Manufacturing to ISO 9001:2015anfrage@online-cnc.comDEEN
Legal

Privacy policy

This English version is a convenience translation. In case of doubt, the German version applies: Datenschutzerklärung.

Last updated: 9 November 2026

This privacy policy applies to the website online-cnc.com and the order portal bestellung.online-cnc.com (calculation, customer account and ordering).

1. Controller

CNCProjekt-Schreiber GmbH

Dresdner Straße 251, 01705 Freital

Managing Director: Sören Schreiber

E-mail: info@online-cnc.com

2. Overview and Legal Bases

We only process personal data insofar as this is necessary for operating our website and our order portal, handling enquiries and processing orders, or insofar as you have given your consent. We rely on the following legal bases:

  • Art. 6(1)(a) GDPR – consent, where we ask you for it,
  • Art. 6(1)(b) GDPR – contract and pre-contractual measures (e.g. enquiry, calculation, order),
  • Art. 6(1)(c) GDPR – legal obligations (e.g. retention under tax and commercial law),
  • Art. 6(1)(f) GDPR – legitimate interests (e.g. secure operation of the website, protection against misuse).

Information is only stored on, or accessed from, your terminal device (e.g. cookies) with your consent pursuant to § 25(1) TDDDG, unless this is strictly necessary for the service you have requested (§ 25(2) no. 2 TDDDG).

We use service providers who process data on our behalf. We have concluded data processing agreements with them pursuant to Art. 28 GDPR. We delete data as soon as the purpose no longer applies and no statutory retention obligations prevent deletion. Specific periods are given in the following sections.

3. Hosting and Server Log Files

We operate the website and the order portal ourselves on a rented server at Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen (data centre Falkenstein/Vogtland). The server is located in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. When the website or the order portal is accessed, the server automatically processes:

  • IP address,
  • date and time of access,
  • page and file accessed, amount of data transferred, status code,
  • previously visited page (referrer),
  • browser type, version and operating system.

The purpose is to deliver the website and to ensure stability and security. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after seven days unless they are needed to investigate a security incident.

To protect against misuse, the order portal briefly stores failed login attempts together with the IP address (lock-out after several failed attempts) and limits the number of calculations without a customer account per IP address. The legal basis is Art. 6(1)(f) GDPR (secure operation).

4. Encryption and Data Security

The website and the order portal use SSL/TLS encryption. You can recognise it by "https://" and the padlock symbol in your browser.

In the order portal, we do not store passwords in plain text, but only as an irreversible hash. Each customer sees only their own projects. Access by our employees is protected by two-step login. Backups are transmitted in encrypted form, stored on access-protected systems in Germany and overwritten after 30 days; data deleted in the order portal therefore also disappears from the backups after this period at the latest.

5. Cookies

Our website does not set any cookies and does not integrate any third-party analytics or advertising services. A cookie notice is therefore not necessary.

The order portal sets only one technically necessary session cookie. It associates your login – or, without a customer account, your ongoing calculation – with your browser and protects the forms against misuse (storage period up to 14 days). If you access the order portal via the personal link or QR code of a sales partner or via the QR code of a letter from us, the same session also remembers this code and – in the case of a letter – the company addressed, so that a subsequent registration is attributed correctly (sections 9 and 18). We do not set a separate, longer-lasting cookie for this purpose. There are no analytics or advertising cookies in the order portal; consent is not required for this (§ 25(2) no. 2 TDDDG). The same applies if you use the upload field on our website (section 7).

6. Enquiries by E-mail

Our website does not contain a contact form. If you send us an enquiry by e-mail (e.g. to anfrage@online-cnc.com), we process the details from your e-mail (e.g. name, company, e-mail address, telephone number, message) as well as attached files (e.g. CAD data, technical drawings). Our e-mail mailbox is operated by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, on servers in Germany; a data processing agreement is in place with the provider.

The purpose is to handle your enquiry and prepare a quotation. The legal basis is Art. 6(1)(b) GDPR, and for general enquiries Art. 6(1)(f) GDPR (our interest in responding).

We delete enquiries that do not result in an order, including the files, no later than three months after the last contact. If an order is placed, the periods set out in section 16 apply.

Note on drawings: Technical drawings often contain the names of designers in the title block. Please remove such details if they are not necessary for manufacturing.

