Skip to content
A brand of AWS-Technik GmbH · Engineering from Düsseldorf since 2000 +49 211 87668255

Privacy policy

Rechtlich verbindlich ist die deutsche Fassung. / The German version is legally binding.

We take the protection of your personal data seriously. Below we explain which personal data we process when you use this Platecore brand website, for which purposes and on which legal basis. Platecore is a brand of AWS-Technik GmbH.

1. Controller

The controller within the meaning of the GDPR is:
AWS-Technik GmbH
Erkrather Str. 401, 40231 Düsseldorf, Germany
Phone: +49 211 87668255
E-mail: platecore@aws-technik.de

2. Hosting and server log files (Cloudflare)

This website runs on infrastructure provided by Cloudflare, Inc. (Cloudflare Workers, D1 database, R2 object storage) under a data processing agreement pursuant to Art. 28 GDPR. Data storage (D1 database, R2 storage) is configured to take place in the European Union; page delivery uses Cloudflare's global network. When pages are requested, Cloudflare processes technically necessary connection data in server log files (in particular IP address, date and time, requested resource, referrer, user agent) to deliver, stabilise and secure the service. Legal basis: Art. 6(1)(f) GDPR. Cloudflare may also set technically required security cookies (e.g. __cf_bm; Section 25(2) no. 2 TDDDG).

Server log files are generally deleted or anonymised after 30 days at the latest, unless exceptionally required longer to investigate security incidents. For third-country transfers see section 9.

Cloudflare Web Analytics: to measure delivery quality (load times, error rates, rough page view counts) Cloudflare adds — where enabled — a small measurement script to our pages (static.cloudflareinsights.com); the measurements are sent back to our own address. This service works without cookies and without identifiers that would make you recognisable across page views or websites; in particular no cross-device profiling takes place. Since nothing is stored on or read from your device, no consent under Section 25(1) TDDDG is required - the service therefore runs independently of your choice in the consent banner. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a technically sound and swiftly delivered website). You may object to this processing under Art. 21 GDPR; contact details are in section 1.

3. Inquiries and configurator

When you use our selection tunnel (configurator) and submit an inquiry, we process the technical specifications you enter and your contact details (in particular company, name, e-mail address, phone number and company address as well as, if you enter a different delivery address, that address too). These data are stored in a database (Cloudflare D1, EU location). The purpose is to handle your inquiry and prepare a quotation. Upon receipt we compute an internal plausibility score server-side (e.g. reachability of the e-mail domain) and store it together with the inquiry and the calculated sizing result.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and, where the inquiry is made on behalf of an organisation, Art. 6(1)(f) GDPR (legitimate interest in handling business inquiries).

After submitting you receive an automatic confirmation e-mail that only mirrors your own entries. This confirmation and the internal notification to our team are sent via Cloudflare's e-mail service, covered by the data processing agreement named in section 2; the internal notification additionally contains the internal prioritisation score and the campaign identifier of your inquiry. For quotation purposes we share only the technical specifications of your inquiry with our suppliers; your contact details are not transmitted. Providing your data is voluntary; without your contact details we cannot process the inquiry or prepare a quotation. For retention see section 10.

4. Spam and abuse protection (Cloudflare Turnstile)

Where enabled, we use Cloudflare Turnstile to protect our forms against automated submissions. A verification token is validated server-side with Cloudflare; technical information such as your IP address and browser details is processed. Legal basis: Art. 6(1)(f) GDPR; access to your device is required for the form function (Section 25(2) no. 2 TDDDG). If Turnstile is not enabled, no such processing takes place.

5. Lead management (Loops)

For the structured follow-up of inquiries we use Loops (Loops, Inc., USA). When you submit an inquiry we store a lead record there: your e-mail address and, where provided, company, name, phone number and the application field of your inquiry. The confirmation e-mail and the internal notification to our team are not sent via Loops but through Cloudflare's infrastructure (see section 3). Legal basis: Art. 6(1)(b) and (f) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place. Processing may take place on servers in the USA; transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with supplementary safeguards.

Inclusion in our Loops prospect list serves exclusively to process and follow up your inquiry. You will not receive marketing e-mails through it without separate consent: newsletters and further product information require double opt-in; the legal basis in that case is your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future.

6. Internal processing, sales system and automation

For internal handling and routing of inquiries we use the self-hosted automation software n8n (operated on our own infrastructure, EU). No inquiry data is transmitted to external third parties through this. Legal basis: Art. 6(1)(b) and (f) GDPR.

For sales processing, inquiries are additionally transferred to an internal, self-hosted CRM system, where the plausibility score computed on receipt (section 3) together with further internal signals (e.g. completeness of the details) is used for prioritisation. The score is used solely for internal prioritisation; no decision based solely on automated processing with legal effect on you (Art. 22 GDPR) takes place - inquiries are always decided by humans.

