Data protection statement


This data protection statement explains which personal data CMF-Produkte Keller (Owner: Michael Keller, Eimeldinger Weg 38, 79576 Weil am Rhein, Germany) will use in the context of

Your visit to our website
Your order via our Goufrais online shop ('Goufrais-Shop'),
and the opening of a customer account in our Goufrais shop,
your registration with the customer account in our Goufrais shop,
registration for our newsletter,
the use of the contact form
the purposes for which we use this data and how we use this data in order to optimise our services for you.

1. Basic information
(1) You can print or save this document by using the usual functionality of your browser (here, it is usually referred to as 'File' or 'Save as').

(2) Unless otherwise described in the following sections, the legal basis for the processing of your personal data arises from the need to handle it in order to provide the functionalities requested by you on this website (art. 6 para. 1b EU General Data Protection Regulation (GDPR)).

2. Controller / Data protection officer
The controller in accordance with art. 4 no. 7 GDPR is

CMF-Produkte Keller,
Owner Michael Keller,
Eimeldinger Weg 38
79576 Weil am Rhein

hereinafter 'CMF' also known as 'we' or 'us'. You can find further information about the controller in our impressum.

3. Provision of the website and log files
(1) When using the website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect the personal data that your browser automatically sends to our server. If you wish to view our website, we collect the following data which is technically necessary for us to display our website and to ensure its stability and security (the legal basis is art. 6 para. 1 sentence 1f GDPR)

IP address
Date and time of the request
Time zone difference to Greenwich Mean Time (GMT)
Content of the request (specific page)
Access status/HTTP status code
Amount of data transferred in each case
Website from which the request comes
Operating system and its interface
Language and version of the browser software.

(2) The IP addresses of users will be deleted or made anonymous after the end of use. In the case of an anonymisation, IP addresses are changed in such a way that the individual details of personal or factual circumstances can no longer be attributed to a specific or determinable natural person, or can only be attributed to a specific or determinable natural person with a disproportionate amount of time, money and labour.

4. Cookies
(1) In addition to the log files data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are assigned and stored on your hard disk, related to the browser you are using. Through the browser, certain information (hereafter 'cookies') is sent to the site that sets the cookie (in this case by us). Cookies cannot execute programs or transfer viruses to your computer. They are used to make the overall Internet presence more user-friendly and effective.

(2) Use of cookies:
This website uses the following types of cookies, the scope and function of which are explained below:

Session cookies (in addition, a)
Persistent cookies (in addition, b).
a) Session cookies are automatically deleted when you close the browser. They store a so-called session ID, with which various requests can be assigned to the shared session from your browser. This enables your computer to be recognised when you return to our website. The session cookies are deleted when you log out or close the browser.

b) Persistent cookies are automatically deleted after a specified period of time, which may vary depending on the cookie. You can delete the cookies in the security settings of your browser at any time.

(3) For what purposes do we use cookies?

a) Settings and function
When you visit our website, the country and language selection which you have determined or chosen is stored in cookies in order to save you having to make a new selection on subsequent visits.
In advance, we check whether your browser supports cookies and this information is stored in another cookie. Afterwards, you will be shown contact information localised by country and language, which will also be saved. The legal basis for this is art. 6 para. 1 sentence 1b GDPR.

b) Identification
If you have an account in the Goufrais Shop we use cookies in order to identify you for subsequent visits (see point 7). The legal basis for this is art. 6 para. 1 sentence 1b GDPR c) Advertising We use advertising cookies to evaluate the efficiency of our advertising measures and to derive optimisations from them. Furthermore, we use advertising cookies in order to enable users of our Internet presence to access websites of the display network of Google Inc. ('Google' for short) with targeted advertising messages (AdWords remarketing). The legal basis for this is art. 6 para. 1 sentence 1f GDPR.

d) Online marketing
We use the online marketing tool DoubleClick by Google in order to continuously improve the internet presence for our customers and interested parties. By using these cookies, we receive information from Google about the use of our website. For example, we learn how often and in which order the individual pages were called up and how much time you spend on our websites on average. We also find out whether you have visited our websites before. The legal basis for this is art. 6 para. 1 sentence 1f GDPR.
see point 9 Web analysis services

(4) Control over cookies
You can configure your browser settings according to your wishes and, for example, control or reject the acceptance of all cookies as you wish. You can delete existing cookies via the browser settings. Please note that you may not be able to use all of the functions of this website if you do so.

