Skip to Content

Privacy policy

The protection of your personal data is important to us. Below, in accordance with the General Data Protection Regulation (GDPR), we inform you about which data we process when you visit our website and our online shop and which rights you have.

1. Controller

The party responsible for data processing on this website is:

SUMMSTOFF Imkereigenossenschaft e.G.
Ibbenbürener Straße 88
49479 Ibbenbüren-Laggenbeck
Telephone: +49 5451 932899
Email: info@summstoff.de
Board: Maximilian Urban
Cooperative register: GnR 194, Steinfurt Local Court
VAT identification number: DE348631651

2. Data protection officer

We have appointed the following data protection officer:

Michael Urban
reachable at the address given above, attn. “Datenschutz” (data protection), and at info@summstoff.de.

3. General information on data processing and legal bases

We process personal data only insofar as this is necessary to provide a functioning website and our content and services, or you have given your consent. The legal bases are in particular:

  • Art. 6 (1) (a) GDPR – your consent (e.g. cookies for analytics, newsletter);
  • Art. 6 (1) (b) GDPR – performance of a contract or pre-contractual measures (e.g. order processing);
  • Art. 6 (1) (c) GDPR – compliance with a legal obligation (e.g. retention under tax and commercial law);
  • Art. 6 (1) (f) GDPR – protection of legitimate interests (e.g. secure operation of the website).

4. Hosting

Our website is hosted by an external service provider. The data collected in the course of use is stored on its servers. The host is:

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Germany

The servers are located in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the host. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a secure and efficient provision of the service).

5. Access data / server log files

Each time our website is accessed, information transmitted by your browser is automatically recorded. This comprises: IP address, date and time of access, page/file accessed, amount of data transferred, message confirming successful retrieval, browser type and version used, operating system and, where applicable, the previously visited page (referrer). The processing takes place to ensure a trouble-free connection set-up, comfortable use, and to evaluate system security and stability. The legal basis is Art. 6 (1) (f) GDPR. The log data is deleted after a short time unless it is needed as evidence in the event of attacks.

6. Cookies and consent management

Our website uses cookies. Technically necessary cookies (e.g. for the cart, login and storing your cookie choice) are set on the basis of Art. 6 (1) (f) or (b) GDPR and Section 25 (2) TDDDG and are required for operation.

Optional cookies – in particular for analytics purposes – are set only with your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). On your first visit you will see a cookie banner through which you make your choice. Without your consent, no analytics cookies are set and no analytics services are loaded. You can withdraw your consent at any time with effect for the future. Details of the cookies used can be found in our Cookie policy.

7. Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics helps us understand how visitors interact with our website so that we can improve our offering.

The collection and processing take place only with your consent (Art. 6 (1) (a) GDPR), which you give via our cookie banner and can withdraw at any time with effect for the future. Without consent, no analytics cookies are set and no data is transmitted to Google (Google Consent Mode v2). The IP address is processed in shortened or anonymised form. A transfer to the USA may take place; Google LLC is certified under the EU-U.S. Data Privacy Framework, so an adequate level of data protection exists. A data processing agreement is in place with Google.

You can withdraw your consent at any time by adjusting your choice in the cookie banner. Further information can be found in Google's privacy policy at policies.google.com/privacy.

8. Customer account and order processing

If you order in our shop or create a customer account, we process the data required for this (in particular name, billing and delivery address, email address, telephone number where applicable, and the order and payment data). The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). To process your order, we pass data on to the payment and shipping service providers we have engaged (see sections 9 and 10). After the contract has been completed, the data is blocked and, once the retention periods under tax and commercial law have expired (generally 6 or 10 years, Art. 6 (1) (c) GDPR), deleted.

9. Payment processing

To process payments, we use service providers depending on the payment method you choose. The data required for the payment is transmitted to the respective provider or entered directly with them. The legal basis is Art. 6 (1) (b) GDPR. The providers are:

  • Stripe – Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
  • PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
  • Bank transfer/prepayment – in this case your payment data is processed via your bank.

The payment service providers are independently responsible for processing the payment data entered with them. For details, please refer to the privacy information of the respective provider.

10. Shipping

To deliver your order, we transmit the necessary data (in particular name and delivery address, and, for shipment notification, where applicable your email address and/or telephone number) to the shipping company we have engaged:

General Logistics Systems Germany GmbH & Co. OHG (GLS)
GLS Germany-Straße 1–7
36286 Neuenstein
Germany

The legal basis is Art. 6 (1) (b) GDPR.

11. Contacting us

If you contact us via the contact form, by email, telephone or WhatsApp, we process the data you provide in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR (where the enquiry serves to initiate a contract) or Art. 6 (1) (f) GDPR (handling of general enquiries). When you contact us via WhatsApp (operator: WhatsApp Ireland Limited, a company of the Meta group), data is processed according to WhatsApp's terms; in this case a transfer to third countries may take place. We delete your enquiry data as soon as it is no longer required and no statutory retention obligations prevent this.

12. Newsletter

If you subscribe to our newsletter, we use the email address you provide to send it. Subscription takes place via the double opt-in procedure: after signing up, you receive an email asking you to confirm your subscription. The legal basis is your consent under Art. 6 (1) (a) GDPR. You can withdraw your consent at any time and unsubscribe from the newsletter using the unsubscribe link in every email or by sending us a message.

13. Bonus programme (bonus points)

Participation in our bonus points programme is voluntary. To manage your points balance, we process your customer and order data (e.g. name, email address, purchases made). The legal basis is Art. 6 (1) (b) GDPR (performance of the participation relationship) or Art. 6 (1) (a) GDPR.

14. Recipients and processors

Your data is passed on to third parties only to the extent described, in particular to our host, the payment and shipping service providers and the analytics provider. We have concluded contracts under Art. 28 GDPR with processors. Any further disclosure takes place only if we are legally obliged to do so or you have given your consent.

15. Storage period

We store personal data only for as long as is necessary for the respective purposes or statutory retention periods apply. After that, the data is deleted or blocked.

16. Your rights

Under the GDPR you have the following rights:

  • Access to the data stored about you (Art. 15 GDPR);
  • Rectification of inaccurate data (Art. 16 GDPR);
  • Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR);
  • Data portability (Art. 20 GDPR);
  • Objection to processing (Art. 21 GDPR, see section 17);
  • Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR).

To exercise your rights, a message to the contact details given above is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany

17. Right to object

If we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR). If the processing is for direct marketing purposes, you have the right to object at any time without giving reasons.

18. Currency and amendment of this privacy policy

This privacy policy is currently valid. Due to the further development of our website or because of changed statutory or regulatory requirements, it may become necessary to amend this policy.

Last updated: July 2026