Privacy policy

Last updated: September 2026

This privacy policy explains which personal data we process when you visit our online shop at foma-systems.shop and use the features offered there, for which purposes and on which legal basis this is done, and which rights you have. This English version is provided for convenience; the German version is the authoritative text.

1. Controller

The controller within the meaning of Art. 4 No. 7 of the EU General Data Protection Regulation (GDPR) is:

FoMaSystems GmbH
Oskar-Sembach-Ring 11
91207 Lauf an der Pegnitz
Germany
Represented by the managing directors Dr.-Ing. Roman Foltyn and Rainer Maertin
Phone: +49 (0) 9123 1573980
E-mail: info@foma-systems.com

Further information about our company can be found in our legal notice.

2. Hosting of the online shop by Shopify

Our online shop is operated and hosted on the shop system of Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). All data generated when you visit the shop, create a customer account or place an order is processed on Shopify's servers.

Shopify acts as our processor; we have concluded a data processing agreement with Shopify pursuant to Art. 28 GDPR. The legal basis for the use of Shopify is Art. 6 (1) lit. b GDPR insofar as the processing serves the initiation or performance of a contract, and otherwise Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the secure, stable and economical operation of our online shop.

For transfers of data to Shopify companies outside the European Union, see section 11.

3. Informational visits to our website

If you merely visit our online shop without signing in, placing an order or otherwise providing information, we only process the data that your browser automatically transmits to the server. This comprises:

  • the IP address of the requesting device,
  • date and time of access,
  • the page or file accessed (URL) and the volume of data transferred,
  • the access status (HTTP status code),
  • the previously visited page (referrer URL),
  • browser, operating system, language and browser software version used.

Processing this data is technically necessary in order to display the online shop and to ensure its stability and security (e.g. detecting and tracing attacks). The legal basis is Art. 6 (1) lit. f GDPR; our legitimate interest follows from the purposes stated above. We do not combine this data with other data sources. The log data is deleted as soon as it is no longer required for the stated purposes.

4. Cookies and consent management

Our online shop uses cookies and comparable technologies (e.g. your browser's local storage). Cookies are small text files stored on your device.

Strictly necessary cookies. Certain cookies are required for the shop to function – for example to store the contents of your cart, your customer account sign-in, the selected language, region and currency as well as your cookie choices, and to process the checkout securely. Storing and reading this information is based on Section 25 (2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); the subsequent processing is based on Art. 6 (1) lit. b or lit. f GDPR.

Non-essential cookies. We only use cookies and technologies for reach measurement or analytics if you have consented to them via our cookie banner (Section 25 (1) TDDDG, Art. 6 (1) lit. a GDPR). You can revoke or adjust your consent at any time with effect for the future via the “Cookie preferences” link in the footer of our website. The individual services concerned are described in section 9.

You can also delete or block cookies via your browser settings. In that case, not all functions of the shop may be available.

5. Contacting us

5.1 E-mail and contact form

When you contact us by e-mail or via the contact form, the data you provide (your e-mail address and, where applicable, your name and telephone number) is stored by us in order to answer your questions. We delete the data arising in this context once its storage is no longer required, or we restrict its processing where statutory retention obligations apply.

The legal basis is Art. 6 (1) lit. b GDPR insofar as your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6 (1) lit. f GDPR; our legitimate interest lies in handling the enquiries addressed to us.

5.2 Chat (Shopify Inbox)

You can contact us in our online shop via a chat feature. For this we use the “Shopify Inbox” service of Shopify International Limited (address in section 2), which acts as our processor in this respect. We process the messages and details you enter in the chat (e.g. name and e-mail address if you provide them), the time of the conversation, the page from which you started the chat and – where available – your cart and previous orders, so that we can assign and answer your enquiry. A cookie is stored on your device to link an ongoing conversation; this is necessary for providing the chat (Section 25 (2) No. 2 TDDDG).

The legal basis is Art. 6 (1) lit. b GDPR insofar as the enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6 (1) lit. f GDPR; our legitimate interest lies in responding to your enquiries quickly and directly. We delete chat histories once the enquiry has been dealt with conclusively and no retention obligations apply.

6. Customer account

You can create a customer account in our online shop. In doing so, we process the data you provide: name, company, e-mail address, billing and delivery address, telephone number and VAT identification number where applicable, and your order history. Sign-in takes place via a one-time code sent to your e-mail address.

The processing serves to make repeat orders easier for you, to display your orders and, where applicable, to provide conditions applicable to your company. The legal basis is Art. 6 (1) lit. b GDPR. You can have your customer account deleted at any time by sending a message to the contact details in section 1. Data subject to statutory retention obligations will in that case be restricted from further processing and deleted after the retention periods expire.

