This English version is a translation for your convenience. In case of any discrepancy, the German version prevails.

In this policy we inform you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), how Sencos GmbH processes personal data when you visit our website www.sencos.de, contact us, apply for a job with us or work with us as the contact person of a customer, supplier or other business partner. Online shops and marketplace listings through which our products are sold to consumers are covered by the privacy notices available there.

1. The essentials in brief

• We only use cookies and similar technologies for analytics or marketing if you have given your consent beforehand via our cookie banner. No such service is currently active. We do not embed content from other providers (no external fonts, maps, videos or social media plugins). Our hosting provider Cloudflare may set technically necessary security cookies (section 4).
• Technically necessary connection data, in particular your IP address, is processed by our hosting provider Cloudflare, a US company, in order to deliver the website and protect it against attacks.
• Messages from the contact form are received for us by the service provider Formspark from Belgium and forwarded to us. Formspark stores the messages in the European Union. You can reach us by email or phone instead at any time.
• We process applications and enquiries only for the respective purpose and delete them after the periods stated below.
• You have extensive rights, including the rights of access, erasure and objection (sections 12 and 13).

2. Controller

The controller within the meaning of the GDPR is:

Sencos GmbH, Carl-Theodor-Reiffenstein-Platz 6, 60313 Frankfurt am Main, Germany

Represented by the managing director Birol Sen · Phone: +49 69 133 84 655 · Email: [email protected]

You can reach us at these contact details with any data protection matter. The subject line “Datenschutz” (data protection) helps us to route your message but is not required.

3. Visiting the website: hosting and server logs

What data is processed. Each time you access our website, your browser transmits data, for technical reasons, to the server that delivers the page:

• IP address of the requesting device,
• date and time of the request,
• address accessed (URL) and files retrieved,
• volume of data transferred and status message (e.g. whether the request was successful),
• browser type, browser version and operating system,
• the previously visited page (referrer), if your browser transmits it,
• technical connection data (e.g. protocol version, encryption parameters and the country of origin derived from the IP address).

Purposes. We process this data to deliver the website to your device, to ensure its stability, to detect and fend off attacks and misuse (e.g. overload attacks and automated access) and to fix errors.

Legal basis. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely, reliably and quickly.

Service provider. We operate the website via the Cloudflare Pages service and the content delivery network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare processes the data on our behalf on the basis of a data processing agreement (Art. 28 GDPR). Cloudflare operates data centres in many countries; your request is usually answered by a data centre near you. Cloudflare also processes log and connection data in the USA (see section 10).

Cloudflare’s own processing. Where Cloudflare derives insights from connection data in order to protect its own network and detect threats, Cloudflare acts as a controller in its own right. Information on this can be found in Cloudflare’s privacy policy at https://www.cloudflare.com/privacypolicy/. Where this involves a disclosure to Cloudflare as a separate controller, we base it on Art. 6(1)(f) GDPR; our legitimate interest is protection that detects attacks on the basis of experience from many websites.

Storage period. We do not keep server logs of our own; logging takes place exclusively at Cloudflare. According to Cloudflare, it stores log data only for a limited period, to the extent necessary for operation and security. In our Cloudflare account we see aggregated statistics (e.g. number of requests, countries of origin). For requests that Cloudflare has classified as an attack or misuse, Cloudflare also shows us sampled details for a limited period (including IP address, browser identifier, address accessed, country of origin). We use these only to trace attacks and adjust protection settings.

Necessity. Without processing this data we cannot display the website to you.

4. Cookies and storage on your device

We distinguish between storage that is technically necessary and storage that only takes place with your consent.

Technically necessary. Without your consent, only the following is stored on or read from your device:

Both are strictly necessary to provide the function you have requested or to protect the website against attacks. You can delete stored entries at any time via your browser settings.

Analytics and marketing only with consent. We only use cookies and similar technologies that are not technically necessary if you have given your consent beforehand. This applies in particular to services that measure the use of our website (visitor statistics) or serve marketing purposes. The legal bases are Section 25(1) TDDDG for storing and reading information on your device and Art. 6(1)(a) GDPR for the subsequent processing.

Cookie banner. We ask for your consent via a cookie banner that appears as soon as we use a service requiring consent. Declining is just as easy there as accepting. Without your consent we do not load these services. We store your choice on your device so that we do not have to ask you again on every visit (Section 25(2) no. 2 TDDDG).

