Privacy Policy
1. Privacy at a glance
The protection of your personal data is very important to us. We treat your personal data confidentially and in accordance with the statutory data protection regulations (GDPR, BDSG) and this privacy policy.
2. Data controller
The controller responsible for data processing on this website is:
setart GmbH
Ober-Eschbacher-Straße 118
61352 Bad Homburg
Phone: +49 (0) 6172 - 27 15 87 -0
Email: office@setart.de
3. Hosting & server log files
This website is hosted by IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany). The contact form and the database in which enquiries are stored also run on IONOS servers (see section 7).
When you visit the website, IONOS automatically collects information in server log files that your browser transmits: browser type and version, operating system, referrer URL, time of the server request and IP address. This data is used to ensure error-free delivery and security and is not merged with other data sources. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure and reliable provision of the website). The log data is stored only for a limited period and then deleted automatically.
A data-processing agreement pursuant to Art. 28 GDPR is in place with IONOS.
4. Cookies
This website itself and the GoatCounter visitor-analytics service we use (section 5) set no cookies. Cookies may only be set once you consent to Google Analytics (section 6) or actively load the Google Maps map on the contact page (section 10).
When you fill in the contact form, your browser temporarily stores your input locally on your device (local storage) so that it is not lost if the page is reloaded by accident. This data is not transmitted to us and is deleted automatically once the form has been sent. You can also delete it at any time in your browser settings.
We also store your Google Analytics consent decision locally in your browser (local storage, key “setart_consent”) so you are not asked again on every page view. This storage is technically necessary to provide the service you requested (remembering your cookie choice) under § 25 (2) no. 2 TDDDG and therefore does not itself require separate consent.
5. Visitor analytics (GoatCounter)
To understand how often our website is visited and which pages are popular, we use the open-source service GoatCounter (operated by Martin Tournoij, the Netherlands). GoatCounter deliberately avoids cookies and any form of cross-device recognition of individual visitors.
Only aggregated, anonymous information is collected: the page visited, the referring website, an approximate location (country/city), and browser and device type. GoatCounter uses your IP address only briefly to process the request and does not store it, so no personal identification is possible. There is no tracking across different websites.
The legal basis is our legitimate interest (Art. 6 (1) (f) GDPR) in statistically evaluating usage behaviour to improve our offering. Since no personal data is stored and no cookies are set, no consent is required under § 25 TDDDG.
Further information: goatcounter.com/privacy.
6. Google Analytics
In addition to the anonymous GoatCounter measurement (section 5), and only with your prior consent, we use the web analytics service Google Analytics (Google Analytics 4) provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
Google Analytics uses cookies that enable an analysis of your use of our website. The information generated by the cookie about your use of this website is generally transmitted to a Google server and processed there. This includes, among other things: pages visited, time spent, an approximate location (country/region/city, derived from a truncated IP address), technical information about your browser, operating system and device, and the referring website or advertising source through which you found us.
IP anonymisation is enabled on this website: your IP address is truncated by Google within member states of the European Union or other states party to the Agreement on the European Economic Area before being transmitted to the USA. It is not combined with other Google data, and we cannot directly identify you from it.
International data transfer: a transfer of personal (pseudonymised) data to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework (European Commission adequacy decision, Art. 45 GDPR); the European Commission’s Standard Contractual Clauses (Art. 46 GDPR) are additionally in place.
The legal basis is exclusively your consent (Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG), given via the cookie banner or cookie settings on this website. Without your consent, no Google Analytics script is loaded and no corresponding cookies are set. You can withdraw your consent at any time with effect for the future by changing your selection via the “Cookie settings” link in this website’s footer; withdrawal is as easy as giving consent.
Retention: user and event data linked to cookies is automatically deleted by Google after 14 months. We store your consent decision locally in your browser until you change it (see section 4).
A data-processing agreement pursuant to Art. 28 GDPR is in place with Google (Google Ads Data Processing Terms).
Objection/opt-out: you can additionally prevent data collection by Google Analytics by installing the Google Analytics opt-out browser add-on: tools.google.com/dlpage/gaoptout. Further information on how Google Analytics handles user data can be found in Google’s privacy policy: policies.google.com/privacy and at support.google.com/analytics/answer/6004245.