7. Orders in our web shop

7.1 Contract processing

Our offering is directed exclusively at entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB). When you order from us, we process the data required for concluding and performing the contract: name of the person ordering or the contact person, company, billing and delivery address, e-mail address, telephone number, VAT identification number, items ordered, payment method and payment status, and the communication associated with the order (order receipt confirmation, order confirmation, invoice, dispatch notification). We transfer order data to our internal systems for order, production and invoicing purposes.

The legal basis is Art. 6 (1) lit. b GDPR. Without this information we cannot fulfil your order. Insofar as we must retain order and invoice data under commercial and tax law, the legal basis is Art. 6 (1) lit. c GDPR (see section 12).

We do not carry out credit checks involving credit agencies.

7.2 Verification of the VAT identification number

If you provide a VAT identification number, we verify its validity via the VAT Information Exchange System (VIES) of the European Commission or the German Federal Central Tax Office. In doing so, the VAT identification number and, where applicable, the company name and address are transmitted. The legal basis is Art. 6 (1) lit. c GDPR in conjunction with VAT-law verification obligations, and Art. 6 (1) lit. b GDPR.

7.3 Payment service providers

To process payments, we pass the data required for this purpose (name, address, e-mail address, invoice amount, currency, order number) to the payment service provider you select during checkout. The legal basis is Art. 6 (1) lit. b GDPR. We do not receive or store your full card or account details; these are processed exclusively by the respective payment service provider under its own responsibility.

  • Prepayment / bank transfer: When you pay by bank transfer, we process the data evident from the incoming payment (account holder, IBAN, payment reference) in order to assign the payment to your order.
  • Shopify Payments (credit/debit card, Apple Pay, Google Pay): The provider is Shopify International Limited (address in section 2). Technical payment processing is carried out by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe also processes payment data for fraud prevention. Further information: stripe.com/privacy.
  • PayPal: The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Further information: PayPal privacy statement.
  • Shop Pay: If you use the “Shop Pay” payment service, Shopify stores your payment and delivery data for future purchases at participating merchants. Shopify is independently responsible for this processing; the Shopify consumer privacy policy applies.

7.4 Shipping

To deliver your order, we pass on your name, company and delivery address as well as – where required for delivery, notification or customs clearance – your e-mail address and telephone number to the company commissioned with the transport. Depending on the shipment and destination country, we use the following providers:

  • DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany, or DHL Express Germany GmbH, Heinrich-Brüning-Straße 5, 53113 Bonn, Germany,
  • United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany,
  • FedEx Express Deutschland GmbH, Langer Kornweg 34 k, 65451 Kelsterbach, Germany (including TNT).

The transport providers process the data under their own responsibility for the purpose of delivery. The legal basis is Art. 6 (1) lit. b GDPR. For deliveries to countries outside the European Union, transferring the above data to the destination country is necessary for the performance of the contract (Art. 49 (1) lit. b GDPR).

8. Newsletter

On our website you can subscribe to our e-mail newsletter, in which we provide information about new products, accessories, software updates, events and offers of FoMaSystems GmbH. Only your e-mail address is required to subscribe.

Subscription uses the double opt-in procedure: after signing up you receive an e-mail in which you confirm the subscription via a link. Only then do we add your address to the mailing list. To document your consent, we store the time of sign-up and confirmation and the IP address used. The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR in conjunction with Section 7 (2) No. 2 of the German Act against Unfair Competition (UWG); logging the sign-up is based on Art. 6 (1) lit. f GDPR (proof of consent).

You can revoke your consent at any time with effect for the future by using the unsubscribe link in every newsletter or by sending a message to info@foma-systems.com. After unsubscribing, your e-mail address is deleted from the mailing list unless we are permitted to process it for other purposes (e.g. contract performance); to honour your revocation we may keep the address on a suppression list.

Dispatch is carried out via the “Shopify Email” service of Shopify International Limited (section 2), which is integrated into our shop system and acts as our processor in this respect. Our newsletters contain tracking pixels and individualised links that allow us to evaluate whether a newsletter was opened and which links were clicked. This evaluation serves to improve our content and is covered by your consent.

9. Web analytics and third-party services

9.1 Shopify statistics

As part of the shop system, Shopify provides us with analyses of the use of our online shop (e.g. number of visits, pages viewed, country of origin, cart and checkout completions). For this purpose, Shopify processes usage and device data on our behalf and uses cookies (including “_shopify_y” and “_shopify_s”). Insofar as these cookies are not strictly necessary, they are only set with your consent (Section 25 (1) TDDDG, Art. 6 (1) lit. a GDPR), which you can revoke at any time via the cookie preferences. The analyses are available to us in aggregated form only.