7. Upload Field on the Website

The field "Teile hochladen – Preis sofort sehen" (upload parts – see the price instantly) on our website is an embedded part of our order portal, which runs on the same server. Files you place there are transferred directly to the order portal and processed there as described in section 8. No other providers are involved.

8. Order Portal: Calculation Without a Customer Account

In the order portal, you can calculate prices without creating a customer account. In doing so, we process the files you upload (CAD data, technical drawings, bills of materials), your selection (material, quantity, surface finishes) and the technical data referred to in section 3. Your name or contact details are not required for this.

The purpose is to calculate a non-binding price (Art. 6(1)(b) GDPR, pre-contractual measure). Files and calculations that you upload without a customer account are automatically deleted after seven days. If you create a customer account or log in during this time, we transfer the calculation to your account; section 9 then applies.

9. Order Portal: Customer Account, Enquiries and Orders

A customer account is required for orders, for quotations as a PDF and for manually prepared quotations. In this context, we process:

  • salutation, first and last name, company, VAT ID, country, telephone number, e-mail address and password (stored only as a hash), and, where a company has several users, their names, e-mail addresses and permissions,
  • billing and delivery addresses,
  • uploaded CAD data, drawings and bills of materials, including your own details contained therein (e.g. item numbers, cost centres, order numbers), calculations, quotations, orders and communication with us (messages in the portal),
  • the time of consent to our Terms and Conditions, of the last login and – if you came to us via the link of another customer or a sales partner – this attribution (for crediting referral points or settling commission). We also attribute a new customer account to a sales partner if that partner already looks after your company (section 18); to this end, we compare the domain of your e-mail address as well as the company name and address with our acquisition data. The sales partner sees your company and your orders insofar as they receive commission for them.

The purpose is to provide the customer account, carry out calculations, prepare quotations and process orders. The legal basis is Art. 6(1)(b) GDPR.

Deletion periods: We automatically delete projects without an order – drafts, enquiries and quotations that were not ordered – including all files, three months after the last change. The order portal shows you the deletion date for the project. Documents relating to orders placed remain stored in your account for repeat orders and complaints until you request deletion. As soon as an order has been shipped and paid for (or cancelled), you can request deletion of its data in your account directly from the order; we then delete the order's files (CAD data, drawings, bills of materials, calculations, messages and inspection documents), including at our manufacturing partner. We retain invoices and order records until the statutory retention periods have expired (section 16). Your master data (account, addresses) remain stored as long as your customer account exists. You can have your account deleted under "Mein Konto" (my account) → "Konto löschen" (delete account) or by e-mail to info@online-cnc.com once no order is in progress. We then delete the account with all users, the projects without an order and the files of your orders; for orders subject to retention requirements, only the company and billing address remain stored as invoice recipient.

10. Automated Evaluation of Drawings and Calculation

In the order portal, uploaded CAD data, technical drawings and bills of materials are evaluated automatically. The system recognises manufacturing information such as geometry, material, tolerances, threads and surfaces and calculates a non-binding price from it. The evaluation runs entirely on our own server (section 3); your documents are not transmitted to AI service providers or other third parties for this purpose.

Personal data involved are mainly your account data and, where applicable, names on the drawings. The legal basis is Art. 6(1)(b) GDPR.

  • The results are suggestions that you can check and change before ordering.
  • Every order is checked by an employee before the order confirmation. No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place.
  • Your documents are not used to train third-party AI models.

11. E-mails from the Order Portal

The order portal sends you e-mails that are necessary for your account and the contract (e.g. confirmation of your e-mail address, password reset, quotation, order acknowledgement and order confirmation, invoice, shipping notification). The legal basis is Art. 6(1)(b) GDPR. The e-mails are sent via ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf (servers in Germany), with whom a data processing agreement is in place.

In addition, we occasionally remind you by e-mail of open drafts and quotations in your account. The legal basis is Art. 6(1)(f) GDPR (our interest in completing enquiries that have been started). You can unsubscribe from these reminders at any time via the link in each reminder e-mail or in your customer account.

12. Fonts

We embed fonts on the website and in the order portal locally from our own servers. No connection is established to servers of Google or other third parties.

