1. Controller and contact
The provider of SAND & MEHR is responsible for processing personal data on this website: Luka Sandvoss, Wilhelm-Wilkens-Ring 4, 27211 Bassum, Deutschland.
You can contact us at info@sandundmehr.com or by telephone on +49 170 2278298.
This notice covers the website, its enquiry and withdrawal functions, the optional customer account and related communication. Where required, you will receive further information before a project begins about any separate processing of project or participant data.
2. Website delivery and security
When you visit a page, technically necessary connection data is processed, including your IP address, date and time, requested address, response status, and device, browser and, where applicable, referral information sent by your browser. This is necessary to deliver the website, investigate errors and prevent attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is reliable and secure operation.
The hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland. The provider processes the data required for hosting as a technical service provider. Further information: Hetzner privacy notice .
Technical log data is retained only as long as necessary for operation, error analysis or investigation of specific security incidents. In the event of an incident, longer retention depends on the investigation required and, where applicable, the establishment or defence of claims.
Form submissions are checked to establish whether the request originated from this website. This protects these functions against unwanted requests from other sources.
3. Enquiries and personal advice
When you contact us, we process your name, email address and message to respond to your request and, where appropriate, prepare a quotation. Providing a telephone number is optional. Send only the documents we need for this purpose; passwords and secret keys must not be included in an enquiry.
An enquiry about your selection also includes the requested services, whether you are a private individual or a business, and the company name for business enquiries. The advice form additionally asks about your concern and a project address or description. These details and the selected services are sent to our enquiry backend for processing. A reference confirms receipt.
We need the fields marked as required to identify and answer your enquiry.
Where we prepare or perform your own contract, the legal basis is Article 6(1)(b) GDPR. If you act as a company's contact person or your message concerns another matter, Article 6(1)(f) GDPR applies. Our legitimate interest is handling correspondence addressed to us. An enquiry does not subscribe you to advertising or a newsletter.
4. Withdrawal notices
When you withdraw from a contract, we process your name, details of the contract concerned, your contact address and the contents of your notice. We document receipt and further processing to identify the withdrawal and confirm that we received it.
The electronic withdrawal form cannot currently accept notices. You can send an unambiguous statement by email or post to the contact above. Further information is provided in the Withdrawal information.
The legal bases are Article 6(1)(b) GDPR for contract administration and Article 6(1)(c) for compliance with legal obligations, particularly sections 355 et seq. of the German Civil Code (BGB). Where evidence is necessary to establish or defend claims, Article 6(1)(f) GDPR applies. A withdrawal notice is not used for advertising or usage statistics.
5. Email communication
In addition to the sender, recipient and content, email processing includes technical delivery data, such as the time and delivery status. We use this data for correspondence and resolving delivery problems. The legal basis depends on the purpose of the communication, as described under enquiries, withdrawal and customer accounts.
We use IONOS for our email inboxes and message delivery. Incoming messages to our SAND & MEHR addresses are also forwarded to info@lukasandvoss.com and brought together there for processing. This involves processing sender and recipient addresses, message contents and technical delivery data. Further information is provided in the IONOS privacy notice .
6. Selection, saved services and comparison list
The ‘sm-country’ cookie stores your chosen country in this browser for up to one year. It contains only ‘DE’ for Germany or ‘US’ for the USA. This determines the language and shop currency: German/EUR or English/USD. You can change the country at the top of the website or delete the cookie at any time. Germany is the default if no selection is made.
Your selection is saved under ‘houx-cart-v1’ in local browser storage, with session storage as a fallback. It contains service identifiers, a non-personal project assignment, a version number and an expiry time. The selection remains valid for up to seven days after its last update. Expired entries are discarded the next time they are read. Project addresses and form text are not part of this stored selection.
When you save a service, the saved list is stored under ‘ff-wishlist-v1’ in local browser storage, with session storage as a fallback. It contains service identifiers, a version number and an expiry time. If linked to an account, it also includes a technical identifier to keep entries belonging to different accounts separate. The selection remains valid for up to 90 days after its last change and is discarded on the next read after expiry. You can remove saved services at any time.
The comparison list contains up to three service identifiers. It is saved under ‘ff-compare-v1’ with a version number and expiry time in local browser storage or session storage. After seven days it is discarded the next time it is read. You can remove services from the comparison at any time.
After a successful enquiry, session storage holds the reference, timestamp, identifiers of the requested services and technical confirmation status under ‘houx-receipt’. The confirmation page displays this information for no more than 30 minutes. The entry remains in session storage until that browser session ends. You can remove website data through your browser at any time.
These storage operations are necessary for the selection, saved-service, comparison and confirmation functions you explicitly request and are based on section 25(2)(2) TDDDG. Where personal data is processed, Article 6(1)(b) GDPR applies, or the legitimate interest in a functional, reliable enquiry function under Article 6(1)(f) GDPR. If storage is blocked, the website attempts to retain the selection for the current visit without persistent storage.
