The Rollwagen shop by HENSEL Fahrzeugbau – formerly rollwagen-shop.de, now at home here. What has changed →
Shop
Advice: +49 9306 9075-0
Sign in 0

Privacy Policy

With this Privacy Policy we inform you which personal data we process, for what purpose this is done and what rights you have in this respect.

1. Controller

The controller responsible for data processing on the websites listed below is:

HENSEL Fahrzeugbau GmbH & Co. KG
Daimlerstraße 2
97295 Waldbrunn

Represented by the Managing Director Ines Hensel
General partner: Hensel Verwaltungs GmbH
Amtsgericht Würzburg (Local Court of Würzburg), HRA 5247

Telephone: 09306 / 9075-0
E-mail: info@hensel-fahrzeugbau.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Data Protection Officer

We have appointed a Data Protection Officer for our company. You can reach her at:

Datenschutzbeauftragte (Data Protection Officer)
HENSEL Fahrzeugbau GmbH & Co. KG
Daimlerstraße 2
97295 Waldbrunn

Telephone: 09306 / 9075-0
E-mail: info@hensel-fahrzeugbau.de

2. Scope

This Privacy Policy applies to the following websites:

  • www.hensel-fahrzeugbau.de
  • www.rollwagen-shop.de
  • shop.hensel-fahrzeugbau.de

Not all of the processing operations described take place on all three websites. Customer accounts and orders concern the two shops only, the contact form concerns www.hensel-fahrzeugbau.de only. We point this out at the relevant places.

If you follow a link to an external website, the privacy policy of the respective provider applies there. Links to social networks are ordinary references on our pages; no plugins are embedded that would transfer data to these networks when our pages are called up.

3. Your rights

You have the following rights vis-à-vis us at any time:

  • Access to information about which data we process about you, where it comes from and to whom we disclose it (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data, provided that no statutory retention obligation stands in the way (Art. 17 GDPR)
  • Restriction of processing, for example while the accuracy of your data is being verified (Art. 18 GDPR)
  • Data portability: release of the data that we process by automated means on the basis of your consent or for the performance of a contract, in a commonly used, machine-readable format (Art. 20 GDPR)
  • Objection to processing operations that are based on a legitimate interest (Art. 21 GDPR)
  • Withdrawal of consent with effect for the future. The lawfulness of the processing carried out up to that point remains unaffected (Art. 7(3) GDPR)

An informal message to the contact details given above is sufficient to exercise these rights. You will incur no costs as a result.

Right to object in particular cases

If we process your data on the basis of a legitimate interest pursuant to Art. 6(1)(f) GDPR, you may object to this processing on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to assert, exercise or defend legal claims.

If your data is processed for the purpose of direct marketing, you may object to this at any time without giving reasons. Your data will then no longer be used for this purpose.

Right to lodge a complaint

If you are of the opinion that we are infringing applicable law when processing your data, you may lodge a complaint with a data protection supervisory authority. The authority responsible is in particular the one at your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 27, 91522 Ansbach.

4. Hosting

We operate our websites on rented servers. The providers process the data arising in this connection exclusively on our behalf and in accordance with our instructions. Data processing agreements pursuant to Art. 28 GDPR (data processing on behalf) are in place with both providers.

www.hensel-fahrzeugbau.de and shop.hensel-fahrzeugbau.de

These websites are hosted by DigitalOcean LLC. The servers are located in the Frankfurt am Main data centre (FRA1) and therefore within the European Union.

www.rollwagen-shop.de

This website is hosted by Timme Hosting GmbH & Co. KG, Marie-Curie-Straße 5, 21337 Lüneburg. The servers are located in Germany.

In order to provide its services, the provider may in turn engage sub-processors, for example the operator of the data centre. These are contractually bound to the same data protection requirements.

All data arising in connection with the operation of the websites is stored on the servers. This includes in particular IP addresses, contact enquiries, order and contract data as well as access data. The legal basis is Art. 6(1)(b) GDPR for the performance of contracts and Art. 6(1)(f) GDPR for our legitimate interest in the secure and reliable operation of our websites.

5. Server log files

Every time one of our pages is called up, data transmitted by your browser is recorded automatically. This is:

  • browser type and browser version
  • operating system used
  • previously visited page (referrer)
  • host name of the accessing computer
  • time of the request
  • IP address

This data is technically necessary in order to display the website to you and serves the stability and security of operations. It is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the error-free and secure operation of our websites.

