privacy policy

Last updated: 13 October 2026 · This English version is a translation; in case of doubt, the German version shall prevail.

1. Controller

The controller responsible for data processing on this website is:

Company: Josip Heger und Simon Heger GbR
Address: Bleichstraße 94, 75173 Pforzheim, Germany
Phone: +49 7231 20700-0
E-mail: kontakt@heger-cad.de

2. General information

We take the protection of your personal data seriously and treat it confidentially and in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and this privacy policy. This website uses no cookies (exception: a technically necessary session cookie in the password-protected customer area, see section 4b), no analytics or tracking services and no social media plugins. Only the file name of the home page is stored in your browser’s local storage so that the links between the pages work; no personal data is processed and no data is transmitted (technically necessary, Section 25(2) of the German Telecommunications Digital Services Data Protection Act, TDDDG). Fonts, images and videos are loaded from our own web space; there is no connection to Google servers or other third-party providers.

3. Hosting and server log files

This website is hosted by an external service provider: ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (data centre in Germany). When you visit the website, information transmitted by your browser is automatically stored in server log files: date and time of access, page requested, amount of data transferred, browser type and version, operating system and the previously visited page (referrer). Your IP address is not stored; the log file contains 0.0.0.0 in its place. This means it is not possible to identify you. No visitor statistics are compiled from the log files, and the data is not combined with other data sources.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free display and the security of the website. The log files are deleted automatically after 7 days. We have concluded a data processing agreement with the hosting provider in accordance with Art. 28 GDPR.

4. Contacting us

If you contact us by e-mail or telephone, we process the data you provide (name, contact details, content of your enquiry) in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR if the enquiry is aimed at concluding a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). The data remains with us until your request has been dealt with in full; statutory retention periods remain unaffected.

Our e-mail mailboxes are operated by Microsoft 365 (Microsoft Ireland Operations Limited, Dublin, Ireland). E-mails to us, enquiries via the contact form (section 4a) and notifications from the customer area (section 4b) are stored there. We have concluded a data processing agreement with Microsoft in accordance with Art. 28 GDPR. The data is stored and processed in the EU (Microsoft EU Data Boundary). A transfer to Microsoft Corporation in the USA is only possible in exceptional cases. It is based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, under which Microsoft is certified (Art. 45 GDPR), and additionally on standard contractual clauses (Art. 46(2)(c) GDPR).

4a. Contact form

If you use the contact form, your details (name, company if applicable, e-mail address, telephone number if applicable, subject and message) are transmitted in encrypted form to our web server and forwarded from there to us by e-mail. The details are not stored on the web server. To protect against automated entries, the form uses an invisible field and a time check – without external services and without cookies. The legal basis is Art. 6(1)(b) GDPR (processing your enquiry) or Art. 6(1)(f) GDPR (legitimate interest in replying); further processing takes place as described in section 4.

4b. Customer area (file upload)

In the password-protected customer area you can send us files. In doing so, we process the details you enter in the form (name, company if applicable, e-mail address, message if applicable) and the uploaded files. The transfer is encrypted. The files are stored on our web space at ALL-INKL.COM (see section 3) in a folder that cannot be accessed publicly, and we are notified by e-mail (see section 4). After uploading, each file is automatically checked on the server with our hosting provider’s virus scanner (ClamAV); suspicious files are blocked and not processed further. No data is transmitted to any other third parties in the process. As soon as we have taken over the files for processing, we delete them from the web space. Cancelled, incomplete transfers are deleted automatically after 48 hours the next time the customer area is accessed.

For logging in, the customer area sets a technically necessary session cookie, which is deleted when you log out or close your browser (Section 25(2) TDDDG). To protect against password guessing, we store a pseudonymised identifier of your IP address (hash value) together with the time of failed attempts; entries older than 24 hours are deleted at the next login attempt. The legal basis is Art. 6(1)(b) GDPR (performance of the order or pre-contractual measures) and, for protection against misuse, Art. 6(1)(f) GDPR (legitimate interest in the security of our website).

5. External links

This website links to the website of our partner novoprint3D and to other external websites. When you click on such a link, you leave our website; the privacy policy of the respective provider applies.

6. Your rights

You have the following rights with regard to the personal data concerning you:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)

Right to object under Art. 21 GDPR

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. This concerns the technically error-free display and the security of the website (section 3), answering enquiries (sections 4 and 4a) and protecting the customer area against password guessing (section 4b). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal message to kontakt@heger-cad.de is sufficient.

An informal message to the contact details above is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart, Germany.

7. Data security

This website uses TLS encryption (recognisable by “https” in the address bar) to protect transmitted data against access by third parties.

8. Changes

We reserve the right to amend this privacy policy if the legal situation or our services change. The version published on this page applies.