Privacy policy

1. Data controller

2. Website delivery and hosting

We use the Starter shared-hosting package from INWX GmbH, Prinzessinnenstr. 30, 10969 Berlin, Germany, for website hosting and email. INWX states that its shared hosting uses servers in Germany.

When you visit this website, connection data needed to deliver the website is processed. This may include your IP address, the date and time of access, requested pages and files, the volume of data transferred, HTTP status, and browser and operating system information. A referrer address sent by your browser may also be processed.

The purposes are to deliver the website, maintain its security and stability, and resolve technical errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of this website. Recipients may include the hosting and technical service providers we use.

Connection data is required for technical transmission. Web server logs are deleted after 14 or 30 days. These periods apply to log data, not to contact enquiries or backup copies.

3. Contact form, email and phone

The contact form sends your details over an encrypted connection to our web server, which forwards them by email to contact@exoskelette24.shop. The script does not store enquiry contents in a database or its own log file. The email is processed in our mailbox under the deletion criteria below.

To prevent spam and duplicate delivery, the form uses a hidden check field and server-side sending limits. Checks derived from the IP address and enquiry data using a secret key, together with timestamps, are stored for this purpose. This protection file contains no plain-text IP addresses, names, email addresses or messages. Sending limits cover one hour and duplicate protection covers 24 hours. Expired entries are removed on the next valid form request. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is preventing abuse and duplicate delivery.

When you contact us, we process the information you provide, in particular your name, email address or phone number and the content of your enquiry, to address your request. Enquiries are handled by our team of two. The people handling your enquiry have access to the information needed for that purpose. Recipients may also include our email and telecommunications service providers.

Where your enquiry concerns entering into or performing a contract with you, processing is based on Article 6(1)(b) GDPR. For other enquiries, including communication with a company’s contact persons, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is responding appropriately to enquiries and conducting business communications.

We delete resolved contact enquiries and related emails no later than 90 days after they are no longer needed to handle the enquiry. Where statutory retention duties apply, we retain the affected messages for the required period and restrict processing to that retention purpose.

Providing your information is voluntary. Without sufficient contact details and information about your enquiry, we may be unable to respond. Please do not send health data or medical documents with an initial enquiry.

4. Cookies, fonts and language selection

The website code does not set cookies, use local or session storage, or integrate analytics, advertising, maps, video or external translation services. The Latin and Chinese fonts are loaded from our own web server. Language selection uses separate page addresses only. These functions do not require cookie consent.

5. Service providers and international transfers

We use INWX GmbH as our processor for hosting and email. A data-processing agreement under Article 28 GDPR has been signed by both parties. It requires INWX to process data within the agreed services and our instructions. Under the agreement, INWX provides its own services in the EU or European Economic Area; processing in third countries is subject to Articles 44 et seq. GDPR.

6. Your data protection rights

• Access to your personal data (Article 15 GDPR).
• Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR).
• Erasure and restriction of processing, subject to the statutory conditions (Articles 17 and 18 GDPR).
• Data portability where the conditions of Article 20 GDPR are met.
• Withdrawal of any consent at any time with effect for the future; this does not affect the lawfulness of processing before withdrawal (Article 7(3) GDPR).
• Lodging a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the alleged infringement (Article 77 GDPR).

You may use the contact details above to exercise your rights. The supervisory authority for our location in Frankfurt am Main is the Hessian Commissioner for Data Protection and Freedom of Information.

Hessian Commissioner for Data Protection and Freedom of Information

7. Automated decisions

There is no solely automated decision-making that produces legal or similarly significant effects. This website does not use profiling.

Last updated: 13 September 2026