Privacy Policy

laminx.eu | Promofolia GmbH | Last updated: 24 June 2026

1. Controller and contact details

The controller responsible for the processing of personal data on laminx.eu is:

For privacy questions or to exercise your rights, please contact us using the details above. This Privacy Policy applies to the laminx.eu storefront and the related customer account, contact, review, cart and checkout functions.

2. General principles and legal bases

We process personal data only where this is necessary for a specified purpose and a legal basis applies. Depending on the activity, processing is based on one or more of the following provisions of the General Data Protection Regulation (GDPR):

• Article 6(1)(a) GDPR - your consent, for example for non-essential cookies or optional marketing technologies;
• Article 6(1)(b) GDPR - performance of a contract with you or steps taken at your request before entering into a contract;
• Article 6(1)(c) GDPR - compliance with legal obligations, including tax, accounting and commercial-record obligations;
• Article 6(1)(f) GDPR - our legitimate interests, including secure operation of the store, prevention of misuse, customer service, establishment or defence of legal claims, and efficient business administration.

Where information is stored on or accessed from your device, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies. Non-essential technologies are used only with consent. Technologies strictly necessary to provide a service expressly requested by you may be used without consent.

3. Visiting the website and server logs

When you access laminx.eu, the systems providing the website may automatically process technical data such as your IP address, date and time of access, requested page or file, referrer URL, browser type and version, operating system, device information, language settings, response status and transferred data volume.

This processing is necessary to deliver the website, maintain stability and security, detect misuse and troubleshoot errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.

Technical logs are retained only for as long as required for operation, security and incident investigation. Where the retention period is under our control, logs are ordinarily deleted or anonymised within 30 days unless a security incident, legal obligation or legal claim requires longer retention.

4. Cookies and similar technologies

The store uses cookies, local storage and similar technologies. Some are technically necessary for functions such as the shopping cart, checkout, customer login, security, session management, tax or location settings, and remembering choices. Other technologies may be used for analytics or measurement only after you have given consent.

4.1 Technically necessary technologies

Necessary technologies are used under Section 25(2) TDDDG. To the extent personal data is processed, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR. These technologies cannot always be disabled without affecting core store functions.

4.2 Optional analytics and similar technologies

Optional analytics or measurement technologies are activated only after consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may refuse consent without losing access to the basic store. You may withdraw or change your choice at any time through the Cookie Settings control available on the website. Withdrawal does not affect processing that occurred before withdrawal.

4.3 Cookie information

The current cookie categories, providers, purposes and durations must be displayed in the website's cookie settings tool. Browser settings can also be used to delete or block cookies, although doing so may limit store functions.

5. Ecommerce platform and hosting - BigCommerce / Commerce.com

The storefront, customer account functions, cart, checkout, order management and related infrastructure are provided using BigCommerce, a Commerce.com service. Depending on the contractual setup and service, processing may involve Commerce.com US, Inc., Commerce Software Ireland Limited, Commerce Software UK Ltd., Commerce.com Pty Ltd. and approved subprocessors.

BigCommerce processes account, browser, contact, device, payment, security, support and transaction information on our behalf as necessary to provide the ecommerce platform. The legal bases for our processing are Article 6(1)(b), Article 6(1)(c) and Article 6(1)(f) GDPR. BigCommerce acts as a processor for merchant data under a data processing agreement.

BigCommerce and its subprocessors may process data outside the European Economic Area. According to the current BigCommerce/Commerce.com data processing terms, transfers may rely on participation in the EU-U.S. Data Privacy Framework where applicable and otherwise on the European Commission's Standard Contractual Clauses or another valid transfer mechanism under Chapter V GDPR.

6. Customer accounts

If you create a customer account, we process the information you provide, such as your name, email address, telephone number, billing and shipping addresses, login credentials, company details and order history. The account is used to make checkout easier, display orders and manage your relationship with us.

The legal basis is Article 6(1)(b) GDPR. Security and misuse-prevention processing is additionally based on Article 6(1)(f) GDPR. Account data is stored until you request deletion or the account is otherwise closed, subject to statutory retention obligations for order and accounting records.

7. Orders and contract performance

When you place an order, we process the data required to accept, fulfil and administer the contract. This can include your name, email address, telephone number, billing and shipping address, company and VAT information, ordered products, prices, payment status, delivery information, correspondence, returns, warranty matters and transaction identifiers.

