Contact Contact us directly Calibration certificates Download Device search &
price inquiry To the overview
Skip links

Login
To the customer area

Privacy policy according to GDPR

(Last updated: July 2026)

Controller responsible for data processing

esz AG calibration & metrology
Max-Planck-Strasse 16
82223 Eichenau, Germany

Phone: +49 (0) 8141 88887-0

Data Protection Officer

Mr Daniel Jank
Email: datenschutz@esz-ag.de

 

yellow header kalibrierscheine 2

I. General information on data processing

1. Scope of the Processing of Personal Data

As a rule, we process our users’ personal data only to the extent necessary to provide a functional website and our content and services. We generally process our users’ personal data only with the user’s consent. An exception applies where obtaining prior consent is not possible for practical reasons and the processing is permitted by law.

Where we obtain the data subject’s consent to the processing of personal data, Article 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary in order to take steps prior to entering into a contract.

Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Article 6(1)(c) GDPR serves as the legal basis.

Where the vital interests of the data subject or another natural person require the processing of personal data, Article 6(1)(d) GDPR serves as the legal basis.

Where processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and those interests are not overridden by the interests or fundamental rights and freedoms of the data subject, Article 6(1)(f) GDPR serves as the legal basis for the processing.

3. Erasure of Data and Storage Period

The data subject’s personal data will be erased or blocked as soon as the purpose for which it was stored ceases to apply. Data may also be stored where this is provided for by the European or national legislature in EU regulations, laws or other provisions to which the controller is subject. The data will also be blocked or erased when a storage period prescribed by the aforementioned provisions expires, unless the data must continue to be stored for the conclusion or performance of a contract.

II. Provision of the website and creation of log files

1. Description and Scope of Data Processing

Whenever our website is accessed, our system automatically collects data and information from the computer system of the device accessing the website.

The following data is collected:

– Information about the browser type and version used
– The user’s operating system
– The user’s internet service provider
– The user’s IP address
– The date and time of access
– Websites from which the user’s system reaches our website
– Websites accessed by the user’s system via our website

The data is also stored in our system’s log files. This data is not stored together with any other personal data relating to the user.

2. Legal Basis for Data Processing

The legal basis for the temporary storage of the data and the log files is Article 6(1)(f) GDPR.

3. Purpose of Data Processing

The temporary storage of the IP address by the system is necessary to deliver the website to the user’s device. For this purpose, the user’s IP address must remain stored for the duration of the session.

The data is stored in log files to ensure the functionality of the website. We also use the data to optimise the website and to ensure the security of our information technology systems. The data is not analysed for marketing purposes in this context.

These purposes also constitute our legitimate interest in data processing pursuant to Article 6(1)(f) GDPR.

4. Storage Period

The data will be erased as soon as it is no longer required for the purpose for which it was collected. Where data is collected for the purpose of providing the website, this is the case when the relevant session ends.

Where data is stored in log files, it will be erased after no more than seven days. Storage beyond this period is possible. In such cases, users’ IP addresses will be erased or anonymised so that the accessing client can no longer be identified.

5. Right to Object and Options for Removal

The collection of data for the provision of the website and the storage of data in log files are strictly necessary for the operation of the website. Consequently, users have no right to object in this respect.

6. Consent Management Tool

Because we use cookies on our website that require consent, we must manage whether you grant or refuse consent. For this purpose, we use a consent management tool, also known as a cookie banner. The tool stores the settings you select in cookies.

Purpose(s) of data processing

Management of consent to data processing.

Legal basis for reading information from or storing information on the user’s terminal equipment

Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG).

Legal basis for the processing of personal data

Article 6(1)(c) GDPR in conjunction with the judgment of the German Federal Court of Justice (Bundesgerichtshof – BGH) of 28 May 2020, I ZR 7/16 (legal obligation).

Recipients or categories of recipients to whom data is disclosed

None.

Transfer of data to a third country and the legal basis for such transfer

No such transfer takes place.

Storage period or criteria used to determine the storage period

For the duration of the session or for 365 days.

III. Use of cookies

Description and Scope of Data Processing

Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user’s device. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a unique string of characters that enables the browser to be identified when the website is accessed again.

We use cookies to make our website more user-friendly. Certain elements of our website require the accessing browser to be identified even after the user moves to another page.

The following data is stored and transmitted in the cookies:

  • Items in a shopping cart
  • Login information

For access to terminal equipment that is strictly necessary for technical reasons, the legal basis is Section 25(2) no. 2 TDDDG.

Depending on the relevant purpose, the subsequent processing of personal data may be based on Article 6(1)(f) GDPR or Article 6(1)(b) GDPR.

