Privacy Policy

Last updated: 22 September 2026

1 Data Controller

GENERATOR.EU UG (limited liability)
Edisonstr. 8, 85716 Unterschleißheim, Germany
Telephone: +49 89 20175987
Email: support-team@generator.eu

2 General information

We process personal data only to the extent necessary for the operation of the shop, the handling of enquiries, the performance of contracts, the fulfilment of legal obligations or on the basis of consent. The legal bases are, in particular, Article 6(1)(a), (b), (c) and (f) of the GDPR and Section 25 of the TDDDG.

3 Hosting and server logs

The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you visit the website, we process the following data: IP address, date and time, file accessed, referrer, browser, operating system and volume of data transferred. The purposes are the delivery, stability and security of the website. The legal basis is Article 6(1)(f) of the GDPR; our legitimate interest is the secure and trouble-free operation of the website. We delete the log data after seven days at the latest. Only if we need to investigate a specific security incident do we store the relevant log data until the investigation is complete.

4 Customer Account, Orders and Pre-contractual Steps

For customer accounts, orders, delivery, invoicing, complaints and support, we process master data, contact details, address details, contractual data, product data, payment data and communication data. The legal bases are Article 6(1)(b) and (c) of the GDPR. Mandatory fields are marked as such. Without the required information, we cannot process the contract.

If you request a quote – by telephone, via our AI assistant, by email or via the contact form – we use your name, your email address and the details of your enquiry to send you the quote and to clarify any queries. The legal basis is Article 6(1)(b) of the GDPR (pre-contractual measures in response to your enquiry). We will only send marketing communications to this email address in accordance with the conditions set out in Section 13.

For the electronic withdrawal function under Section 356a of the German Civil Code (BGB) (‘Withdraw from the contract’), we process your name, your address, your email address, the details of the relevant order, and the date and time of receipt of your notice of withdrawal. We require this data to process your withdrawal, to send you the legally required acknowledgement of receipt, and to be able to provide proof of receipt. The legal basis is Article 6(1)(c) of the GDPR, as we are required by law to provide this function and to issue the acknowledgement of receipt, as well as Article 6(1)(b) of the GDPR for the reversal of the contract. We retain the notice of withdrawal and the acknowledgement of receipt together with the order details and delete them once the time limits specified in the following paragraph have expired.

We store order and contract data for the duration of the contract and for the statutory warranty and limitation periods. We store accounting records and invoice data for eight years; other documents required to be retained under tax law are retained for up to ten years, depending on the type of document.

5 Recipients for delivery and direct dispatch

For delivery purposes, we pass on the name and delivery address to the parcel service (DHL, DPD or UPS) or to the haulage contractor specified during the ordering process. In the case of direct dispatch, the manufacturer or wholesaler carrying out the dispatch receives only the data necessary for dispatch and notification. The legal basis is Article 6(1)(b) of the GDPR.

For deliveries by a freight forwarder, the freight forwarder will arrange the delivery date with you by telephone. To this end, we will pass on your telephone number to the freight forwarder (Article 6(1)(b) of the GDPR). We will only pass on your email address or telephone number to DHL, DPD or UPS for the purpose of a delivery notification if you have given your consent during the ordering process (Article 6(1)(a) of the GDPR). You may withdraw this consent at any time with future effect.

6 Payment service providers

If you pay by credit card or Amazon Pay, we will pass on the data required for the payment to Stripe Payments Europe Limited (Ireland) or Amazon Payments Europe S.C.A. (Luxembourg). In the case of payment in advance, our bank will receive the bank transfer details. The payment service providers process data in part under their own responsibility under data protection law. The legal basis is Article 6(1)(b) of the GDPR. For fraud prevention and security checks, the payment service providers also rely on Article 6(1)(f) of the GDPR; the legitimate interest is protection against payment fraud.

7 Contact, Support and Protection of the Contact Form

When you contact us via the contact form, by email or by telephone, we process your details in order to deal with your enquiry. The legal basis is Article 6(1)(b) of the GDPR for contract-related enquiries; in all other cases, it is Article 6(1)(f) of the GDPR; our legitimate interest is to respond to your enquiry.

We protect our contact form against spam and automated attacks using Cloudflare Turnstile from Cloudflare, Inc., USA. When the contact page is accessed, Turnstile checks the technical characteristics of your browser and device, as well as your IP address, in order to distinguish humans from automated programmes. Turnstile does not set any cookies for advertising or analytical purposes. The legal bases are Article 6(1)(f) of the GDPR and Section 25(2)(2) of the TDDDG; our legitimate interest is to protect our form from misuse. Cloudflare also processes some of this data under its own responsibility to improve bot detection. Further details can be found in Cloudflare’s Turnstile Privacy Addendum. Data is transferred to the USA on the basis of the EU-US Data Privacy Framework, under which Cloudflare, Inc. is certified.