5. Newsletter
(1) For advertising purposes, i.e. sending information related to products and services, company news, invitations to trade fairs and events (hereinafter referred to as a 'newsletter') by e-mail, we ask interested parties for their express consent and agreement to this data protection statement.

(2) We use the so-called double opt-in procedure. This means that after your registration, we will send you an e-mail to the e-mail address you provided during registration. In this e-mail, we will ask you to confirm that you wish to receive the newsletter by e-mail. If you do not confirm your registration within 72 hours, your personal data will be blocked and automatically deleted after one month (hereinafter referred to as the 'double opt-in procedure'). In addition, we store your addresses and the time of registration and confirmation. The purpose of this procedure in order to provide proof of your registration and, if necessary, in order to clarify any possible misuse of your personal data.

(3) After your confirmation, we save your e-mail address for the purpose of sending the newsletter. The legal basis for this is art. 6 para. 1 sentence 1a GDPR.

(4) You can revoke and cancel your consent to receive the newsletter at any time. You can revoke your consent by clicking on the link provided in each e-mail or by sending a message to the contact details in the impressum.

6. Contact form and e-mail contact
(1) A contact form is available on our website. If you use this option, the data entered in the input screen will be transmitted to us and stored. The data of the contact form will be transmitted in an encrypted format. The corresponding data can be seen directly on the respective input screen.

At the time of sending, the following data is also stored:

Your IP address
Date and time of sending the contact form
(2) For the processing of the data, your consent is always obtained in the course of the sending process and reference is made to this data protection declaration. Alternatively, it is possible to contact us using the e-mail addresses provided. In this case your personal data that is transmitted with the e-mail will be stored. The data will be exclusively used for the processing of the enquiry.

(3) The legal basis for the processing of the data is art. 6 para. 1a GDPR if your consent has been obtained. The legal basis for the processing of data transmitted in the course of sending an e-mail is art. 6 para. 1f GDPR. If the e-mail contact is aimed at the conclusion of a contract, the additional legal basis for processing is art. 6 para. 1b GDPR. If the contact inquiry or e-mail contact serves to initiate an employment relationship, especially in the context of an online application, the legal basis for processing is art. 26 GDPR.

(4) For us, the processing of the personal data from the input screen is solely to process the contact request. In the event that you contact us by e-mail, this is also the necessary legitimate interest in processing the data. The other personal data processed during the sending process act to prevent misuse of the contact form and to ensure the security of our information technology systems.

(5) The data will be deleted as soon as they are no longer required for the purpose for which they were collected. This is the case for personal data from the input screen of the contact form and data sent by e-mail when the respective conversation with you has ended. The conversation is finished when from the circumstances, it can be concluded that the matter in question has been finally clarified. At the latest, the additional personal data collected during the sending process will be deleted after a period of seven days.

7. Use of the Goufrais shop
(1) If you would like to order from our Goufrais shop, it is necessary that you provide your personal data for the processing of your order. You do not need to register in order to place your order in the Goufrais shop. You can place an order as a guest or as a registered customer (see point 8). Mandatory information necessary for the processing of the order is marked separately with *. Further information is voluntary. After an examination by us, an order confirmation or the ordered goods will be sent. The legal basis for data processing in order to process your order is art. 6 para. 1 sentence 1b GDPR.

(2) If you buy products from us, we may, in the future, send you information e-mails for similar goods from our product range. The legal basis for this is art. 7 para. 3 Unfair Competition Act. The information e-mails are sent in accordance with our data protection statement. You can object at any time and request that we no longer send you such e-mails.

(3) Under commercial and tax law, we are obliged to store your address as well as payment and order data for a period of ten years. However, after the statutory limitation periods have expired, we will restrict the processing, i.e. your data will only be used to comply with the statutory storage obligations.

(4) In order to prevent unauthorised access to your personal data by third parties, especially financial data, the ordering process is encrypted using SSL technology!

