Skip to content
Legal

Privacy Policy

Please note: This English version is a translation provided for convenience. Only the German version is legally binding.

In this privacy policy we inform you in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR) which personal data we process when you visit this website, for what purpose, on which legal basis and for how long. Personal data means any information relating to an identified or identifiable person, for example a name, an e-mail address or an IP address.

1. Controller

ZECK GmbH
Columba-Schonath-Str. 6
96110 Scheßlitz
Germany

Phone: +49 9542 9494-0
E-mail: datenschutz@zeck-gmbh.com

Represented by the managing director Michael Zeck. Further details are given in the imprint.

2. Data protection officer

We have appointed an external data protection officer. You can reach them at:

ITs Hein GmbH
Kulmbacher Straße 27b
95460 Bad Berneck
Germany
Phone: +49 9273 5013910
E-mail: info@its-datenschutz.de

3. Summary

  • This website runs on a server of Hetzner Online GmbH in Germany. We manage its content with the content management system Storyblok.

  • Without your consent we use no cookies and no analytics or advertising tools. We only show a cookie banner if we use Google Analytics.

  • Google Analytics is loaded only if you consent to the category “Analytics” in the cookie settings.

  • YouTube videos only load when you click “Play video”.

  • We deliver fonts ourselves; no connection to Google Fonts is made when you open a page.

  • Our online forms for contact requests, transport booking requests and job applications send your details in encrypted form directly to our own server; a security check without cookies protects them against misuse (sections 13 to 16). You can also reach us by e-mail, phone, fax or post.

4. Legal bases

We only process personal data if one of the following legal bases applies. We name the relevant one for each processing operation.

  • Consent (Art. 6(1)(a) GDPR): you have given us your consent. Where information is stored in or read from your device, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies. You can withdraw your consent at any time with effect for the future.

  • Contract and pre-contractual measures (Art. 6(1)(b) GDPR): the processing is necessary for a contract with you or for steps taken at your request before entering into a contract, for example a quotation or a job application.

  • Legal obligation (Art. 6(1)(c) GDPR): a law obliges us to process the data, for example to retain business records.

  • Legitimate interests (Art. 6(1)(f) GDPR): the processing is necessary for our legitimate interests and your interests do not override them. We state our legitimate interests in each case.

No consent is required for storing information in your device that is strictly necessary for the service you have requested (Section 25(2) no. 2 TDDDG).

5. Hosting and provision of the website

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. Hetzner processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

When you open a page, your browser necessarily transmits, among other things, your IP address, the requested address, the date and time, the address of the previously visited page (referrer, if your browser sends it) and information about your browser and operating system. We use these data to deliver the pages to you.

Server logs: Our web server keeps technical logs. They contain the date and time, your IP address, the requested address, the request method and the browser identification (user agent). We use these logs exclusively to fix errors and to detect and defend against attacks. We do not analyse them to create user profiles and do not combine them with other data. We keep them only as long as necessary for these purposes and delete them afterwards.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the reliable, secure and error-free provision of the website.

6. SSL/TLS encryption

For security reasons this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in the address bar of your browser and by the padlock symbol. When encryption is active, the data you transmit to us cannot be read by third parties.

7. Content, images and documents (Storyblok)

We manage the texts, images, videos and documents of this website with the content management system Storyblok of Storyblok GmbH, Peter-Behrens-Platz 2, 4020 Linz, Austria. Storyblok stores the content in data centres in the European Union and uses Amazon Web Services as a sub-processor for this. Storyblok processes data on our behalf under a data processing agreement (Art. 28 GDPR).

Our server retrieves page texts and images from Storyblok and delivers them to you itself. No data about you are transmitted to Storyblok in the process.

Some files, however, are loaded by your browser directly from Storyblok's media server (a.storyblok.com): PDF documents such as our general terms and conditions, the preview images of the video clips on the careers page, and these video clips once you play one of them. Storyblok then receives your IP address, the requested file, the date and time and information about your browser. The files are delivered via the content delivery network Amazon CloudFront, so requests are usually answered by a server close to you. Where data are transferred to the USA in the process, Amazon Web Services is certified under the EU-US Data Privacy Framework through Amazon.com, Inc. (see section 18).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the reliable and fast provision of our content and documents.

Fonts: The fonts used on this website are loaded from our own server. No connection to servers of Google (Google Fonts) or other font providers is made when you open a page.

8. Cookies, browser storage and consent management

Cookies and similar techniques such as your browser's local storage (localStorage, sessionStorage) store information in your device or read it from there.

