Privacy Policy

The controller responsible for data processing under the General Data Protection Regulation (GDPR) is:
Luc Wood Energy GmbH
Hagebuttenweg 9
01169 Dresden, Deutschland
Email: info@holzholz.de
Phone: +49 1517 5758383

We process our users' personal data only to the extent necessary to provide a functioning website and our content and services. Processing generally takes place only with the user's consent (Art. 6(1)(a) GDPR), to perform a contract or pre-contractual measures (Art. 6(1)(b) GDPR), or on the basis of our legitimate interest (Art. 6(1)(f) GDPR), such as in a secure and functioning website.

This website is hosted by Vercel Inc.; the application database is hosted by Supabase (EU region, Frankfurt). When you access the website, the hosting provider automatically processes technical access data (including IP address, date and time of access, page accessed, browser type) to ensure the operation of the website and to prevent misuse (Art. 6(1)(f) GDPR).

We use exclusively technically necessary cookies — no analytics, marketing, or tracking cookie is in use today:

• HOLZHOLZ_CART_SESSION — assigns you to your shopping cart. Duration: 30 days.
• HOLZHOLZ_LOCATION — stores the postcode you most recently checked and the result of the delivery-area check, so you don't have to enter it again. Duration: 30 days.
• HOLZHOLZ_LOCALE — stores your chosen language.

These cookies are necessary to provide the website's core functions (shopping cart, delivery-area check) (§25(2) TDDDG, Art. 6(1)(f) GDPR) and do not require separate consent.

To process an order, we collect the data you enter in the order form (first and last name, delivery and, where applicable, billing address, email address, requested delivery date). We process this data to fulfil the contract (Art. 6(1)(b) GDPR) and to comply with commercial and tax-law retention obligations (Art. 6(1)(c) GDPR). Data is only shared with third parties necessary for contract fulfilment (Section 6).

We use the payment provider Stripe for payment processing. When you select a payment method, the data required for it (including payment data) is automatically transmitted to Stripe. Your payment data (e.g. card details) is transmitted directly to Stripe and is not stored on our own servers. This may involve a transfer of data to the USA; Stripe has committed to appropriate safeguards for this (including EU Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework). Further information: stripe.com/privacy.

To determine the delivery distance and delivery costs, we transmit the postcode or delivery address you enter to the Google Routes API (Google Ireland Limited or Google LLC) server-side. This may involve a transfer of data to the USA. The legal basis is our legitimate interest in an accurate delivery-cost calculation (Art. 6(1)(f) GDPR) and/or contract fulfilment (Art. 6(1)(b) GDPR). Further information: policies.google.com/privacy.

If you contact us by email, phone, or WhatsApp, or request a notification or an individual quote via the delivery-area check, we process the data you provide (including your email address) to handle your request (Art. 6(1)(b) or (f) GDPR).

This website currently does not use any analytics, tracking, or marketing tools (e.g. Google Analytics, Meta Pixel). Should this change in the future, we will update this notice accordingly and, where required, obtain your consent in advance.

We store personal data only for as long as necessary for the respective purpose, or as required by statutory retention obligations (in particular commercial and tax-law periods of typically 6 or 10 years). Cart and location data with no completed order is automatically deleted after 30 days.

You have the following rights:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR)

To exercise these rights, please contact us using the contact details given above.