8. Registration function
(1) In our Goufrais shop we offer you the possibility to simplify the ordering process by creating a customer account. Your personal data will then be permanently stored in a password-protected customer account. We need your consent for this. We use the double opt-in procedure for this. After creating a customer account no new data entry is necessary. In addition, you can view and change the data stored about you in your customer account at any time or delete your customer account.

(2) The corresponding data can be seen directly on the respective input screen. Mandatory data is marked with *. The data entered during registration will be used for the purpose of using the Goufrais shop. You can be informed by e-mail about information relevant to offers, the registration process and technical circumstances. If you have deleted your customer account, the personal data stored in it will be deleted. Data which must be retained for reasons under commercial law or tax law in accordance with art. 6 para. 1c GDPR. It is incumbent on you to secure your data before the end of the contract if deletion has taken place. We are entitled to irretrievably delete all of your data stored during the term of the contract after the statutory retention periods have ceased to apply.

(3) We store the IP address and the time of the respective user action within the framework related to the usage of our registration functions and the usage of the customer account. The storage is based on our legitimate interests as well as the legitimate interests of the users concerning protection against misuse and other unauthorised use. As a matter of principle, this data is not passed on to third parties unless it is necessary to pursue our claims or there is a legal obligation to do so in accordance with art. 6 para. 1c GDPR. The IP addresses are anonymised or deleted after 7 days at the latest.

9. Web analysis services
(1) Our websites continue to use the online marketing tool DoubleClick by Google. The legal basis for this is art. 6 para. 1 sentence 1f GDPR.

(2) DoubleClick uses cookies in order to show ads that are relevant to you, to improve campaign performance reports and to prevent you from seeing the same ads more than once. Google uses a cookie ID to record which ads are shown in which browser and in doing so, can prevent them from being shown more than once. DoubleClick may also use cookie IDs to track conversions related to ad requests. For example, this is the case if you see a DoubleClick ad and later visit the advertiser's website using the same browser and make a purchase. According to Google, DoubleClick cookies do not contain any personal information.

(2) Due to the marketing tools that are used, your browser automatically establishes a direct connection with Google's server. We have no influence concerning the scope and further use of the data collected by Google through the use of these tools and as such, we inform you according to the state of our knowledge: Through the integration of DoubleClick, Google receives the information that you have called up the corresponding part of our website or have clicked on one of our advertisements. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or have not logged in, it is possible that the provider will find out and save your IP address.
In addition, the DoubleClick floodlight cookies that are used allow us to understand whether you perform certain actions on our site after you view or click on one of our display/video ads on Google or another platform through DoubleClick (conversion tracking). DoubleClick uses this cookie to understand the content that you have interacted with on our sites so that we can send you targeted advertisements later on.

(3) You can prevent participation in this tracking process in a number of ways: a) by adjusting your browser software settings accordingly, especially by suppressing third-party cookies so that you do not receive third-party ads; b) by disabling conversion tracking cookies by setting your browser to block cookies from the domain, de/settings/ads, whereby this setting will be deleted if you delete your cookies; c) by deactivating interest-based ads from the providers that are part of the self-regulation campaign 'About Ads' via the link, whereby this setting will be deleted if you delete your cookies; d) by permanently deactivating them in your Firefox, Internet Explorer or Google Chrome browsers under the link, e) by means of an appropriate cookie setting. Please note that in this case, you may not be able to use all of the functions of this website if you do so.

(4) Further information concerning DoubleClick by Google can be found at and on data protection at Google in general: Alternatively, you can visit the website of the Network Advertising Initiative (NAI) at Google has complied with the EU-US Privacy Shield,

10. Automated decision making
As a matter of principle, in order to establish and conduct the business relationship, we do not use fully automated decision making in accordance with art. 22 GDPR.

11. Profiling
In order to be able to inform and advise you about products in a targeted manner, we or service providers may use web analysis services, especially tracking technology, on our behalf. This enables communication and advertising to be tailored to your needs. In this regard, we would like to refer you to point 9 Web analysis services.

