Privacy Policy

1) Introduction and contact details of the controller

We are pleased that you are visiting our website and thank you for your interest. Below we inform you about how we handle your personal data when you use our website. Personal data is any data that can be used to identify you personally.

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Christian Grömmer
Westendstr. 281
80686 München
Deutschland
Phone: +49 1522 7651012 o. +49 89 41870713
Email: info@ampguard-zentinel.de

The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data collection when visiting our website (hosting)

When you use our website purely for informational purposes, i.e. when you do not actively transmit information to us (for example via a contact form), we only collect the data that your browser transmits to our web server (so-called "server log files").

Web hosting via ALL-INKL:

Our website is hosted on the servers of the German provider ALL-INKL.COM - Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf). A data processing agreement (DPA) compliant with Art. 28 GDPR has been concluded with ALL-INKL to ensure the protection of your data at European server level.

When you access our website, the server automatically collects the following data, which is technically necessary to ensure the stability and security of the display:

• The address of our website visited
• Date and time of access
• Amount of data sent in bytes
• Source/reference from which you accessed the page (referrer)
• Browser type and operating system used
• IP address used (in anonymised, shortened form by the hosting provider)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in ensuring IT security, defending against attacks, and technically improving the stability and functionality of our website. This server data is not passed on to any other third parties.

3) Contacting us

When you contact us (e.g. via the contact form or by email), personal data is collected. Which data is collected when using our contact form is directly apparent from the input fields of the contact form (such as name, email address and your message text).

This data is processed and stored exclusively for the purpose of dealing with your enquiry or for contacting you and the associated technical administration.

The legal basis for processing this data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your enquiry is aimed at concluding or preparing a commercial contract, the additional legal basis for processing is Art. 6(1)(b) GDPR.

Your data will be deleted once your enquiry has been fully dealt with. This is the case when it can be inferred from the circumstances that the matter in question has been conclusively clarified, provided that no statutory or tax-related retention obligations prevent deletion.

4) Rights of the data subject

Applicable data protection law grants you extensive rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data:

• Right of access pursuant to Art. 15 GDPR: You have the right to obtain information about the personal data we process concerning you.
• Right to rectification pursuant to Art. 16 GDPR: You have the right to have inaccurate or incomplete data corrected without undue delay.
• Right to erasure pursuant to Art. 17 GDPR: You may request the deletion of your data, provided no statutory retention periods stand in the way.
• Right to restriction of processing pursuant to Art. 18 GDPR: You may request the restriction of processing, for example while the accuracy of your data is being verified.
• Right to notification pursuant to Art. 19 GDPR: Right to be informed of any rectification or erasure of data communicated to all recipients.
• Right to data portability pursuant to Art. 20 GDPR: Right to receive your data in a structured, commonly used and machine-readable format.
• Right to withdraw consent given pursuant to Art. 7(3) GDPR: You may withdraw consent to data processing that you have given at any time, with effect for the future.
• Right to lodge a complaint pursuant to Art. 77 GDPR: If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with a supervisory authority (e.g. the Bavarian State Office for Data Protection Supervision).

Right to object (Art. 21 GDPR)

IF, WITHIN THE SCOPE OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. FURTHER PROCESSING REMAINS POSSIBLE, HOWEVER, IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

5) Duration of storage of personal data

The duration for which personal data is stored is determined by the applicable legal basis, the specific purpose of processing and, where relevant, the applicable statutory retention period (e.g. commercial and tax retention periods under the German Commercial Code (HGB) or Fiscal Code (AO)).

Where statutory retention periods apply to business and contract data processed on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted once the tax-related retention periods have expired, provided it is no longer required for the active performance of the contract or we no longer have a legitimate interest in its continued storage.

Cookies and Google Analytics 4

This website uses cookies. Necessary cookies are required for the website to function and cannot be disabled. Optional cookies (statistics) are only set with your express consent, which you can give via the cookie banner or revoke/adjust at any time via the "Cookie Settings" link in the footer.

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies or comparable technologies that enable an analysis of your use of the website.

This is used solely on the basis of your consent pursuant to Art. 6 (1)(a) GDPR in conjunction with Section 25 (1) TDDDG. Without your consent given via the cookie banner, Google Analytics is not actively loaded.

We use Google Consent Mode: as long as you have not consented to the use of statistics cookies, Google Analytics does not process any personal cookie data; at most, anonymized, aggregated signals without personal reference are transmitted. Only after your consent is data collection activated in full.

Data processed includes, among other things: pages visited, time spent on the site, approximate location at city/region level, device and browser used, and the origin of the visit. Google Analytics 4 truncates or masks IP addresses server-side before they are stored; a complete IP address is not permanently stored.

The data collected is processed by Google, in part on servers in the USA as well. Google has adopted the EU Standard Contractual Clauses and/or participates in the EU-U.S. Data Privacy Framework to ensure an adequate level of data protection.

The retention period for user data in Google Analytics is 14 months, after which it is automatically deleted.

You can revoke your consent at any time with effect for the future via the "Cookie Settings" link in the footer. For further information on data processing by Google, please see Google's privacy policy: policies.google.com/privacy.

At present, we use the following cookies:

Use of AI Systems

AI systems may be used to assist in creating and editing content on this website, for example for research, wording, or technical implementation. All content is personally reviewed and approved by Christian Grömmer before publication.

