This document has not yet been reviewed by a lawyer and is not in force. Passages marked [[ ERGÄNZEN: … ]] are to be completed by the operator or by the lawyer.
Is your data in our company database? Then the information under Art. 14 GDPR applies to you. You can object via the Objection page.
The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) is:
Martin Adamec (sole trader)
Mírová 1541, 516 01 Rychnov nad Kněžnou, Czech Republic
Company identification number (IČO): 19552319
Email: info@b2bkartei.de
Phone: +420 720 950 900
Further details about the provider are in the legal notice.
This privacy policy explains how we process the personal data of visitors to the b2bkartei.de website, of people who contact us, and of customers and their contact persons. For people whose data is contained in our company databases (in particular sole traders and named authorised representatives), the separate information under Art. 14 GDPR applies.
The website runs on a virtual server that we rent from Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. Data centre location: [[ ERGÄNZEN: Standort des Rechenzentrums laut Hostinger-Konto (EU-Mitgliedstaat) ]]. Hostinger processes the data as a processor on the basis of a contract under Art. 28 GDPR. [[ ERGÄNZEN: Abschluss des Auftragsverarbeitungsvertrags (Hostinger Data Processing Addendum) bestätigen ]]
When you visit the website, the web server processes technically necessary data transmitted by your browser and stores it in log files:
Purpose: delivering the website and ensuring stability and security, in particular detecting and preventing attacks and misuse (for example by limiting requests per IP address). Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and functional operation of the website. Storage period: log files are deleted [[ ERGÄNZEN: Löschfrist der Logdateien, z. B. 14 Tage – logrotate-Einstellung auf dem Server bestätigen ]] after they are created, unless they are needed for longer to investigate a specific security incident.
The connection to the website is encrypted with TLS.
If you contact us via the contact form, by email or by phone, we process the information you provide. In the contact form, this is: full name, company, VAT identification number or register number, email address, phone number, type of request, country of the data, industry and your message. Required fields are marked. To protect against automatically sent messages (spam), we evaluate the time of submission and a control field that is invisible to humans; for both inquiries and objections, the message also includes the submission date and time, the sending device’s IP address and browser identifier (user agent), and the page language. [[ ERGÄNZEN: mit der endgültigen Fassung von /api/kontakt.php abgleichen (übermittelte Felder, IP-Adresse) ]]
Purpose: handling your request, preparing a quote and communicating with you; protection against misuse. Legal basis: Art. 6(1)(b) GDPR where your request is aimed at concluding a contract (pre-contractual measures); otherwise Art. 6(1)(f) GDPR, our legitimate interest being to answer requests and to protect against misuse. [[ ERGÄNZEN: Anwalt – das Kontrollkästchen im Formular ist derzeit als Einverständnis formuliert; klären, ob es als Einwilligung (Art. 6 Abs. 1 lit. a) oder nur als Kenntnisnahme dieser Hinweise dienen soll, und Formulartext angleichen ]]
Process: the form is transmitted to our server and forwarded from there as an email to the website operator’s mailbox. The mailbox is operated by [[ ERGÄNZEN: Anbieter des E-Mail-Postfachs, Anschrift, Auftragsverarbeitungsvertrag ]]. If the email cannot be delivered, the server temporarily stores the request in a non-public directory so that it is not lost. [[ ERGÄNZEN: Löschfrist dieser Sicherungskopien ]]
Storage period: we delete requests that do not lead to a contract [[ ERGÄNZEN: Löschfrist, z. B. 12 Monate nach Abschluss der Korrespondenz ]]. If a contract is concluded, section 6 applies.
Via the form on the Objection page, we process the information required to handle your objection or erasure request: company name or name, identification or register number, the contact details concerned, your email address for our reply and your message.
