Privacy Policy

This privacy policy informs you about which personal data are processed when you visit the website www.e-vein.com (also reachable at e-vein.com, e-vein.de and www.e-vein.de) and our product catalogue and portal at erp.e-vein.com, and when you contact us, for what purpose this is done and what rights you have. The applicable laws are the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications and Digital Services Data Protection Act (TDDDG).

The controller responsible for data processing within the meaning of Art. 4(7) GDPR is:

e-vein GmbH
Aign 4
83569 Vogtareuth
Germany

Represented by the managing directors Georg Höß and Vitus Höß
Email: info@e-vein.com
Telephone: +49 8031 2219886

Commercial register: Amtsgericht Traunstein (Local Court), HRB 27755
VAT ID no.: DE319738109

Our website www.e-vein.com is a purely informational, static company website. It requires very little data processing:

• No cookies are set on www.e-vein.com. The system at erp.e-vein.com sets only strictly necessary cookies, see Section 8.
• There are no analytics or tracking services, no social media plugins, no embedded videos or maps.
• On www.e-vein.com there is no contact form, no newsletter, no login area and no shop; you can reach us by email or telephone. The contact form and the portal at erp.e-vein.com are described in Section 8.
• There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR.
• We do not base any processing on consent, and there is no consent banner: the only accesses to your device, namely storing the selected language and the “Pause animations” choice (Section 5) and the strictly necessary cookies and settings in local storage at erp.e-vein.com described in Section 8, do not require consent under Section 25(2) no. 2 TDDDG.

The following sections explain which data are nevertheless generated for technical reasons when you access the site.

The website is hosted by Amazon Web Services (AWS). The website files are stored in the Amazon S3 storage service in the eu-central-1 region (Frankfurt am Main, Germany). They are delivered via the Amazon CloudFront content delivery network, which has delivery locations (edge locations) worldwide. Visitors from the EU are generally served from a location within the EU; depending on your location, however, delivery may also take place via a location outside the EU.

Data processed: In order for the website to be transmitted to your device, your IP address must be transmitted to AWS for technical reasons. It is strictly necessary for establishing the connection and delivering the content. Whether and for how long it is stored in logs beyond this is described in Section 4.

Purpose and legal basis: Provision, stability and security of the website. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable and secure presentation of our company's offering on the internet.

Processor: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. A data processing agreement pursuant to Art. 28 GDPR is in place with AWS (AWS Data Processing Addendum as part of the AWS Service Terms).

Transfer to third countries: Where data are delivered via an edge location outside the EU or the EEA or are processed by the US group company Amazon Web Services, Inc., this is safeguarded by the EU standard contractual clauses (Art. 46(2)(c) GDPR) contained in the AWS Data Processing Addendum. In addition, Amazon Web Services, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR).

Further information: AWS Privacy Notice.

We do not keep any server logs (log files) of accesses to our website www.e-vein.com. Access logging of the Amazon CloudFront delivery service is switched off. Your IP address and the other technical connection data (e.g. browser type, page accessed, time) are not logged, stored or analysed by us. Whether and for how long AWS processes connection data for its own operational and security purposes is governed by the AWS privacy notice (link in Section 3). Section 8 applies to erp.e-vein.com instead.

The legal basis for the purely technical transmission of your IP address to AWS for delivering the website is Art. 6(1)(f) GDPR (legitimate interest in providing the website, see Section 3). Retention period: no storage by us.

Our website can store two settings that you make yourself in your browser's local storage (localStorage). If you do not make such a choice, nothing is stored.

• Language: Our website is available in German and English. If you actively select a language via the language selector, your browser stores the selected language under the entry “language” with the value “de” or “en”. On each subsequent visit, the website reads the stored entry in order to display the page directly in the selected language.
• Pausing animations: On the homepage, you can use the “Pause animations” button to pause the moving elements of the page, including the rotating 3D model. When you press the button, your browser stores your choice under the entry “evein-still” with the value “1” (paused) or, if you switch the animations back on with the same button, “0”. On each subsequent visit, the website reads the stored entry so that the animations remain paused if you have chosen this.

Purpose: The settings you have selected are to be retained on your next visit. The entries contain no identifier, do not make it possible to recognise you and are not transmitted to us or to third parties; they remain exclusively in your browser.

