contact forms, email and file uploads
If you write to us using a form (e.g. contact, consultation, freight enquiry, quantity calculator, partner programme) or by email, we process your details – usually your name, email address, phone number if provided, company, address of the building project, your message and uploaded files such as plans or photos – in order to handle your enquiry. The enquiry is stored in our customer management system (Odoo).
The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or a quotation; otherwise it is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Please only upload files that are needed for your enquiry.
If you request the quantity calculator, we send you a one-off invitation email in your language. This is part of handling your enquiry and is not a newsletter.
5. Live chat
On lehm-laden.de we offer a live chat. In doing so, we process the chat history, the time and any details you provide in the chat (e.g. name or email address). The chat runs on our Odoo system (section 2). The legal basis is Art. 6(1)(b) or (f) GDPR.
6. Phone and AI phone assistant (voicebot)
For telephony we use the phone system of Zadarma (IP Telecom Bulgaria LTD, Bulgaria). This involves processing your phone number and the time and duration of the call. Calls with our staff are not recorded.
If we are unavailable (e.g. outside business hours or when all lines are busy), an AI-based voice assistant provided by fonio GmbH answers the call. At the start of the call, the assistant informs you that you are speaking to a digital assistant. The following is processed:
- your phone number and the time and duration of the call
- your speech, which is converted into text in real time – the audio file is not stored
- a text transcript or summary of the call
- personal details you provide during the call (e.g. name, email address, building project)
The transcript or summary is sent to us by email so that we can call you back or prepare a quotation. fonio processes the voice data on servers in Germany. Zadarma and fonio act on our behalf (Art. 28 GDPR).
The legal basis is our legitimate interest in being easy to reach (Art. 6(1)(f) GDPR); if the call concerns an enquiry or order, also Art. 6(1)(b) GDPR. We keep transcripts until your request has been dealt with and no statutory retention obligations apply any longer. If you do not wish to speak to the assistant, you can end the call at any time and send us an email instead.
7. Video consultation
We offer consultation appointments by video conference via Google Meet (Google Ireland Limited, Dublin, Ireland). Your name, email address, image and sound during the call and connection data are processed. Calls are not recorded. The legal basis is Art. 6(1)(b) GDPR. Google acts on our behalf.
8. Orders, quotations and customer account
When you place an order, receive a quotation or create a customer account, we process the data required for this: name, company and VAT ID number if applicable, billing and delivery address, email address, phone number, order and payment information and our correspondence with you. The legal basis is Art. 6(1)(b) GDPR and, where statutory retention obligations apply, Art. 6(1)(c) GDPR.
You can have your customer account deleted at any time; a short message to info@lehm-laden.de is sufficient. Data that we are required to retain will be blocked until the retention period has expired.
9. Shipping companies and manufacturers
For delivery, we pass your name and delivery address on to the shipping company commissioned in each case, depending on the consignment e.g. DPD, UPS, Deutsche Post/DHL, GO! Express, Transporte & Logistik Theurer, Emons Spedition, Hellmann Worldwide Logistics, Nanno Janssen, DSV or WMG. We only pass on your phone number or email address where this is necessary to announce and arrange the delivery.
If a manufacturer delivers the goods directly to you (drop shipping), it receives your name, the delivery address and, if applicable, your phone number for this purpose. Shipping companies and manufacturers process this data as independent controllers. The legal basis is Art. 6(1)(b) GDPR.
10. Payment processing
If you pay with PayPal, you will be redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; we transmit the data required for the payment, such as order number and amount. Card payments in our shop are processed by PAYONE GmbH, Frankfurt am Main. For bank transfers, the banks involved process the payment data. Payment service providers and banks act as independent controllers. The legal basis is Art. 6(1)(b) GDPR.
11. Email delivery and newsletter
Emails from our system – e.g. order confirmations, quotations, invoices and shipping information – are delivered via the email service Mailjet (Sinch Mailjet SAS, Paris, France). Our mailboxes, documents and internal communication are hosted by Google Workspace (Google Ireland Limited, Dublin, Ireland). Both service providers act on our behalf. We do not use open or click tracking.
You will only receive our newsletter if you have subscribed and confirmed your subscription via the link in a confirmation email (double opt-in). For this purpose we store your email address and the time of subscription and confirmation. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time using the unsubscribe link in each issue or by emailing us.
12. Use of artificial intelligence
To process emails, enquiries, order documents and supplier documents more quickly, we use AI models from Anthropic PBC (San Francisco, USA) via its application programming interface. This may involve processing the content of your message and the contact details it contains, e.g. to assign a message, prepare a draft quotation or transfer the details from a business card you give us, for example at a trade fair, into our customer system.