Purpose: handling your request, documenting how it was handled and blocking the details concerned so that they are not added again during a later update from the sources. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 12, 17 and 21 GDPR; for the suppression list additionally Art. 6(1)(f) GDPR. Storage period: [[ ERGÄNZEN: Aufbewahrungsdauer der Korrespondenz und der Sperrliste ]]
For quotes, contract performance and invoicing, we process the data of the customer and its contact persons (name, company, address, contact details, identification and tax numbers, order and payment data). Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (statutory retention obligations). For contact persons of business customers, processing is based on Art. 6(1)(f) GDPR; our legitimate interest lies in communicating with the contracting party.
Storage period: we store contract data until the limitation periods expire; we keep accounting records and invoices for the duration of the statutory retention periods. [[ ERGÄNZEN: maßgebliche Aufbewahrungsfristen nach tschechischem Steuer- und Buchhaltungsrecht – Steuerberater ]]
This website currently sets no cookies and stores no information on your device. It uses no analytics or advertising services (for example Google Analytics or Google Ads), no social media plugins and does not load fonts, scripts or other content from third-party servers; all components are delivered from our own server. Consent under § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) is therefore not required, and no consent banner is displayed.
Links to external websites (for example to public registers) are recognisable as such. Data is only transmitted to the respective provider when you click such a link; that provider is responsible for its own processing.
Personal data is only received by parties that need it for the stated purposes:
We do not pass your data on to third parties for advertising purposes.
We do not transfer your data to countries outside the European Union or the European Economic Area. [[ ERGÄNZEN: bestätigen – Unterauftragsverarbeiter von Hostinger und des E-Mail-Anbieters prüfen; ggf. Drittland und Garantie nach Art. 44 ff. DSGVO angeben ]]
You are under no legal or contractual obligation to provide us with personal data. Without the information marked as required, however, we cannot handle a request or an objection; to conclude a contract, we need the information required to perform it.
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
Subject to the statutory requirements, you have the following rights:
Right to object (Art. 21 GDPR): where we process your data on the basis of Art. 6(1)(f) GDPR, you can object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can send your objection informally to info@b2bkartei.de or via the Objection page.
To exercise your rights, a message to the contact details in section 1 is enough. We reply without undue delay, at the latest within one month (Art. 12(3) GDPR).
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). As the controller is established in the Czech Republic, the lead supervisory authority (Art. 56 GDPR) is:
Úřad pro ochranu osobních údajů (Czech Office for Personal Data Protection)
Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
uoou.gov.cz
You can also contact the supervisory authority of the member state of your habitual residence, your place of work or the place of the alleged infringement – in Germany, the data protection authority of your federal state. The Federal Commissioner for Data Protection and Freedom of Information provides an overview.
No data protection officer has been appointed. [[ ERGÄNZEN: Anwalt – Benennungspflicht prüfen, siehe Hinweis ]]
Note on the obligation to appoint (for the legal review, remove before publication): under Art. 37(1) GDPR, the obligation only applies to public authorities, to core activities involving regular and systematic monitoring of data subjects on a large scale, or to large-scale processing of special categories under Art. 9 and 10 GDPR. In our assessment, compiling publicly available company information is not monitoring of people’s behaviour; special categories are not processed. As we understand it, the Czech implementing act (No. 110/2019 Coll.) imposes no further obligation on non-public bodies (to be confirmed). § 38 BDSG is an open question: a sole trader does not reach the threshold of 20 persons, but under § 38(1), second sentence, BDSG, anyone who processes personal data commercially for the purpose of transfer must appoint a data protection officer regardless of headcount – which describes the sale of data exports. The controller has no establishment in Germany; however, under § 1(4), second sentence, no. 1 BDSG, the BDSG applies to it if it processes personal data in Germany (for example with a server located in Germany). To be clarified: server location, applicability of the BDSG and, if necessary, appointment of an (external) data protection officer.
We adapt this privacy policy when the processing or the legal situation changes, in particular before we use any analytics or advertising services. The version published at b2bkartei.de/datenschutz/ applies.
Version: October 2026 (draft)