6. Consent management with Klaro

We use the open source software Klaro to manage your consent. Klaro runs entirely on our own server. No data is transferred to third parties, in particular not to the manufacturer of the software.

When our pages are called up, nothing that requires your consent is loaded initially. The respective services are only activated once you agree.

We store your decision in a cookie named hensel_consent so that we do not have to ask you again on every visit. This cookie is valid for six months. After that we ask again.

In addition, we log every decision on our server. The following is stored:

  • time of the decision
  • the page on which the decision was made
  • your selection, i.e. which services you allowed or rejected
  • a truncated IP address in which the last segment is replaced by a zero (203.0.113.45 thus becomes 203.0.113.0)

Because the IP address is truncated, it cannot be attributed to you personally. This logging serves solely to demonstrate that consent was given, as required by Art. 7(1) GDPR. The legal basis for the use of Klaro is Art. 6(1)(c) GDPR, since we are legally obliged to obtain consent and to be able to demonstrate it.

You can change or completely withdraw your selection at any time. You can reach the dialogue via the Cookie settings link in the footer of every page.

7. Cookies and similar technologies

Cookies are small text files that are stored on your device. They do no harm there. We distinguish between two cases:

Technically necessary cookies are required for the website to function. These include the cookie described above that stores your data protection decision, as well as cookies that maintain your session in the shop and the contents of your shopping cart. We set these cookies on the basis of Art. 6(1)(f) GDPR; without them we could not provide the functions you request.

All other cookies are set exclusively with your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG (German Digital Services Data Protection Act). Which ones these are is explained in the following sections and in the consent dialogue.

You can configure your browser so that you are informed about the setting of cookies, so that cookies are permitted only in individual cases, or so that they are excluded in general. If cookies are deactivated, the functionality of our websites may be limited.

8. Contacting us

Contact form

On www.hensel-fahrzeugbau.de you can reach us via a form. Mandatory details are your name, e-mail address, subject and your message; company and telephone number are optional. We use these details in order to process your enquiry and to reply to you.

You can attach up to three images to your enquiry, for example photographs of damage. These files are stored exclusively on our server, in a directory with a random name that cannot be guessed. They are used solely to process your enquiry and are not published.

In addition, we create a log entry for every enquiry. This contains:

  • time of the enquiry
  • subject selected
  • name
  • company, if provided
  • telephone number, if provided
  • e-mail address
  • a truncated IP address (last segment replaced by a zero)

The entry ensures that no enquiry is lost and helps us to detect and prevent misuse of the form.

Enquiries by e-mail, telephone or fax

If you contact us by any of these means, we store and process your enquiry including the personal data arising from it in order to deal with your request.

Sending of our e-mails

For the reliable dispatch of the e-mails generated by the contact form – that is, the notification to us and your confirmation of receipt – we use the technical dispatch service provider Postmark, operated by ActiveCampaign LLC, USA. The contents of the respective e-mail, including your e-mail address and your name, are transmitted in the process. The service provider processes this data exclusively for the delivery of the message and on our behalf. The transfer to the USA is based on the standard contractual clauses of the EU Commission.

Legal bases and storage period

The processing takes place on the basis of Art. 6(1)(b) GDPR insofar as your enquiry is connected with the initiation or performance of a contract. In all other cases we rely on our legitimate interest in the effective handling of incoming enquiries pursuant to Art. 6(1)(f) GDPR and, insofar as it was requested, on your consent pursuant to Art. 6(1)(a) GDPR.

We store your enquiry until you ask us to erase it, withdraw your consent or the purpose of storage ceases to apply, for example because your request has been dealt with conclusively. Statutory retention periods remain unaffected.

9. Videos from Vimeo

On individual pages we embed videos that are stored at Vimeo. The provider is Vimeo Inc., 330 West 34th Street, New York, New York 10001, USA.

When a page containing a video is called up, no connection to Vimeo is established. The video is technically inactive until you have given your consent. Only after your consent is the video loaded; from that point on, Vimeo receives your IP address and the information about which of our pages you have called up, and can set its own cookies.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. It can be withdrawn at any time. Further information can be found at https://vimeo.com/privacy.

10. Maps from Apple

We use Apple MapKit to display maps. The provider is Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA.

Maps are never loaded automatically. You first see a placeholder with a corresponding notice. A connection to Apple is only established once both conditions are met: you have consented to the use and you have pressed the button to load the map.