Legal basis: Section 25(2) no. 2 TDDDG. Storing the entries and reading them later are strictly necessary in order to provide the service you have expressly requested by making the respective selection – the display of the website in the selected language or with paused animations. Consent is therefore not required. No personal data reach us in this process; to this extent, no processing under the GDPR by us takes place.

Retention period: The entries remain stored until you delete them. You can remove them at any time via your browser settings (deleting the site data for this website).

The fonts Inter and Oswald used on this website are delivered from our own hosting (see Section 3). There is no connection to Google Fonts or other external font providers; apart from retrieving the font files, which is part of the normal delivery of the website, no additional data are generated.

If you contact us by email (e.g. via the link info@e-vein.com on our website) or by telephone, we process the data you provide: your email address or telephone number, your name if given, the content of your enquiry and, where applicable, your company details.

Purpose: Processing and answering your enquiry, preparing quotations, and initiating, performing and settling contracts.

Legal basis: If your enquiry is aimed at concluding or performing a contract (e.g. request for a quotation, order, complaint), the legal basis is Art. 6(1)(b) GDPR. For other enquiries, it is Art. 6(1)(f) GDPR; our legitimate interest lies in properly answering enquiries addressed to us.

Obligation to provide data: You are neither legally nor contractually obliged to provide us with your data. Without your contact details and the content of your enquiry, however, we cannot process it.

Processor: Our email system is operated via Microsoft 365 (Exchange Online). The provider is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. A data processing agreement pursuant to Art. 28 GDPR is in place with Microsoft (Microsoft Products and Services Data Protection Addendum). The email data are stored within the EU (Microsoft EU Data Boundary).

Transfer to third countries: Access by the US-based Microsoft Corporation, for example for support or security purposes, cannot be entirely ruled out. It is safeguarded by the EU standard contractual clauses (Art. 46(2)(c) GDPR) contained in the Microsoft DPA; in addition, Microsoft Corporation is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Further information: Microsoft Privacy Statement.

AI assistant: To process emails and data in our ERP system (Section 8), we use the AI assistant Claude (“Claude Team” plan), which accesses our mailbox and the ERP system through interfaces. This may include the content of your enquiry. The provider and our processor is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. This is based on its data processing agreement (Data Processing Addendum), which forms part of its Commercial Terms of Service. The data are stored in the United States and may also be processed in other countries. Anthropic is not certified under the EU-US Data Privacy Framework, so the European Commission's adequacy decision for the United States (Art. 45 GDPR) does not apply to this transfer. Instead, transfers to third countries are safeguarded by the EU standard contractual clauses agreed in the Data Processing Addendum (Art. 46(2)(c) GDPR). Their text is available in Commission Implementing Decision (EU) 2021/914; you can obtain a copy of the version agreed with Anthropic on request from info@e-vein.com. Under the contract terms, Anthropic may not use this content to train its AI models.

Retention period: We store your enquiry until it has been dealt with conclusively and no further queries are to be expected. If it constitutes business correspondence, we are legally obliged to retain it (Art. 6(1)(c) GDPR in conjunction with Section 257(4) of the German Commercial Code (HGB) and Section 147(3) of the German Fiscal Code (AO)): we retain commercial and business letters for six years and accounting records (e.g. invoices) for eight years, in each case calculated from the end of the calendar year in which the letter was received or sent or the record was created. The period is extended for as long as the documents are relevant to taxes for which the assessment period has not yet expired (Section 147(3) AO). After expiry, the data are deleted.

At erp.e-vein.com we use the ERPNext software to run our product catalogue and a portal for customers and suppliers. The system runs on our own virtual server (Amazon Lightsail) at Amazon Web Services in the eu-central-1 region (Frankfurt am Main, Germany). We administer it ourselves. The processor for its operation is AWS; for the contract and transfers to third countries, Section 3 applies accordingly. Emails sent from the system, such as the acknowledgement of the contact form, login details, login codes and portal notifications, are sent via Microsoft 365; Section 7 applies in this respect. The pages do not load any content from third-party servers and contain no analytics or tracking services.

AI assistant: To work with data from the system, including data from the contact form and the portal, we use the AI assistant Claude; the provider, contractual basis and third-country transfers are described in Section 7.

