privacy policy
This privacy policy explains how personal data is processed when you visit our website at kressweb.de, contact us or apply for a job.
1. Controller
Harald Kreß Maschinenbau & CNC-Technik GmbH
Industriestraße 39
74909 Meckesheim
Germany
Phone: +49 (0) 6226 784664
Email: info@kressweb.de
2. Hosting and access to the main website
Our main website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you access the website, STRATO processes technical access data on our behalf. This may include your IP address, date and time of access, requested address, previously visited page, browser, operating system, volume of data transferred and access status.
Processing serves to deliver the website, ensure stable and secure operation, and detect and investigate misuse and technical faults. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable provision of our online services.
STRATO receives the data as a processor. We have an agreement with STRATO under Article 28 GDPR. According to its documentation, STRATO makes customer-accessible log files available for a limited period of up to six weeks and anonymises the address data they contain. Longer retention may be necessary in individual cases to investigate a specific security incident or establish, exercise or defend legal claims.
Further information is available in the STRATO privacy information.
3. Cookies, web storage and locally provided content
Our main website at kressweb.de does not use cookies or local web storage for analytics or advertising. We do not use audience measurement or user tracking. Fonts, images, videos, libraries and icons are provided by our own web server. Loading this content does not establish a connection to an external content provider.
Our website therefore currently does not require a cookie consent prompt.
4. Contacting us
If you contact us through the contact form, by email, telephone or another means, we process the contact details you provide and the content of your message to handle and respond to your enquiry.
The contact form requires your name, email address and message; company and phone number are optional. You may attach one PDF, JPG or PNG file up to 5 MB. Your enquiry and any attachment are forwarded to us by email via our web server. The uploaded file is temporarily stored on the server for processing and automatically removed when the request has finished processing on the web server. As part of the email, it is subject to the retention and deletion rules described below. The form uses a hidden check field and sending limits to protect against automated enquiries. A hash of your IP address and request timestamps are temporarily stored on the server for this purpose. Entries expire after one hour and are removed on the next valid request.
If your enquiry relates to a contract or pre-contractual steps, the legal basis is Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f) GDPR based on our legitimate interest in appropriate communication and handling enquiries.
Within our company, only the people responsible for handling your enquiry have access to your data. Technical service providers may act as processors. We delete data once the enquiry has been fully dealt with and there are no statutory retention obligations or legitimate interests requiring further storage. Business correspondence may be subject to statutory commercial and tax retention periods.
5. Job applications by email
If you apply by email, we process the data needed for the recruitment process. This may include your name, contact details, CV, qualifications, certificates, the position sought, your message and other information you voluntarily provide.
The legal basis is section 26(1) of the German Federal Data Protection Act (BDSG). Where special categories of personal data are needed to exercise employment law rights or meet related obligations, processing is based on Article 9(2)(b) GDPR. If, exceptionally, processing is based on explicit consent, Article 9(2)(a) GDPR applies. Please provide such information only where necessary for the process.
Recipients are exclusively the people involved in recruitment within our company and technical service providers acting as processors for our email communications. Decisions on your application are not made solely by automated means.
If the application leads to employment, the data may be transferred to the personnel file. Otherwise, we delete applicant data no later than six months after the process ends or the application is withdrawn, unless longer retention is required to defend legal claims. Inclusion in an applicant pool requires your voluntary consent, which you may withdraw at any time with future effect.
6. External links
Our pages contain links to external services, particularly LinkedIn and Google Maps. Simply viewing our website does not transmit data to those providers through these links. Only when you select a link does your browser access the external service. From that point, the respective provider is responsible for processing there. Please consult its privacy information.
7. Recipients and transfers
We share personal data only where necessary for the stated purposes, where legally required or where you have consented. Recipients may include relevant internal departments, hosting and technical service providers, communications providers, authorities and legal advisers where an appropriate legal basis exists.
Processors are bound by contracts under Article 28 GDPR. Transfers outside the European Union or European Economic Area occur only where the requirements of Articles 44 et seq. GDPR are met.
8. Your rights
Subject to the applicable legal requirements, you have in particular the following rights:
- Access to information about the processing of your personal data under Article 15 GDPR
- Rectification of inaccurate data under Article 16 GDPR
- Erasure of your data under Article 17 GDPR
- Restriction of processing under Article 18 GDPR
- Data portability under Article 20 GDPR
- Withdrawal of consent with future effect under Article 7(3) GDPR
- Complaint to a data protection supervisory authority under Article 77 GDPR
Where processing is based on Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. We will then stop processing the data unless there are compelling legitimate grounds or grounds for establishing, exercising or defending legal claims.
To exercise your rights, simply contact us using the details in section 1.
9. Right to complain
Without prejudice to other remedies, you may complain to a data protection supervisory authority. The authority responsible for our company is:
The State Commissioner for Data Protection and Freedom of Information, Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Phone: 0711 615541 0
Email: poststelle@lfdi.bwl.de
www.baden-wuerttemberg.datenschutz.de
10. Version and changes
This privacy policy is dated 31 August 2026. We update it when the services used, actual processing or legal requirements change.