VERSION

15 July 2026

OVERVIEW

The protection of your commercial and personal data is of utmost priority to FORSTER HILLER GmbH. This Privacy Policy informs you, as a commercial customer, business representative, or website visitor (hereinafter "Customer" or "User"), about the nature, scope, purposes, and legal bases of the processing of personal data on our website forsterhiller.com and its integrated services.

DATA CONTROLLER AND CONTACT DETAILS

The data controller within the meaning of the EU General Data Protection Regulation (GDPR) and national data protection laws is:

FORSTER HILLER GmbH
Bahnhofstraße 26
86938 Schondorf am Ammersee
Email: hello@forsterhiller.com
Managing Directors: Sophia Forster & Gregor Hiller

DATA COLLECTION, PURPOSES, AND LEGAL BASES

We process personal data only to the extent necessary to provide a functional B2B storefront and fulfill our contractual obligations. We categorize our data processing as follows:

• (a) Technical Provision of the Website (Server Logs): When you browse our site, your browser automatically transmits technical metadata (such as your IP address, browser type, operating system, date/time of access, and referral URL).

  • Purpose: To ensure website stability, loading performance, and cybersecurity monitoring.

  • Legal Basis: Art. 6(1)(f) GDPR (Our legitimate interest in operating a secure and reliable B2B platform).

• (b) Commercial User Registration and Account Administration: When you register a B2B account, we collect your name, business name, company registration data, tax ID/VAT number, corporate email address, and physical business address.

  • Purpose: To manage your corporate buyer profile, grant access to custom pricing, and verify your commercial status.

  • Legal Basis: Art. 6(1)(b) GDPR (Steps prior to entering into a commercial contract).

• (c) Order Processing and Transaction Execution: When you place an order for gemstones, we process your delivery data, transaction totals, and payment metadata.

  • Purpose: To securely process payments, issue invoices, execute insured shipping, and handle commercial warranty verification.

  • Legal Basis: Art. 6(1)(b) GDPR (Performance of a contract) and Art. 6(1)(c) GDPR (Compliance with strict German commercial and fiscal retention periods under § 147 AO and § 257 HGB).

THIRD-PARTY INFRASTRUCTURE AND SHOPIFY PROCESSOR CLARIFICATION

Our B2B storefront operates using the e-commerce infrastructure provided by Shopify International Limited (Victoria Buildings, 2nd Floor, 1-2 Green Street, Dublin 7, Ireland).

• Data Processing on our Behalf: Shopify acts as a Data Processor on our behalf. We have concluded a formal Data Processing Addendum (DPA) with Shopify incorporating the EU Standard Contractual Clauses (SCCs) to guarantee lawful data protection standards for any automated cross-border infrastructure routing.

• Payment Gateways and Transport Providers: For order fulfillment, data is securely transmitted to selected enterprise providers (e.g., Stripe for payment clearance, and specialized insured logistics couriers for transport). These recipients are strictly bound by statutory or contractual data confidentiality agreements.

COOKIES AND TECHNICAL SCRIPTS

Our website utilizes technically essential cookies and session tokens executed by Shopify. These cookies are mandatory for fundamental infrastructure operations, including maintaining your regional language selection, preserving your active shopping cart state during your session, and protecting our checkout from fraudulent transactions.

• Tracking Disclosure: We do not deploy cookies or tracking pixels for third-party behavioral advertising, remarketing, or non-essential analytical user profiling on this storefront.

• Legal Basis: Art. 6(1)(f) GDPR in conjunction with national laws (Legitimate interest in maintaining a functional, secure web application). You can block or clear cookies via your browser settings at any time, though this may restrict checkout functionality.

COMMERCIAL ELIGIBILITY AND RESTRICTIONS

Our services are targeted exclusively at commercial entities, entrepreneurs, and professional buyers. We do not deliberately gather, process, or hold data from private consumers or individuals who are minors.

DATA RETENTION PERIODS

We store personal data only as long as necessary to achieve the specific processing purpose or as mandated by statutory law. Commercial correspondence, corporate account data, invoices, and payment audits must be legally retained for up to 10 years under German tax and commercial laws (§ 147 AO, § 257 HGB). Technical log files are automatically purged or anonymized within standard rolling infrastructure cycles.

YOUR STATUTORY RIGHTS UNDER THE GDPR

As a data subject, you hold the following explicit rights under the GDPR regarding your stored personal data:

• Art. 15 GDPR (Right of Access): The right to receive full disclosure regarding what categories of your data we hold.

• Art. 16 GDPR (Right to Rectification): The right to request immediate correction of inaccurate or incomplete corporate data.

• Art. 17 GDPR (Right to Erasure): The right to request deletion of your records, provided no legal retention obligations override the request.

• Art. 18 & 20 GDPR (Restriction and Portability): The right to limit processing or transfer your machine-readable files.

• Art. 21 GDPR (Right to Object): The right to object at any time to data processing carried out based on our legitimate interests.

To exercise any of your statutory rights, contact us directly via email at hello@forsterhiller.com.

RIGHT TO LODGE A COMPLAINT

If you believe that the processing of your data by FORSTER HILLER GmbH infringes your data protection rights under European law, you have the statutory right to lodge an official complaint with a competent supervisory authority. The relevant authority for our corporate head office is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach
Germany