Without your consent this website sets no cookies. In your browser we only store what is strictly necessary for the use you have requested (Section 25(2) no. 2 TDDDG):

  • cookie-consent (localStorage): a cookie banner only appears if we use Google Analytics. We store your choice in it (“necessary” and “analytics”: yes or no) so that the banner does not reappear on every page and your decision is respected. The entry remains stored until you delete it in your browser. Your choice is not transmitted to us.

  • zk-locale-switch-focus (sessionStorage): after a language switch, remembers the chosen language for no more than ten seconds so that keyboard navigation continues in the same place. The entry is deleted afterwards or when you close the tab.

Our online forms store nothing in your browser.

The processing of your choice is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (demonstrating consent) and on Art. 6(1)(f) GDPR (our legitimate interest in respecting your decision).

Changing or withdrawing consent: As long as we use Google Analytics, you will find the button “Cookie Settings” in the footer of every page. With it you can change your choice and withdraw a consent you have given at any time. The withdrawal applies to the future; the lawfulness of processing until the withdrawal remains unaffected. You can also delete the stored entries in your browser settings at any time.

9. Google Analytics (only with consent)

If you consent to the category “Analytics” in the cookie settings, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Without your consent Google Analytics is not loaded. On the pages where you apply for a job, Google Analytics is always switched off.

Purpose: We want to understand how our website is used, for example which pages are visited often and how visitors find us, in order to improve our website.

Data processed: Google Analytics stores the cookies “_ga” and “_ga_<ID>” in your browser (storage period up to two years) and records usage data such as pages visited, time spent, referring page, device type, browser, screen resolution and approximate location. According to Google, Google Analytics 4 does not store IP addresses; the IP address is only used to derive the approximate location and is then discarded. We do not use Google signals or advertising features.

Storage period: Usage data are automatically deleted in Google Analytics after no more than 14 months.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time via “Cookie Settings”; no further data are then sent to Google and the Google Analytics cookies in your browser are deleted.

Recipients and third country: Google processes the data as our processor. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (register entry); in addition, the standard contractual clauses of the European Commission apply. Further information: Google privacy policy.

10. YouTube videos

Some pages, for example our Academy, contain videos from the YouTube platform. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The videos are embedded with a two-click solution: when you open the page we only show a preview image from our own server, and there is no connection to YouTube. Only when you click “Play video” does your browser load the video player in privacy-enhanced mode from the address youtube-nocookie.com. Google then receives, among other things, your IP address, the address of the page and information about your browser; YouTube may also store cookies or similar techniques in your browser, for example for playback, statistics and fraud prevention. If you are logged in to a Google account, Google may associate the request with your account.

The legal basis is your consent, which you give by clicking “Play video” (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It applies only to the video concerned. You can withdraw it for the future by closing the player and not starting any further videos; cookies stored by YouTube can be deleted in your browser. Google is responsible for the data processing by YouTube. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. Further information: Google privacy policy.

11. Links to social networks and other websites

At the bottom of every page we link to our profiles on Facebook, Instagram, LinkedIn and YouTube. We also refer to other websites, for example to map services for our locations or to partner companies. These are simple links: no data are transmitted to these providers when you open our pages. Only when you click a link do you leave our website; the respective provider is responsible for the processing there.

12. Contact by e-mail, phone, fax or post

When you contact us in these ways, we process your details (for example name, contact details, company and the content of your message) to handle your request and answer follow-up questions.

The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract or concerns pre-contractual measures, for example a request for a quotation. In all other cases the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is answering the requests addressed to us.

We delete your data once your request has been dealt with conclusively and no statutory retention obligations apply. If the request results in a business transaction, we retain the correspondence in accordance with commercial and tax law (Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO); up to ten years).

13. Online forms: transmission, security check and logs

We offer online forms for contact requests, transport booking requests and job applications. This section applies to all three; what applies to each form is set out in sections 14 to 16.

Direct transmission to our server: Your browser sends your details in encrypted form (TLS) directly to our intake point api.zeck-gmbh.company. The server of this website does not receive your form entries. We operate the intake point and the database in which we store your request ourselves on servers of Hetzner Online GmbH in Germany. Hetzner processes the data on our behalf (Art. 28 GDPR).

Security check: To protect against automated requests, your browser solves a small computing task when you submit a form. The task comes from our own intake point; no third-party provider is involved, no cookies are set and the form stores nothing in your browser. We delete the related technical check values after two days at the latest.

Protection against misuse: To prevent misuse, we limit the number of requests. For this we derive an encrypted value from your IP address that changes regularly; we do not store the IP address itself in our database for this purpose. We temporarily block addresses from which attacks originate. These protective measures run on our own servers; we do not pass on any data about your requests to third parties.

Logs: To protect against attacks, our access server logs requests with the IP address and technical details of the request, but without form content. We delete the full IP address earlier and all log data after no more than 30 days.

