Privacy policy

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

AGREX Agrar-Export GmbH
Gut Schwaige 97, OT Leutstetten
82319 Starnberg
Germany

Phone: +49 8151 2585
Email: info@agrex.de

Represented by the managing directors Benedikt Zapf and Christoph Zapf.

No data protection officer has been appointed, as there is no legal obligation to do so.

This privacy policy describes which personal data are processed when you visit this website, for what purposes and on what legal basis. Personal data are any information relating to an identified or identifiable natural person, for example name, email address or IP address.

The website provides information about the products and services of AGREX. It contains no online shop, no newsletter and no analytics or advertising services.

The following are processed:

• technical access data with every page view (section Hosting)
• a technically necessary security cookie (section Cookies)
• data for the security check on the contact page (section Protection of the contact form)
• information from the contact form, from emails and phone calls (section Contacting us)

Personal data are passed on only to the service providers named in this policy or where there is a legal obligation to do so. There is no automated decision-making, including profiling.

Heroku

The website is operated on the Heroku platform. The provider is Salesforce, Inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA. The servers and the database of the website are located in the USA.

With every visit to the website, the following data are processed for technical reasons and recorded in server log files: IP address, date and time of access, page or file requested, amount of data transferred, status code, referrer URL and browser type and operating system.

The processing is necessary to deliver the website, to ensure stability and security and to analyse errors. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and trouble-free operation of the website. AGREX does not store the log data permanently; the platform only keeps the most recent entries (at most 1,500 lines), and older entries are continuously overwritten.

Images and documents

Images and documents of the website are stored at Amazon Web Services and loaded directly from there when a page is viewed. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. In the process, the IP address and the technical data listed above are transmitted to Amazon Web Services. The data are stored in a data centre in Frankfurt am Main. The legal basis is Art. 6(1)(f) GDPR.

Data processing agreements and transfers to third countries

Data processing agreements pursuant to Art. 28 GDPR are in place with both providers. Salesforce, Inc. and Amazon.com, Inc. are certified under the EU-US Data Privacy Framework. Transfers to the USA are based on the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR) and additionally on standard contractual clauses (Art. 46(2)(c) GDPR).

The website does not set any cookies for analytics or advertising purposes and does not use a consent banner. Only information required for operation is stored:

• a security cookie (csrftoken) that protects forms such as the contact form against misuse (CSRF protection)
• when logging in to the protected area, a session cookie that keeps you logged in for the duration of the session

The legal basis is Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), and Art. 6(1)(f) GDPR for further processing. No consent is required for this.

To protect against spam and automated requests, the contact page uses the Turnstile service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile is loaded only on the contact page.

Cloudflare processes the IP address as well as information about the browser and device and about the interaction with the page in order to distinguish people from automated programs. When the form is submitted, the result of the check is transmitted to the website's server and confirmed there with Cloudflare.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in protecting the contact form against misuse. Access to information on the device is based on Section 25(2) No. 2 TDDDG. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the adequacy decision of the European Commission (Art. 45 GDPR). Further information: Cloudflare privacy policy.

Contact form

When you send an enquiry via the contact form, the information entered is processed: name, email address and message (required) and, if provided, company, country, sector and products, as well as the confirmation that you have read the privacy policy. Providing this information is voluntary; without the required information, however, the enquiry cannot be handled. The information is stored in the website's database and forwarded to AGREX by email.

Email and phone

If you contact us by email or phone, AGREX processes the information provided in order to handle the enquiry.

Email service

Emails to and from AGREX, including the forwarding of enquiries from the contact form, are transmitted and stored via the email service of Telekom Deutschland GmbH, Landgrabenweg 151, 53227 Bonn, Germany. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in reliable email communication.

Purpose, legal basis and storage period

The information is used solely to handle the enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract or steps prior to entering into a contract, and otherwise Art. 6(1)(f) GDPR; the legitimate interest lies in answering the enquiry.

The information is deleted after one year, unless statutory retention obligations prevent this. Commercial and business letters are retained for six years under Section 257 HGB (German Commercial Code), and documents relevant for tax purposes for up to ten years under Section 147 AO (German Fiscal Code).

Under the GDPR, data subjects have the following rights:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

Right to object under Art. 21 GDPR

Where processing is based on Art. 6(1)(f) GDPR, it may be objected to at any time on grounds relating to the particular situation of the data subject. AGREX will then no longer process the data unless there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

To exercise these rights, a message to info@agrex.de or to the address above is sufficient.

Right to lodge a complaint

Data subjects may lodge a complaint with a data protection supervisory authority. The authority responsible for AGREX is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

The website uses TLS encryption. Data transmitted via the website, for example enquiries via the contact form, are thereby protected against being read by third parties. An encrypted connection can be recognised by “https://” in the browser's address bar.