The primary legal basis is Article 6(1)(b) GDPR. Processing required by tax, accounting, customs or commercial law is based on Article 6(1)(c) GDPR. Fraud prevention, claim management and internal administration may also be based on Article 6(1)(f) GDPR.

8. Payment processing

Payment data is processed by the payment service provider selected by you at checkout. The provider's identity and the available payment methods are displayed before you submit the order. Depending on the payment method, the provider may receive your name, billing details, email address, order amount, currency, transaction reference, device or security data and payment information.

The payment methods currently confirmed for the shop include Visa, Mastercard, Google Pay, Apple Pay, Amazon Pay, and PayPal. Card payments may be processed through the relevant card network and payment gateway. Additional or different payment methods may be shown at checkout if they are enabled in the shop.

Payment providers may act as our processors or as independent controllers under their own legal obligations, for example for payment authorisation, fraud prevention, anti-money-laundering checks or dispute handling. The legal basis for our transmission is Article 6(1)(b) GDPR and, where applicable, Article 6(1)(c) or Article 6(1)(f) GDPR. We generally do not receive or store complete card authentication data.

Please review the privacy information presented by the selected payment provider. If a payment provider processes data outside the EEA, it is responsible for explaining the applicable transfer safeguards in its privacy notice.

9. Delivery and logistics

To deliver an order, we transmit the data necessary for shipping to the carrier or logistics provider selected for the order. This normally includes the recipient's name, delivery address, contact details where needed for delivery, parcel information and order or tracking reference.

The legal basis is Article 6(1)(b) GDPR. If a telephone number or email address is used for delivery notifications, this is limited to what is necessary for delivery or is based on your request or consent.

10. Contact, customer service, warranty and returns

If you contact us by form, email, telephone or another channel, we process the information you provide, such as your name, contact details, company, order number, message, photographs and supporting documents. We use this data to answer your request, provide product advice, handle an order, return, withdrawal, complaint or warranty matter, and document the communication.

Where your request concerns a contract or pre-contractual question, the legal basis is Article 6(1)(b) GDPR. Otherwise, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in responding to inquiries and operating customer support. Legal-obligation processing is based on Article 6(1)(c) GDPR.

11. Product reviews

If you submit a product review, we process the rating, name or display name, review title, comments, email address, product reference and technical information associated with the submission. The review content and the name or display name may be published. The email address is used for moderation, verification or follow-up and is not intended to be published.

Publication is based on your consent under Article 6(1)(a) GDPR. Review moderation, prevention of misuse and defence against fraudulent or unlawful content may also be based on Article 6(1)(f) GDPR. You may withdraw consent for future publication by contacting us. We may retain limited records where necessary to document the withdrawal or defend legal claims.

12. Search, compare and recently viewed functions

Search terms and interactions with product, compare, recently viewed or cart functions may be processed to provide the requested feature, improve navigation and maintain session state. Depending on the function, this may involve technically necessary cookies or local storage. The legal bases are Article 6(1)(b) or Article 6(1)(f) GDPR and Section 25(2) TDDDG. Optional measurement of these interactions requires consent.

13. External links and social media

The website contains links to external services, including Facebook and Instagram. A simple link does not normally transmit data to the external provider until you click it. Once you leave laminx.eu, the external provider processes data under its own responsibility and privacy notice. We do not control that processing.

14. Limited technical website support from the United States

Promofolia GmbH remains solely responsible for operating the shop and for deciding the purposes and means of processing personal data. Lamin-x Protective Films, LLC, 478 Beasley St., Blairsville, Georgia 30512, USA, provides reactive technical support at Promofolia’s request, including website administration and theme, page, script and product-catalog maintenance.

The administrator permissions required for this work are technically broad and may allow authorised U.S.-based support personnel to access personal data stored in the BigCommerce shop. They do not routinely access customer, order or payment information and do not use such data for their own purposes. Personal data is accessed only where Promofolia requests assistance with a specific technical issue and access is necessary to resolve that issue. Any access is limited to the requested task, carried out under Promofolia’s instructions and confidentiality requirements, and ended when it is no longer required.