Non-essential cookies or tracking technologies are used only with prior consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.

Purpose of Data Processing

Technically necessary cookies are used to make websites easier to use. Certain functions of our website cannot be provided without cookies. These functions require the browser to be recognised even after the user moves to another page.

We require cookies for the following applications:

  • Shopping cart
  • Login information

User data collected through technically necessary cookies is not used to create user profiles.

These purposes also constitute our legitimate interest in processing personal data pursuant to Article 6(1)(f) GDPR.

Storage Period, Right to Object and Options for Removal

Cookies are stored on the user’s device and transmitted from it to our website. As a user, you therefore have full control over the use of cookies. You can disable or restrict the transmission of cookies by changing the settings in your internet browser. Cookies that have already been stored can be erased at any time. This can also be done automatically.

If cookies are disabled for our website, some of the website’s functions may no longer be available in full.

Calendly

You can schedule appointments with us through our website. We use the Calendly tool for appointment bookings. The provider is Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA (hereinafter “Calendly”).

To book an appointment, you enter the requested data and your preferred appointment time in the form provided. The data entered is used to plan, conduct and, where necessary, follow up on the appointment. The appointment data is stored on Calendly’s servers on our behalf. Calendly’s privacy information is available at:

https://help.calendly.com/hc/de/sections/4411772410519-Sicherheit-und-Einhaltung-gesetzlicher-Vorschriften

The data you enter will remain with us until you ask us to erase it, withdraw your consent to its storage or the purpose for storing the data ceases to apply. Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

The legal basis for the processing is Article 6(1)(f) GDPR. The website operator has a legitimate interest in making it as straightforward as possible for prospective and existing customers to arrange appointments. Where corresponding consent has been requested, the processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s terminal equipment, such as device fingerprinting, within the meaning of the TDDDG. Consent may be withdrawn at any time.

Data transfers to the United States are based on the European Commission’s Standard Contractual Clauses. Details are available at:

https://calendly.com/pages/dpa

Friendly Captcha

We use Friendly Captcha (hereinafter “Friendly Captcha”) on this website. The provider is Friendly Captcha GmbH, Am Anger 3-5, 82237 Woerthsee, Germany. Friendly Captcha is used to determine whether data entered on this website, for example in a contact form, is being entered by a human or by an automated program. For this purpose, Friendly Captcha analyses the behaviour of website visitors on the basis of various characteristics. As part of this analysis, Friendly Captcha evaluates various items of information, such as an anonymised IP address, the referrer and the time of the visit. Further information is available at:

https://friendlycaptcha.com/legal/privacy-end-users/

The data is stored and analysed on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in protecting its online services against abusive automated scraping and spam. Where corresponding consent has been requested, the processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s terminal equipment, such as device fingerprinting, within the meaning of the TDDDG. Consent may be withdrawn at any time.

IV. Newsletter

1. Description and Scope of Data Processing

You can subscribe to a free newsletter on our website. When you register for the newsletter, the data entered in the registration form is transmitted to us. To receive the newsletter offered on our website, you can register using our form. We use a double opt-in procedure. First, a confirmation email is sent to the email address you provide, asking you to confirm your registration. Your registration becomes effective only when you click the activation link in the confirmation email.

The following data is also collected during registration:

  • The IP address of the device used to access the website
  • The date and time of registration
  • The email address

As part of the registration process, we obtain your consent to the processing of the data and refer you to this Privacy Policy.

The data is not disclosed to third parties for their own purposes. We use rapidmail GmbH as a processor for sending the newsletter. The data is used exclusively to send the newsletter. We use rapidmail to distribute our newsletter, and your data is therefore transmitted to rapidmail GmbH. rapidmail GmbH is prohibited from using your data for any purpose other than sending the newsletter. rapidmail GmbH is not permitted to disclose or sell your data. rapidmail is a certified German newsletter software provider that was carefully selected in accordance with the requirements of the GDPR and the German Federal Data Protection Act (BDSG).

Where the user has given consent, the legal basis for processing data following registration for the newsletter is Article 6(1)(a) GDPR.

3. Purpose of Data Processing

The user’s email address is collected in order to deliver the newsletter.

Other personal data collected during the registration process is used to prevent misuse of the services or of the email address provided.

4. Storage Period

The data will be erased as soon as it is no longer required for the purpose for which it was collected. The user’s email address will therefore be stored for as long as the newsletter subscription remains active.

Other personal data collected during the registration process is generally erased after seven days.