7. Analytics with PostHog (only with your consent)

If you have consented via our consent banner, we use the analytics service PostHog (PostHog, Inc., USA; the European instance eu.i.posthog.com is used). Without your consent no PostHog script is loaded and no analytics data is collected. Legal basis: Art. 6(1)(a) GDPR; storing and reading information on your device is based on Section 25(1) TDDDG. Analytics data is deleted or aggregated after 12 months at the latest.

Withdrawal: you may withdraw your consent at any time with effect for the future - most easily via the “Privacy settings” link in the page footer, which reopens the consent banner; if you decline, analytics stops and the associated cookies and storage entries are removed. Alternatively an informal notice to the contact details above suffices. The lawfulness of processing before withdrawal remains unaffected.

8. Marketing attribution and conversion measurement

If you reach our website via an advertising or campaign link, the URL may contain origin parameters: UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and the click identifiers gclid (Google Ads) and msclkid (Microsoft/Bing Ads). We do not place these parameters in your browser. They stay in the address bar while you move around our website and are passed on to our internal links. They are only stored once you submit an inquiry - then together with your inquiry in our database (Cloudflare D1, EU location). If you do not submit an inquiry, we store the parameters nowhere; they do nonetheless appear in your browser history and in the server logfiles described in section 2, like any address you call up.

The purpose is to attribute your inquiry to the triggering campaign in order to evaluate the effectiveness and cost of our campaigns. The click identifiers gclid and msclkid are capable of identifying a person. We send the click identifier gclid of a submitted inquiry back to Google Ads so that the campaign can attribute the result to the click that caused it (offline conversion import). What is transmitted is limited to that identifier, the time of the inquiry, the name of our conversion action and a value in euros by which we rate an inquiry internally - none of the contents of your inquiry, in particular neither name nor e-mail address nor technical design data. Independently of that, the Google Ads script described in the next paragraph reports an event to Google, but only with your consent. Since this attribution requires no access to your device, Section 25 TDDDG does not apply here; the legal basis is our legitimate interest in measuring the success of our advertising (Art. 6(1)(f) GDPR). You may object to this processing under Art. 21 GDPR - an informal message to the contact details above is sufficient. If you reach our pages without a campaign link, the parameters do not arise in the first place.

Retention: without a submitted inquiry we place the parameters neither in your browser nor in our database. Like any address you call up, however, they do appear in your browser history, which you can clear yourself, and in the server logfiles described in section 2, which are deleted or anonymised after 30 days at the latest. If stored with an inquiry, the retention periods for inquiry and quotation data apply (section 10). The report to Google Ads is sent retrospectively and in batches; per inquiry it is always limited to the items named above, even where a transmission is repeated.

Google Ads conversion measurement (only with your consent): if you have consented via our consent banner or the optional checkbox in the configurator, we load the gtag.js script from googletagmanager.com and report a conversion event to Google when a configurator inquiry is submitted. What is transmitted: our conversion identifier (Google Ads account and conversion action ID), your IP address, browser and device details and the timestamp; Google attributes the event to a specific ad using the click identifier gclid. The contents of your inquiry - in particular name, e-mail address and technical design data - are not transmitted to Google (enhanced conversions are disabled). For this purpose Google sets cookies on your device, in particular _gcl_aw with a lifetime of typically 90 days, and reads the gclid.

The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data is also transferred to Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework, so the transfer relies on the European Commission's adequacy decision of 10 July 2023. In addition, Google uses the EU Standard Contractual Clauses for certain transfers. We will provide you with a copy of the respective safeguards on request using the contact details above.

Joint controllership: for the collection of this data on our website and its transmission to Google, we and Google are joint controllers within the meaning of Art. 26 GDPR. We decide on the integration and the measurement purpose; Google determines the technical means - script, cookies and attribution logic - and at the same time uses the data for its own purposes, in particular to improve its advertising services. Google alone is responsible for any subsequent processing it carries out; the Google Ads data processing terms and Google's privacy policy govern that stage. Under Art. 26(3) GDPR you may exercise your data subject rights both against us and directly against Google.

We use the service solely for measuring success: personalised advertising, remarketing and customer-list matching are permanently disabled (Google Consent Mode v2, the “ad_personalization” signal always remains denied). As long as you have not consented, no Google script is loaded and your browser establishes no connection to Google. That applies to this browser-side measurement. The offline conversion import described above takes place regardless of your decision: it does not run via your device but from our database without any involvement of your browser, and relies on Art. 6(1)(f) GDPR. Your consent therefore governs the script and the cookies in your browser, not the attribution as such - you may object to the latter under Art. 21 GDPR. Legal basis: your consent (Art. 6(1)(a) GDPR); storing and reading on your device is based on Section 25(1) TDDDG.

