Cartonplast Logo

Privacy Policy

1. Data Protection

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with applicable data protection laws and this Privacy Policy.

Please note that data transmission over the Internet—for example, when communicating via email—may be subject to security vulnerabilities. It is not possible to completely protect data from access by third parties.


2. Data control authority

The data control authority within the meaning of the General Data Protection Regulation (GDPR) is:

Cartonplast Group GmbH
Marie-Curie-Straße 8
63128 Dietzenbach
Germany
Phone: +49 6074 8531-0
Email: info@cartonplast.com

 

3. Data Protection Officer

Our Data Protection Officer is:

Protektis GmbH
Frank Fengel
Benzstraße 2a
63741 Aschaffenburg
Tel: +49 6021 6262 150
frank.fengel@protektis.de

 

4. Provision of the Website

When you visit this website, technically necessary connection data is processed in order to transmit the requested content to your device and to ensure the functionality and security of the website. This includes, in particular, the IP address, the date and time of access, the content accessed, and information about the browser and operating system used.

Processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, stable, and error-free provision of the website.

The data is processed only for as long as is necessary for the provision and security of the website. Storage beyond this period occurs only if there is a specific reason or a legal obligation to do so.

 

5. Cookies and Similar Technologies

This website uses cookies and similar technologies. This may involve storing information on your device or retrieving information from your device.

 

To the extent that this is strictly necessary for the operation of the website and the provision of the functions you have expressly requested, the storage or access is based on Section 25(2)(2) of the TDDDG. Consent is not required for this.

For all cookies and similar technologies that are not strictly necessary—in particular those used for preferences, statistics, analysis, marketing, the personalization of content or ads, and the integration of external services—the storage of information on your device or access to information on your device is based solely on your consent in accordance with Section 25(1) of the TDDDG.

 

To the extent that personal data is processed in connection with strictly necessary technologies, such processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, stable, and user-friendly operation of this website. To the extent that processing is necessary for the implementation of pre-contractual measures or for the performance of a contract, it is based on Article 6(1)(b) of the GDPR.

 

To the extent that personal data is processed in connection with non-essential cookies or similar technologies, such processing is based on your consent pursuant to Article 6(1)(a) of the GDPR.

You may withdraw your consent at any time with future effect via the cookie settings or change your selection. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.

 

6. Contact via Email and Contact Form

If you contact us via email or through our contact form, we will process the data you provide to handle your inquiry and for any follow-up questions.

 

If your inquiry is aimed at initiating or performing a contract, the processing is based on Article 6(1)(b) of the GDPR. In other cases, processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the proper handling of inquiries directed to us. If you have expressly consented, processing is based on Article 6(1)(a) of the GDPR.

 

We delete the data as soon as it is no longer necessary for processing your inquiry and there are no legal retention obligations or other legitimate reasons for further storage. General inquiries are generally deleted no later than twelve months after processing is completed. If a contractual relationship arises from the inquiry or if the communication concerns documents relevant under tax or commercial law, the applicable statutory retention periods apply.

 

7. Google Tag Manager

This website uses Google Tag Manager, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to manage and deploy website tags. In particular, it allows services for audience measurement, analysis, and marketing purposes to be integrated and controlled.

Tags that are not strictly necessary—in particular, statistics, analytics, and marketing tags—are only activated after you have consented to the respective processing via the consent management feature. Without such consent, these optional tags will not be triggered.

 

To the extent that personal data is processed in connection with Google Tag Manager, this is done on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in the technically reliable and consent-based control of the services used on this website.

 

The processing of personal data by companies within the Google Group outside the European Union or the European Economic Area—in particular by Google LLC in the United States—cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework.

 

8. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is used only with your consent. The storage of information on your device or access to information on your device is based on Section 25(1) of the TDDDG; the subsequent processing of personal data is based on Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect via the cookie settings.

According to Google, Google Analytics does not log or store individual IP addresses for users from the European Union, Switzerland, and the United Kingdom. Processing of personal data by Google entities outside the European Union or the European Economic Area—in particular by Google LLC in the United States—cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework.

 

The retention period for event and user data collected via Google Analytics is determined by the settings configured in our Google Analytics property. Accordingly, event data is stored for 2 months and user data is retained for 14 months.

 

9. Adobe Fonts

This website uses Adobe Fonts to ensure consistent font display. The provider is Adobe Systems Software Ireland Limited or the Adobe Group.

