Privacy policy

1. Controller and data protection officer

This privacy policy explains how personal data is processed when you use valitool.org, contact us or purchase from the merchandise shop at valitool.org/shop.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

valitool GmbH

Schlunkweg 58, 50374 Erftstadt, Germany

represented by Managing Director Andreas Pelekies, MBA

Email: shop@valitool.org · Telephone: +49 2235 95190-20

Our data protection officer is Stefan Gräfe. You can contact him at datenschutz@valitool.org or by post at our address, marked “Data protection officer”.

2. Basis of processing

Personal data means any information relating to an identified or identifiable natural person. We process such data only where necessary for the relevant purpose and where a legal basis exists. The applicable legal basis is stated in each section. This policy is based on the GDPR and the German Telecommunications Digital Services Data Protection Act (TDDDG).

3. Provision of the website and server logs

When you access valitool.org, technically necessary data is processed: IP address, date and time of access, page accessed, status code, volume of data transferred, browser and operating system information, and the previously accessed page. This data is necessary to deliver the website, resolve errors and protect against abuse and attacks.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website and communication systems.

We retain technical logs for as long as they are necessary for operation, troubleshooting and security checks. Firewall logs are set to be deleted automatically after 90 days. In the event of specific security incidents, relevant logs may be retained longer until the incident has been clarified and, where applicable, any legal proceedings have been concluded.

The website is hosted by Mittwald CM Service GmbH & Co. KG in Germany. Mittwald also provides email delivery for messages from the shop.

4. Cookies and management of your privacy choices

We use cookies and similar storage that are necessary for the functions you request. These include the cart, ordering process, login, security and storage of your privacy choices. Access to your device is based on Section 25(2), point 2 TDDDG. Subsequent processing of personal data is based on Article 6(1)(b) or (f) GDPR, depending on the purpose.

Privacy choices are managed using the Complianz cookie tool. We do not use analytics, advertising or marketing cookies; optional page statistics are described in section 10. You can change your choices at any time using “Privacy settings” in the footer. You can also delete or block cookies in your browser. However, blocking necessary cookies may prevent the cart or ordering process from working fully.

5. Contact, enquiries and appointments

If you contact us using a contact form, email, telephone or your business contact details, we process your information, the contents of your message and any attachments to respond to your enquiry. Depending on the circumstances, this includes your name, company, contact details and information about your request. For enquiries concerning your own contract or steps prior to entering into it, the legal basis is Article 6(1)(b) GDPR. For other enquiries and business communication, Article 6(1)(f) GDPR applies. Our legitimate interest is the proper handling of enquiries. This also applies to requests for a sample invoice.

Required information is marked. Without it, we may be unable to process your enquiry.

We use Microsoft 365 for business email communication and appointment organisation. Sender and recipient details, message contents, attachments and technical communication data are processed. Microsoft may also process data outside the European Union; please see section 11.

For appointments, we provide a link to a Microsoft booking page. The booking service is not embedded as a form in our website. Microsoft’s privacy information additionally applies only when you open the link. When you make a booking, we process the contact and appointment details you provide to arrange and conduct the meeting. The legal basis is Article 6(1)(b) GDPR for appointments relating to a contract and otherwise Article 6(1)(f) GDPR.

6. Merchandise shop: orders and customer accounts

When you place an order, we process your name, billing and shipping address, email address, ordered items, variants, quantities, prices, tax and shipping amounts, payment method, time of order and processing status. We use voluntarily supplied telephone numbers and order notes only to communicate about and process the relevant order.

For business orders, we additionally process the company name, contact person and, if provided, VAT identification number. Please do not provide a personal tax number.

The shop uses WooCommerce software operated on our website with the Germanized extension. You can also order as a guest. A customer account is optional. For an account, we process the necessary account and access data to provide login, address management and an order overview. You may request deletion of your account. Order and invoice documents that must be retained by law are unaffected.

Legal bases: Article 6(1)(b) GDPR (steps prior to entering into and performance of a contract), point (c) (statutory retention and bookkeeping obligations), and point (f) for contacts at business customers (conducting business with the corporate customer).

Order confirmations and other messages about your order are sent using the mail server of our hosting provider, Mittwald.

7. Payment by invoice, business management and accounting

The merchandise shop accepts payment by invoice only. We process invoice data and incoming payments to perform the purchase contract and meet our bookkeeping obligations. We do not use an external invoice-payment financing provider or automated credit checks.

We manage invoices and related business documents in the Dolibarr business management software. The software is hosted by Hetzner Online GmbH in Germany. Customer, order, invoice and, where applicable, tax identification data is transferred from the shop. Merely using the software does not mean that data is transmitted to its developers. We send invoices by email as ZUGFeRD invoices.

Our accounting is handled by the tax advisory firm Hartmann & Partner, Gronau. We provide the necessary invoice, business and payment data through DATEV Unternehmen online. The tax advisers process the data to fulfil their engagement and professional obligations. When you make a bank transfer, the banks involved process payment data under their own responsibility.

Legal bases: Article 6(1)(b) and (c) GDPR.

We do not currently use external payment service providers. If further payment methods are offered in future, we will update this policy before introducing them.

