THERMOCON privacy notice
Updated: September 22, 2026
This notice covers personal data processed on thermocon-coldchain.com, including its language versions, contact forms, inquiry basket and Cold Chain News subscription. Separate websites operated by other companies have their own notices. Visiting this website or sending a product inquiry does not constitute general consent to advertising.
1. Controller and privacy contact
The controller for this website is Schaumaplast GmbH & Co. KG, Haydnallee 40, 68799 Reilingen, Germany. Telephone: +49 6205 97740; email: holding@schaumaplast.de. THERMOCON is a brand of the Schaumaplast Group. Contact our data protection officer at datenschutz@schaumaplast.de, or by post at the controller’s address, marked “Data Protection Officer”.
A regional inquiry may be forwarded to the responsible Schaumaplast company or sales partner identified on the relevant contact page. This includes the Polish contact at biuro@schaumaplast.pl, the Romanian sales partner Inatech at office@inatech.ro, US sales at us.sales@thermocon.cool and the Hungarian contact at difu@thermocon.cool. Forwarding is for the relevant regional or technical response, not a blanket permission for group-wide marketing. Recipients determining their own processing purposes act as controllers for that processing; instructed service providers are subject to processor requirements.
2. Purposes and legal bases
We process data to operate and secure the website and answer inquiries. Newsletter distribution, analytics and marketing are separate purposes, subject to the conditions of each service. Pre-contractual steps requested by an individual are based on Article 6(1)(b) GDPR. Processing the details of a company’s representatives and general business correspondence is based on Article 6(1)(f): our legitimate interest in appropriate business communication and responding to product inquiries. Legal obligations are based on Article 6(1)(c); consent-dependent processing on Article 6(1)(a).
Storing or accessing information on a device is also subject to section 25 of Germany’s TDDDG. Strictly necessary operations to provide a service expressly requested by the user fall within section 25(2)(2). Other consent-dependent operations require prior permission through the cookie settings. Permission to access a device does not replace a legal basis for subsequent personal data processing.
3. Hosting, security and email
Page requests produce technical data, including IP address, time, requested URL, status information, browser and device details and, where available, the referring page. These support content delivery, troubleshooting and protection against misuse. The website is hosted by Raidboxes GmbH in Germany. Form emails are transmitted through an SMTP connection to an IONOS/1&1 email service; sender, recipient, message and necessary delivery information are processed.
The legal basis for operation and security is Article 6(1)(f) GDPR; inquiry communication follows the bases explained above. Website connections use HTTPS. Access and security logs may be needed to investigate incidents or establish and defend claims. Backups support recovery and are not an active marketing database.
4. Contact forms and product inquiries
We process the contact and company details you enter, selected products, variants, quantities and messages to answer your inquiry, clarify requirements and prepare a quotation. Required fields are marked. The phone number and message in the inquiry form are optional. Without necessary information, it may not be possible to process the form; you can also contact us by email.
The forms use WordPress and WPForms or WooCommerce configured for inquiries. Inquiries are processed in the website system and by the responsible recipients. Technical form refreshes may process some information in the visitor session while you type: not every processing operation starts only when you finally submit. The inquiry basket does not process payments.
Acknowledging this notice is documented with the inquiry, including time, language and the referenced notice version. This acknowledgment is not consent to newsletters, advertising or tracking. Newsletter registration requires the separate optional selection and confirmation process.
5. Basket, browser storage and cookie choices
Necessary WooCommerce session data associate the selected products with your visit. A normal visitor session generally lasts 48 hours and may be renewed by further use. Logged-in accounts can involve additional account-related functions. WPML supports language selection.
We use the current browser tab’s sessionStorage to remember the return route and temporarily retain entered contact details and messages when you visit the product selection again. Restoration data are removed when restored and are discarded on the next check if more than two hours old. The browser usually removes them when the tab session ends. This supports your inquiry, not an advertising profile, and does not automatically grant new consents.
Borlabs Cookie manages and documents your consent choices. The configured Borlabs cookie lasts 60 days. Its dialog provides individual services, providers and configured cookie lifetimes. You can change or withdraw your choices at any time through Cookie settings or the privacy control. Withdrawal does not affect earlier lawful processing.
6. Google reCAPTCHA spam protection
Contact and inquiry forms use Google reCAPTCHA v2 to detect automated submissions. It loads only after the reCAPTCHA service has been permitted in the consent system. Technical data, including IP address, browser/device details and interactions with the verification, are sent to Google. The _GRECAPTCHA cookie may be used. Our server verifies the token issued by Google; simply displaying a checkbox is not sufficient.
Loading the external service and related consent-dependent device access rely on Article 6(1)(a) GDPR and section 25(1) TDDDG. Processing the verification result to prevent abuse serves our legitimate interest under Article 6(1)(f). The protected form cannot be sent without permission and successful verification; email contact remains available.
Since 2 April 2026, Google describes its role for reCAPTCHA Customer Data as a processor under Google Cloud terms and the Cloud Data Processing Addendum. This does not involve obtaining blanket agreement to Google’s general privacy policy. See Google’s reCAPTCHA data processing information and the Cloud Data Processing Addendum. International transfers are addressed below.
