Privacy policy

1. Controller

The controller responsible for processing personal data on this website is:

Tuchel & Sohn GmbH
Hermann-Buck-Weg 6
22309 Hamburg, Germany
Phone: +49 (0)40 6390070
Fax: +49 (0)40 63900777
Email: [email protected]

Represented by the managing directors Peter Tuchel and Mirko Tuchel. Further details are in our imprint.

2. Data protection officer

You can reach our data protection officer at [email protected] or at our postal address, marked “Data protection officer”.

3. Overview

This is a static website. It sets no cookies of its own, uses no advertising or tracking services and serves its fonts from our own server. Services of other providers (live chat, maps, catalogue) load only when you explicitly start them with a click.

We process personal data only where there is a legal basis: your consent (Art. 6(1)(a) GDPR, and Section 25(1) TDDDG for access to your device), the performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR), a legal obligation (Art. 6(1)(c) GDPR) or our legitimate interests (Art. 6(1)(f) GDPR). We delete data once the purpose no longer applies, unless statutory retention periods (for example six or ten years under German commercial and tax law) require us to keep it.

Some of the service providers below are based in the United States. Transfers there rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR).

4. Hosting and delivery of the website

The website is delivered through Cloudflare Pages and the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. For every page request Cloudflare processes technically necessary data: IP address, date and time, requested address, amount of data transferred, referrer, browser and operating system. This serves delivery, stability and protection against attacks; the legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Cloudflare; Cloudflare is certified under the EU-US Data Privacy Framework. More: Cloudflare privacy policy.

The connection to this website is encrypted with TLS (shown by “https://” in the address bar).

5. Audience measurement with Cloudflare Web Analytics

To understand which pages are visited and how often, we use Cloudflare Web Analytics. It sets no cookies and builds no user profiles; it reports aggregated figures such as page views, referring page, country, device type and loading times. The legal basis is our legitimate interest in improving our website (Art. 6(1)(f) GDPR). You can object at any time, for example by blocking static.cloudflareinsights.com with a content blocker in your browser.

6. Contact form

When you use our contact form, we process the details you enter (name, email address, topic and your message) to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract or its preparation, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

The form is sent through Formspree, a service of Formspree, Inc., USA, which forwards the message to our mailbox and stores it for us. The transfer to the United States is based on the Standard Contractual Clauses. More: Formspree privacy policy. We delete your enquiry once it has been dealt with, unless retention obligations apply.

7. Contact by email and phone

When you contact us by email, phone or fax, we process your details to deal with your request (Art. 6(1)(b) or (f) GDPR). We manage our email with Microsoft 365 from Microsoft Ireland Operations Ltd., Dublin, Ireland; processing by Microsoft Corporation in the United States, which is certified under the EU-US Data Privacy Framework, cannot be ruled out.

8. Live chat (tawk.to)

Our live chat loads only when you click the chat button. Only then does your browser connect to tawk.to, Inc., USA. tawk.to processes your IP address, browser and device information, the page you are on and your chat messages, and stores cookies or data in your browser’s local storage to continue the conversation. The legal basis is the consent you give with the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it by deleting this website’s data in your browser; the chat then loads again only after another click. tawk.to is certified under the EU-US Data Privacy Framework. More: tawk.to privacy policy.

9. Maps (Google Maps)

We show Google Maps only after you click “Load Google Maps”. Your browser then sends data such as your IP address to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework, is possible. The legal basis is the consent you give with the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); reloading the page withdraws it for the future. More: Google privacy policy.

10. Embedded catalogue (Flipsnack)

On our German Private Label page you can load our catalogue, which is hosted by Flipsnack, Inc., USA. Only after your click does your browser connect to Flipsnack, sending among other things your IP address and data on how you use the catalogue. The legal basis is the consent you give with the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Flipsnack is certified under the EU-US Data Privacy Framework. More: Flipsnack privacy policy.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object: where we process data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object to that processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

Just write to [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

12. Other information

You are not obliged to provide personal data; without your contact details, however, we cannot answer an enquiry. We do not use automated decision-making, including profiling.

Last updated: October 2026