Privacy Policy

1. Controller

The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

GKM Global GmbH
Gerhofstraße 1-3
c/o WeWork
20354 Hamburg
Germany
Phone: +49 176 64269066
Email: info@gkm-global.com

2. General information on data processing

We process personal data only to the extent necessary to provide a functioning website, to handle contact and procurement requests, to carry out pre-contractual measures, to fulfill contracts, or to safeguard our legitimate interests.

Personal data is any information relating to an identified or identifiable natural person. This includes, in particular, names, contact details, communication content, IP addresses, and the information contained in forms or uploaded documents.

We do not sell personal data.

3. Hosting and server log files

This website is hosted by the following provider:

IONOS SE
Elgendorfer Str. 57
56410 Montabaur, Germany

When you access our website, your browser transmits technically required information to the server on which our website is provided. This may include, in particular:

• IP address of the accessing device,
• date and time of access,
• page accessed or file requested,
• amount of data transferred,
• HTTP status code,
• previously visited page or referrer URL, if transmitted by the browser,
• browser type and version,
• operating system of the device,
• hostname of the accessing device or internet service provider.

This processing is carried out to technically provide the website, ensure its stability and security, detect technical errors, and defend against attacks or misuse.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, uninterrupted, and technically reliable operation of our website and the protection of our IT systems.

Server log data is generally stored for up to eight weeks and then deleted. Longer storage only takes place if there are concrete indications of a security incident, unlawful access, or other misuse. In that case, the affected data may be stored until the matter has been fully clarified and, where applicable, to assert, exercise, or defend legal claims.

The hosting provider processes the data on our instructions on the basis of a data processing agreement pursuant to Art. 28 GDPR, insofar as it acts as a processor.

4. Cookies and similar technologies

At present, our website does not use any cookies or similar technologies that require consent under Section 25(1) of the German Telecommunications and Digital Services Data Protection Act (TDDDG).

In particular, we do not use analytics, tracking, marketing, or profiling cookies. We do not use tracking pixels and do not create user-related usage profiles.

Where strictly necessary information is stored on your device, or already stored information is accessed, this is done solely to provide a digital service you have explicitly requested. Such operations are based on Section 25(2) No. 2 TDDDG. Where personal data is processed in this context, this is based on Art. 6(1)(f) GDPR, or, where the processing is necessary to carry out a measure you requested, on Art. 6(1)(b) GDPR.

As no technologies requiring consent are currently used, we do not display a consent banner. Should the use of cookies or similar technologies change, we will update this privacy policy before their use and obtain consent where required.

5. No external analytics, maps, or font services

This website does not use external analytics or tracking services such as Google Analytics.

Likewise, no external map services such as Google Maps and no fonts loaded from external servers, such as Google Fonts, are embedded. Simply visiting our website therefore does not, under the current technical setup, establish connections to such providers.

6. Contact by email or phone

If you contact us by email or phone, we process the data you provide, in particular your name, contact details, the content of your request, and any further information you provide.

This processing serves to handle and respond to your request and to communicate with you.

Where your contact relates to entering into or performing a contract with you, the legal basis is Art. 6(1)(b) GDPR.

Where you act as a representative of a company, or your request concerns general business communication, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling business inquiries, maintaining business relationships, and efficient corporate communication.

Where a statutory obligation to retain the communication exists, further storage is based on Art. 6(1)(c) GDPR.

Please note that ordinary emails are generally not end-to-end encrypted. Please send particularly confidential information only after prior arrangement or via a suitable secure transmission channel.

7. Contact form

Via the contact form, you can send us general questions, inquiries about our services, or a request for an initial call.

We process the following data:

• name,
• company,
• email address,
• phone number, if provided,
• selected topic,
• content of the message.

The form sends your details by email to our mailbox info@gkm-global.com. We use them only to handle your request and to communicate with you.

Where the request relates to a possible contract with you or to pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR.

Where you act on behalf of a company, or the request is not aimed at a contract with you as a natural person, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in responding to business inquiries and in initiating and maintaining business relationships.

We do not ask for your consent to use the form. After you submit the form, we send an automatic confirmation to the email address you provided. To prevent the form from being misused to send emails to other people, we store a keyed hash of your IP address and of your email address for up to 24 hours. Without the required information, we cannot process your request. Required fields are marked with *. All other fields are optional. You can also reach us by phone or email.

8. Procurement request and file upload

Via the procurement request form, you can send us details about a specific product, material, or procurement need.