5. Right to Object and Options for Removal

The data subject may unsubscribe from the newsletter at any time. Every newsletter contains a link for this purpose.

Unsubscribing also enables the data subject to withdraw consent to the storage of the personal data collected during the registration process.

V. Registration:

1. Description and Scope of Data Processing

Our website allows users to register by providing personal data. The data is entered in a form, transmitted to us and stored. The data is not disclosed to third parties.

The following data is collected during the registration process:

  • Name
  • Company
  • Customer number
  • Email address
  • Any other information requested in the registration form

The following data is also stored at the time of registration:

  • The user’s IP address
  • The date and time of registration
  • The email address

As part of the registration process, the user’s consent to the processing of this data is obtained.

The legal bases for processing the data are Article 6(1)(a) and Article 6(1)(b) GDPR.

3. Purpose of Data Processing

User registration is required in order to provide certain content and services on our website, including:

  • Access to price lists

4. Storage Period

The data will be erased as soon as it is no longer required for the purpose for which it was collected.

For data collected during the registration process, this is the case when the registration on our website is cancelled or amended.

5. Right to Object and Options for Removal

As a user, you may cancel your registration at any time. You may also have the data stored about you amended at any time.

VI. Contact form and email contact

1. Description and Scope of Data Processing

Our website provides a contact form that can be used to contact us electronically. If a user makes use of this option, the data entered in the form is transmitted to us and stored.

The following data is also stored when the message is sent:

  • The user’s IP address
  • The date and time of submission
  • Name
  • Customer number
  • Company
  • Postal code
  • City
  • Telephone number
  • Email address

As part of the submission process, we obtain your consent to the processing of the data and refer you to this Privacy Policy.

Alternatively, you may contact us using the email address provided. In this case, the user’s personal data transmitted with the email will be stored.

We may engage service providers to provide and operate the contact form. These service providers process personal data solely on behalf of and in accordance with the instructions of esz AG. Data processing agreements pursuant to Article 28 GDPR have been concluded with these service providers.

Where the user has given consent, the legal basis for processing the data is Article 6(1)(a) GDPR.

The legal basis for processing data transmitted when an email is sent is Article 6(1)(f) GDPR. Where the email correspondence is aimed at entering into a contract, Article 6(1)(b) GDPR provides an additional legal basis for the processing.

3. Purpose of Data Processing

The personal data entered in the form is processed solely for the purpose of handling the contact request. Where contact is made by email, this purpose also constitutes the necessary legitimate interest in processing the data.

Other personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our information technology systems.

4. Storage Period

The data will be erased as soon as it is no longer required for the purpose for which it was collected. In the case of personal data entered in the contact form and personal data sent by email, this is the case when the relevant conversation with the user has ended. The conversation is deemed to have ended when the circumstances indicate that the matter in question has been conclusively resolved.

Additional personal data collected during the submission process will be erased after no more than seven days.

5. Right to Object and Options for Removal

The user may withdraw consent to the processing of personal data at any time. If the user contacts us by fax, email or telephone, the user may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued.

All personal data stored in connection with the contact request will then be erased.

VII. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights in relation to the controller:

1. Right of Access

You may request confirmation from the controller as to whether personal data concerning you is being processed by us.

Where such processing takes place, you may request the following information from the controller:

  • The purposes for which the personal data is processed
  • The categories of personal data concerned
  • The recipients or categories of recipient to whom the personal data concerning you has been or will be disclosed
  • The envisaged period for which the personal data concerning you will be stored or, if specific information cannot be provided, the criteria used to determine that period
  • The existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing
  • The existence of a right to lodge a complaint with a supervisory authority
  • Any available information as to the source of the data where the personal data was not collected from the data subject
  • The existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject

You also have the right to request information as to whether personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer.

2. Right to Rectification

You have the right to obtain rectification and/or completion from the controller where personal data concerning you is inaccurate or incomplete. The controller must rectify the data without undue delay.

3. Right to Restriction of Processing

You may request restriction of the processing of personal data concerning you where one of the following applies:

  • You contest the accuracy of the personal data concerning you, for a period enabling the controller to verify its accuracy
  • The processing is unlawful and you oppose the erasure of the personal data and request restriction of its use instead
  • The controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims
  • You have objected to processing pursuant to Article 21(1) GDPR and it has not yet been determined whether the controller’s legitimate grounds override your grounds

Where processing of personal data concerning you has been restricted, that data may, apart from storage, be processed only with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

If processing has been restricted under the above conditions, the controller will inform you before the restriction is lifted.

