Privacy notice

1. Controller

Represented by Managing Director Andreas Hänel.
Phone: +49 34651 399-0
Email: info@gefas-rossla.de

2. Data Protection Officer

Phone: +49 173 3816089
Email: gunter_pueschel@web.de

3. Website and planned hosting

Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, is the intended hosting provider for the new website. Accessing a website involves the technical processing of data, in particular the IP address, date and time, requested URL including any query parameters, volume of data transferred, status code, and information about the browser and operating system. The previously visited page may also be transmitted if your browser permits it.

This processing serves to deliver the website, ensure its secure and stable operation, and detect and resolve errors or misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to provide information about our company through a functional and secure website.

Vercel uses a global delivery infrastructure and subprocessors. Selecting a European region for functions alone cannot rule out processing outside the EU or EEA, particularly in the USA.

Before the website goes live, the agreement applicable to the plan actually selected, the subprocessors, and the appropriate safeguards under Art. 44 et seq. GDPR must be reviewed and documented for processing on our behalf and any transfers to third countries. The published Vercel Data Processing Addendum includes EU Standard Contractual Clauses, among other provisions. This draft does not claim that GEFAS has already entered into an agreement.

The specific logging arrangements and erasure periods for the future project have yet to be determined. The display of runtime logs depends on the plan and does not guarantee that all infrastructure and security data will be erased. Further information from the provider: Vercel Privacy Notice.

4. Contact and contact form

When you contact us by telephone or email, we process the contact details and information you provide to deal with your enquiry. For enquiries relating to a contract or steps prior to entering into a contract, the legal basis is Art. 6(1)(b) GDPR where you are personally a party to the contract. For general enquiries and enquiries on behalf of a company, we rely on Art. 6(1)(f) GDPR; our interest is in communicating appropriately with prospective customers and business partners.

When you submit the contact form, our server processes your details and sends your enquiry to the GEFAS inbox through the ALL-INKL email service. First name, last name, email address, area of interest and message are required. Company and telephone number are optional. The connection to the email service is encrypted. We do not store your submission in a separate form database.

If the form shows a copy recipient, that address receives the same enquiry in CC for quality assurance. If the form is temporarily unavailable or JavaScript is disabled, you can use the contact email address or telephone number.

To protect against automated enquiries, Vercel BotID checks the browser request. We validate the form data on the server and limit the number of attempts. The server application uses the IP address briefly in memory for this purpose. This helps prevent misuse and keep the contact channel available.

A product selection can be passed as a parameter in the page URL. When the page is opened, this is also transmitted to the hosting provider as part of the technical request and may appear in its logs. Please do not enter personal or confidential information in the page URL.

5. Job applications

You can write to pfeiffer@gefas-rossla.de to submit your application. We process your contact details, application documents, information about your qualifications and subsequent correspondence to decide whether to enter into an employment relationship. The legal basis is, in particular, Section 26 BDSG. Please provide only the documents necessary for your application.

Access is granted to the people involved in the selection process and, where necessary, service providers used for email and IT operations. Data is shared for other purposes only where there is an appropriate legal basis. This website does not make automated decisions about your application.

If you are hired, the necessary documents are transferred to personnel administration. Otherwise, we retain documents only for as long as they are needed for the selection process and, where applicable, to establish or defend legal claims. Art. 6(1)(f) GDPR may provide a basis for retention to defend legal claims. Longer-term inclusion in an applicant pool requires separate, voluntary consent; applying alone does not place you in such a pool. The specific erasure period used by the company must be checked and finalised before publication.

6. Browser storage

Logo intro

When the home page is first opened, the marker gefas-intro-seen with the value 1 is currently set automatically in your browser’s sessionStorage and read on subsequent visits. This means the logo intro appears only once within the same tab session. The marker contains no name and is not used to track your behaviour across websites. Our application does not transmit it to a server.

