Privacy policy

1. Responsible Party

Roman Kobosil // DrainMaster
c/o IP-Management #8351
Ludwig-Erhard-Str. 18
20459 Hamburg, Germany

E-mail: [email protected]
Phone: +49 30 83797726
Imprint: https://drain-master.de/en/imprint/

We have not appointed a data protection officer because the legal requirements for doing so are not met. For all questions regarding data protection, please contact the address mentioned above directly.

2. Your Rights

You have the right at any time to information about the data stored about you (Art. 15 GDPR), to rectification of incorrect data (Art. 16), to deletion (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to objection against processing based on a legitimate interest (Art. 21).

You can withdraw your consent at any time: for cookies via the “Cookie Settings” link in the footer, for the newsletter via the unsubscribe link in every e-mail. The withdrawal applies to the future.

You can also lodge a complaint with a supervisory authority, for example, with the Hamburg Commissioner for Data Protection and Freedom of Information.

3. Hosting and Server Logs

Our website runs on a server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen) in Germany. When accessing each page, the server automatically processes: IP address, date and time, accessed address, amount of data transferred, browser type and operating system, as well as the previously visited page.

This data is technically necessary to deliver the site and serves security and error analysis. The legal basis is our legitimate interest in a secure, functioning offer (Art. 6 para. 1 lit. f GDPR). The logs are deleted after 14 days at the latest.

Upstream of the server is a security and acceleration service from Cloudflare Germany GmbH (Rosental 7, 80331 Munich). Cloudflare filters attacks and accelerates delivery; your IP address is processed in the process. Legal basis: Art. 6 para. 1 lit. f GDPR.

The e-mail dispatch of our system messages runs via the mail server of our hoster.

4. Cookies and Consent

We use cookies and similar technologies. We set technically necessary cookies (shopping cart, login, language selection, consent storage) on the basis of Section 25 para. 2 TDDDG and Art. 6 para. 1 lit. f GDPR without consent.

All other cookies and services, in particular analysis and advertising, are only set with your consent according to Section 25 para. 1 TDDDG and Art. 6 para. 1 lit. a GDPR. Management is handled by Borlabs Cookie (Borlabs GmbH, Rübenkamp 32, 22305 Hamburg); the software runs on our own server and stores your decision in a cookie on your device.

You can change or withdraw your selection at any time via the “Cookie Settings” link in the footer. A complete list of all services used with purpose, provider, cookie names, and duration can be found directly in the consent banner under “Individual Privacy Settings”.

5. Order and Customer Account

For an order, we process: name, billing and delivery address, e-mail address, telephone number (if provided), ordered items, payment method, and order history. We need this data to fulfill the purchase contract (Art. 6 para. 1 lit. b GDPR).

Under commercial and tax law, we are obliged to keep billing and booking data for ten years (Section 147 AO, Section 257 HGB, Art. 6 para. 1 lit. c GDPR). You can have a customer account deleted at any time; statutory retention obligations for orders already processed remain unaffected.

The shop software is WooCommerce, operated on our own server. For invoicing and accounting, we use Lexware Office (Haufe Service Center GmbH, Munzinger Str. 9, 79111 Freiburg).

Address completion: While entering your address during the ordering process, an assistant suggests suitable addresses. For this purpose, your entry is transmitted to the Places API of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The legal basis is our legitimate interest in error-free delivery addresses (Art. 6 para. 1 lit. f GDPR).

6. Payment Service Providers

Depending on the selected payment method, we pass on the data necessary for processing to the respective provider. The legal basis is the fulfillment of the contract (Art. 6 para. 1 lit. b GDPR). The providers are independently responsible for their processing.

• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg): also for credit and debit cards, Apple Pay, Google Pay, as well as the European procedures iDEAL, Bancontact, EPS, Przelewy24, Blik, MyBank, Trustly, and Multibanco. Privacy policy: https://www.paypal.com/de/legalhub/privacy-full
• Klarna (Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden). Klarna performs its own identity and credit checks for purchase on account and installment payments and may involve credit agencies for this purpose. Privacy policy: https://www.klarna.com/de/datenschutzerklaerung/
• Prepayment by bank transfer: no disclosure to third parties takes place here.

7. Shipping

For shipping, we pass on the name, delivery address and, if necessary for notification, also the e-mail address and telephone number to the commissioned shipping company (Art. 6 para. 1 lit. b GDPR):

DHL (Deutsche Post AG / DHL Group, Charles-de-Gaulle-Str. 20, 53113 Bonn). Privacy policy: https://www.dhl.de/de/privatkunden/hilfe-und-kontakt/datenschutz.html

8. Newsletter and E-mail Marketing

We send our newsletter via Klaviyo (Klaviyo Inc., 125 Summer Street, Boston, MA 02110, USA). Klaviyo processes your e-mail address, your name (if provided), as well as your order and usage data in our shop for this purpose.

Registration takes place using the double opt-in procedure: After your registration, we will send you a confirmation e-mail; only after you click on the link contained therein will we include you. We log the registration, confirmation, and time for proof. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR); you can withdraw it at any time via the unsubscribe link in every e-mail.

Performance measurement: Our e-mails contain tracking pixels and marked links. This allows us to recognize if and when a mail was opened and which links were clicked. This evaluation is part of the consent and serves to improve content and dispatch times.

Usage analysis on the website: Klaviyo also records which pages and products you view in our shop in order to align recommendations and messages accordingly. This recording only takes place if you have agreed to the “Marketing” category in the consent banner (Art. 6 para. 1 lit. a GDPR).