8 AI-powered voice assistant

The widget for our AI voice assistant is integrated into all pages of our shop and is only loaded once you have given your consent in the cookie dialogue (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). Without this consent, no connection is established with the assistant’s provider.

If you voluntarily initiate a voice or telephone interaction with our AI assistant, we engage Retell AI, Inc., 548 Market St, PMB 30534, San Francisco, CA 94104-5401, USA, as a data processor. During the conversation, we process your speech, the transcript generated from it, the duration of the conversation, technical session data and the information you provide during the conversation. This real-time processing is based on Article 6(1)(b) of the GDPR where an order or contract is involved; in all other cases, it is based on Article 6(1)(f) of the GDPR; our legitimate interest is the prompt handling of enquiries.

Recording: At the start of the call, the assistant will inform you that the call is being recorded and ask for your consent (Article 6(1)(a) of the GDPR). Only if you give your consent will Retell AI store the call recording, the transcript and the call logs. In doing so, the system automatically removes personal data falling within the categories specified by us, insofar as this is technically possible. Recordings can only be accessed via time-limited, signed links. If you do not give your consent, we will not store either the recording or the transcript, but only basic data such as the time and duration of the call.

Processing by our staff: Members of our sales and customer service teams read the transcript or listen to the recording in order to deal with your enquiry – for example, to send you a requested quotation by email. We enter the necessary details into our customer system (see section 4).

Retention period: Retell AI automatically deletes all call data from our account after 30 days. If we require specific details from the call for an order or due to statutory retention obligations, we will transfer them to our customer system; the retention periods set out in Section 4 apply there.

Data is transferred to the USA on the basis of EU Standard Contractual Clauses (Article 46(2)(c) of the GDPR), which form part of our data processing agreement with Retell AI.

9 Google Services

We only activate Google Analytics, Google Ads and Google Tag Manager with your consent. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal bases are Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG. You may withdraw your consent at any time via the cookie settings.

When using these services, data is also transferred to Google LLC, USA. The legal basis for this is the EU-US Data Privacy Framework (Adequacy Decision of the European Commission of 10 July 2023), under which Google LLC is certified.

10 Meta Services

We only use Meta Pixel and the Meta Conversion API with your consent. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The purposes are to measure reach, attribute orders to adverts and deliver personalised advertising. The legal bases are Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.

Data is also transferred to Meta Platforms, Inc., USA. The legal basis for this is the EU-US Data Privacy Framework, under which Meta Platforms, Inc. is certified.

11 Cookies and consent management

We use technically necessary technologies, including Cloudflare Turnstile on the contact page, in accordance with Section 25(2) of the TDDDG and Article 6(1)(f) of the GDPR; our legitimate interest is the secure operation of the shop. We only activate statistical, convenience and marketing technologies once you have given your voluntary consent. In the consent dialogue, you can opt out of all non-essential technologies with a single click – it’s just as easy as giving your consent. Details, providers, purposes and durations can be found in the Cookie Policy and in the settings dialogue.

12 Transfers to third countries

We transfer personal data to the following countries outside the European Economic Area:

  • USA – Google LLC and Meta Platforms, Inc.: EU-US Data Privacy Framework (Art. 45 GDPR); see sections 9 and 10.
  • USA – Cloudflare, Inc.: EU-US Data Privacy Framework (Art. 45 GDPR); see Section 7.
  • USA – Retell AI, Inc.: EU Standard Contractual Clauses (Article 46(2)(c) of the GDPR); see Section 8.

A copy of the Standard Contractual Clauses is available on request from support-team@generator.eu.

13 Newsletters and Partner Offers

You will only receive advertising by email and offers from partners if you have given your separate, voluntary and unpreselected consent. The legal basis is Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with effect for the future.

14 Your rights

In accordance with the GDPR, you have the rights to access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw your consent at any time with effect for the future (Article 7(3)); the lawfulness of the processing carried out prior to withdrawal remains unaffected. To exercise your rights, please write to support-team@generator.eu.

You may lodge a complaint with the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach.

15 Information on your right to object under Article 21 of the GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which we carry out on the basis of Article 6(1)(f) of the GDPR (legitimate interests).

In this statement, this applies to: server logs (Section 3), enquiries not related to a contract and form protection using Cloudflare Turnstile (Section 7), real-time processing by the AI voice assistant not related to a contract (Section 8) and technically necessary technologies (Section 11).

Following an objection, we will no longer process your data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Please send your objection informally to support-team@generator.eu.

16 Automated decision-making

No decisions with legal or similarly significant effects are made solely by automated means. If a payment service provider carries out its own automated checks, it will provide information about this in its privacy notice.

17 Updates

We update this policy when the legal situation, services or processing operations change.