When you visit the website, your browser may load fonts from Adobe servers. In doing so, technical access data—in particular your IP address—may be transmitted to Adobe. According to Adobe, Adobe Fonts does not use cookies when providing fonts for websites; Adobe receives the IP address for the purpose of delivering the font but, according to its own statements, does not store it. Processing by Adobe companies outside the European Union or the European Economic Area—in particular in the United States—cannot be ruled out. According to Adobe, it bases cross-border data transfers, among other things, on adequacy decisions and standard contractual clauses; Adobe Inc. is certified under the EU-U.S. Data Privacy Framework.

Our legitimate interest lies in ensuring a consistent and user-friendly presentation of our website. The legal basis is Article 6(1)(f) of the GDPR.

 

10. YouTube

This website embeds videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The videos are not loaded immediately when the page is accessed, but only after you give the necessary consent or actively play the video.

The videos are embedded in enhanced privacy mode via youtube-nocookie.com. According to Google, views of embedded videos in this mode are not used to personalize the YouTube browsing experience or to personalize advertising outside of this website.

To the extent that information is stored on or read from your device when the video is loaded or played, this is done on the basis of your consent pursuant to Section 25(1) of the TDDDG. The subsequent processing of personal data is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect.

The processing of personal data by Google companies outside the European Union or the European Economic Area—in particular in the United States—cannot be ruled out.
Our legitimate interest lies in ensuring a consistent and user-friendly presentation of our website. The legal basis is Article 6(1)(f) of the GDPR.

 

11. Newsletter

When you subscribe to our newsletter, we process your email address to send you regular information about the Cartonplast Group’s products, services, and news. Subscription is based solely on your explicit consent. The legal basis is Article 6(1)(a) of the GDPR; and for sending promotional emails, prior explicit consent is also required under Section 7(2)(2) of the German Unfair Competition Act (UWG).

You may revoke your consent at any time with future effect, in particular via the unsubscribe link included in every newsletter. The lawfulness of the processing carried out up until the revocation remains unaffected.

We use Campaign.Plus, a service provided by Campaign.Plus GmbH, Wollmarktstraße 115b, 33098 Paderborn, to send the newsletter. We have entered into a data processing agreement with Campaign.Plus, which obligates Campaign.Plus to protect the processed data and to process it in accordance with our instructions.

 

To the extent that the newsletter contains tracking functions—such as those used to measure opens or clicks—this is done only if the appropriate consent has been obtained. To the extent that information is stored on or retrieved from your device in this process, § 25(1) of the TDDDG serves as the legal basis; the subsequent processing of personal data is based on Article 6(1)(a) of the GDPR.
Our legitimate interest lies in ensuring a consistent and user-friendly presentation of our website. The legal basis is Article 6(1)(f) of the GDPR.

 

12. Security and Encryption

We take appropriate technical and organizational measures to protect your data against loss, destruction, unauthorized access, unauthorized modification, and unauthorized disclosure. However, complete protection against all risks cannot be guaranteed.

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognize an encrypted connection by “https://” and the padlock icon in your browser’s address bar.

 

13. Links to Other Websites

Our website may contain links to third-party websites. The respective operator is responsible for data processing on these external websites. Please review the privacy policies posted on those sites.

 

14. Your Rights

Subject to the statutory requirements, you have the following rights in particular:

  • Right of access pursuant to Art. 15 of the GDPR
  • Right to rectification pursuant to Art. 16 of the GDPR
  • Right to erasure pursuant to Art. 17 of the GDPR
  • Right to restriction of processing pursuant to Article 18 of the GDPR
  • Right to data portability pursuant to Article 20 of the GDPR
  • Right to object pursuant to Article 21 of the GDPR; further information is provided below
  • Right to withdraw consent with future effect

To exercise your rights, you may contact us using the contact information provided above.

Your right to object under Article 21 of the GDPR:

If we process your personal data on the basis of Article 6(1)(e) or (f) of the GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation. We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

 

If your personal data is processed for direct marketing purposes, you have the right to object to such processing at any time. This also applies to profiling, to the extent that it is related to such direct marketing. Once you have objected, your personal data will no longer be processed for direct marketing purposes.

To exercise your right to object, you may contact us using the contact information provided in Section 2.

 

15. Right to File a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedies, you have the right to file a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR.

In particular, you may contact a supervisory authority in your country of habitual residence, at your place of work, or in the location where the alleged infringement occurred.

The data protection supervisory authority responsible for us is:


Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden

 

16. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy if the legal situation, our website, or the nature of data processing changes. The version currently published on this website is the valid one.

 

August 2026