Draft, pending legal review

Privacy policy

This translation is for information only. The German Datenschutzerklärung is the authoritative version.

This page explains which personal data we process when you use this website, contact us or become a customer. Last updated: November 2026

1. Controller

Hofglanz Frankfurt
Zum Köpperner Tal 44, 61381 Friedrichsdorf
Represented by the partners: Aykut Halici, Anton Merk
Phone: +49 152 39604753
Email: info@hofglanz-reinigung.com

We have not appointed a data protection officer. You can reach us with any data protection question using the contact details above.

2. No cookies, no tracking

This website sets no cookies and uses no analytics or advertising services. Fonts and images are loaded from our own web space.

3. Visiting the website (hosting)

• Purpose: delivering the website, protecting it from attacks and analysing errors.
• Data: IP address, time, requested page, browser and device details, and technical log data. Your browser may also send network error reports to Cloudflare (Network Error Logging).
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the website.
• Recipient: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as processor. Requests may pass through data centres outside the EU.
• Retention: the logs of our Cloudflare account are deleted after 7 days. Where Cloudflare processes data for its own purposes, Cloudflare's privacy policy applies.

4. Protecting the request form (Cloudflare Turnstile)

• Purpose: telling humans from automated programs so that the form is not used for spam and abuse. Turnstile loads as soon as you scroll close to the form, so also if you do not send it.
• Data: technical signals from your browser and device, in particular IP address, TLS fingerprint and user agent, as well as the identifier and origin of our website. Turnstile also creates an entry in your browser's local storage (cf.turnstile.u, in the area of challenges.cloudflare.com). This is not a cookie.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is protection from spam and abuse. Access to information on your device is based on § 25(2) no. 2 TDDDG.
• Recipient: Cloudflare, Inc. For the check itself, Cloudflare acts as our processor. For improving its bot detection, Cloudflare states that it acts as a controller in its own right.
• Retention: we do not store the result of the check. For processing by Cloudflare, its Turnstile Privacy Addendum applies.

You can always reach us without Turnstile by phone or email.

5. Request form

• Purpose: answering your request and preparing a quote.
• Data: name, phone number, town, requested service, message, the estimate from the price calculator, photos if you add any, page language and time of the request. We also record whether the form was sent without JavaScript and whether the notification email was sent.
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps). If the request comes from a business, we base the processing of the contact person's data on Art. 6(1)(f) GDPR. Our legitimate interest is then handling the business enquiry.
• Abuse protection: when you send the form, we limit the number of requests per IP address and pass the IP address to the Turnstile check (Art. 6(1)(f) GDPR). We do not store the IP address in the request itself.
• Recipients: Supabase stores the request in our database (section 8). Resend sends a notification with the content of the request to our email inbox. We attach photos to this email and do not store them in the database. The email goes to our address at hofglanz-reinigung.com. Cloudflare, Inc. (section 3) forwards it to our inbox via its Email Routing service without storing it permanently. The inbox is hosted by Google Ireland Limited (Gmail), Gordon House, Barrow Street, Dublin 4. The same applies if you write to this address directly.
• Retention: if no order follows, we delete the request once it is dealt with, at the latest after 12 months. If an order follows, section 7 applies.

5a. Price calculator and photo assessment

• Price calculator: your entries stay in your browser and in the page address. They only reach us when you send the calculation with a request.
• Travel: we send your postcode or town to our server to work out the travel cost. We do not store this entry, but it may briefly appear in technical logs.
• Photos: your browser shrinks photos before upload. Embedded data such as the location is removed.
• AI assessment: only when you click the button do we send the first photo to Cloudflare Workers AI. An AI model estimates which surface is shown and how soiled it is. The result is a suggestion that you can change. It does not decide on a contract or a price. To our knowledge, Cloudflare does not keep the photo after processing and does not use it for training. We do not store it for this assessment either.
• Please note: if possible, do not photograph people or number plates.
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request). We base the limit on calls per IP address and the Turnstile check on Art. 6(1)(f) GDPR.