9.2 No further analytics or marketing services

We do not use analytics, tracking or advertising services of other providers (such as Google Analytics or Meta Pixel) in our online shop. Third-party content (e.g. videos or map services) is not embedded. Should we use such services in the future, we will amend this privacy policy accordingly and, where required, obtain your consent.

9.3 Links to other websites

Our online shop contains links to websites of other providers (e.g. to our company website or our social media profiles). These are mere links; data is only transferred to the respective provider once you click the link. The respective provider is responsible for the data processing on the linked sites.

10. Recipients of your data

Within our company, only those units that need your data to fulfil the purposes described receive access to it. Beyond that, we only pass on data to the recipients named in this privacy policy: Shopify as operator of the shop system and as service provider for the chat feature and newsletter dispatch (sections 2, 5.2 and 8), payment service providers (section 7.3) and shipping providers (section 7.4). In addition – where necessary in the individual case – our tax and legal advisers as well as authorities and courts where we are legally obliged (Art. 6 (1) lit. c GDPR). We do not sell your data or pass it on for third-party advertising purposes.

11. Transfers to third countries

Your data is processed outside the European Union or the European Economic Area only in the following cases:

  • Shopify (sections 2, 5.2, 6, 7, 8 and 9.1): Shopify International Limited may transfer data in the course of sub-processing to its parent company Shopify Inc., 151 O’Connor Street, Ottawa, ON K2P 2L8, Canada, and to further group companies and sub-processors, in particular in the USA. An adequacy decision of the European Commission exists for Canada (Art. 45 GDPR). Shopify safeguards transfers to third countries without an adequacy decision by means of the European Commission's Standard Contractual Clauses (Art. 46 (2) lit. c GDPR). Further information and a copy of the safeguards are available at shopify.com/legal/dpa or from us on request.
  • Payment service providers (section 7.3): Stripe and PayPal may transfer data to affiliated companies in the USA in the course of payment processing and fraud prevention. This takes place on the basis of the adequacy decision on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the basis of the European Commission's Standard Contractual Clauses or binding corporate rules.
  • Shipping to third countries (section 7.4): For delivery addresses outside the EU/EEA, we transfer the data required for delivery and customs clearance to the transport provider and the competent customs authorities in the destination country (Art. 49 (1) lit. b GDPR).

12. Retention periods

We store personal data only for as long as necessary for the respective purposes. In detail:

  • Order, invoice and payment data and business correspondence are retained in accordance with the retention obligations under German commercial and tax law (Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)) for six to ten years. After completion of the contract, this data is restricted from use for other purposes.
  • Customer account data is stored until the account is deleted.
  • Enquiries and chat histories are deleted once they have been dealt with conclusively and no retention obligations apply.
  • Newsletter data is stored until you revoke your consent; we keep proof of consent until the expiry of the limitation periods.
  • Log data (section 3) is deleted as soon as it is no longer required for the operation and security of the shop.

13. Data security

All data transmitted between your browser and our online shop is encrypted (TLS/HTTPS). We and the processors we engage implement technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, alteration and unauthorised access. These include, in particular, access and authorisation concepts, the obligation of our employees to confidentiality, and the regular review and adaptation of the measures to the state of the art.

14. Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

  • Right of access (Art. 15 GDPR) to the data we process about you,
  • Right to rectification (Art. 16 GDPR) of inaccurate data or completion of incomplete data,
  • Right to erasure (Art. 17 GDPR),
  • Right to restriction of processing (Art. 18 GDPR),
  • Right to data portability (Art. 20 GDPR), i.e. to receive the data you provided in a structured, commonly used and machine-readable format or to have it transmitted to another controller,
  • Right to object to processing (Art. 21 GDPR, see section 15),
  • Right to withdraw consent (Art. 7 (3) GDPR) with effect for the future; the lawfulness of processing carried out on the basis of the consent before its withdrawal remains unaffected.

The exercise of these rights is governed by the statutory requirements of the GDPR and may be subject to statutory restrictions in individual cases.

To exercise your rights, an informal message to the contact details in section 1 is sufficient. For your protection, we may request additional information to verify your identity where there are reasonable doubts.

15. Right to object under Art. 21 GDPR

Insofar as we process your data on the basis of Art. 6 (1) lit. f GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You may object to the processing of your data for direct marketing purposes at any time without stating reasons; we will then no longer process your data for this purpose.

16. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de

17. Obligation to provide data; automated decision-making

You are neither legally nor contractually obliged to provide your data. However, without the information designated as required in sections 6 and 7, we cannot set up a customer account or fulfil an order. Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

18. Changes to this privacy policy

We will amend this privacy policy when our online shop, the services used or the legal situation change. The version published here at the time applies.