You give this consent separately from web analytics (section 7): our consent banner lets you allow or decline each of the two services individually. You may withdraw at any time via “Privacy settings” in the page footer, likewise separately per service. We then stop measurement without delay: no further conversion event is reported, we set the consent signals towards Google to “denied”, and we delete the Google cookies we set (_gcl_*) as far as our website can access them. We have no access to data already transmitted to Google before the withdrawal, nor to cookies Google has set on its own domains; please contact Google directly regarding those. Besides the consent banner, you can also give your consent to conversion measurement via an optional checkbox in the configurator. It is the same consent with the same effect: it is stored in the same place, submitting your enquiry does not depend on it, and a withdrawal via “Privacy settings” covers it as well.

Calls via our Google ads (no consent, no cookies): our Google search ads may display a phone number. The number shown is not our own but a forwarding number provided by Google; a call to it is put through to our line automatically. In doing so Google records connection data: date and time, duration, whether the call was answered, the area the number originates from (dialling code), the ad that triggered the call and the device type. From Google we receive an aggregated report, that is the number and duration of calls per ad. Conversations are not recorded: call recording is switched off in our Google Ads account. The forwarding number appears only in the ad and only Monday to Friday from 8 a.m. to 5 p.m.; our website states our own number given in the legal notice throughout.

This happens outside our website: no cookies are set and nothing is stored on or read from your device. Section 25 TDDDG therefore does not apply, and consent before the call is neither possible nor required. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in measuring the success of our advertising. We decide on the use of call measurement and its purpose; Google determines the technical means - forwarding number, call routing and reporting - and Google is responsible for its subsequent processing. Recipients and third-country transfers are the same as stated above for conversion measurement: Google Ireland Limited, onward transfer to Google LLC, USA. You may object to this processing under Art. 21 GDPR (section 12). If you wish to avoid it altogether, simply dial our number given in the legal notice instead of the one in the ad.

9. Recipients, processors and third-country transfers

Processors: Cloudflare, Inc. (hosting/infrastructure; transfers safeguarded by its certification under the EU-US Data Privacy Framework), Loops, Inc. (e-mail/lead management; EU Standard Contractual Clauses) and - only with consent - PostHog, Inc. (analytics; DPF-certified, EU instance). Data processing agreements pursuant to Art. 28 GDPR are in place. In addition, Google Ireland Limited receives data from conversion measurement on our website (only with consent), the click identifier gclid of submitted inquiries from the subsequent offline conversion import (without consent, based on legitimate interests) as well as connection data from calls made via the forwarding number in our ads (without consent, based on legitimate interests); all three are described in section 8. Google is not our processor here: for collection and transmission we and Google are joint controllers under Art. 26 GDPR, while Google alone is responsible for its subsequent processing. Onward transfer to Google LLC, USA (DPF-certified). Suppliers receive only technical specifications without contact details for quotation purposes. Data may furthermore be disclosed to authorities or courts where we are legally obliged to do so.

With US providers a residual risk remains that US authorities may access data on the basis of US surveillance laws. You can request a copy of the relevant safeguards from us using the contact details above.

10. Retention

We store personal data only as long as necessary for the respective purposes or as required by statutory retention obligations. For inquiry and lead data: inquiries that do not lead to a contract are deleted no later than three years after the end of the year of the inquiry (standard limitation period, Section 195 German Civil Code). Inquiries classified as rejected or no interest are deleted after six months. If a contract is concluded, we retain the related records under commercial and tax law: six years for commercial letters (Section 257 German Commercial Code) and ten years for accounting records (Section 147 German Fiscal Code). After expiry the data is deleted; deletion also covers the lead record stored with Loops.

11. Data processing in the course of business relationships

Beyond this website we process personal data of our customers, prospects, suppliers and their contact persons where necessary to initiate, perform and settle contracts (Art. 6(1)(b) GDPR; for contact persons of legal entities Art. 6(1)(f) GDPR). Before deliveries on account we may obtain credit information from credit agencies or trade credit insurers (Art. 6(1)(f) GDPR). Where we have obtained your e-mail address in connection with the sale of goods or services, we occasionally inform you by e-mail about our own similar products (Section 7(3) German Act against Unfair Competition; Art. 6(1)(f) GDPR); we point this out, together with your right to object at any time, when collecting the address and in every e-mail.

Right to object to direct marketing (Art. 21(2) GDPR): you may object at any time, without stating reasons, to the use of your data for direct marketing; an informal notice to the contact details above suffices.

12. Your rights as a data subject

Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing (Art. 21). Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). If you exercise your right to erasure, we delete your data in all systems involved, including the lead record stored with Loops and our internal sales processing, unless statutory retention obligations prevent this.

Right to object (Art. 21(1) GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves to establish, exercise or defend legal claims.

To exercise your rights, please contact: platecore@aws-technik.de.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestr. 2-4, 40213 Düsseldorf
https://www.ldi.nrw.de/

14. Currency of this policy

This privacy policy is updated whenever our data processing changes or new legal requirements make it necessary. The version published on this page applies.

Last updated: 9 September 2026