Privacy Policy

1. Data Controller

KombiMED GmbH is responsible for processing your personal data in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

2. Types of Data Collected

We collect and process the following categories of personal data:

Automatically Collected Data

• IP address (anonymized)
• Browser type and version
• Operating system
• Referrer URL
• Date and time of access
• Pages visited and interactions

Voluntarily Provided Data

• Name and contact information
• Email address
• Phone number
• Company name and position
• Inquiry and order details

Business Data

• Billing and payment information
• Delivery addresses
• Order history
• Communication history

Consultation Data (Laboratory Equipment Consulter)

When you use the Laboratory Equipment Consulter, we process the following data:

• Your questionnaire responses (laboratory requirements, equipment preferences)
• Contact information you provide (name, email, organization — optional)
• Generated Investment Memorandum data

This data is processed solely for the purpose of generating your consultation results and Investment Memorandum. Legal basis: Art. 6(1)(b) GDPR (contract fulfillment) and Art. 6(1)(f) GDPR (legitimate interest in providing our service). Consultation data is stored on secure servers and can be accessed via your unique consultation access code. We do not share your consultation data with third parties or equipment vendors without your explicit consent.

3. How We Use Your Data

We process your data based on Art. 6(1) GDPR for various purposes. Detailed information about each processing purpose can be found in the sidebar under "Data Processing Purposes".

4. Cookies and Tracking

Our website uses cookies and similar technologies. Detailed information about individual cookie categories can be found in the sidebar under "Cookie Information".

You can prevent the installation of cookies by adjusting your browser settings; however, please note that in this case you may not be able to use all the functions of our website to their full extent.

5. Data Sharing

We only share your personal data when necessary for providing our services or when legally required. Detailed information about data recipients can be found in the sidebar under "Third-Party Services".

We ensure that all recipients provide adequate data protection guarantees, including data processing agreements in accordance with Art. 28 GDPR.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes:

• Contract data: Duration of business relationship + statutory retention period
• Invoice data: 10 years (§ 147 AO)
• Business correspondence: 6 years (§ 257 HGB)
• Website analytics: Up to 26 months
• Marketing data: Until withdrawal of consent
• Applicant data: 6 months after completion of the process

7. Your Rights

Under the GDPR, you have the following rights:

• Right of Access: Art. 15 GDPR — Information about your stored data
• Right to Rectification: Art. 16 GDPR — Correction of inaccurate data
• Right to Erasure: Art. 17 GDPR — Deletion under certain conditions
• Right to Restriction: Art. 18 GDPR — Restriction of processing
• Data Portability: Art. 20 GDPR — Transfer of your data
• Right to Object: Art. 21 GDPR — Objection to processing
• Withdrawal of Consent: Art. 7(3) GDPR — Withdrawal of given consent
• Right to Complain: Art. 77 GDPR — Complaint to a supervisory authority

To exercise your rights, please contact: datenschutz@kombi-med.com

8. Data Security

We implement comprehensive technical and organizational measures to protect your data:

• SSL/TLS encryption for all data transmissions
• Regular security audits and penetration testing
• Access restrictions based on the need-to-know principle
• Encrypted data storage
• Regular employee training on data protection
• Documented contingency plans for data breaches

9. International Data Transfers

Some of our service providers are located outside the EEA. We ensure that adequate safeguards are in place:

• EU Standard Contractual Clauses (Art. 46(2)(c) GDPR)
• EU Commission adequacy decisions (Art. 45 GDPR)
• Supplementary protective measures where necessary (e.g., encryption)

10. Children's Privacy

Our website and services are directed at businesses and professionals (B2B). We do not knowingly collect personal data from children under 16. If we become aware that data has been collected from a child without parental consent, it will be deleted immediately.

11. Changes to This Privacy Policy

We reserve the right to update this privacy policy:

• Regular review and updates
• Notification of material changes via email or website notice
• Continued use after update constitutes acceptance

12. Contact Information