Klaviyo processes data in the USA. We have concluded a data processing agreement including EU standard contractual clauses; see Section 14.

9. Customer Reviews

We work with Trusted Shops (Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne). The seal of quality is integrated on our pages and the buyer protection function is offered; your IP address is processed in the process. After an order, you will receive an invitation to rate the purchase. The legal basis for the integration of the seal and the processing of the buyer protection is Art. 6 para. 1 lit. b and lit. f GDPR, for the rating invitation your consent or Section 7 para. 3 UWG. Privacy policy: https://www.trustedshops.de/datenschutz/

10. Web Analysis and Advertising

We use the following services exclusively with your consent (Art. 6 para. 1 lit. a GDPR, Section 25 para. 1 TDDDG). They will not be loaded without consent.

• Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): Reach measurement and analysis of usage behavior. The IP address is processed in shortened form. Storage duration of usage data: 14 months.
• Google Ads including conversion measurement and remarketing (Google Ireland Limited): measures the success of our ads and enables the addressing of visitors who already knew our site.
• Meta Pixel (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland): Success measurement and target group formation for advertising on Facebook and Instagram. We operate a joint processing with Meta within the meaning of Art. 26 GDPR.
• releva.nz (releva GmbH, Kaiserstr. 39, 55116 Mainz): Ad delivery on partner sites.
• Pixel Manager for WooCommerce (SweetCode GmbH): manages the technical integration of the above-mentioned measurement methods on our site.

We use Google Consent Mode: Before your consent, no identifiers are set; Google only receives an anonymous signal that no consent has been given.

11. Sales via Marketplaces

We also sell our products via Amazon and eBay. If you order there, the data protection provisions of the respective marketplace initially apply to the purchase process. We receive the data necessary for contract fulfillment (name, delivery address, order data) from there and process it for handling and accounting (Art. 6 para. 1 lit. b and lit. c GDPR). For order management, we use Billbee (Billbee GmbH, Paulinenstr. 54, 32756 Detmold).

12. Further Functions of our Website

• Read-aloud function: Texts can be read aloud on request. If the function is used, the text to be read aloud is transmitted to a speech synthesis service (including ElevenLabs Inc., USA, or Google Cloud Text-to-Speech). This only happens if you actively start the playback (Art. 6 para. 1 lit. a GDPR).
• Telephone assistant: If you call our service number, an AI-supported assistant can answer the call and record your request. Contact data, telephony metadata, audio voice data, and information on service quality are processed. The processor is fonio GmbH, Joanelligasse 5/16, 1060 Vienna, Austria; the service is hosted in Germany, a transfer to third countries is not excluded in individual cases and is secured by the data processing agreement. The legal basis is our legitimate interest in continuous telephone availability (Art. 6 para. 1 lit. f GDPR). You can request a human callback at any time.
• Sweepstakes: In case of participation, we process name, e-mail address, and the participation actions chosen by you for implementation and determination of winners (Art. 6 para. 1 lit. b GDPR). After completion and expiry of any deadlines, we delete the data.
• Partner program: For our affiliate program, we process master data of the partners as well as the orders mediated via partner links for commission billing (Art. 6 para. 1 lit. b GDPR).
• Spam protection: Forms contain an invisible additional field that recognizes automated submissions. No personal data is transmitted to third parties (Art. 6 para. 1 lit. f GDPR).
• Multilingualism: The language selection is stored in a technically necessary cookie.

13. Embedded Content and Social Networks

On individual pages, we embed third-party content: YouTube and Vimeo (videos), Instagram and Facebook (posts), Google Maps and OpenStreetMap (maps).

This content is blocked by default. Only when you release it by clicking or agree to the “External Media” category in the consent banner will it be loaded and your IP address and device information transmitted to the respective provider (Art. 6 para. 1 lit. a GDPR).

We also maintain profiles on Instagram, Facebook, YouTube, and X. If you visit these, the data protection provisions of the respective platform apply. We are jointly responsible with the platform for the processing of statistical data of our pages (Art. 26 GDPR).

14. Data Transfer to Third Countries

Some of the providers mentioned process data in the USA, in particular Klaviyo, ElevenLabs, as well as group companies of Google and Meta. For these transfers, we rely on the adequacy decision of the EU Commission on the EU-US Data Privacy Framework and, insofar as a provider is not certified there, on standard contractual clauses according to Art. 46 para. 2 lit. c GDPR.

We point out that there is no level of data protection in the USA equivalent to European law and, in particular, access by security authorities cannot be completely excluded.

15. “DrainMaster Plus” App

For our mobile app, the following applies additionally:

• Firebase Authentication and Firestore (Google Ireland Limited): Registration and storage of your plant data and measured values so that they are available across devices (Art. 6 para. 1 lit. b GDPR).
• Sentry (Functional Software Inc., USA): Recording of crashes and technical errors to improve stability (Art. 6 para. 1 lit. f GDPR).
• Bluetooth connection to compatible measuring devices. The measured values remain on your device and in your account; they are not evaluated for advertising purposes.
• The app contains no advertising or tracking services.
• An offline mode stores data locally on your device.

16. Storage Duration

We store personal data only as long as it is necessary for the respective purpose or as required by statutory retention periods:

17. Changes to this Privacy Policy

We adapt this declaration if our processing or the legal situation changes. The version published here applies in each case.

Status: August 2026