The legal basis for the security check, the protection against misuse and the logs is Art. 6(1)(f) GDPR. Our legitimate interest is the secure operation of the forms and protection against spam and attacks.

Mandatory details: Mandatory fields are marked in the form. Without them we cannot handle the request. Instead of the form you can always reach us by e-mail or phone.

14. Contact form

You can send us a request via the contact form on the “Contact” page. Section 13 applies to the transmission.

Data processed: your concern (topic), name, e-mail address and message, and optionally company, phone number and field of application; also the language of the page, the version of this privacy notice and the time of receipt. We do not store your IP address or browser identification with the request.

Purpose and legal basis: We handle and answer your request. The legal basis is Art. 6(1)(b) GDPR if your request concerns a contract or pre-contractual measures, for example a quotation, a rental or a training course. In all other cases the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is answering the requests addressed to us.

Delivery and recipients: Depending on the topic you choose, we forward your request by e-mail to the responsible team (sales, rental park, Academy or our head office). We create requests about service and spare parts as a case (ticket) in our service system, where our service team handles them. Our reply goes to the e-mail address you entered. We currently do not send an automatic e-mail acknowledgement. E-mails are sent via Microsoft 365 (section 18).

AI functions in the service system: If a member of staff uses AI functions while handling the ticket, for example for reply suggestions, the text of your request is transmitted to an AI service provider based in the EU that acts as our processor. Decisions are always made by a person.

Storage period: In our database we anonymise your request together with the related notification e-mails automatically, as a rule six months after receipt and no later than twelve months; requests recognised as spam after 30 days. We delete e-mails in the team mailbox and service tickets as soon as they are no longer needed for handling your concern and for statutory retention obligations, and on request in individual cases. If the request results in a business transaction, we retain the correspondence in accordance with commercial and tax law (Section 257 HGB, Section 147 AO; up to ten years).

15. Transport booking request

Via the form on the “Transport” page, carriers, customers and suppliers can request an appointment for collecting or delivering machines at our site. Section 13 applies to the transmission.

Connection as soon as the page is opened: If the form is switched on, your browser usually loads the free appointments from our intake point (section 13) as soon as you open the page, before you enter anything. The technically necessary connection data, in particular your IP address, are transmitted and processed as described in section 13; no form details are transmitted in the process. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing current appointments.

Data processed: type of transport (collection or delivery), preferred day and time window; company or name, address and country; contact person, e-mail address and phone number; for collections, if requested, a different recipient with name, contact person, e-mail address, phone number and address; optionally carrier, vehicle registration, reference number and notes; the machines with description and optionally serial number, reference and identification; also the language of the page.

Purpose and legal basis: We plan and carry out the transport. The legal basis is Art. 6(1)(b) GDPR insofar as you yourself are our contractual partner; otherwise Art. 6(1)(f) GDPR, our legitimate interest in orderly logistics. We receive details of contact persons and of a different recipient from the person filling in the form, not from the data subjects themselves; please inform these persons about this section.

Recipients and e-mails: We store the request in our logistics system; our logistics team handles it. To the e-mail address entered we send an acknowledgement of receipt with tracking code, type, day and time window, without your free texts, and later messages on the handling, for example changes or the confirmation of completion. The confirmation of completion may contain the name of the person who signed for the handover and a photo of the load. E-mails are sent via Microsoft 365 (section 18). An appointment only becomes binding when our logistics team confirms it. In individual cases our logistics team checks a request before we send you an e-mail.

Storage period: We anonymise your personal details of the booking six months after the transport has been completed or cancelled. We delete a request that we do not accept after such a check no later than after 14 days. We delete check values against duplicate requests, derived from your details, after seven days, and the related e-mails in our sending system after six months.

16. Job applications

You can apply online only: via the form on our vacancy pages, also speculatively, or via our careers portal. Our server loads the vacancies shown on this website from our own system; no data about you are processed in the process.

Data processed and purpose: We process the data you send us with your application as well as notes from interviews in order to decide on establishing an employment relationship. In the online form these are: salutation (optional), first and last name, e-mail address and phone number; optionally cover letter, earliest start date, salary expectations, answers to questions about the vacancy and how you heard about us; your documents such as CV, cover letter and references. We also store the vacancy, the language, the time of your confirmation that you have taken note of this privacy information and the version of the information you saw. This confirmation is not consent; it only shows that you have received the information.

Online application: Your browser sends your details and documents directly to our intake point (section 13). Google Analytics is always switched off on the application pages. After receipt we send you an acknowledgement by e-mail that does not repeat your details.

The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) within the framework of Art. 88 GDPR. If you voluntarily tell us about special categories of personal data, for example a severe disability, we process them under Art. 9(2)(b) GDPR to the extent necessary for rights and obligations under employment law. If you are hired, we continue to process your data to carry out the employment relationship (Art. 6(1)(b) GDPR).