We process the following data:

• name,
• company,
• email address,
• phone number, if provided,
• product or material sought,
• manufacturer and part number, if provided,
• description and specification,
• desired quantity,
• target price,
• desired delivery date,
• delivery location,
• country of delivery,
• intended use, if provided,
• type of need,
• additional information,
• content of any uploaded files.

The form sends your details and files by email to our mailbox info@gkm-global.com. We use them to review your request, to make inquiries with suppliers, to communicate with you, and to prepare a quote.

The legal basis is Art. 6(1)(b) GDPR, insofar as processing is necessary for pre-contractual measures at your request or to fulfill a contract.

Where you act on behalf of a company and do not yourself become a party to the contract, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in handling business procurement requests, initiating business relationships, and preparing quotes.

We do not ask for your consent to use the form. After you submit the form, we send an automatic confirmation to the email address you provided. To prevent the form from being misused to send emails to other people, we store a keyed hash of your IP address and of your email address for up to 24 hours. Required fields are marked with *. All other fields are optional.

File upload

You may voluntarily attach files to your request, for example specifications, drawings, parts lists, or product descriptions. Accepted formats are PDF, JPG, PNG, XLSX, DOCX, and CSV up to 10 MB.

Before uploading, please make sure that you are allowed to share the information the file contains. Remove or redact any personal data we do not need for the request.

Please do not upload health data, biometric data, or information on racial or ethnic origin, political opinions, religion, trade union membership, sexual orientation, or other special categories of personal data within the meaning of Art. 9 GDPR.

We use uploaded files only for the respective request and any order resulting from it. Access is limited to the people and service providers who need the files for their tasks.

9. Disclosure to suppliers, manufacturers, and other business partners

To prepare a quote, we make inquiries with manufacturers, distributors, and other suppliers. In doing so, we share only the technical details needed for a quote, such as the product, manufacturer and part number, specification, and quantity. We share uploaded files only where they are needed for this purpose.

Suppliers learn your company name and the names and contact details of your staff only if you have agreed to it or if this is necessary to carry out an order.

If an order is placed, suppliers, logistics providers, and inspection service providers receive the information they need to carry it out, for example the delivery address and a contact person for delivery.

The legal basis is Art. 6(1)(b) GDPR, insofar as the disclosure is necessary for pre-contractual measures at your request or to fulfill a contract. Where the data subject is not themselves a party to the contract, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in properly handling the request and obtaining suitable quotes.

Suppliers, manufacturers, and other business partners process the data they receive under their own data protection responsibility.

10. Other recipients and service providers

Within GKM Global GmbH, only those persons who need the data to handle the respective request or to perform their duties are given access to personal data.

In addition, the following categories of recipients may receive personal data:

• hosting and data center providers,
• email, communication, and IT service providers,
• technical administrators of the website,
• suppliers, manufacturers, distributors, and logistics providers,
• tax advisors, auditors, lawyers, and other professionally bound advisors subject to confidentiality,
• authorities, courts, and other public bodies, insofar as there is a statutory obligation of disclosure,
• other recipients, insofar as disclosure is necessary to fulfill a contract, handle your request, or safeguard our rights.

Service providers who process personal data exclusively on our instructions are engaged on the basis of a contract pursuant to Art. 28 GDPR.

Data is not shared solely for advertising purposes, and personal data is not sold.

11. Transfers to third countries

A third country is a state outside the European Union and the European Economic Area.

Technical website operation

In connection with the technical operation of this website and the processing of contact inquiries, no transfer of personal data to countries outside the European Union or the European Economic Area is envisaged.

International procurement requests

In connection with international procurement, trade, import, or export requests, it may in individual cases be necessary to share information with suppliers, manufacturers, or other business partners in countries outside the European Union or the European Economic Area.

Such a transfer only takes place insofar as it is necessary to handle the specific request and the requirements of Art. 44 et seq. GDPR are met.

Depending on the recipient country, we base such transfers in particular on:

• an adequacy decision of the European Commission pursuant to Art. 45 GDPR,
• appropriate safeguards, in particular standard contractual clauses pursuant to Art. 46 GDPR,
• or, in a non-recurring exceptional case, a statutory exception under Art. 49 GDPR.

Where possible, personal details are removed, reduced, or replaced with non-personal project information before a transfer to a third country.

Further information on a specific third-country transfer and the safeguards used can be requested at info@gkm-global.com.

12. Retention period and deletion

We store personal data only for as long as necessary for the respective processing purposes or as required by statutory retention obligations.

The following periods generally apply to the data processed on this website:

Server log files

Server log files are generally deleted after eight weeks at the latest. In the event of a specific security incident, the affected data may be stored until the incident has been fully clarified and resolved.