4. Right to Erasure

a) Obligation to Erase

You may request that the controller erase personal data concerning you without undue delay, and the controller is obliged to erase that data without undue delay where one of the following grounds applies:

  • The personal data concerning you is no longer necessary in relation to the purposes for which it was collected or otherwise processed
  • You withdraw the consent on which the processing is based pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal basis for the processing
  • You object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR
  • The personal data concerning you has been unlawfully processed
  • The personal data concerning you must be erased in order to comply with a legal obligation under European Union or Member State law to which the controller is subject
  • The personal data concerning you was collected in relation to the offer of information society services referred to in Article 8(1) GDPR

b) Information to Third Parties

Where the controller has made personal data concerning you public and is obliged pursuant to Article 17(1) GDPR to erase it, the controller, taking account of the available technology and the cost of implementation, will take reasonable steps, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of any links to, or copies or replications of, that personal data.

c) Exceptions

The right to erasure does not apply to the extent that processing is necessary:

  • For exercising the right of freedom of expression and information
  • For compliance with a legal obligation that requires processing under European Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
  • For reasons of public interest in the area of public health pursuant to Article 9(2)(h) and (i) and Article 9(3) GDPR
  • For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, insofar as the right referred to in subsection (a) is likely to render impossible or seriously impair the achievement of the objectives of that processing
  • For the establishment, exercise or defence of legal claims

5. Right to Notification

If you have exercised your right to rectification, erasure or restriction of processing against the controller, the controller is obliged to communicate that rectification or erasure of data or restriction of processing to each recipient to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort.

You have the right to be informed by the controller about those recipients.

6. Right to Data Portability

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit that data to another controller without hindrance from the controller to which the personal data was provided, where:

  • The processing is based on consent pursuant to Article 6(1)(a) GDPR or Article 9(2)(a) GDPR, or on a contract pursuant to Article 6(1)(b) GDPR; and
  • The processing is carried out by automated means

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to Object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions.

The controller will no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defence of legal claims.

Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for those purposes.

In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

You have the right to withdraw your consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

9. Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. This does not apply where the decision:

  1. Is necessary for entering into or performing a contract between you and the controller;
  2. Is authorised by European Union or Member State law to which the controller is subject and that law lays down suitable measures to safeguard your rights, freedoms and legitimate interests; or
  3. Is based on your explicit consent.

Such decisions may not be based on special categories of personal data referred to in Article 9(1) GDPR unless Article 9(2)(a) or (g) GDPR applies and suitable measures to safeguard your rights, freedoms and legitimate interests are in place.

In the cases referred to in points 1 and 3 above, the controller will implement suitable measures to safeguard your rights, freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

10. Social Plugins

This website contains links to Facebook, YouTube, X, LinkedIn and Xing. These services are provided by Meta Platforms Ireland Limited (ATTN: Privacy Operations, Merrion Road, Dublin 4, D04 X2K5, Ireland), Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), X Internet Unlimited Company (One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland), LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland) and New Work SE (Baumwall 7, 20459 Hamburg, Germany).

When you visit a page and follow one of these links, your browser establishes a connection to Facebook, YouTube, X, LinkedIn or Xing, as applicable, and content is loaded from the relevant website. As a result, your visit to this website may be tracked by Facebook, YouTube, X, LinkedIn or Xing even if you do not actively use the relevant function. If you have an account with Facebook, YouTube, X, LinkedIn or Xing, you can use such a link to share information with your contacts. We have no influence over the behaviour of external websites or the information they transmit.

Facebook, YouTube, X, LinkedIn and Xing provide detailed information on their websites about the scope, nature, purpose and further processing of your data. You will also find further information there about your rights and the settings available to protect your privacy.

11. YouTube

This website uses YouTube’s embedding function to display and play videos from YouTube. The website uses enhanced privacy mode, which, according to the provider, initiates the storage of user information only when a video is played. When playback of an embedded video begins, YouTube sets cookies to collect information about your user behaviour.

According to information provided by YouTube, these cookies are used, among other things, to compile video statistics, improve user-friendliness and prevent misuse.

Irrespective of whether an embedded video is played, a connection to Google’s DoubleClick network is established whenever this website is accessed. This may trigger further data processing operations over which we have no control.

12. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

In the German federal state of Bavaria, the competent supervisory authority is:

Bavarian State Office for Data Protection Supervision
(Bayerisches Landesamt für Datenschutzaufsicht – BayLDA)
Promenade 18
91522 Ansbach
Germany

The supervisory authority with which the complaint has been lodged will inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.

Note: This English-language version is a translation of the German Privacy Policy. In the event of any discrepancy between the English and German versions, the German-language version shall prevail.