Privacy Notice

1. Controller

Telephone: +49 (0)8031 23 55 366
Email: info@alpinabavaria.com

2. Technical hosting and server logs

When the website is accessed, the hosting and delivery infrastructure processes connection data that is technically required. This may include, in particular, the IP address, date and time, requested address, HTTP method and status code, transmitted referrer information, browser and device information, and technical security and diagnostic information.

Processing serves the secure and stable provision of the website, error analysis and protection against misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a secure and functional online presence. The application itself does not maintain its own permanent visitor log. Platform logs are stored only for as long as required for operation, troubleshooting and security, and are then deleted or anonymised.

Recipients, to the extent required, are OpenAI as the provider of the Sites platform and Cloudflare as the provider of hosting, database, storage, network and security infrastructure. These service providers are used to make the website available.

3. Images delivered externally

Some publicly visible product and background images are loaded from Contentful's media infrastructure. When an image is requested, that service receives technically required connection data such as the IP address, time, requested image address, browser information and, where transmitted by the browser, referrer information. The purpose is fast and appropriate image delivery. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a reliable and bandwidth-appropriate display of the website. Retention follows the periods required by the service for delivery, operation and security.

4. Customer registration and user accounts

When a customer account is registered, we process first name, last name, email address, company or institute on an optional basis, a technically secured password hash with salt, the time at which this privacy notice was accepted, and creation, modification and last sign-in times. The plain-text password is not stored.

The purpose is to establish, provide and secure the customer portal. The legal basis is Art. 6(1)(b) GDPR and, for security evidence and protection against misuse, additionally Art. 6(1)(f) GDPR. An account cannot be set up without the information marked as mandatory. Recipients are only authorised personnel and the technical service providers named in section 2.

Account data is stored for as long as the account or the underlying business relationship exists. It is then deleted once no statutory retention obligations or legitimate interests in establishing, exercising or defending legal claims prevent deletion.

5. Sign-in and necessary cookies

After a customer has signed in successfully, the portal sets the technically necessary cookie alpina_admin_session. It contains a signed session record with the email address, customer access designation and expiry time, cannot be read by browser JavaScript, and is transmitted only over a secure connection. The session ends after no more than eight hours or when the customer signs out.

The purpose is sign-in, access verification and protection of the secure customer area. Storing and reading this strictly necessary information is carried out pursuant to § 25 Abs. 2 Nr. 2 TDDDG. The legal bases for the subsequent processing are Art. 6(1)(b) GDPR for providing the portal and Art. 6(1)(f) GDPR for its security. The hosting and security infrastructure may additionally set short-lived, technically necessary security cookies. No advertising or analytics cookies are used.

6. Contact by email

If you contact us by email, we process the contact details you provide, the message content, any attachments and technical communication data. The purpose is to process and answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR based on our interest in appropriate communication.

Recipients may be authorised personnel and the email service provider used. We store correspondence for as long as required for handling and documentation. Longer periods apply only where statutory retention obligations or the protection of legal claims require them.

7. Recipients and transfers to third countries

We do not disclose personal data for advertising purposes and do not sell it. Disclosure takes place only to required processors and technical service providers, internally authorised persons, or public authorities and other bodies where we are legally required to do so.

With globally used platform, infrastructure and media service providers, processing outside the European Union or European Economic Area cannot be ruled out. Where personal data is transferred to a third country, this takes place only in accordance with Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses.

8. Your rights

Subject to the statutory requirements, you have in particular the right to:

• access your personal data (Art. 15 GDPR),
• rectify inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR), and
• object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR).

If processing is exceptionally based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing up to the withdrawal remains unaffected. To exercise your rights, a message to info@alpinabavaria.com is sufficient.

9. Right to lodge a complaint

Under Art. 77 GDPR, you may lodge a complaint with a data protection supervisory authority. For Alpina Bavaria GmbH, the competent authority is in particular:

10. No automated decisions

No decision based solely on automated processing, including profiling, takes place on this website. We also do not use analytics, advertising, newsletter or payment services.

11. Protected owner administration

Addition dated 16.09.2026

The separate administration area uses a fixed email account and a self-chosen password. We process the administration email address, a password hash protected with a random salt, account/sign-in times, and hashed session keys with expiry and revocation times. The password is not stored in plain text. One-time setup requires a personally provided, short-lived setup key; only its hash and a one-use record are held server-side. Customer accounts and ChatGPT sign-in do not grant administration access. The necessary cookie __Host-alpina_owner_session contains only a random session key, is HttpOnly, Secure and SameSite=Strict, and lasts no more than two hours; signing out revokes it server-side. Storage and reading are pursuant to § 25 Abs. 2 Nr. 2 TDDDG. The legal basis for access checks is Art. 6(1)(f) GDPR; our legitimate interest is protecting nonpublic product maintenance. Time-window counters and hashed client/IP identifiers are processed to prevent repeated sign-in attempts, also under Art. 6(1)(f) GDPR.

Once product maintenance is authorised, product information, prices, VAT rate, stock, uploaded images with filename, file type and size, the ID of the last person editing, and creation/modification times are stored. The purpose is durable maintenance and controlled publication of the catalogue; the legal basis is Art. 6(1)(f) GDPR. Recipients are exclusively authorised persons and the technical service providers named in section 2; data is held in D1 and R2. Only explicitly published catalogue fields and images are displayed publicly. Internal prices, exact stock quantities and editor IDs remain nonpublic.

For Excel product imports, the file and its contents are processed temporarily for validation only; the XLSX file is not retained. The read-only preview contains the proposed changes. An encrypted confirmation bound to the specific administration session expires after 15 minutes. Product information is saved only after explicit confirmation. To prevent duplicate imports, D1 stores only an import identifier, the administration identifier, the number and time of committed changes. These records are progressively cleaned up after 24 hours during subsequent successful imports. The purpose, legal basis and recipients are the same as for product maintenance described above. No formulas are executed, external links accessed or additional cookies set.

Account data is retained for the duration of administration access. Session keys become invalid after no more than two hours; expired records are cleaned up during subsequent successful sign-ins. Security counters apply for short windows of no more than 15 minutes and are cleaned up after expiry during subsequent authentication requests. The hashed one-use record is retained to prevent repeated setup. Editing records, image files and product data are retained for catalogue maintenance, restoration and traceability; old image versions are not automatically deleted when replaced. Personal components are removed when no longer necessary for these purposes and no statutory retention obligations or legitimate interests in legal claims prevent removal. The general information on transfers to third countries and data subject rights also applies here. No additional advertising, analytics or language-preference cookies are introduced.