Cookies: When you access the system, it sets strictly necessary cookies: “sid” for the session (5 days) and “system_user”, “full_name”, “user_id” and “user_lang” for login status and interface language, plus, for logged-in users with a profile picture, “user_image” containing the address of that picture (each until you close the browser). As long as you are not logged in, they contain no personal identifier but the placeholder “Guest”. They serve solely to operate the catalogue, the contact form and the login, not for analytics or advertising. The legal basis for storing and reading them is Section 25(2) no. 2 TDDDG; insofar as personal data are processed, Art. 6(1)(f) GDPR. If someone opens an address with the parameters “cc” or “sp”, the system additionally stores their value for about 30 minutes in the cookies “referral_coupon_code” and “referral_sales_partner”; we do not use such links and do not evaluate these cookies.

Stored catalogue settings: If you switch between list and grid view in the product overview, your browser stores the selected view in local storage (localStorage) under the entry “product_view”. If you use the product search, it also stores your last up to four search terms under “recent_searches” in order to show them to you again as suggestions. The entries are not transmitted to us and remain stored until you delete them via your browser settings.

Server logs: The system's web server logs every request with IP address, time, requested address, status code, amount of data transferred, referring page (referrer) and browser identifier (user agent). The purpose is secure operation, error analysis and defence against attacks; the legal basis is Art. 6(1)(f) GDPR. The logs are deleted automatically after 14 days.

Contact form: If you submit the form at erp.e-vein.com/contact, we store your email address, the selected subject and your message in our ERP system and answer your enquiry by email. Purpose, legal basis, processors and retention period are as described in Section 7.

Request a quotation: The “Angebot anfragen” (request a quotation) button on a product page opens your own email program with a prepared message. No data are transmitted to the ERP system; Section 7 applies to the email.

Portal access for customers and suppliers: There is no self-registration; only contact persons of our customers and suppliers for whom we create an account receive access. We receive the name and email address from you or from your company in the course of the business relationship. In the portal you can view the documents of our business relationship, such as requests for quotation, quotations, orders, deliveries and invoices, and submit support requests. We process name, email address, login data and the content you submit in the portal. We do not store the password in plain text but only as a cryptographic hash. At each login, the system records the time, the result and the IP address in order to detect misuse of the account; these entries are deleted automatically after 90 days. In addition, the system stores the time and IP address of the most recent login in the user account; these are overwritten at each login and deleted together with the account.

Purpose and legal basis: Handling of the business relationship. If you yourself are our contractual partner, the legal basis is Art. 6(1)(b) GDPR; if you act on behalf of a company, it is Art. 6(1)(f) GDPR, our legitimate interest being efficient cooperation with your company. Login records are based on Art. 6(1)(f) GDPR.

Retention period: The account exists for the duration of the business relationship and is deleted afterwards. We retain business documents until the statutory retention periods have expired (Section 7).

The website is delivered exclusively via an encrypted HTTPS connection (TLS). Unencrypted requests via http:// are automatically redirected to the encrypted connection. The same applies to erp.e-vein.com. You can recognise the encryption by the address beginning with https:// in your browser's address bar.

With regard to the personal data concerning you, you have the following rights vis-à-vis us:

• Access (Art. 15 GDPR) to whether and which data we process about you, as well as the further information set out in Art. 15;
• Rectification (Art. 16 GDPR) of inaccurate data or completion of incomplete data;
• Erasure (Art. 17 GDPR), insofar as the processing is no longer necessary and no statutory retention obligations stand in the way;
• Restriction of processing (Art. 18 GDPR) under the conditions set out there;
• Data portability (Art. 20 GDPR): receipt of the data you have provided to us on the basis of a contract in a structured, commonly used and machine-readable format;
• Objection (Art. 21 GDPR) – see Section 11;
• Complaint to a supervisory authority (Art. 77 GDPR) – see Section 12.

A right of withdrawal under Art. 7(3) GDPR presupposes that consent has been given. Since we do not base any processing on your consent, it currently does not apply.

To exercise your rights, an informal message to info@e-vein.com or to the postal address given in Section 1 is sufficient. Exercising your rights is free of charge for you.

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority competent for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA – Bavarian State Office for Data Protection Supervision)
Promenade 18
91522 Ansbach
Telephone: +49 981 180093-0
Email: poststelle@lda.bayern.de
www.lda.bayern.de

This privacy policy is dated 9 October 2026. We will adapt it if the data processing on our website or the legal requirements change. The current version can always be found on this page.