6. Contact by WhatsApp, phone and email

• Purpose: dealing with your concern, on request also using photos of your surface.
• Data: your phone number or email address, your name, the content of your message and photos you send us.
• Legal basis: Art. 6(1)(b) GDPR, for requests from businesses and other concerns Art. 6(1)(f) GDPR. Our legitimate interest is dealing with your concern.
• WhatsApp: the links on this website only open WhatsApp when you tap them. No data is sent to WhatsApp before that. If you write to us via WhatsApp, WhatsApp Ireland Limited, Ireland, receives the data needed for this. A transfer to Meta companies in the USA is possible. WhatsApp processes this data as a controller in its own right under its own privacy policy.
• Phone: phone links start the phone app on your device. No data is sent to this website in the process.
• Retention: as in section 5, for an order as in section 7.

You do not have to use WhatsApp. You can always reach us by phone, by email or through the form.

7. Quotes, contracts and invoices

• Purpose: concluding and performing one-off jobs and subscriptions, scheduling, documenting visits, invoicing, handling payments and meeting legal obligations.
• Data: name, address, phone number, email address, type of customer, agreed services and prices, subscription data, appointments, notes on the visit, payment data and invoices, and photos of the surfaces worked on.
• Legal basis: Art. 6(1)(b) GDPR for the contract. Art. 6(1)(c) GDPR for tax and commercial law obligations. Art. 6(1)(f) GDPR for asserting or defending claims.
• Photos: after each visit we send you photos of the surface worked on by WhatsApp or email, as agreed with you. We use photos for advertising only with your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future.
• Recipients: Supabase (section 8), our email provider, WhatsApp where agreed, banks for payments, tax advisers and, where required by law, tax authorities.
• Retention: we store contract data until the contract ends and then until the statutory limitation periods for possible claims have expired. Documents subject to tax or commercial retention duties are kept for the statutory period (§ 147 AO, § 14b UStG, § 257 HGB), up to ten years depending on the document.

8. Service providers and database

• Cloudflare (Cloudflare, Inc., USA): hosting, protection from attacks, Turnstile, running the form and our internal management system, AI assessment of photos (Workers AI).
• Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513): database for requests and customer management. The servers are in Frankfurt am Main.
• Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA): sending notification emails to us.

These providers process the data on our behalf under data processing agreements according to Art. 28 GDPR. We only pass data to other third parties if we are legally obliged to do so or you have consented. We do not sell data.

9. Transfers to third countries

• Cloudflare (USA): Cloudflare is certified under the EU-US Data Privacy Framework. The basis is the European Commission's adequacy decision (Art. 45 GDPR). Standard contractual clauses also apply (Art. 46(2)(c) GDPR).
• Resend (USA): the basis is the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). The provider also refers to the EU-US Data Privacy Framework.
• Supabase (Singapore, USA): the database is in Frankfurt am Main. Access from third countries for operations and support cannot be ruled out. The basis is standard contractual clauses (Art. 46(2)(c) GDPR).
• WhatsApp: if you use WhatsApp, WhatsApp informs you about transfers to the USA in its privacy policy.

You can obtain a copy of the standard contractual clauses on request using the contact details in section 1.

10. Your rights

Subject to the statutory conditions, you have the right to:

• access to your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we base processing on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

11. Complaint to the supervisory authority

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163, 65021 Wiesbaden
Telefon: +49 611 1408-0
E-Mail: poststelle@datenschutz.hessen.de

12. Obligation to provide data

You are under no legal or contractual obligation to give us data. For the form we need your name and phone number, otherwise we cannot reply. Town, service and message are voluntary. To conclude and perform a contract we need the data required for it, in particular name, address and place of service. Without this data we cannot conclude a contract. Technical data when visiting the website is needed to deliver it; without it the website cannot be displayed.

13. No automated decisions

We do not use automated decision-making including profiling within the meaning of Art. 22 GDPR. Turnstile automatically checks whether the form is sent by a human. If the check fails, the form is not accepted. You then receive our phone number and can reach us directly. We decide on requests and contracts in person.

Back to the home page