Privacy policy
1. Introduction
With the following information, we would like to give you as a “data subject” an overview of the collection, use and processing of your personal data by us and your rights under data protection laws. It is generally possible to use our website without entering personal data. However, if you wish to make use of special services of our company via our website, it may be necessary to process personal data. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain your consent.
The processing of personal data, such as your name, address or e-mail address, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in accordance with the data protection regulations applicable to Priority AG.
As the controller, we have implemented numerous technical and organizational measures to ensure the most complete protection possible for personal data processed via this website. Nevertheless, Internet-based data transmissions can generally have security gaps, meaning that absolute protection cannot be guaranteed. For this reason, you are free to transmit personal data to us by alternative means, for example by telephone or post.
2. Person responsible
The controller within the meaning of the GDPR is the:
Priority AG
Leopoldstrasse 2–8,
32051 Herford, Germany
Phone: +49 5221 85411-20
Email: Show email address
Represented by:
repmäksalF revilO
3. Contact for data protection enquiries
For questions about data protection or to exercise your rights, please contact:
Priority AG
Email: Show email address
4. Server logs
When this website is accessed, the web server processes technical connection data and creates access and error logs. Where access logging is enabled for the respective request, it records the IP address, date and time, the request including HTTP method, URL with any query parameters and protocol version, HTTP status code, response size, and the Referrer and User-Agent information supplied by the browser. The User-Agent may indicate the browser type, version and operating system. For HTTP-authenticated requests, a username may also be logged.
Error logs may contain technical error messages with timestamps and details of the affected connection or request, such as the IP address, server name and requested URL. IP addresses in these web server logs are not anonymised by default. The access log format does not include the message body submitted through the contact form using POST. Processing of form details and separate spam-protection data is described in sections 5 and 7.
Logging supports technical operation, troubleshooting, and the detection and prevention of abuse and attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the security and reliability of the website.
Web server logs are rotated automatically every day, even when no new entries have been recorded. Up to 13 daily archives are retained in addition to the current file. During normal operation, this corresponds to approximately 14 days of retention; older entries are removed when the corresponding archive is deleted. Archives with a file age exceeding 14 days are additionally removed during rotation. Cleanup operates on whole files rather than at an exact second for each entry. If rotation is interrupted, for example by a server outage, cleanup takes place at the next successful rotation run.
5. Contents of our website
Contact / Contact form
When you contact us through the contact form or by email, we process your contact details and the contents of your enquiry to handle your request and respond to you. The information collected through the form is shown in the form itself.
On successful submission, the contact form details are sent by email to our company-operated ticket system for processing. The ticket system runs on a server in Germany and sends an acknowledgement with a ticket ID. No additional archive of form messages is created on the web server. The separate processing of server logs and security data is described in sections 4 and 7.
The legal basis is our legitimate interest in handling your enquiry under Article 6(1)(f) GDPR. Where the enquiry is necessary to perform a contract or to take steps at your request before entering into a contract, processing is based on Article 6(1)(b) GDPR.
The retention period depends on what is necessary to handle the specific enquiry and substantively related follow-up correspondence. Continued retention requires an ongoing lawful need, such as a statutory retention obligation or the necessary establishment, exercise or defence of legal claims. The mere possibility of a future follow-up enquiry does not justify indefinite retention. Once no such reason remains, the data must be deleted. The criteria in section 9 also apply.
6. Cookies and tracking
This website does not set cookies or integrate external tracking services. No cookies are used to analyse browsing behaviour, recognise returning visitors or serve advertising.
Data processing in server logs and when using the contact form is described separately in the respective sections of this privacy policy.
7. Image CAPTCHA and spam protection
To protect our contact form against automated submissions, spam and abuse, we use a self-hosted image CAPTCHA, a validation field hidden from visitors and request limits. The CAPTCHA image is generated on our server and your answer is checked there. No external CAPTCHA provider is integrated and no cookies are set for this purpose.
For these technical checks, we process your IP address, the CAPTCHA answer you enter, a time-limited security token and the contents of the hidden validation field. In a separate security database, we store a pseudonymous identifier derived from the IP address using a secret key, the type and time of a request, and hashes of previously used security tokens with timestamps. These identifiers are not anonymous data. Your message and contact details are not stored in this security database.