Editorial and professional responsibility for all published content rests entirely with Christian Grömmer as the operator of this website.

Device portal and QR test plaques

Our test plaques carry a QR code that leads to the status page of the respective device (app.ampguard-zentinel.de). There you can see the test status and the next due date. Further details (e.g. test history, reports about the device) are only visible after entering a PIN, which we provide to our customers.

Access data and audit log

When a device page is opened and when actions are taken on the page (e.g. QR scan, PIN login, calendar export, defect report, printing a replacement plaque), we record the following in a tamper-proof audit log: device ID, type of action, time, IP address, browser identifier (user agent), a technical session identifier and, where applicable, details about your device (e.g. screen size, time zone). The entries are cryptographically chained to one another, so any later change would be detectable.

The purpose is to document the inspection (DGUV Regulation 3), to protect against manipulation and for IT security. The legal basis is our legitimate interest under Art. 6 (1)(f) GDPR. The entries are kept for 6 years and then deleted automatically.

PIN login and security

PINs are stored only as an irreversible hash. After a successful login, a strictly necessary session cookie (PHPSESSID) is set; it is deleted when you close the browser. For security reasons the login ends automatically after 5 minutes without any interaction. To protect against abuse, we limit the number of requests and PIN attempts per IP address; in doing so we store failed login attempts (IP address, device accessed, time; not the PIN entered) and requests to reset the PIN (email address, IP address, time) for 30 days. The legal basis is Art. 6 (1)(f) GDPR (security of our service) in conjunction with Section 25 (2) no. 2 TDDDG for the session cookie.

If you request a PIN reset, we send a new, temporary code by email to the address we have on file for your company. The display setting (light/dark) is stored locally by your browser on your device; it is not transmitted to us.

Device data and search engines

We process the details shown on the device page (device name, location, test status, test dates, customer) to perform the inspection contract (Art. 6 (1)(b) GDPR). The device pages are blocked for search engines and are not indexed. We send emails (e.g. notifications) via our hosting provider's servers (see above).

Data backup

To protect against data loss, a copy of the database and of uploaded photos is created daily. The copy is encrypted (AES-256), kept for 14 days on the server and for 30 days on a separate, secured computer of the controller in Germany, and then deleted automatically. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in data security and availability). Deleted data may therefore still be contained in backup copies until these periods have expired.

Defect reports for devices

On the device page, logged-in users can report a defect (selected from a catalogue, optionally with a free-text note). We process: the reported defects, the optional note, time, device and customer, the reporter's role, and technical details (IP address, browser identifier, screen size, time zone, language, platform, referring page). Please do not enter health data or other sensitive information in the note. You can attach up to 3 photos to a report. The photos are reduced in size on our server and stored without metadata (e.g. location of capture), and can be viewed only by logged-in users of the respective device and by us. In addition, customers with a company PIN can add device photos (up to 5) if we have not taken a photo of the device ourselves; these device photos are shown on the device page to anyone who opens the QR code. Please do not photograph people.

The report creates a ticket with a processing status and history. We receive an email notification; a shortened confirmation (without IP address and browser data) is sent to the email address on file for your company. Only if you actively choose to share via WhatsApp is the report text passed to the app you select.

The legal basis is the performance of the inspection contract and the handling of your report (Art. 6 (1)(b) GDPR); for the technical details, our legitimate interest in traceability and protection against abuse (Art. 6 (1)(f) GDPR); and the retention of business communication (Art. 6 (1)(c) GDPR in conjunction with Section 257 HGB and Section 147 AO).

Retention and deletion periods

Inspection reports for ladders and step stools (photos and location)

For ladders and step stools we create an online inspection report (DGUV Information 208-016). We process: the inspected object and its location, inspection results, inspection date, details about the inspector (email address, signature), where applicable a description of defects and measures taken, and up to 3 photos of the overall condition and up to 5 defect photos per inspection. Saved reports cannot be changed and carry a sequential report number.

The photos of the overall condition serve as evidence and are shown on the object's status page to anyone who scans the QR code. Defect photos, the inspection report and further details can only be viewed after logging in with the company or personal PIN, and internally by us. The photos are reduced in size on our server and stored without metadata (e.g. location of capture), are not kept in publicly accessible folders and are delivered only via protected requests. We take care not to depict any persons.

To record the address of the inspected object more quickly, our inspector can use the location function on a mobile device. This happens only when a button is tapped explicitly and after permission is granted in the browser. The determined coordinates are then sent via our server to the Nominatim service of the OpenStreetMap Foundation to determine the address. We do not store the coordinates; only the confirmed address is stored as the location of the inspected object. No movement profiles are created. The function is available only to our inspector in the internal area, not to website visitors.

The legal basis is the performance of the inspection contract (Art. 6(1)(b) GDPR) and the necessary documentation of the inspection (Art. 6(1)(c) and (f) GDPR). For online access to the inspection status and the overall-condition photos via QR code, our legitimate interest in providing simple proof of the inspection also applies (Art. 6(1)(f) GDPR).

Inspection reports and related photos are retained as evidence for as long as this is necessary for documenting the inspection, for warranty and evidence purposes or under statutory retention obligations (e.g. § 257 HGB, § 147 AO), and are deleted afterwards. Objects for which no inspection was ever saved are deleted together with their photos on request. The photos are also included in the encrypted backup (see section "Backup").