Withdrawal. You can withdraw or change your consent at any time with effect for the future. As soon as we use a service requiring consent, we will provide a “Cookie settings” link at the bottom of every page for this purpose. Processing carried out before the withdrawal remains lawful.

Current status. We currently do not use any services requiring consent; the cookie banner is therefore not displayed. Before we activate such a service, we will add the provider, the data processed, the storage period and any transfer to third countries to this policy.

5. Contact form

What data is processed. If you write to us via the contact form, we process your name, your email address and your message (mandatory fields) as well as your company and your phone number if you provide them. We need your name to address you personally and to assign your enquiry. In addition, we process the chosen language, the time of submission and your IP address, the approximate location derived from it (country, region, city) and your browser identifier, which the form service records to prevent misuse.

Purposes and legal bases. We process the details to handle and answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if you yourself are, or wish to become, a contracting party and your enquiry is aimed at this. In all other cases – in particular if you are enquiring on behalf of a company – the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to answer enquiries and to initiate and maintain business contacts. We also base spam prevention on Art. 6(1)(f) GDPR; our interest is to protect our mailbox against unwanted and harmful messages.

Service provider Formspark. For the technical receipt and forwarding of messages we use the Formspark service of Trampoline Software SRL, Rue de Marsannay-la-Côte 16, 5032 Mazy, Belgium. When you submit the form, your browser transmits the details in encrypted form to Formspark’s servers. Formspark stores the message in our customer account and forwards it to us by email. To protect against spam, Formspark evaluates form fields that are invisible to humans. We have switched off the automatic spam scoring by a third-party provider in the USA and CAPTCHA services (e.g. Google reCAPTCHA, hCaptcha). Formspark processes the data as our processor (Art. 28 GDPR) in accordance with our instructions. Formspark stores messages and IP addresses on servers in Ireland and Germany (sub-processors: Amazon Web Services and Hetzner). For error analysis, Formspark uses a service provider in the USA (see section 10).

Storage period. Formspark stores every message in our customer account. We delete the messages there as soon as they have arrived in our email inbox, at the latest 30 days after receipt. According to Formspark, deleted messages are kept for a further 30 days for recovery. According to Formspark, the IP address and derived location are stored for twelve months. In our email inbox we keep enquiries until they have been fully dealt with and delete them no later than six months afterwards. Enquiries from prospective customers and business partners are stored in accordance with section 8; statutory retention periods apply to commercial and business letters (section 11).

Voluntary use. Use of the form is voluntary. Without the mandatory fields, however, we cannot process your enquiry. You can write to us at [email protected] or call us instead at any time.

6. Contact by email and phone

If you send us an email or call us, we process your contact details (e.g. name, email address, phone number), the content of your message or the conversation, and the date and time. Purposes and legal bases correspond to those of the contact form (Art. 6(1)(b) or (f) GDPR).

Our email mailboxes are operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, as a processor (Art. 28 GDPR).

Emails are encrypted in transit where the other party’s mail server supports this. The content is not end-to-end encrypted. For confidential communications we therefore recommend another route, such as post.

Storage period. The same applies to emails and call notes as to enquiries via the contact form (section 5).

Enquiries and reports about products. If you contact us with a question, a complaint or a report of an intolerance concerning a product, or if a retailer forwards your report to us, we process the details to handle the case and to monitor the safety of the products. If you describe health complaints, we also process health data. The legal basis is Art. 6(1)(f) GDPR. Where we record undesirable effects and have to report serious undesirable effects to the authorities, the legal bases are Art. 6(1)(c) and Art. 9(2)(i) GDPR in conjunction with Art. 23 of Regulation (EC) No 1223/2009; otherwise we base the processing of health data on Art. 9(2)(f) GDPR. Recipients may be the competent supervisory authorities and the manufacturer of the product; where possible we pass on your case to them without your name and contact details.

7. Job applications

What data is processed. If you apply for a job with us – for an advertised position or speculatively – we process the data you send us: contact details, cover letter, CV, references and proof of qualifications, as well as information from interviews and from our correspondence with you. Please do not send us any information that is not required for the application, in particular no special categories of personal data (e.g. on health, religion or origin).

