Privacy Policy
Last updated: 3 August 2026
This privacy policy explains which personal data we process when you visit this website and use our enquiry function. Werkstatur is a request-for-quotation (RFQ) shop for business customers: nothing is sold online; you submit an enquiry via the website and we prepare an individual offer by e-mail. Data processing is correspondingly lean — we do not use advertising cookies and do not share data for advertising purposes.
This English version is provided for convenience. The German version is authoritative where legal terms of the GDPR and German law are concerned.
1. Controller
The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:
Aslan Conversions UG (haftungsbeschränkt) i. Gr. Represented by: Mikail Aslan Haberstraße 15 69126 Heidelberg Germany
E-mail: mikailaslan3005@gmail.com Phone: +49 151 22683564
No data protection officer has been appointed, as the statutory requirements for a mandatory appointment are not met.
2. Hosting (Vercel) and Server Log Files
This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. The website is served and processed server-side primarily via the Vercel region Frankfurt am Main (EU). We have concluded a data processing agreement with Vercel pursuant to Art. 28 GDPR. Insofar as a transfer of data to the USA cannot be ruled out (e.g. in the context of support or maintenance access), it is safeguarded by the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
When you access the website, the server automatically processes so-called server log files: IP address, date and time of access, page or file requested, HTTP status code, data volume transferred, referrer URL, and browser type and operating system (user agent). This data is technically necessary to deliver the website, ensure its stability and detect attacks (e.g. abuse and fraud attempts).
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure and stable provision of the website). Storage period: Log data is retained only for a short time and then deleted automatically, unless a specific security incident requires longer retention. It is not merged with other data sources.
3. Enquiry Form and Enquiry List (Request for Quotation)
The core of this website is the request for quotation: you compile an enquiry list of products and send it to us via the enquiry form. In doing so, we process the data you provide in the form — in particular company, contact person, e-mail address, phone number (if provided) and your message — as well as the contents of your enquiry list (products, quantities, requested logo customisation).
Abuse prevention: We additionally store a truncated IP address with each request (the last segment is zeroed, so the address can no longer be traced to a single connection). It serves solely to detect automated bulk submissions. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protecting the form). The browser identifier (user agent) is not stored.
Purpose: Processing your enquiry, follow-up questions and preparation of an individual offer.
Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures taken at your request). Where you enquire on behalf of a company and we process contact details of contact persons, processing is additionally based on Art. 6 (1) (f) GDPR (legitimate interest in communicating with business partners).
Storage: Your enquiry is stored in a database operated by Neon (Neon, Inc., USA). The database runs in an EU region, i.e. the data is located within the EU. We have concluded a data processing agreement with Neon pursuant to Art. 28 GDPR; any access from the USA (e.g. support) is covered by the EU Standard Contractual Clauses.
E-mail dispatch: We use Resend (a US company) to send confirmation and offer e-mails. Sending is configured to Resend's EU region. As Resend is a US provider, access from the USA cannot be entirely ruled out; the transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). A data processing agreement is in place with Resend.
Storage period: We store enquiry data for as long as necessary for processing and any follow-up communication. If a contract is concluded or the correspondence qualifies as commercial correspondence, the statutory retention periods of six or ten years apply (Sec. 257 German Commercial Code (HGB), Sec. 147 German Fiscal Code (AO); legal basis in this respect: Art. 6 (1) (c) GDPR). Enquiries that do not lead to a business contact are deleted once the purpose no longer applies.
Providing your data is neither legally nor contractually required; however, we cannot respond to your enquiry without your contact details.
4. Contact by E-mail or Phone
If you contact us by e-mail or phone, we process the resulting data (contact details, content of the message) to handle your request. Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a (potential) contractual relationship, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). Section 3 applies accordingly to the storage period.
5. Contact via WhatsApp (Link-Only Solution)
We offer the option of contacting us via WhatsApp. This is a pure link solution (wa.me link): no script or other Meta service is embedded on our website. As long as you do not click the link, no data whatsoever is transferred to WhatsApp or Meta.
