AXOY GMBH

Privacy notice

This notice explains how personal data is processed when you visit our website and contact AXOY GmbH.

Last updated: 25 October 2026

1. Controller

2. Hosting and access data

We use STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, to host this website. When you access the website, data processed includes your IP address, date and time, the requested page or file, the volume of data transferred, status messages, browser and operating system and, where applicable, the previously visited page (referrer).

This processing serves to deliver the website, maintain its stability, analyse errors and protect against attacks. The legal basis is Article 6(1)(f) of the General Data Protection Regulation (GDPR). Our legitimate interest is the secure and reliable operation of our website.

According to STRATO, IP addresses are stored for no more than seven days to detect and prevent attacks. Access logs made available to website operators contain anonymised IP addresses or hostnames and can be retrieved for the previous six weeks. Necessary data may need to be retained longer to investigate specific security incidents until they have been resolved.

Further information: STRATO on processing data on behalf of customers and STRATO on access logs.

3. Cookies, fonts and website functions

This website does not itself set cookies or use local browser storage to recognise returning visitors. No analytics or advertising trackers are integrated. The product selector does not process personal data and selections are not stored permanently.

Text is displayed using system fonts already installed on your device. Images and website files are loaded from our own hosting space. This website has no registration, comments, newsletter subscription or contact form.

4. Contact by email or telephone

When you contact us, we process your contact details, the content of your enquiry and the information needed to handle it. Email and telephone links on the website simply open the corresponding application on your device.

For enquiries relating to a contract or pre-contractual steps with you, the legal basis is Article 6(1)(b) GDPR. Other enquiries and communication with contact persons at business customers are processed on the basis of Article 6(1)(f) GDPR; our legitimate interest is to handle enquiries appropriately and maintain our business relationships.

We delete enquiry data when the matter has been resolved and further storage is no longer necessary. Where contractual records or business documents subject to retention requirements result, statutory retention periods apply. Data may be retained to the extent necessary to establish or defend legal claims.

5. Business and contract data

When initiating and conducting business relationships, we process in particular the names and contact details of customers and contact persons, as well as company, order, delivery, invoice and payment data. This processing serves to prepare offers, perform contracts, deliver goods, invoice and comply with legal obligations, on the basis of Article 6(1)(b), (c) and (f) GDPR. For company contact persons, our legitimate interest is to conduct the business relationship.

Data is provided only to recipients who need it for the relevant purpose, such as hosting and communications providers, transport providers, payment providers or banks, tax advisers, legal advisers or legally authorised public bodies. Service providers processing data on our behalf must be engaged in accordance with Article 28 GDPR.

Retention periods depend on the purpose and legal obligations: business correspondence must generally be retained for six years, accounting vouchers for eight years, and books and annual financial statements for ten years. The applicable statutory periods and their rules on commencement and expiry are decisive. Personal data is deleted once its purpose no longer applies and the necessary retention periods have expired.

6. External links and Instagram

Our website contains links to Instagram and external information sources. Instagram posts are not embedded as interactive plugins. The campaign images shown are loaded locally from our hosting space; displaying these images alone does not establish a connection to Instagram.

Only when you open an external link do you access the respective provider’s website. That provider processes data under its own privacy policies; this may include processing outside the European Economic Area. Please refer to the privacy notice of the respective provider.

7. Your rights

Subject to the statutory requirements, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing before consent was withdrawn.

To exercise your rights, please contact info@axoy.de.

8. Right to lodge a complaint

Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, your workplace or the suspected infringement. In North Rhine-Westphalia, this is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.

LDI NRW website · Email: poststelle@ldi.nrw.de

9. Provision of data and automated decisions

The access data listed in section 2 is required to provide the website technically. Contacting us is voluntary; without the information needed to handle your request, we may be unable to answer it or perform a contract. This website does not involve automated decisions with legal or similarly significant effects, or profiling.