Purposes and legal bases. We process your data to assess your suitability and to decide on establishing an employment relationship. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request); where Section 26(1) sentence 1 BDSG (German Federal Data Protection Act) also applies, we base the processing on it as well. Where necessary to defend against or assert legal claims arising from the application process, we base the processing on Art. 6(1)(f) GDPR, and for special categories of personal data on Art. 9(2)(f) GDPR. Otherwise we process special categories of personal data from your documents only where this is necessary to exercise rights or fulfil obligations under employment law (Art. 9(2)(b) GDPR, Section 26(3) BDSG) or where you have consented (Art. 9(2)(a) GDPR). If you would like us to keep your documents on file for future positions, we need your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future.

Recipients. Only the management and the persons involved in the selection decision have access. Applications sent by email to [email protected] are received via our email service provider (section 6).

Storage period. If we hire you, we transfer the necessary documents to your personnel file. Otherwise we delete your application data six months after the end of the application process (receipt of our rejection or withdrawal of your application). We need this period to be able to defend ourselves against possible claims, in particular under the German General Equal Treatment Act (AGG). If you have consented to being kept on file, we store your documents until you withdraw your consent, for a maximum of twelve months.

Necessity. You are not obliged to provide us with data. Without the information required for the position, however, we cannot consider your application.

Our team on the careers page. We publish names, roles and photos of our employees only with their consent (Art. 6(1)(a) GDPR, Section 26(2) BDSG). Consent is voluntary and can be withdrawn at any time; we then remove the information without delay.

8. Customers, suppliers and other business partners

This section applies to contact persons and employees of our customers, suppliers, brand partners, service providers and prospective customers, and to business partners who are themselves natural persons.

What data is processed. We process name, role and business contact details, the content of communications (e.g. emails, call notes, appointments) as well as contract, order, delivery and billing data. For sole traders, bank and tax data are added where they are required for processing transactions.

Source of the data. As a rule we receive the data from you yourself or from your company. In addition we use publicly accessible sources such as company websites, the commercial register and professional networks.

Purposes and legal bases.

• Initiation, conclusion and performance of contracts: Art. 6(1)(b) GDPR if you yourself are our contracting party; otherwise Art. 6(1)(f) GDPR. Our legitimate interest is cooperation with the company you work for.
• Maintaining the business relationship and business communication: Art. 6(1)(f) GDPR.
• Informing existing business contacts about our range and new products, where permitted under competition law: Art. 6(1)(f) GDPR. Our legitimate interest is promoting our sales; you can object at any time (section 13).
• Compliance with legal obligations, in particular retention obligations under commercial and tax law and traceability obligations under product law (e.g. Art. 7 of Regulation (EC) No 1223/2009): Art. 6(1)(c) GDPR.
• Establishment, exercise or defence of legal claims: Art. 6(1)(f) GDPR.

Recipients. We only pass on data where this is necessary for these purposes: to IT service providers (e.g. for email and inventory management), logistics and shipping service providers, banks and payment service providers, tax advisers, auditors and lawyers, to manufacturers and brand owners of the products we distribute where this is necessary for complaints, product safety or delivery processing, and to authorities and courts where we are obliged to do so. Service providers that process data on our behalf are contractually bound in accordance with Art. 28 GDPR.

Transfers to third countries. If a manufacturer or brand owner is based outside the European Economic Area (e.g. in Türkiye), we transfer personal data there only in individual cases, where this is necessary for the performance of a contract with you or of a contract concluded in your interest (Art. 49(1)(b) or (c) GDPR), or on the basis of the EU standard contractual clauses. Section 10 applies to our IT service providers.

Storage period. We store the data for the duration of the business relationship and beyond that for as long as statutory retention periods run or claims can be asserted (section 11). We delete contact details of prospective customers with whom no business relationship comes about no later than three years after the last contact.

Necessity. Without the data required for processing contracts we cannot conclude or perform contracts.

9. LinkedIn and external links

Links. Our website contains a simple link to our company profile on LinkedIn. Your browser only connects to LinkedIn when you click the link. LinkedIn does not receive any data when you merely visit our website. The respective provider is responsible for the content and data processing on linked pages.

Our company profile. For users in the European Economic Area and Switzerland, LinkedIn is provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. If you visit our profile or contact us there, LinkedIn processes your data under its own responsibility; details can be found in LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy. LinkedIn also processes data outside the European Economic Area, in particular in the USA; LinkedIn’s privacy policy states which safeguards it uses for this.