6a. Optional customer account
For registration, we process your first name, surname, email address, password and selected language. Your email address also serves as your username. You sign in using your email address and password through our Keycloak authentication service. The website sends your credentials to the responsible server; it does not save your password in browser storage.
After sign-in, the website receives an account identifier, your email address, your name where applicable, and assigned access roles. These determine which account functions you may access.
The cookies „sam-shop-session-access“ and „sam-shop-session-refresh“ contain encrypted access tokens for sign-in and renewal. Browser scripts cannot read them. Their lifetime depends on the validity period set by the authentication service. They expire at the end of that period; successful renewal starts a new validity period. Signing out removes both cookies.
Sign-in and its renewal are separate from storage of the account. Signing out does not delete your account. You can request access to or deletion of your data using the contact address above. Required contract documents are retained under the rules described in section 11.
Storage operations necessary for the account access you request are based on section 25(2)(2) TDDDG. The legal basis for account processing is Article 6(1)(b) GDPR. Article 6(1)(f) GDPR applies to business contacts and protection against unauthorised access; our interest is the secure assignment of accounts and permissions.
7. Privacy settings
Your choice regarding optional statistics is stored by the locally hosted CookieConsent software in the ‘houx_consent’ cookie for up to 180 days. No external consent service is contacted. Storage implements your decision and avoids repeated requests. The legal bases are section 25(2)(2) TDDDG and Article 6(1)(c) or (f) GDPR where personal data is involved.
You can change your choice at any time using in the footer or this link. Withdrawal applies to the future; it does not retrospectively make processing carried out on the basis of consent unlawful. Refusing or withdrawing consent does not affect the selection, calculator, enquiry or withdrawal form.
8. Usage statistics
Matomo usage statistics are currently disabled. No Matomo scripts are loaded and no usage events are sent to Matomo. If statistics are enabled, this will happen only after your voluntary consent and with the relevant information provided.
Google Analytics 4 is currently disabled. No Google Analytics scripts are loaded and no usage events are sent to Google Analytics.
9. Search, service finder and potential calculator
Searching through the search field opens the services page with a search parameter in its address. The search term reaches the website server and may appear in browser history and technical server logs. Processing serves the search you request and is based on Article 6(1)(b) or (f) GDPR. Do not enter confidential or personal information there.
The service finder uses fixed rules and locally available product data. It does not require an email address or an external AI service. The potential calculator computes your scenarios directly in the browser. Its inputs and results are not sent to our server or an analytics service, and the calculator does not store them persistently.
There is no automated decision with legal or similarly significant effects within the meaning of Article 22 GDPR. A finder recommendation is not a decision to enter into a contract.
10. Recipients, external links and embedded content
Only people and service providers who need data for the purposes stated receive access. These include the person responsible for handling enquiries, the technical service providers named and, where legally required, tax or legal advisers, authorities and courts. Data is not sold.
Fonts, images and reference logos are loaded from our own website server. There are no automatic image requests to stock photo portals or Google Fonts. External providers are contacted only when you follow a link; their own privacy notices then apply. The website currently offers neither a payment checkout nor newsletter registration.
11. Retention period
We retain personal data for as long as necessary for the stated purpose. For enquiries, the period depends in particular on whether your concern is still being processed or a contractual relationship results. Once processing is complete, data no longer needed is removed unless a statutory obligation or necessary evidence requires retention.
For completed enquiries that do not lead to a contract, a regular deletion review is planned after 180 days. The review considers remaining retention obligations and specific unresolved claims; it does not mean automatic deletion regardless of individual circumstances.
Contract and withdrawal records may remain necessary until the applicable limitation periods expire. Records subject to tax and commercial retention requirements are kept for the applicable statutory period. Depending on the document type, this may include six, eight or ten years. During any required longer retention, use is restricted to those purposes. These periods do not apply indiscriminately to every unsuccessful enquiry.
Required deletion also covers email copies and technical delivery data. Backups follow their own limited backup cycle and must not lead to the renewed active use of data already deleted.
12. Your rights
Subject to statutory conditions, you have the right of access to your data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with future effect (Article 7(3)). Statutory exceptions, such as necessary retention obligations, may prevent immediate erasure.
Objection: Where we process data on the basis of legitimate interests under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation (Article 21 GDPR). No specific reason is required to object to direct marketing; you may object to that processing at any time.
Send your request to info@sandundmehr.com. We request additional identity information only where necessary to identify you securely. Exercising your rights is generally free of charge; statutory exceptions remain applicable.
13. Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority, particularly where you habitually reside, work or believe an infringement has occurred. For the registered office in Lower Saxony stated above, the State Commissioner for Data Protection of Lower Saxony is one contact point.
Contact and complaint options: State Commissioner for Data Protection of Lower Saxony . You do not have to contact us before approaching an authority.