The same applies to the static map sections on the pages of our deliveries. Merely calling up the page generates no requests to Apple whatsoever; these too are only loaded after an action on your part.

As soon as a map is loaded, Apple receives your IP address. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG; it can be withdrawn at any time. Further information can be found at https://www.apple.com/legal/privacy/de-ww/.

11. Reach measurement and advertising

Own visitor counting

To measure reach, we count the visits to our pages ourselves, on our own servers; no external analytics service is used for this. We want to know which of our pages are read and by which routes visitors find us, in order to align our offering accordingly.

The counting sets no cookies, stores nothing on your device and reads nothing from it. It records the page called up, the referring page (for campaign links also their tagging), the language of the page, the browser, operating system and device type, whether you are logged in to the shop, and certain actions such as adding to the cart or placing an order together with its amount. Your IP address is not stored. To be able to count visits, a check value (hash) is formed from the IP address and browser identifier together with a secret value, and it changes every day; this makes it impossible to recognise you beyond the day, across several websites or to link the data to your person. No profiles are created and the data is not passed on to third parties.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical evaluation of usage behaviour in order to improve our offering. Since the counting neither stores information on your device nor accesses information stored there, consent pursuant to § 25 TTDSG (German Telecommunications-Telemedia Data Protection Act) is not required; it therefore takes place – unlike the services named below – without prior consent.

The Google services described below, by contrast, are loaded only after your consent. Without your consent, no communication whatsoever with Google takes place.

Google Tag Manager

We use the Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager is an administration tool through which the services named below are embedded. It does not itself create user profiles and does not carry out any analysis of its own.

The Tag Manager is not loaded when our pages are called up, but only after you have given your consent.

Google Analytics

Google Analytics is embedded exclusively via the Google Tag Manager and is therefore likewise only loaded after your consent. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics helps us to understand how our websites are used, for example which pages are called up, how long visitors stay and which region they come from. For this purpose, cookies and comparable technologies are used that make it possible to recognise your browser.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. It can be withdrawn at any time. Further information: https://policies.google.com/privacy?hl=de.

Google Ads and conversion tracking

We place advertisements via Google Ads and measure their success with Google's conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

If you reach our website via one of our advertisements, Google can track whether an action defined by us subsequently took place, for example the submission of an enquiry. We only learn the total number of such events; we do not receive any information that would allow us to identify you personally.

This service, too, is only loaded after your consent. The legal basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG; consent can be withdrawn at any time. Further information: https://policies.google.com/technologies/partner-sites.

12. Online shops

This section applies to www.rollwagen-shop.de and shop.hensel-fahrzeugbau.de.

Registration and customer account

You can create a customer account in our shops. For this we require the details marked as mandatory fields in the registration form, in particular name, address and e-mail address as well as a password chosen by you. Without these details we cannot set up the account.

The customer account saves you from having to enter your data again with every order and gives you an overview of your previous orders. We use the details exclusively for this purpose and to process your orders.

We will inform you of material changes, for example to the scope of services or for technical reasons, via the e-mail address provided during registration.

The legal basis is Art. 6(1)(b) GDPR. We store the data for as long as your customer account exists. You can have it deleted at any time; the data is then erased, provided that no statutory retention obligation exists.

Orders and contract processing

In order to process an order we process your master data – name, address, contact details – as well as the contract data, that is, the goods ordered, prices, delivery and invoice address and the order date.

This processing is necessary in order to perform the purchase contract with you. The legal basis is Art. 6(1)(b) GDPR. Data is only disclosed to the extent that this is necessary for the delivery of the goods or the processing of payment, or where you have given your consent.

Invoice data and statutory retention

Invoices and the underlying accounting records are subject to statutory retention obligations. We retain these documents in accordance with § 147 of the German Fiscal Code (Abgabenordnung) and § 257 of the German Commercial Code (Handelsgesetzbuch), generally ten years for invoices and accounting records and six years for commercial letters. The period begins at the end of the calendar year in which the transaction was completed.

For the duration of these periods, the processing is justified under Art. 6(1)(c) GDPR. During this time we restrict the processing to fulfilling the retention obligation; the data is not used for other purposes. Once the periods have expired, it is erased.

