PRIVACY POLICY

English translation for your convenience – the German version is legally binding.

Owner: Timm Lehmann

Mobile: +49 170 8768563
Office: +49 5045 9120728
Address: Osterland 6a
31832 Bennigsen (Springe), Germany

Email: info@zigarrenroller.de

Zigarrenroller logo

Controller (Art. 4(7) GDPR)

Zigarrenroller – owner Timm Lehmann
Osterland 6a
31832 Bennigsen (Springe), Germany
Mobile: +49 170 8768563
Office: +49 5045 9120728
Email: info@zigarrenroller.de

1. General information

This privacy policy informs you about the nature, scope and purpose of the processing of personal data when you visit this website and when you contact us. Personal data is any data by which you can be personally identified.

2. Legal bases

We only process personal data if there is a legal basis, in particular:

  • Consent (Art. 6(1)(a) GDPR) – e.g. for Google Analytics

  • Contract / pre-contractual measures (Art. 6(1)(b) GDPR) – e.g. enquiries and bookings

  • Legal obligation (Art. 6(1)(c) GDPR) – e.g. retention obligations under tax law

  • Legitimate interests (Art. 6(1)(f) GDPR) – e.g. IT security, error analysis, prevention of abuse

Where information is stored on or read from your device (e.g. cookies), this is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

3. Hosting and server log files

This website is hosted by Alfahosting GmbH, Ankerstraße 3b, 06108 Halle (Saale), Germany. We have concluded a data processing agreement with the provider (Art. 28 GDPR); it processes the data only on our instructions.

When you access the website, the server automatically records information in so-called server log files: page/file accessed, date and time, amount of data transferred, notification of successful retrieval, browser type and version, operating system, referrer URL and IP address.

The processing takes place in order to deliver the website and to ensure stability and security (Art. 6(1)(f) GDPR). This data is not merged with other data sources. The log files are deleted regularly unless a specific security incident requires longer retention.

4. Contacting us (email, phone, enquiry form)

When you contact us, we process your details in order to handle your enquiry and clarify any questions. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry relates to a contract, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Enquiry form: Mandatory fields are your name, your email address and your message – without them we cannot answer your enquiry. Your phone number is optional. In addition, the page from which you sent the form is transmitted. By ticking the box, you confirm that you have read this privacy policy.

The details are transmitted to our server in encrypted form, sent from there to us by email via our hosting provider's mail server, and are not stored in a database. The form does not set any cookies.

To protect against abuse (spam), we store on the server a hash value of your IP address created with a secret key, together with the times of your submission attempts, in order to limit the number of enquiries per connection. The IP address itself is not stored. This information is no longer taken into account after one hour and is automatically deleted the next time the form is accessed – i.e. the next time the contact page is opened or the form is submitted by any visitor (Art. 6(1)(f) GDPR).

Retention period: We delete your enquiry once it has been dealt with conclusively. If an order results, we keep the related correspondence for the statutory retention periods (up to ten years, e.g. Section 147 of the German Fiscal Code, AO).

5. Consent management

On your first visit, a banner asks whether you consent to statistics (Google Analytics). You can choose “Accept”, “Decline” or make an individual choice under “Preferences”. Google Analytics is not loaded until you have decided.

We store your choice and when you made it in your browser's local storage (entry “zr_consent”). This information is not transmitted to us. It is necessary so that we can respect your choice and do not have to ask again on every page view (Section 25(2) No. 2 TDDDG; Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). We ask again after twelve months.

You can change your choice or withdraw your consent at any time via the “Manage consent” button at the bottom right of every page. Details can be found in our cookie policy.

6. Google Analytics 4

Only if you have given your consent do we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) to analyse and improve the use of our website. Without consent, Google Analytics is not loaded and no connection to Google is established.

Data processed: a pseudonymous identifier (cookie), pages viewed, time spent and interactions, the source of the visit, technical information about device and browser, and the approximate location that Google derives from your IP address. IP addresses are not stored in Google Analytics 4.

Cookies: “_ga” and “_ga_LL72QJJ2EK”, each stored for up to two years.

Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Data processing and third country: We have concluded a data processing agreement with Google. Data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision of the EU Commission (Art. 45 GDPR).

Retention period: Event and user data are stored in Google Analytics for 14 months and then deleted automatically. For user data, this period starts again if you visit our website again within the period (reset on new activity).

Withdrawal: You can withdraw your consent at any time with effect for the future via “Manage consent”. We then delete the Analytics cookies on your device and no longer load Google Analytics.

Further information: Google privacy policy.

7. Videos

The videos on this website (e.g. on the home page, under “Private Label” and in the Mercedes-Benz reference) are hosted on our own server and played directly from there. Video platforms such as YouTube or Vimeo are not embedded; no connection to third parties is established during playback, and no cookies are set. The videos play without sound and are only loaded when they come into view. Only the server log files described in section 3 are generated.

8. Fonts

This website uses fonts to ensure a consistent appearance. The fonts are embedded locally and loaded exclusively from our own server. No connection to servers of Google or other third parties is established.

9. Links to other websites, platforms and share buttons

Our website contains links to our profiles on Facebook and Instagram as well as to websites of clients and partners. On some journal articles you will also find share buttons (e.g. Facebook, X, LinkedIn, Pinterest, Threads, Bluesky, Xing, WhatsApp, email).

These are simple links: the respective page is only opened when you click a link. No data is transferred to these providers beforehand; no scripts or content from these providers are embedded in our website. Once you leave our site, the privacy policy of the respective provider applies.

10. Recipients

We only pass on personal data if this is necessary to perform a contract, if there is a legal obligation or if you have given your consent. Recipients are our hosting and email service provider and – only with your consent – Google (see section 6). These service providers process the data as processors only on our instructions.

11. Retention period

Unless a specific period is stated in this policy, we store personal data only for as long as is necessary for the respective purpose. It is then deleted, unless statutory retention obligations (e.g. under commercial or tax law) prevent this.

12. Your rights

Subject to the statutory requirements, you have the following rights:

  • Access (Art. 15 GDPR)

  • Rectification (Art. 16 GDPR)

  • Erasure (Art. 17 GDPR)

  • Restriction of processing (Art. 18 GDPR)

  • Data portability (Art. 20 GDPR)

  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An informal message is sufficient for a request: info@zigarrenroller.de.

13. Right to object (Art. 21 GDPR)

If we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragter für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

15. No automated decision-making

No automated decision-making, including profiling (Art. 22 GDPR), takes place.

16. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as your enquiries, this website uses SSL/TLS encryption.

17. Changes to this privacy policy

We adapt this privacy policy when the legal situation or our website changes. The version published here applies.

Last updated: 10 November 2026