Privacy policy

This is a courtesy translation. The German version is legally binding.

We built this website to collect as little data as possible: no cookies, no advertising or tracking services, no embedded third-party content. We serve fonts, images, videos and our usage statistics exclusively from our own server in Germany. Below, in accordance with Art. 13 GDPR, we explain which personal data we process, for what purpose and on what legal basis.

1. Controller

DAS Inovations UG (haftungsbeschränkt)
Eisenbahnstraße 40-42
67655 Kaiserslautern
Germany

Represented by the managing director André Hamm
Phone: +49 631 6250 7425
Email: info@lisholz.de

Lisholz is a brand of the company named above.

2. Summary

• Visiting the website: your browser transmits technically necessary connection data. We do not keep access logs containing IP addresses.
• Usage statistics: no cookies, pseudonymisation that changes daily, on our own server. You can object at any time (section 5).
• Request basket: stored in your browser. An anonymous copy without names or contact details helps us improve our collection.
• Quotation request: we use your contact details only to answer your request and send you a quotation.
• No transfers to third countries, no sale of data, no third-party advertising.

3. Hosting and delivery of the website

Our website, database and backups run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland, in data centres in Germany. We have concluded a data processing agreement with this provider pursuant to Art. 28 GDPR. More information: Hetzner privacy policy.

When you visit the website, your browser necessarily transmits data to our server: IP address, date and time, the requested address, the previously visited page (referrer), browser and operating system (user agent) and language settings. We need this data to deliver the website, secure the connection and prevent abuse. The legal basis is our legitimate interest in a secure and functional website (Art. 6 (1) (f) GDPR).

We do not keep access logs containing IP addresses. To prevent abuse, such as mass form submissions, we briefly count requests per IP address in memory, and only as an encrypted hash. These counts are discarded after eleven minutes at the latest. Technical error logs contain no IP addresses and are continuously overwritten. All connections are encrypted with TLS.

4. No cookies – local storage in your browser

We do not set any cookies on the website. So that your request basket is kept when you reload the page or come back later, we store it in your browser's local storage: the selected pieces with wood and quantity, whether you would like a wood sample set, and a random basket ID. Names or contact details are not stored there. This storage is strictly necessary for the request basket you explicitly use (Section 25 (2) no. 2 TDDDG). The basket is emptied after you send a request. You can remove it yourself at any time or delete it in your browser settings.

If you object to the usage statistics (section 5), we also store this decision in local storage so that it applies on your next visit.

In the editorial area of the website, which is only accessible to our staff, a technically necessary session cookie is set after login.

5. Usage statistics without cookies

To understand how our website is used and to improve it, we record usage events on our own server. These include: pages viewed, sections seen, scroll depth, use of the light controls, configurator and request basket (e.g. selected piece, wood, quantity, price), the domain of the previously visited page and campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term). We never record what you type into form fields.

To count visits without recognising you, our server creates a shortened hash from your IP address, user agent and a random key. The key exists only in memory, is regenerated daily and then discarded. We do not store the IP address itself. This makes it impossible to recognise you beyond the day in question or to link the statistics to your request. We also derive the device class (smartphone, tablet or desktop) from the user agent. Nothing is stored on your device for the statistics.

The legal basis is our legitimate interest in a data-minimising analysis to improve our website and collection (Art. 6 (1) (f) GDPR). The data is analysed only by us and deleted automatically after 13 months.

Objection

You can object to the usage statistics at any time without giving reasons. This browser will then no longer send usage data or a copy of the request basket to us. If your browser sends a Global Privacy Control or Do Not Track signal, we automatically collect nothing.

6. Anonymous analysis of the request basket

We also learn which pieces and woods are in demand from baskets that are never sent. For this, your browser transmits changes to the request basket to our server: the random basket ID, the items (piece, wood, quantity), the wood sample request, timestamps and the device class. This copy contains no names, email addresses or IP addresses. If you send a request later, we link the basket to it.

The legal basis is our legitimate interest in improving our collection (Art. 6 (1) (f) GDPR). We delete anonymous baskets after 13 months. An objection under section 5 also ends this transmission.

7. Quotation request

You can use the request form to ask for a non-binding quotation. No order or payment takes place on the website. We process:

• name and email address (required)
• phone number (required if you ask for a call back or video consultation, otherwise optional)
• postcode of the delivery address and your message (optional)
• the requested pieces with wood, quantity and price, your wood sample request and preferred contact channel
• the website language, the page through which you reached us and any campaign parameters
• the time of the request and the time and version of the privacy policy you acknowledged

We use this data to handle your request, prepare a quotation and contact you via your preferred channel. The legal basis is Art. 6 (1) (b) GDPR (steps taken at your request prior to entering into a contract). Without the required details we cannot answer your request. You receive a confirmation by email; our sales team is also notified by email.

We protect the form against spam without third-party services: with an invisible check field, a minimum completion time and a limit on requests per IP address (Art. 6 (1) (f) GDPR, see section 3).

Retention: If no order results, we automatically delete your request and contact details 12 months after it was last processed. If an order results, we keep the request as part of our business correspondence for 6 years (Section 257 HGB, Section 147 AO). Invoices and accounting records are kept separately in line with the statutory periods that apply to them.

8. Contact by email or phone

If you email or call us, we process your details to answer your enquiry (Art. 6 (1) (b) GDPR for questions about an order or quotation, otherwise Art. 6 (1) (f) GDPR). Our mailboxes and the sending of confirmation emails run on servers of Hetzner Online GmbH in Germany, also under a data processing agreement. Section 7 applies accordingly to retention.

9. Sales system

To handle requests and orders, we may transfer contact details and request content to our sales system ExoPaper. ExoPaper is software developed by our own company and runs on servers in Germany. This does not involve disclosure to third parties. Legal basis and retention follow section 7.

10. Fonts, media and external links

We serve fonts, images and videos from our own server. We do not embed third-party content such as Google Fonts, YouTube, maps or social media plugins. Links to external services such as Instagram are plain links: data is only transmitted when you click them, and the provider's privacy policy then applies.

11. Interface for AI assistants

Through a public interface (Model Context Protocol) and the llms.txt file, AI assistants can retrieve our product catalogue, woods, prices and FAQs. No personal data is requested or disclosed. An assistant can only create a link with a pre-filled request basket; a request is always sent by you yourself on this website. The per-IP limit described in section 3 applies to prevent abuse.

12. Recipients and transfers to third countries

Only staff who need your data for their work and our processor for hosting and email in Germany have access to it. If an order results, we pass your name, delivery address and phone number to the commissioned carrier as far as necessary for delivery (Art. 6 (1) (b) GDPR). There is no transfer to countries outside the European Union or the European Economic Area.

13. No automated decisions

We do not make automated decisions or create profiles within the meaning of Art. 22 GDPR.

14. Your rights

You have the right to

• access the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability in a common, machine-readable format (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)

An informal message to info@lisholz.de is sufficient. We reply within one month.

Right to object under Art. 21 GDPR

Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation. You can object to the usage statistics and the basket analysis without giving reasons – directly with the switch in section 5.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, place of work or the alleged infringement. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34, 55116 Mainz, Germany
www.datenschutz.rlp.de

15. Data security

We transmit all data encrypted (TLS), grant access rights by role and only to the extent necessary, back up the database daily on servers in Germany and keep our systems up to date. Backups are overwritten on a rolling basis; deleted data is removed from backups after four months at the latest.

16. Changes to this privacy policy

We update this privacy policy when our website, our processes or the legal situation change. The version published on this page applies.

Last updated: October 2026