Payment and shipping

In order to process payment and delivery we pass on the data required for this to the companies involved in each case, for example to the bank you have chosen or to the company commissioned with the shipment. Only what is necessary for the respective purpose is transmitted: for shipping in particular name and delivery address, for payment the details necessary for processing. The legal basis is Art. 6(1)(b) GDPR.

Should we use further payment or shipping service providers in the future, we will name them here before the processing begins.

13. Job applications

You can apply to us by e-mail or by post. We process your application data exclusively in order to decide on the establishment of an employment relationship.

Scope and purpose

We process the data you transmit to us: contact and communication data, your application documents and notes from job interviews. Within our company, only those persons involved in the application procedure are given access.

The legal basis is § 26(1) BDSG (German Federal Data Protection Act) in conjunction with Art. 88 GDPR for the initiation of an employment relationship, supplemented by Art. 6(1)(b) GDPR and, insofar as you have given one, your consent pursuant to Art. 6(1)(a) GDPR.

If your application is successful

If an employment relationship comes about, we store your data in our human resources systems in order to carry out this relationship. The legal basis is § 26(1) BDSG and Art. 6(1)(b) GDPR.

Retention period

If we cannot offer you a position, if you decline an offer or if you withdraw your application, we retain your documents for up to six months after the conclusion of the procedure. This serves the purpose of providing evidence, for example in the event of a legal dispute under the German General Act on Equal Treatment (Allgemeines Gleichbehandlungsgesetz). The legal basis is Art. 6(1)(f) GDPR. After that we erase the data and destroy documents in paper form.

If it is foreseeable that we will need the data beyond these six months, for example because of an impending or pending legal dispute, we will not erase it until that reason no longer applies.

Inclusion in our applicant pool

If we cannot offer you a position but you are in principle a good fit for us, we will ask you whether we may include your documents in our applicant pool in order to approach you about suitable positions.

Inclusion takes place exclusively with your express consent pursuant to Art. 6(1)(a) GDPR. It is voluntary and has no influence on the ongoing procedure. You can withdraw your consent at any time; we will then delete your data from the pool, provided that no statutory grounds for retention stand in the way. The data is erased no later than two years after consent was given.

14. Online presence on social media

We maintain public profiles on Facebook (facebook.com/HENSEL.Fahrzeugbau) and Instagram (instagram.com/hensel_fahrzeugbau) and can be reached via WhatsApp. The provider of all three services is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta").

On our websites these services are embedded solely as simple links. No plugins or similar technologies from Meta are loaded; when you visit our websites, therefore, no data is transferred to Meta. Only when you follow one of the links or write to us via WhatsApp does Meta process your data (e. g. usage data and cookies) under its own responsibility; Meta's privacy notices then apply, available at facebook.com/privacy/policy.

For the processing of statistical data of our Facebook and Instagram profiles ("Insights") we are joint controllers with Meta within the meaning of Art. 26 GDPR; the basis is the joint controllership agreement provided by Meta. The legal basis for our presence is our legitimate interest in public relations and communication pursuant to Art. 6(1)(f) GDPR. Data may be transferred to the USA in this context; Meta is certified under the EU-US Data Privacy Framework.

Rights of data subjects, such as the right of access, are most effectively asserted directly with Meta, since only Meta has full access to the data. You are of course also welcome to contact us.

15. Transfer to third countries

Some of the services named are offered by companies based in the USA. If they are used, your data may be transferred there and processed. The USA does not have a level of data protection that corresponds in every respect to that of the European Union; in particular, authorities may access data under certain conditions without you having effective legal remedies against this.

We base these transfers on the standard contractual clauses of the EU Commission. Insofar as the services in question are only loaded with your consent, the transfer additionally takes place on the basis of Art. 49(1)(a) GDPR.

The services concerned are Vimeo, Apple, Google and the dispatch service provider Postmark. All of these services – with the exception of the e-mail dispatch, which is necessary in order to answer your enquiry – only become active after your consent.

16. Encryption

Our websites use encryption to the TLS standard throughout. You can recognise this by the address bar of your browser beginning with https:// and by the padlock symbol. Data that you transmit to us can therefore not readily be read by third parties.

17. Objection to advertising e-mails

We hereby object to the use of contact details published in the legal notice for the purpose of sending advertising and information material that has not been expressly requested. We reserve the right to take legal action in the event of unsolicited advertising being sent.

18. Changes to this Privacy Policy

We adapt this Privacy Policy when the technology we use or the legal requirements change. The version published on our websites applies in each case.

Last updated: August 2026