7. Cold Chain News and Mailchimp
Subscribing is voluntary and independent of your inquiry. The provider is The Rocket Science Group LLC d/b/a Mailchimp, USA, part of Intuit. Neither Newsletter2Go nor Elastic Email is the provider for this newsletter process. German subscriptions use the German audience; the other available languages use the English-language audience.
Newsletter distribution relies on consent under Article 6(1)(a) GDPR and applicable email-marketing requirements. New subscriptions require a double opt-in confirmation email: the address is enabled for newsletters only after confirmation. Existing confirmed subscriptions are unaffected. We process email address, audience/language allocation and necessary signup and confirmation evidence. Signup time, source and wording are documented; Mailchimp may process technical delivery and confirmation data.
A newsletter choice does not automatically authorize transferring the whole inquiry basket or all customer information as e-commerce marketing data. The newsletter process is separate. You may unsubscribe using the link in each newsletter or our privacy contact, without affecting your inquiry. Necessary evidence and suppression information may be retained for the limited purpose of proving consent and preventing unwanted further messages.
Engagement measurement: where open and click tracking is enabled, Mailchimp processes requests to tracking pixels and individualised links. This may create technical access data linked to an email address. Personal engagement analysis is distinct from delivery and requires an appropriate, transparent legal basis. No permission for this is inferred from an inquiry or acknowledgment of this notice.
Provider information: Mailchimp Data Processing Addendum and European data transfers.
8. Consent-dependent analytics and marketing
Google Analytics 4 is used to analyse website use, including pages, interactions, source channels and device/browser information. Google Ads supports advertising attribution and performance measurement. Where implemented on a language version, the services are governed by their respective cookie choices. The bases are Article 6(1)(a) GDPR and, for consent-dependent device access, section 25(1) TDDDG. Providing an opt-out alone is not a substitute for prior consent.
Leadinfo B.V., Rivium Quadrant 141, 2909 LC Capelle aan den IJssel, Netherlands, is configured to recognise business website visits. IP address, visited pages and technical visit data may be associated with company information. Permission is managed through the Leadinfo service in the consent dialog. IP-based visit data are not automatically anonymous or outside data protection law. See Leadinfo’s privacy information.
Google recipients can include Google Ireland Limited, Google LLC and their contracted providers. The consent dialog lists services configured for each language and their cookie lifetimes. A cookie lifetime is not the retention period of every item of data processed by a provider.
9. External content and social networks
Individual pages may offer external YouTube or Vimeo videos, Google Maps or Facebook content. Enabling content may establish a provider connection and transmit IP address, technical access details and identifiers. Consent-dependent embeds are released through the consent system. Merely displaying locally hosted pictures or fonts does not contact the original provider.
A link to a social network differs from an embedded feature. Following a link leaves our website; the platform’s information applies there. We process messages sent to our business profiles to respond. Certain platform statistics can involve joint responsibility, depending on the relevant service agreements. This notice is not general consent to all platform processing.
10. Recipients and international transfers
Access is limited by purpose to responsible staff and necessary IT, hosting, email and other service providers. Regional inquiry recipients are described above. Instructed processing is subject to Article 28 GDPR; independent controllers need their own legal basis. Authorities or legal advisers may receive data where required by law or necessary for claims.
Transfers outside the EEA are also subject to Articles 44 onwards GDPR. An adequacy decision can apply to a specifically covered recipient. The EU-US Data Privacy Framework covers participating, certified US recipients, not every US company. Mailchimp identifies itself as covered by Intuit’s programme. Where there is no applicable adequacy decision, safeguards can include Article 46 standard contractual clauses, appropriate assessments and supplementary measures where necessary. Information about applicable safeguards is available from our privacy contact. Transfers are not based on the former Privacy Shield.
11. Retention and deletion
Retention is purpose-specific. Inquiries and correspondence are needed while processing, an ensuing business relationship or legitimate evidence/claims interests require them. Afterwards data must be erased or restricted to a remaining lawful purpose, unless legal obligations require retention. A review interval alone is not a basis for indefinite storage.
German statutory retention differentiates between record types: generally ten years for books, inventories and annual accounts; eight for accounting vouchers; six for business correspondence (section 257 HGB and section 147 AO). Statutory start dates and exceptions apply. Sending a product inquiry does not automatically make it a ten-year accounting record.
Active newsletter addresses support the subscription. After unsubscribing, only necessary evidence and suppression records are retained for their distinct purposes. Unconfirmed registrations must not be treated as confirmed recipients. Section 5 describes session, restoration and consent-cookie lifetimes. Backups follow their recovery cycle; restoration is not permission to reuse data without a legal basis.
12. Your rights
Subject to applicable conditions, you have GDPR rights of access, rectification, erasure, restriction and portability (Articles 15–20). You can withdraw consent for the future. You can object on grounds of your situation to Article 6(1)(f) processing; you can object to direct marketing and associated profiling without such grounds.
You can complain to a supervisory authority, particularly where you live, work or consider an infringement occurred. For the controller in Reilingen: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany; authority contact. This does not limit your right to contact another competent authority.
Send privacy requests to datenschutz@schaumaplast.de. Only information necessary to verify a request will be requested. Changes to this notice are published here; changing the text does not replace any new consent required.