12. Your rights
If personal data are processed by you, you are a data subject in terms of GDPR and you are entitled to the following rights with respect to us as the controller. If you wish to assert your rights or require further information, please contact us.

a) Rights in accordance with art. 15 et seqq GDPR
(1) You have the right to information in accordance with 15 GDPR. Under certain conditions you have the right of rectification under art. 16 GDPR, the right to restrict processing under art. 18 GDPR and the right of deletion ('right to be forgotten') under art. 17 GDPR. In addition, you have the right to have the data you provide released in a structured, common and machine-readable format ('right to data transferability') in accordance with art. 20 GDPR, provided that the processing is carried out using automated procedures and is based on consent in accordance with art. 6 para. 1a) or art. 9 para 2a) or based on a contract in accordance with art. 6 para. 1b) GDPR. In the case of the right of information and the right of deletion, the restrictions pursuant to sects. 34 and 35 Federal Data Protection Act apply.

b) Revocation of consent in accordance with art. 7 para. 3 GDPR
If the processing is based on consent, you can revoke the given consent to the processing of personal data at any time. This also applies to the revocation of declarations of consent that were issued to us before the GDPR came into force, i.e. before 25 May 2018. Please note that the revocation is only effective for the future. Processing that took place before the revocation is not affected.

c) Right of appeal
You have the opportunity to address a complaint to us or to a data protection supervisory authority, especially in the member state of your place of residence, your place of work or the place of the suspected infringement (art. 77 GDPR in conjunction with sect. 19 Federal Data Protection Act).

d) Right of objection under art. 21 GDPR
In addition to the rights mentioned above, you have the right to object as follows:


Right of objection in individual cases
For reasons arising from your particular situation, you have the right to object at any time to the processing of personal data concerning you. This is carried out on the basis of art 6, para. 1f) of the GDPR (data processing based on a balancing of interests); this also applies to profiling based on this provision as defined by art. 4, paragraph 4 of the GDPR.
If you lodge an objection, we will no longer process your personal data unless we can prove compelling reasons for processing that are worthy of protection and outweigh your interests, rights and freedoms, or unless the processing serves to assert, exercise or defend legal claims.

Right to object to the processing of data for advertising purposes
In individual cases, we process your personal data in order to carry out direct advertising.
You have the right to object, at any time, to the processing of personal data concerning you for the purposes of such direct marketing. This also applies to profiling, insofar as it is connected with such direct marketing. If you object to processing for the purposes of direct marketing, we will no longer process your personal data for those purposes.

The objection can be made without the need for a form. This is sent to the office indicated under point 2 of this data protection statement.

13. Integration of YouTube
(1) We have integrated YouTube videos into our online presence, which is stored at and can be played directly from our website. These videos are all embedded in 'enhanced privacy mode', which means that no data about you as a user is transferred to YouTube if you do not play the videos. It is only when you play the videos that the data mentioned in point 13, paragraph 2 will be transmitted. We have no influence regarding this data transfer.

(2) By visiting the website, YouTube receives information that you have called up the corresponding subpage of our website. In addition, the data mentioned under point 3 of this statement is transmitted. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists. If you are logged in at Google, your data will be directly assigned to your account. If you don't want the assignment to your profile on YouTube, you have to log out before activating the button. YouTube stores your data as user profiles and uses them for the purposes of advertising, market research and/or the demand-oriented design of its website. Such an evaluation is especially carried out (even for users who are not logged in) for the purpose of providing needs-based advertising and to inform other users of the social network about your activities on our website. You have a right of objection to the creation of these user profiles. For this, you must contact YouTube in order to exercise this right.

(3) For further information concerning the purpose and scope of data collection and processing by YouTube, please refer to the data protection statement. There, you will also find further information concerning your rights and setting options to protect your privacy: . Google also processes your personal data in the USA and has complied with the EU-US Privacy Shield,

14. Security
(1) We have taken technical and organisational security measures to protect your personal data from loss, destruction, manipulation and unauthorised access. All our employees and all third parties involved in data processing are obliged to comply with the Federal Data Protection Act and to handle personal data confidentially.

(2) In the event of the collection and processing of personal data via the contact form of the web shop, the information is transmitted in encrypted form to prevent misuse of the data by third parties.

15. Changes to our data protection regulations
We reserve the right to change our security and data protection measures if this becomes necessary due to technical developments. In such cases we will also adapt our data protection statement accordingly. Therefore, please note the current version of our data protection statement.