VAT identification number checks. If a VAT identification number is provided, we check it using the European Commission’s VAT Information Exchange System (VIES) against the relevant national registers. This check serves tax classification and the accuracy of company and invoice data. The legal basis is Article 6(1)(f) GDPR and, where a statutory duty to check exists, additionally point (c).

8. Shipping, returns and withdrawal

For delivery, we transmit your name, delivery address and necessary shipment data to DHL Paket. We do not pass your email address or telephone number to DHL for shipping. You receive the tracking number in our shipping confirmation. You decide whether to open DHL’s tracking service; DHL’s privacy information applies to processing there.

For returns, defects and withdrawals, we process the necessary order and contact data, your declaration and, where applicable, shipment data and evidence. For a withdrawal, we process your name, information identifying the contract, your declaration, the time of receipt and, where applicable, your email address to acknowledge receipt. This also applies when using the electronic withdrawal function. No customer account is required.

Legal bases: Article 6(1)(b) and (c) GDPR and, where necessary to assert or defend specific claims, point (f).

9. Product reviews and comments

Product reviews can be submitted only by purchasers verified in the shop. We process your chosen review name, email address, review text, star rating and the technical data necessary to prevent abuse. Linking the review to the recorded purchase enables the “Verified purchase” label.

Your review text, star rating and chosen name are publicly visible. The name may be a pseudonym or your first name with the initial of your surname. Your email address is not published. Please do not include confidential information or personal data of third parties in your text.

We similarly process comments with the publication name, email address, comment text and technical data to prevent abuse. Submissions are reviewed before publication.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is meaningful feedback, informing other users and preventing abusive content. Reviews and comments are stored for as long as they are published. Additional internal data is stored only while a purpose or retention obligation exists.

10. Website statistics

a) Analysis of server logs. To improve usability and technical stability, we aggregate server logs on our own server into daily counts of visits to public pages and referring domains. Only aggregated counters are stored; data is not transmitted to third parties. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a service that meets users’ needs and is reliable.

b) Optional page statistics with consent. If you consent to the “Statistics” category in the privacy settings, we additionally collect cookie-free page statistics on our own server. We process page visits, timestamps, fixed page identifiers and a shortened IP address. No analytics cookies are set and the data is not transmitted to third parties. The legal basis is your consent under Article 6(1)(a) GDPR and, where your device is accessed, Section 25(1) TDDDG. These statistics are not collected without your consent; use of the website and shop remains unrestricted.

You can withdraw your consent at any time, with effect for the future, using “Privacy settings” in the footer. The lawfulness of processing carried out before withdrawal is unaffected.

Retention period. We delete raw data after 90 days. We retain aggregated reports for usage and time comparisons and review their necessity at least annually.

11. Recipients and transfers to third countries

Within our company, only persons who need your data for their work have access to it. Depending on the activity, external recipients include:

Processors are contractually bound in accordance with Article 28 GDPR. Our website and business management system are hosted in Germany.

Transfers to the USA. Use of Microsoft 365 and the booking service may involve processing by Microsoft group companies in the USA. For these transfers, we rely on the EU-US Data Privacy Framework where the recipient is certified under it, and on the standard contractual clauses approved by the European Commission. Further information is provided in Microsoft’s privacy terms for enterprise services. You can request a copy of the applicable safeguards from our data protection officer.

Apart from this case, no transfers to third countries currently take place. We do not currently embed videos or maps from external providers on our website.

For links to other websites, such as shipment tracking or appointment booking, the external service opens only when you follow the link. The respective provider’s privacy information applies to processing there.

12. Retention periods

We delete personal data once its purpose ceases to apply and no statutory retention obligations prevent deletion. The following periods or criteria apply:

Ongoing contractual matters, specific claims or statutory extensions may require longer retention. Following restoration from a backup, we reapply deletions previously carried out.

13. Your rights

Subject to the statutory conditions, you have the right to:

• access the data stored about you (Article 15 GDPR),
• rectify inaccurate data (Article 16 GDPR),
• erasure (Article 17 GDPR) and restriction of processing (Article 18 GDPR),
• data portability (Article 20 GDPR),
• object to processing based on Article 6(1)(e) or (f) GDPR on grounds relating to your particular situation (Article 21 GDPR). You may object to direct marketing at any time without giving reasons.

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal is unaffected.

To exercise your rights, contact shop@valitool.org or our data protection officer. If we have doubts about your identity, we will request suitable information to verify it.

Right to lodge a complaint. You may complain to a data protection supervisory authority, particularly in the place of your residence, workplace or an alleged infringement. The competent authority for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (www.ldi.nrw.de).

Obligation to provide data. Information marked as required is needed for the relevant function, enquiry or order. Without it, we may be unable to process your order, customer account or enquiry.

14. Automated decisions, newsletters and changes

No decision based solely on automated processing with legal or similarly significant effects, including profiling, takes place in the activities described.

We do not send newsletters. Contacting us, requesting a sample invoice, registering or placing an order does not result in a newsletter subscription.

We update this privacy policy when our services or legal requirements change. The version published on valitool.org applies.

Last updated: 13 October 2026