Page statistics. LinkedIn provides us with aggregated statistics on the use of our profile (“Page Insights”). We cannot identify individual visitors in them. LinkedIn and we are joint controllers for this processing (Art. 26 GDPR). The allocation of responsibilities is governed by the “Page Insights Joint Controller Addendum” (https://legal.linkedin.com/pages-joint-controller-addendum). Under it, LinkedIn fulfils the rights of data subjects; you can address your concerns to LinkedIn or to us. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to present our company and to understand the reach of our posts.

Messages via LinkedIn. We process messages and comments you send us via LinkedIn in order to answer them (Art. 6(1)(b) or (f) GDPR). Where technically possible for us, we delete them no later than three years after the last contact. Applications you send us via LinkedIn are processed in accordance with section 7. LinkedIn determines how long it stores data for the page statistics.

10. Recipients and transfers to third countries

Within our company, only those persons who need your data for the purposes stated have access to it. We do not sell data and do not pass it on to third parties for advertising purposes.

We use the following service providers to operate the website and our communications:

For transfers to the USA, the adequacy decision of the European Commission only applies if the recipient is certified under the EU-U.S. Data Privacy Framework. Formspark stores the messages from the contact form in the European Economic Area. Only technical error reports that Formspark sends to the Sentry service can reach the USA; according to Formspark, Sentry is certified under the Data Privacy Framework. If we use analytics or marketing services with your consent in future (section 4), we will name their providers and the basis for any transfer to third countries in this overview.

Beyond this, we only transfer data where a legal basis permits it, for example to authorities and courts on the basis of legal obligations or to advisers in order to enforce our rights.

11. Storage period

We store personal data only for as long as is necessary for the respective purpose. The specific periods, or the criteria for them, are stated in sections 3 to 9. In addition, the following principles apply:

• Statutory retention obligations under Section 257 HGB (German Commercial Code) and Section 147 AO (German Fiscal Code): six years for commercial and business letters, eight years for accounting vouchers such as invoices and ten years for books, inventories and annual financial statements. The periods begin at the end of the calendar year in which the document was created. They may be extended for as long as the documents are relevant for taxes that are not yet time-barred; ten years apply to customs documents.
• We store data that we need to assert or defend against claims until the limitation periods have expired. The standard limitation period is three years from the end of the year (Sections 195, 199 BGB, German Civil Code).
• After the periods have expired, we delete the data or restrict its processing if deletion is not possible.

12. Your rights

You have the following rights vis-à-vis us with regard to your personal data:

• access to the data processed and a copy of this data (Art. 15 GDPR),
• rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR),
• erasure, unless statutory grounds prevent it (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability for data that you have provided to us and that we process by automated means on the basis of consent or a contract (Art. 20 GDPR),
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR); processing carried out before the withdrawal remains lawful,
• objection to processing (Art. 21 GDPR, see section 13).

To exercise your rights, an informal message to the contact details stated in section 2 is sufficient.

Complaint to a supervisory authority. You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information), Postfach 3163, 65021 Wiesbaden, Germany

Phone: +49 611 1408-0 · Email: [email protected] · Online complaint: https://datenschutz.hessen.de/service/beschwerde-uebermitteln

13. Your right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data that we base on Art. 6(1)(f) GDPR (legitimate interests) (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

This applies to the processing described in sections 3 to 9 where Art. 6(1)(f) GDPR is stated there.

If we process your data for direct marketing purposes, you can object to this at any time without giving reasons (Art. 21(2) GDPR). We will then no longer use your data for this purpose.

The objection can be made informally, for example by email to [email protected].

14. Provision of data, automated decisions

As a rule, you are under no legal obligation to provide us with personal data. For the conclusion and performance of a contract with us – including an employment contract – we do, however, need certain information; without it we cannot conclude or perform the contract. Sections 3 to 8 state which information is required and what the consequences of not providing it are.

We do not make any decisions that are based solely on automated processing and that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). No profiling takes place.

15. Data security

Our website is transmitted exclusively in encrypted form (HTTPS/TLS). We take technical and organisational measures to protect your data against loss, alteration and unauthorised access, and adapt these measures to the state of the art.

16. Version and changes

This privacy policy was last updated in October 2026. We adapt it when our website, the service providers used or the legal situation change. The version published on this page at any given time applies.