Only when you click the link and continue the conversation in WhatsApp does WhatsApp Ireland Limited (for users in the EEA; parent company: Meta Platforms, Inc., USA) process your data in accordance with WhatsApp's own privacy policy. This may involve a transfer of data to the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF). We have no influence over the data processing carried out by WhatsApp/Meta.
Legal basis for processing messages we receive via WhatsApp: Art. 6 (1) (b) GDPR (initiation or performance of a contract), otherwise your consent expressed through active use (Art. 6 (1) (a) GDPR). Using WhatsApp is voluntary — you can always reach us by e-mail or phone instead.
6. Google Analytics 4 (Only With Your Consent)
We use Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to statistically evaluate the use of our website (e.g. page views, session duration, approximate region of origin) and to improve our offering.
GA4 is only loaded if you have given consent via our consent banner. Without your consent, no analytics take place.
Legal basis: Art. 6 (1) (a) GDPR and Sec. 25 (1) of the German TDDDG (consent). You can withdraw your consent at any time with effect for the future by reopening the cookie/consent settings on the website and changing your selection.
IP anonymisation: Google Analytics 4 does not log or store full IP addresses; IP data is truncated at collection and, for EU users, received via servers in the EU. We do not use any Google advertising features (no Google Signals, no remarketing) and have not enabled any data sharing for advertising purposes.
Third-country transfer: In the context of GA4, data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF); the EU Standard Contractual Clauses apply in addition. A data processing agreement (Google Ads Data Processing Terms) is in place with Google.
Storage period: Data stored at user and event level is automatically deleted in Google Analytics after 14 months at the latest.
7. Consent Banner, Cookies and localStorage
Consent banner: On your first visit, we ask for your consent to analytics (Section 6). Your decision (consent or refusal) is stored locally in your browser so that the banner does not reappear on every visit. This storage is technically necessary (Sec. 25 (2) no. 2 TDDDG; Art. 6 (1) (f) GDPR — interest in proof of consent and user convenience).
Enquiry list (localStorage): The products you add to your enquiry list are stored exclusively locally in your browser (localStorage) so that your list is preserved while navigating and on a later visit. This storage is strictly necessary for the function you explicitly request; no consent is required for it (Sec. 25 (2) no. 2 TDDDG). The data only leaves your browser when you submit the enquiry (Section 3 then applies). You can clear localStorage at any time via your browser settings.
We do not use advertising cookies. There is no tracking for advertising purposes and no data is passed to advertising networks.
8. Your Rights as a Data Subject
With regard to personal data concerning you, you have the following rights vis-à-vis us:
- Access (Art. 15 GDPR) to the data processed,
- Rectification of inaccurate data (Art. 16 GDPR),
- Erasure (Art. 17 GDPR),
- Restriction of processing (Art. 18 GDPR),
- Data portability (Art. 20 GDPR),
- Withdrawal of consent (Art. 7 (3) GDPR) with effect for the future.
Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6 (1) (f) GDPR (legitimate interest), you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless there are compelling legitimate grounds.
An informal message to mikailaslan3005@gmail.com is sufficient to exercise your rights.
Right to lodge a complaint: You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence or of the alleged infringement. The authority responsible for our registered office is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (www.baden-wuerttemberg.datenschutz.de).
9. Storage Periods (Summary)
Unless stated otherwise above, we store personal data only for as long as necessary for the stated purposes. The data is then deleted, unless statutory retention obligations (in particular Sec. 257 HGB: 6 years for commercial correspondence, Sec. 147 AO: up to 10 years for documents relevant for tax purposes) prevent deletion; in that case, processing is restricted to fulfilling those obligations.
10. No Automated Decision-Making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Offers are prepared individually and by humans.
11. Data Security
All transmissions between your browser and our website are TLS-encrypted (HTTPS). Access to stored enquiry data is restricted to the persons involved in processing.
12. Changes to This Privacy Policy
We will update this privacy policy if data processing or the legal situation changes (e.g. when new features are introduced). The version published here applies; the effective date is shown at the top of the page.