To the extent that this support makes personal data available in the United States, Promofolia uses appropriate contractual safeguards under Articles 28 and 44 to 46 GDPR, in particular the European Commission’s controller-to-processor Standard Contractual Clauses where applicable. The legal basis for using this technical support is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and professional administration of the online shop.

15. Other recipients

We disclose personal data only where necessary. Recipients may include:

• hosting, ecommerce, IT, security, email and technical-support providers acting under contract;
• payment service providers, banks and fraud-prevention services;
• shipping, postal, freight and logistics providers;
• tax advisers, accountants, auditors, legal advisers and debt-collection providers;
• manufacturers or product-support partners where required to resolve a technical, warranty or product-safety matter;
• public authorities, courts or law-enforcement bodies where disclosure is legally required;
• a purchaser, successor or adviser in connection with a genuine corporate transaction, subject to appropriate confidentiality and legal safeguards.

We do not sell personal data.

16. International transfers

Some service providers process data outside the EEA or permit access from outside the EEA, particularly BigCommerce/Commerce.com and, only where necessary for a requested technical-support task, the U.S.-based support described in Section 14. Where no adequacy decision applies, we use an appropriate safeguard under Articles 44 to 49 GDPR, normally the European Commission’s Standard Contractual Clauses, and assess whether supplementary technical or organisational measures are required. You may contact us for information about the relevant safeguards.

17. Retention periods

We retain personal data only for as long as necessary for the relevant purpose and applicable legal obligations. The following criteria generally apply:

• order, invoice and accounting records are retained for the statutory periods, generally six, eight or ten years depending on the record under German commercial and tax law;
• contract and claim-related records may be retained until the applicable limitation period expires, normally three years beginning at the end of the relevant calendar year, and longer where a claim, proceeding or special limitation period applies;
• customer account data is retained until account deletion or closure, except where order or legal records must be preserved;
• contact and support inquiries are normally retained until the matter is completed and then for up to three years where needed for follow-up or legal defence;
• reviews are retained while published and until deletion or withdrawal, subject to limited records required for moderation or legal defence;
• consent records are retained for as long as the consent is relied upon and for an appropriate period afterward to demonstrate compliance;
• cookie and technology durations are stated in the cookie settings tool.

When a retention period expires, data is deleted or anonymised unless continued storage is legally required.

18. Your rights

Subject to the conditions of the GDPR, you have the right to:

• obtain access to your personal data and information about its processing (Article 15 GDPR);
• have inaccurate data corrected and incomplete data completed (Article 16 GDPR);
• request deletion of your data (Article 17 GDPR);
• request restriction of processing (Article 18 GDPR);
• receive data you provided in a structured, commonly used and machine-readable format and transmit it to another controller where the requirements are met (Article 20 GDPR);
• object to processing based on legitimate interests (Article 21 GDPR);
• withdraw consent at any time with effect for the future (Article 7(3) GDPR);
• lodge a complaint with a data protection supervisory authority (Article 77 GDPR).

To exercise a right, contact info@laminx.eu. We may request information necessary to verify your identity, but we will not request more data than is reasonably required.

19. Special notice regarding your right to object

20. Right to complain

You may complain to any competent data protection supervisory authority. The authority generally responsible for private companies established in Baden-Wuerttemberg is:

21. Provision of data

Fields marked as required are necessary to provide the requested function, answer an inquiry or complete an order. Without the required information, we may be unable to create an account, process a payment, deliver an order or respond adequately. Optional information is voluntary.

22. Automated decision-making

Promofolia GmbH does not make decisions producing legal effects or similarly significant effects concerning you solely by automated means within the meaning of Article 22 GDPR. Payment or fraud-prevention providers may carry out automated checks under their own responsibility; details are provided in the relevant provider's privacy information.

23. Security

We and our service providers use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. No online transmission or storage system can be guaranteed to be completely secure.

24. Children

The store is not directed at children, and we do not knowingly request personal data from children for marketing purposes. Orders must be placed by a person legally capable of entering into the relevant contract or by an authorised representative.

25. Changes to this Privacy Policy

We may update this Privacy Policy when the website, providers, processing activities or legal requirements change. The current version is published on laminx.eu with the revision date shown at the top.

26. Language versions

The German and English versions are intended to have the same meaning. If wording differs, the German version will be used for interpretation, subject to mandatory rights and law applicable to the individual concerned.