13. Cookie-Free Visitor Statistics (Umami)

To find out how our website is used, we count page views with the statistics software Umami, which we operate ourselves on our server in Germany (section 3). The following are recorded: the page accessed, the previous page (referrer), browser, operating system, device type, screen size, language, the approximate country, clicks on the buttons "Sofortpreis berechnen" (calculate instant price) and "Angebot per Mail" (quotation by e-mail), and campaign identifiers in the address (e.g. which of our advertisements you came from). Umami does not set cookies and does not store IP addresses; visits are only grouped using a value that changes daily and cannot be traced back, so we cannot recognise you. The data are not passed on to third parties.

The purpose is to improve our website and to measure the success of our advertising. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a needs-based design). You can object to the processing at any time, e.g. by activating "Do Not Track" in your browser or by writing to us.

14. Google Ads

We place advertisements with Google Ads. If you click on one of our advertisements, the address of our website contains a campaign identifier that is evaluated only by our own statistics (section 13). No Google program code is embedded on our website; no data about your visit are transmitted to Google and no remarketing is carried out. Google's privacy policy applies to the advertisement itself and to clicking on it: https://policies.google.com/privacy.

15. Disclosure to Manufacturing Partners and Shipping Service Providers

For manufacturing and – in the case of parts that we cannot calculate automatically – already for obtaining prices, we pass on technical documents to selected manufacturing partners. This is done via our own supplier platform, which runs on the same server as the order portal. Beforehand, we remove all details relating to you and your company from the documents (e.g. in the title block of the drawing and in the CAD data); the manufacturing partners do not learn for whom they are manufacturing and do not receive any personal data. All partners are obliged to maintain confidentiality.

Our manufacturing partners are predominantly located in the People's Republic of China, and for aluminium profiles in Germany. If a project without an order is deleted in accordance with section 9, we also delete the related files provided on the supplier platform.

For delivery, we pass on name, company, delivery address and, where applicable, telephone number to the commissioned shipping service provider (DHL or a freight forwarder) (Art. 6(1)(b) GDPR).

16. Contract Processing, Accounting and Retention

To process orders and for invoicing and accounting, we process your contract and payment data and, where necessary, pass them on to our tax adviser and our bank (Art. 6(1)(b) and (c) GDPR). We retain accounting vouchers and invoices for eight years, and commercial and business letters for six years (§ 147 AO, § 257 HGB). The data are then deleted.

17. Transfer to Third Countries

On our website and in the order portal, we do not use any services that transfer personal data to third countries. Manufacturing partners outside the EU only receive anonymised technical documents without personal data (section 15).

18. Approaching Companies (Acquisition by Letter and LinkedIn)

We approach companies that might purchase CNC parts by letter or via the professional network LinkedIn. For this purpose, we process the company name, address, website and industry of the company and – where known – the name, position and professional LinkedIn profile of a contact person, as well as notes on our contact (date, type, response, next contact). The data come from publicly accessible sources (company websites, industry directories such as "wer liefert was", LinkedIn) or from direct contact. We only use e-mail addresses and telephone numbers for advertising with your consent.

Each company approached is assigned to one of our sales partners (commercial agents), who looks after it; only they and we see these data. Our letters contain a personal QR code. If you scan it, we store the time and the number of accesses relating to this letter – without the IP address – and inform the responsible sales partner so that they can get in touch with you. If you then register, we attribute the customer account to this sales partner (section 9).

The purpose is to acquire business customers (direct marketing). The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. You can object to this processing at any time without giving reasons, e.g. by e-mail to info@online-cnc.com. We will then no longer approach you and will only keep a blocking note (company, name if applicable) to ensure that this remains the case. If no business relationship arises, we delete the acquisition data no later than 24 months after the last contact.

19. Your Rights

You have the right to:

  • access to your data stored by us (Art. 15 GDPR),
  • rectification of inaccurate data (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • withdrawal of consent given, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): If we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.

To exercise your rights, an e-mail to info@online-cnc.com is sufficient.

20. Right to Lodge a Complaint with a Supervisory Authority

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Sächsische Datenschutz- und Transparenzbeauftragte

Maternistraße 17, 01067 Dresden

E-mail: post@sdtb.sachsen.de

21. Obligation to Provide Data

Providing the data required for enquiries, the customer account and the contract is necessary for concluding the contract; without them, we cannot prepare quotations or carry out orders. All other details are voluntary.

We will amend this privacy policy if our data processing or the legal situation changes.