Anthropic acts on our behalf and, according to its own information, does not use the transmitted data to train its models. The results of the AI are checked by our staff; the AI does not make decisions that have legal effects for you. The legal basis is Art. 6(1)(b) GDPR or our legitimate interest in prompt processing (Art. 6(1)(f) GDPR). For the transfer to the USA, see section 20.
13. Google Tag Manager
On lehm-laden.de we use Google Tag Manager (Google Ireland Limited, Dublin, Ireland). We use it to integrate the services described in sections 14 to 16. Tag Manager itself does not set any cookies or analyse any data; however, your IP address is transmitted to Google when it loads. The legal basis is Art. 6(1)(f) GDPR.
14. Google Analytics 4
With your consent, we use Google Analytics 4 (Google Ireland Limited, Dublin, Ireland) on lehm-laden.de to understand how our website is used and to improve it. Among other things, pages visited, time spent, origin of the visit, device, browser and approximate location are recorded; IP addresses are not stored by Google. Google sets cookies for this purpose (e.g. _ga). The data is deleted after the retention period set in Google Analytics (no more than 14 months).
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via the cookie settings.
15. Google Ads conversion tracking and remarketing
With your consent, we use Google Ads (Google Ireland Limited, Dublin, Ireland) on lehm-laden.de. This allows us to measure whether a visit via one of our ads led to an order or enquiry, and to show relevant ads on other websites to people who have visited our website. Google sets cookies for this purpose (e.g. _gcl_au).
For orders we also use “enhanced conversions”: your email address or phone number is encrypted (hashed) in your browser and transmitted to Google so that Google can match the order to an ad click. We only receive aggregated reports, no information about individual persons.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via the cookie settings.
16. Pinterest Tag
With your consent, we use the Pinterest Tag of Pinterest Europe Ltd., Dublin, Ireland, on lehm-laden.de. This allows us to measure the effectiveness of ads on Pinterest and to show relevant ads on Pinterest to visitors to our website. Among other things, pages visited, device information and a cookie identifier (e.g. _pin_unauth) are processed. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via the cookie settings. Further information: Pinterest privacy policy.
17. YouTube videos
We embed videos from our YouTube channel in privacy-enhanced mode (youtube-nocookie.com, Google Ireland Limited, Dublin, Ireland). When you open a page with a video, a connection to YouTube servers is established and your IP address is transmitted. Only when you play a video can YouTube collect further data and set cookies. If you are logged in to YouTube, YouTube can link the playback to your account. The legal basis is our legitimate interest in presenting our products clearly (Art. 6(1)(f) GDPR).
18. Google Fonts
Our websites use fonts from Google Fonts (Google Ireland Limited, Dublin, Ireland), which are loaded from Google servers when a page is opened. In the process, your IP address is transmitted to Google. No cookies are set. The legal basis is our legitimate interest in a consistent presentation (Art. 6(1)(f) GDPR).
19. Social media profiles, competitions and job applications
On our websites we link to our profiles on Facebook, Instagram, LinkedIn and YouTube. These are simple links; data is only transmitted when you click a link and visit the respective platform. The privacy policy of the platform operator applies there. Competitions on Instagram are subject to our terms of participation.
If you apply for a job with us, we process your application documents for the application procedure (Section 26 BDSG, Art. 6(1)(b) GDPR). If no employment relationship results, we delete the documents no later than six months after the end of the procedure, unless you have consented to longer storage.
20. Recipients and transfers to third countries
In addition to the service providers named above, our tax advisers and accountants receive the data required for bookkeeping (Art. 6(1)(c) GDPR). All service providers acting on our behalf are contractually bound to data protection (Art. 28 GDPR).
Some service providers (Google, Pinterest, Anthropic) are based in the USA or may transfer data there. The transfer is based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).
21. Storage period
We only store personal data for as long as is necessary for the respective purpose. We delete enquiries that do not lead to an order once they have been dealt with and no further communication is expected. Due to commercial and tax law obligations (Section 257 HGB, Section 147 AO), we retain data from orders and invoices for up to ten years, depending on the document. Storage periods of individual services are stated in the relevant section.
22. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). An informal message to info@lehm-laden.de is sufficient.
Right to object: If we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to the use of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR).
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Die Landesbeauftragte für den Datenschutz Niedersachsen (Data Protection Commissioner of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de.
You are neither legally nor contractually obliged to provide your data. However, without the details required for an order or enquiry, we cannot process it.
23. Changes
We will update this privacy policy if our data processing or the legal situation changes. Last updated: October 2026.