Storage locations and recipients: We store your details and documents in our applicant management system on servers in Germany provided to us by Hetzner Online GmbH and another IT service provider as our processors. We send and receive e-mails via Microsoft 365 (section 18). Your application is only seen by the persons in our company who are involved in the selection process (human resources, the responsible line managers, management) and, where provided for by law, the employee representatives.

Storage period: If no employment relationship results, we delete your application including documents six months after the application process has ended; online applications are deleted automatically six months after the last change of status, as a rule the rejection. Until then we retain them on the basis of our legitimate interest in being able to defend ourselves against possible claims, in particular under the German General Equal Treatment Act (AGG) (Art. 6(1)(f) GDPR). If legal proceedings are pending or foreseeable, we delete them only after they have been concluded. Longer storage, for example for future vacancies, only takes place with your express consent (Art. 6(1)(a) GDPR), which we ask for separately and which you can withdraw at any time.

For applications via the careers portal, the privacy information provided there applies in addition.

17. Whistleblower system

For reports of legal violations we offer a hotline and an external online reporting channel (app.whistle-report.com); details are given on the page whistleblower system. This website only forwards you to the reporting channel: information you enter there is not transmitted via this website. The privacy information of the reporting channel explains how your report is processed. We treat reports confidentially in accordance with the German Whistleblower Protection Act (HinSchG).

18. Recipients and transfers to third countries

We only pass on personal data if this is described in this policy, a legal basis permits it or we are legally obliged to do so. Recipients are in particular our processors:

  • Hetzner Online GmbH, Gunzenhausen: servers of this website, of our intake point and of our database as well as backups (data centres in Germany),

  • Storyblok GmbH, Linz: content and media of the website (Austria, data centres in the EU),

  • Microsoft Ireland Operations Limited, Dublin: e-mail via Microsoft 365 (storage in the EU),

  • IT service provider with a data centre in Germany: storage of application documents,

  • AI service providers based in the EU: AI functions in the service system, only if they are used while handling a request (section 14),

  • other service providers who support us in operating our IT systems.

Agreements under Art. 28 GDPR are in place with all processors. Only after your consent or your click is Google (Google Analytics, YouTube) also a recipient.

A third country is a country outside the European Union and the European Economic Area. Transfers to the USA may occur with Google Analytics, YouTube and when files are delivered via Amazon CloudFront. With Microsoft 365 the data are stored in the EU; access by Microsoft Corporation from the USA, for example for support or security purposes, cannot be ruled out. For the USA, the European Commission has adopted an adequacy decision for companies certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Google LLC, Amazon.com, Inc. (including Amazon Web Services) and Microsoft Corporation are certified. In addition, standard contractual clauses of the European Commission are in place (Art. 46(2)(c) GDPR).

19. Storage period

Unless this policy states a specific storage period, we store personal data only for as long as necessary for the respective purpose. We then delete them unless statutory retention obligations (in particular under commercial and tax law) prevent this; in that case we restrict the processing and delete the data when these periods expire.

We back up our database regularly. Deleted or anonymised data disappear from these backups when they expire, after three months at the latest. If a backup is restored, our deletion runs delete or anonymise the data again.

20. Your rights

You have the following rights with regard to your personal data:

  • Access to the data we process (Art. 15 GDPR),

  • Rectification of inaccurate or completion of incomplete data (Art. 16 GDPR),

  • Erasure of your data (Art. 17 GDPR),

  • Restriction of processing (Art. 18 GDPR),

  • Data portability, i.e. receiving the data you have provided to us in a commonly used, machine-readable format (Art. 20 GDPR),

  • Withdrawal of a consent you have given, with effect for the future (Art. 7(3) GDPR),

  • Objection to the processing (Art. 21 GDPR, see section 21).

To exercise them, simply contact datenschutz@zeck-gmbh.com or our data protection officer.

21. Right to object under Art. 21 GDPR

If we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

If we process your data for direct marketing, you can object to this processing at any time without giving reasons. We will then no longer use your data for direct marketing purposes.

The objection is not subject to any form and should be addressed to datenschutz@zeck-gmbh.com.

22. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR (Art. 77 GDPR). You can contact in particular the supervisory authority of your place of residence or work, or the authority responsible for us:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, Bavarian Data Protection Authority)
Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de

23. No obligation to provide data, no automated decision-making

You are under no statutory or contractual obligation to provide us with personal data. Without the technically necessary connection data, however, we cannot display the website to you, and without contact details we cannot handle your request or application.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

24. Changes to this privacy policy

We adapt this privacy policy when the website, our processing operations or the legal situation change. The version published on this page applies.

Last updated: 22 October 2026