Privacy policy
Last updated: 14 October 2026
This notice explains how personal data is processed on xfortis.com. It covers website visits and contact, rental and callback enquiries. Camera operation and access control at individual project sites are subject to separate information tailored to the relevant deployment.
1. Controller and privacy contact
The controller is XFortis GmbH, Robert-Koch-Weg 22b, 59427 Unna, Germany. For privacy questions and to exercise your rights, contact us at:
info@xfortis.com · +49 2303 6768200
2. Hosting and website delivery
Our website and CRM run on a server hosted by Hetzner in Nuremberg, Germany. The hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
When you access the website, the server processes technical connection data, including your IP address, time, requested address, status information and browser, operating-system and, where supplied, referrer details. This supports delivery, troubleshooting and abuse prevention. The basis is Article 6(1)(f) GDPR: our interest in secure, reliable operation. Technical logs are retained only while needed for those purposes or to investigate a security incident.
3. Contact form, email and telephone
The contact form processes your name, email address, subject and message; providing a phone number is optional. Our server receives the message and forwards it via Microsoft Graph to our Microsoft 365 business mailbox. Microsoft receives the message and contact details for this purpose. We also process information you provide by email or telephone to handle your enquiry.
Pre-contractual enquiries and contractual matters are processed under Article 6(1)(b) GDPR. Other enquiries and communication with business representatives are based on Article 6(1)(f) GDPR and our interest in handling business communications. Required fields are necessary to process the enquiry; the form cannot be submitted without them. You are not legally required to use the form.
4. Rental enquiries and callback requests
The rental / callback form sends your enquiry to our CRM. Depending on the request, we process your name, email address, phone number, company and billing address, equipment selection, quantities, rental duration, preferred start date, location, delivery and installation preferences, and additional information. A phone number is required for callbacks; a preferred callback time is optional. This information supports advice, quotations and enquiry handling on the legal bases described in section 3. Submitting an enquiry does not itself create a booking.
5. Spam and abuse prevention
Our forms use Cloudflare Turnstile from Cloudflare, Inc., USA. Loading a form transmits signals such as your IP address, browser and connection characteristics, and website origin to Cloudflare. Cloudflare processes these for bot protection and, as a separate controller, to improve detection. Our use is based on Article 6(1)(f) GDPR: preventing automated abuse and maintaining availability.
We also limit submission attempts and check signed form tokens. This uses time-limited counters and verification values derived from IP and email addresses rather than stored in plain text. The form cannot be submitted without a successful security check; you may alternatively contact us by email or telephone.
6. Recipients and international processing
Access is limited to staff handling your enquiry and the IT, hosting and communications providers used for this purpose. We use Microsoft 365 for email; its European entity is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Data may also be provided to authorities where legally required.
Cloudflare, Microsoft and activated Google content may involve processing outside the European Economic Area, particularly in the United States. German hosting does not exclude this. The providers describe applicable transfer mechanisms in their privacy information, including adequacy decisions for covered recipients and standard contractual clauses. You can request information and copies of the safeguards applicable to our processing through our privacy contact.
7. Retention
Enquiries are retained for their handling and necessary follow-up, then deleted unless statutory retention duties or evidence needed to establish, exercise or defend legal claims require continued storage. For business and tax records, the retention period depends on the document category and applicable commercial and tax rules. Retained records are used only for the remaining purposes. Statutory retention is based on Article 6(1)(c) GDPR; necessary evidence for claims is based on Article 6(1)(f) GDPR.
The technical delivery queue stores messages encrypted until handover is confirmed. The queued message is then removed; technical handover records are deleted by the regular processing job after 30 days from receipt. Failed or uncertain submissions remain until resolved. These rules concern the queue, not subsequent handling in the mailbox or CRM.
8. Language preferences and local storage
When you explicitly choose a language, your browser saves it as xfortis-language in local storage until you clear the website data or change languages. Without a saved choice, the website uses the language in the link or your browser preference. This supports your selected display, based on section 25(2)(2) TDDDG and, where personal data is involved, Article 6(1)(f) GDPR. We do not use our own analytics or advertising trackers on this website. Security functions and activated third-party content are described separately.
9. Google Maps, media and external links
The Google map on the contact page loads only after you click its labelled button. Google then receives your IP address and browser and usage data; cookies or similar technologies may also be used. The EEA provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The basis is your consent under Article 6(1)(a) GDPR and, where required, section 25(1) TDDDG. You can use the written address without activating the map. Select “Deactivate content” or reload the page to remove the embed; this does not affect processing already carried out.
Our images, font files and embedded TimeLaps film load from the website server. Links to YouTube, LinkedIn, Facebook or the shop open other services. A connection to the destination is established when you open the link; that service’s privacy information then applies.
10. Your rights
Subject to the legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You can withdraw consent at any time for the future without affecting the lawfulness of earlier processing.
Right to object: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. If data is processed for direct marketing, you may object at any time. Contact info@xfortis.com to exercise this right.
You may complain to a data protection supervisory authority, particularly in the place of your habitual residence, workplace or the alleged infringement. The supervisory authority for North Rhine-Westphalia is the LDI NRW.