A CAPTCHA security token is valid for ten minutes and is marked as used after a checked submission attempt, including when the CAPTCHA answer is incorrect. An automatic cleanup checks the security database every five minutes, independently of further form requests, and deletes request-limit entries and hashes of used security tokens once they are older than one hour. During normal operation, these records are therefore deleted after approximately one hour, no later than the next cleanup run. After a server interruption, a missed cleanup run is performed when the timer starts again.
This processing serves our legitimate interest in operating a secure and reliable contact form and is based on Article 6(1)(f) GDPR. Processing in general server logs and the handling of your message are separate and are described in sections 4 and 5. If you cannot use the image challenge, you can also contact us by telephone on +49 5221 85411-20.
8. Your rights as a data subject
If you would like to exercise your rights as defined below, please contact Priority AG using the contact for data protection enquiries given above.
8.1 Right to confirmation
As a data subject, you have the right to request confirmation from us as to whether personal data concerning you is being processed.
8.2 Right to information Art. 15 GDPR
As a data subject, you have the right to receive information from us at any time free of charge about the personal data stored about you and a copy of this data.
8.3 Right to rectification Art. 16 GDPR
You have the right to request the rectification of inaccurate personal data concerning you. You also have the right to request the completion of incomplete personal data, taking into account the purposes of the processing.
8.4 Erasure Art. 17 GDPR
You have the right to obtain from us the erasure of personal data concerning you without undue delay where one of the grounds provided for by law applies and insofar as the processing is not necessary.
8.5 Restriction of processing Art. 18 GDPR
You have the right to demand that we restrict processing if one of the legal requirements is met.
8.6 Data portability Art. 20 GDPR
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us to whom the personal data has been provided, provided that the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
Furthermore, when exercising your right to data portability pursuant to Art. 20 para. 1 GDPR, you have the right to obtain that the personal data be transferred directly from one controller to another controller, insofar as this is technically feasible and provided that this does not adversely affect the rights and freedoms of other persons.
8.7 Objection pursuant to Art. 21 GDPR
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Article 6(1)(e) (data processing in the public interest) or (f) (data processing on the basis of a balancing of interests) of the GDPR. This also applies to profiling based on these provisions within the meaning of Art. 4 No. 4 GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.
In individual cases, we process personal data for direct marketing purposes. You can object to the processing of your personal data for the purpose of such advertising at any time. This also applies to profiling insofar as it is associated with such direct advertising. If you object to processing for direct marketing purposes, we will no longer process the personal data for these purposes.
You also have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out by us for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 para. 1 GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you are free to exercise your right to object by automated means using technical specifications.
8.8 Revocation of consent under data protection law
You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.
8.9 Right to lodge a complaint with a supervisory authority
If you believe that the processing of your personal data infringes the GDPR, you may lodge a complaint with a data protection supervisory authority under Article 77 GDPR. In particular, you may contact an authority in the EU Member State where you habitually reside, work or where the suspected infringement occurred. Other administrative or judicial remedies remain available.
In North Rhine-Westphalia, you may contact the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW). You remain free to contact another competent supervisory authority.
9. Criteria for retention and deletion
Personal data may be retained only for as long as necessary for the respective lawful processing purpose. Relevant criteria include the status and content of an enquiry, a related ongoing contractual relationship and applicable statutory retention obligations. Where documents are necessary to establish, exercise or defend legal claims, the limitation periods applicable to the particular case and any ongoing proceedings must also be considered. This does not establish a blanket retention period for all enquiries.
Once the necessary processing purposes and any retention obligations cease, the data must be deleted. Data retained solely to comply with a retention obligation or to protect legal claims may be used only for that purpose. Separate retention and deletion rules for technical security data are described in section 7.
10. Up-to-dateness and amendment of the privacy policy
This privacy policy is currently valid and has the status: October 8, 2026.
It may become necessary to amend this data protection declaration due to the further development of our website and offers or due to changes in legal or official requirements. You can call up and print out the current data protection declaration at any time on the website under data protection.