Privacy Policy
1. Controller
Ananda GmbH
Wikingerstraße 10
76189 Karlsruhe
Germany
Phone: +49 721 470 373 34
E-mail: datenschutz@ananda.gmbh
2. Hosting and server log files
This website runs on servers of DigitalOcean, LLC in a data centre in Frankfurt am Main, Germany, which we manage ourselves. With every request the web server processes technically necessary data: IP address, date and time, the page requested, the amount of data transferred, the referring page, and browser and operating system. This is required to deliver the website and keep it secure. The legal basis is our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest. A data processing agreement is in place with DigitalOcean.
3. Fonts
The fonts are loaded from our own server. No connection to third-party servers (such as Google Fonts) is made.
4. Visitor statistics (Umami)
We compile anonymous visitor statistics with the open-source software Umami, which we run on our own servers in Frankfurt. Umami sets no cookies and stores no IP addresses; it only derives a value from IP address and browser details that changes daily and cannot be traced back, in order to count visits. It records the pages viewed, the referring page, browser, device type and country. When you successfully submit one of our forms, Umami counts this event with the form, the website and the language version; the details you enter are not sent to Umami. The data is not passed on to third parties. The legal basis is our legitimate interest in improving our website (Art. 6(1)(f) GDPR).
5. Google Analytics 4 (only with your consent)
With your consent we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The measurement runs server side: your browser does not send the data to Google directly but to our own server at gtag.ananda.gmbh, which we operate in Frankfurt am Main. There your IP address is truncated before the data is passed on to Google; Google does not receive your full IP address. We record the pages viewed, the time spent, the referring page and campaign, device type, browser, an approximate location at country or city level, and interactions such as scroll depth, clicks on external links, file downloads and the successful submission of a form.
Cookies are set in the process (among them _ga and FPID) which recognise your browser for up to two years, so that returning visits are not counted twice. If personalised advertising is switched on in your Google account, Google can attribute these visits to your account across devices through the "Google signals" feature. Google also processes the data in the United States, on the basis of the EU standard contractual clauses and the certification of Google LLC under the EU-US Data Privacy Framework. We have a data processing agreement with Google. The data is deleted after 14 months.
The legal basis for storing the cookies is your consent under Section 25(1) TTDSG, and for the processing that follows Art. 6(1)(a) GDPR. Without your consent no Google service is loaded and no cookie is set. You can withdraw your consent at any time with effect for the future, through the "Cookie settings" link in the footer of every page.
6. Cookies
Without your consent this website sets only what is technically necessary: a cookie that stores your decision about the cookie notice, one for your choice of language, and the cookies that the spam check of the forms (section 8) lets Cloudflare set while the check runs. Only with your consent do the statistics cookies join them (section 5). If you decline or withdraw, we delete the statistics cookies again.
7. Links to other websites
Our pages link to the websites of our brands and partners. Their operators are responsible for the processing of data on those websites; their privacy policies apply.
8. Request and application forms
Through the forms "Request product range" and "Request private label" we process what you enter there: company, contact person, e-mail address, the product group or article and your details on the project (quantities, delivery route, message). The purpose is to answer your request and to initiate a business relationship (Art. 6(1)(b) GDPR). Requests are deleted from our system automatically 24 months after receipt unless a business relationship has come about or statutory retention obligations apply.
Through the application form we process your name, e-mail address, phone number, the position, the possible start date and your message, together with the documents you send to bewerbung@ananda.gmbh by e-mail, solely for the recruitment procedure (Section 26(1) BDSG, Art. 6(1)(b) GDPR). The data is deleted six months after the procedure ends, and in the form system six months after receipt at the latest. Longer storage requires your consent.
The form data is stored in a backend of a cloud provider based in the USA, which we run in the provider's EU region (Ireland), and sent as a notification to our internal mailboxes through the e-mail service of Mailgun Technologies, Inc. (EU region). Data processing agreements with the EU standard contractual clauses are in place with both providers. To protect the forms against automated input we use Cloudflare Turnstile of Cloudflare, Inc., San Francisco (USA), which checks technical characteristics of your browser and your IP address when you submit; the legal basis is our legitimate interest in running the forms free of abuse (Art. 6(1)(f) GDPR). To limit the number of requests per sender we also store a non-reversible hash of your IP address and the browser identifier with the request; the IP address itself is not stored.
9. Contacting us
When you contact us by e-mail or phone, we process your details to answer your request (Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR). The data is deleted once the request has been dealt with, unless statutory retention obligations apply.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR), and the right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). To exercise them, write to datenschutz@ananda.gmbh.
You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.