General contact inquiries

Inquiries that do not lead to a contract and are not subject to a statutory retention obligation are generally deleted no later than six months after final processing.

Procurement requests

Procurement requests that do not lead to an order or contract and are not subject to a statutory retention obligation are generally deleted no later than six months after the review is completed or after the last substantive communication.

Contractual and business records

If a request leads to a contract or a specific business project, we store the necessary data for the duration of the business relationship and thereafter within the scope of statutory retention periods.

Commercial and business letters are generally retained for six years. Accounting vouchers are generally retained for eight years. Certain books, records, annual financial statements, and comparable documents relevant under tax or commercial law may be subject to a ten-year retention period.

These periods generally begin at the end of the calendar year in which the relevant document was created or the communication was concluded.

Legal claims

Where data is necessary to assert, exercise, or defend legal claims, it may be stored until the applicable statute of limitations has expired. The regular civil-law limitation period is generally three years and generally begins at the end of the year in which the claim arose and the statutory conditions for the start of the period are met.

After the respective period expires, the data is deleted or anonymized, unless a further legal basis for its processing exists.

13. Data security and encryption

This website uses SSL/TLS encryption. An encrypted connection is indicated, in particular, by the website address beginning with "https://".

Encryption protects the content transmitted between your browser and our server from unauthorized reading during transmission.

We take appropriate technical and organizational security measures, taking into account the state of the art, implementation costs, the nature, scope, and purposes of processing, and the varying likelihood and severity of potential risks.

These include, in particular, measures for access control, restricting permissions, securing transmission channels, ensuring system availability, and regularly reviewing the security measures in place.

Despite appropriate security measures, data transmission over the internet cannot be fully protected against all risks. Absolute protection therefore cannot be guaranteed.

14. Provision of data

Providing personal data via our forms is generally neither legally nor contractually required.

However, we need the information in the required fields to allocate, process, and respond to your request. If it is missing, the form cannot be submitted, or we cannot process the request properly.

Information without * and file uploads may be left out.

Should a contract be concluded later, providing additional personal data may become necessary to carry out the contract or to comply with statutory obligations.

15. Automated decision-making and profiling

In connection with this website, the contact forms, and the procurement requests, we do not use solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Requests and procurement needs are reviewed and processed by people.

16. Rights of data subjects

Where the statutory requirements are met, you have, in particular, the following rights:

Right of access

You may request information under Art. 15 GDPR as to whether, and which, personal data we process about you.

Right to rectification

You may request the rectification of inaccurate and the completion of incomplete personal data under Art. 16 GDPR.

Right to erasure

You may request the erasure of your personal data under Art. 17 GDPR, insofar as no statutory retention obligations, overriding legitimate grounds, or other statutory exceptions apply.

Right to restriction of processing

Under the statutory requirements, you may request the restriction of the processing of your personal data under Art. 18 GDPR.

Right to data portability

Insofar as processing is based on your consent or a contract and is carried out using automated means, you may request under Art. 20 GDPR to receive the data you provided in a structured, commonly used, machine-readable format, or to have it transmitted to another controller where technically feasible.

Right to withdraw consent

Where processing is exceptionally based on your consent, you may withdraw that consent at any time with effect for the future.

The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

Right to object

Under the conditions described below, you have a right to object under Art. 21 GDPR.

To exercise your rights, you may contact us in particular by email at info@gkm-global.com.

To prevent unauthorized disclosure or alteration of personal data, we may request additional information to verify your identity where we have reasonable doubts about it.

17. Special notice regarding the right to object under Art. 21 GDPR

Where we process your personal data on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object at any time to such processing for reasons arising from your particular situation.

We will then no longer process the personal data concerned, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time, without giving reasons, to the processing of your personal data for such marketing. Following your objection, your personal data will no longer be processed for direct marketing purposes.

The data collected via the contact and procurement forms is not currently used for newsletters or automated advertising profiles.

18. Right to lodge a complaint with a supervisory authority

You have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR.

You may in particular contact the supervisory authority responsible for our registered office, the Hamburg Commissioner for Data Protection and Freedom of Information:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22
20459 Hamburg, Germany
Phone: +49 40 428 54-4040
Email: mailbox@datenschutz.hamburg.de

Your right to lodge a complaint exists independently of any other administrative or judicial remedies. You may generally also contact any other competent data protection supervisory authority.

19. Changes to this privacy policy

We regularly review this privacy policy and adjust it if our data processing activities, the technical systems used, or the statutory requirements change.

The version published on this website at any given time applies.

Last updated: November 2026