7. Contact form
If you send us enquiries via the contact form, we process the details you provide (name, email address, optionally phone number and subject, optional project details such as event, event location, event date, stand size and budget, and your message) for the purpose of handling your enquiry and in case of follow-up questions.
Storage and notification: Your enquiry is transmitted in encrypted form to our web server at IONOS (see section 3), stored there in a database and additionally sent as an email to our mailbox.
Our mailbox is operated by Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). A data-processing agreement pursuant to Art. 28 GDPR is in place with Microsoft (Microsoft Products and Services Data Protection Addendum). A transfer of personal data to Microsoft Corporation in the USA cannot be ruled out. Such transfers are based on Microsoft’s certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and on the European Commission’s Standard Contractual Clauses (Art. 46 GDPR).
Protection against abuse: To limit too many enquiries in a short time (e.g. spam), we store a pseudonymised value (hash) of your IP address for a maximum of 24 hours when you submit the form. The IP address itself is not stored. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in preventing spam and abuse).
The legal basis is Art. 6 (1) (b) GDPR (performance of pre-contractual measures) and Art. 6 (1) (f) GDPR (legitimate interest in efficiently handling enquiries). You may object to future processing at any time.
Retention: In the database, your enquiry is deleted automatically 6 months after it was received. We delete the email in our mailbox no later than 6 months after the last contact if it does not lead to an order. If an order is placed, we keep the correspondence for the statutory retention periods (up to 6 or 10 years under the German Commercial Code and Fiscal Code).
8. Enquiries by email or phone
If you contact us by email or phone, we process your enquiry including the personal data it contains (e.g. name, contact details, content of the enquiry) for the purpose of handling your request. Emails arrive in our mailbox at Microsoft 365 (see section 7). We do not pass this data on without your consent.
The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively handling the enquiries addressed to us (Art. 6 (1) (f) GDPR).
The data remains with us until you ask us to delete it or the purpose for storing it no longer applies (e.g. once your request has been dealt with). Mandatory statutory provisions, in particular retention periods, remain unaffected.
9. Job applications
You can apply to us by email, for an advertised position or speculatively. We process your application data (e.g. contact details, cover letter, CV, references and any other documents you send us) solely to carry out the application process. Only the people involved in the selection have access to it.
The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into an employment relationship) in conjunction with § 26 BDSG. If you voluntarily provide special categories of personal data (e.g. information on a severe disability), we process it on the basis of Art. 9 (2) (b) GDPR.
If you are hired, your data is transferred to your personnel file. Otherwise, we delete your application documents no later than 6 months after the process has ended; this period serves to defend against possible claims under the German General Equal Treatment Act (AGG). Longer storage, for example for future vacancies, only takes place with your explicit consent, which you can withdraw at any time.
10. Google Maps
On the contact page you can load a map from the Google Maps service (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) showing our location. The map is not loaded automatically, only when you click “Load map”. Before that, no data is transmitted to Google.
After the click, data — in particular your IP address — is transmitted to Google and may be processed and stored there; Google may set cookies or store information on your device. Data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR).
The legal basis is your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG), which you give by clicking. Consent applies only to the current page view and is not stored; on your next visit the map is only loaded after another click.
Alternatively, you can open our location directly in Google Maps via a simple link. Further information on how Google handles user data can be found in Google’s privacy policy: policies.google.com/privacy.
11. SSL / TLS encryption
For security reasons and to protect the transmission of confidential content, this site uses SSL / TLS encryption. You can recognise an encrypted connection by the “https://” in your browser’s address bar.
12. Your rights
You have the following rights regarding your personal data:
– Right of access (Art. 15 GDPR)
– Right to rectification (Art. 16 GDPR)
– Right to erasure (Art. 17 GDPR)
– Right to restriction of processing (Art. 18 GDPR)
– Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object to this processing at any time on grounds relating to your particular situation.
Withdrawal of consent (Art. 7 (3) GDPR): You can withdraw any consent you have given at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights, an informal message to office@setart.de or to the address given in section 2 is sufficient.
Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information), Postfach 31 63, 65021 Wiesbaden, Germany, datenschutz.hessen.de.
13. Changes to this privacy policy
We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or in order to implement changes to our services.
Last updated: October 2026