The marker is stored for the current browser session, usually until the tab or window is closed. Whether it is present again after a session is restored depends on the browser. You can delete website data or block access through your browser settings. If session storage is unavailable, the intro may appear again.

Storage without directly identifiable personal information is also generally subject to the requirements of Section 25 TDDDG. Before publication, it must be established whether a valid statutory exemption applies to this purely visual function or whether consent or a technical change is required. This draft therefore does not categorically describe the marker as technically necessary or claim that consent has already been obtained. The privacy notice alone cannot replace any consent that is required.

7. Fonts, media and external links

The new website delivers its font files, images, videos and PDF documents through its own website infrastructure. No external font providers or video platforms are integrated to display them. The home page video is a local media file rather than an embedded video from a third party.

Ordinary links, such as links to distributors or a route planner, load the other website when you follow the link. Its provider then processes data under its own responsibility.

Audience measurement with Vercel Web Analytics

We use Vercel Web Analytics on www.gefas-rossla.de to measure page views and improve our website. The statistics can include pages visited, browser and device information, approximate country and the referring page, where available. We remove query parameters and fragments from the page URL before sending the event. Vercel does not use third-party cookies for this measurement. According to Vercel, the session identifier derived from the request is discarded after 24 hours.

Vercel Web Analytics privacy information

Performance measurement with Vercel Speed Insights

We use Vercel Speed Insights to measure how quickly and smoothly our website loads in your browser. Vercel processes technical metrics such as loading time and layout stability, together with page, device, browser and connection information. We remove query parameters and fragments from the measured URL. Vercel says these measurements are recorded without being associated with individual visitors or IP addresses.

Vercel Speed Insights privacy information

8. Retention periods and recipients

We generally retain personal data only for as long as the relevant purpose requires or statutory retention obligations apply. For business correspondence and contractual documents, these obligations depend on the type of document and the applicable commercial and tax law. Data needed to defend legal claims is retained only to the extent necessary until the relevant limitation periods expire. It is then erased unless another legal basis applies.

Within GEFAS, only the people responsible have access. Depending on the matter, hosting, email and IT service providers may also be recipients. Disclosures to authorities required by law and the involvement of legal advisers remain possible. For the published version, the actual email provider and the relevant contracts must still be checked against the arrangements used in practice. The purpose-specific criteria described above also apply to hosting logs and job applications.

9. Your rights

Subject to the applicable legal requirements, you have the following rights in particular:

• Access to your personal data under Art. 15 GDPR and rectification of inaccurate data under Art. 16 GDPR.
• Erasure under Art. 17 GDPR and restriction of processing under Art. 18 GDPR.
• Data portability under Art. 20 GDPR, where its requirements are met.
• Withdrawal of consent with effect for the future under Art. 7(3) GDPR. The lawfulness of processing before withdrawal remains unaffected.
• Objection under Art. 21 GDPR to processing based on Art. 6(1)(e) or (f) GDPR on grounds relating to your particular situation. You may object to direct marketing at any time.

To exercise your rights, please contact us or our Data Protection Officer. You may also lodge a complaint with a data protection supervisory authority under Art. 77 GDPR, in particular in the place where you usually live, work or believe an infringement has occurred.

For our location: State Commissioner for Data Protection of Saxony-Anhalt, Otto-von-Guericke-Straße 34a, 39104 Magdeburg; Postfach 1947, 39009 Magdeburg. Contact the supervisory authority.

You are under no contractual obligation to provide personal information merely to browse the website; technically necessary access data is generated when the connection is established. Without the information required for an enquiry or application, we may be unable to deal with it. The website functions described do not carry out automated decision-making, including profiling, under Art. 22 GDPR.

10. Security and notice status

An encrypted HTTPS connection is planned for the published website. Ordinary email communication does not guarantee end-to-end encryption. Please agree arrangements with us before sending particularly confidential information.

Draft dated: 10 November 2026. Before publication, this information will be checked against the technology actually used and the company’s procedures. The company details and the Data Protection Officer’s contact details have been confirmed for the relaunch.