Legal

Privacy policy

This English version is provided for information. The German version is legally binding.

This privacy policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter “data”) within our online offering and the websites, functions and content connected with it, as well as external online presences such as our social media profiles (hereinafter jointly “online offering”). With regard to the terms used, such as “processing” or “controller”, we refer to the definitions in Article 4 of the General Data Protection Regulation (GDPR).

Controller

Types of data processed

• Inventory data (e.g. names, addresses)
• Contact data (e.g. email, telephone numbers)
• Content data (e.g. text entries, uploaded application documents)
• Usage data (e.g. pages visited, access times)
• Meta/communication data (e.g. device information, IP addresses)

Categories of data subjects

Visitors and users of the online offering, prospective and existing customers, applicants and participants in our events (hereinafter collectively “users”).

Purpose of processing

• Providing the online offering, its functions and content
• Responding to contact requests and communicating with users
• Conducting application procedures and events
• Security measures
• Audience measurement without cookies (see below)

Relevant legal bases

In accordance with Article 13 GDPR we inform you of the legal bases of our data processing. Where the legal basis is not stated in this policy, the following applies: the legal basis for obtaining consent is Article 6 (1) (a) and Article 7 GDPR; the legal basis for processing to fulfil our services and carry out contractual measures and to respond to enquiries is Article 6 (1) (b) GDPR; the legal basis for processing to comply with our legal obligations is Article 6 (1) (c) GDPR; and the legal basis for processing to safeguard our legitimate interests is Article 6 (1) (f) GDPR.

Security measures

In accordance with Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as access, input, disclosure, ensuring availability and its separation. This website is delivered exclusively over an encrypted connection (HTTPS).

Cooperation with processors and third parties

Where, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them or otherwise grant them access to the data, this is done only on the basis of a legal permission, if you have consented, if a legal obligation provides for it or on the basis of our legitimate interests (e.g. when using web hosts). Where we commission third parties to process data on the basis of a so-called data processing agreement, this is done on the basis of Article 28 GDPR.

Hosting and server log files

This website is operated on servers in the European Union. When you access it, server log files are stored on the basis of our legitimate interests (Article 6 (1) (f) GDPR) in secure and efficient operation. These include the page accessed, date and time, amount of data transferred, notification of successful retrieval, browser type and version, operating system, the previously visited page (referrer) and the IP address. Log files are stored for security reasons (e.g. to investigate misuse) for a maximum of 7 days and then deleted. Data whose further retention is required for evidential purposes is excluded from deletion until the respective incident has been clarified.

Contact form and getting in touch

When you contact us (via the contact form, by email or telephone), the user’s details are processed to handle the enquiry and in case of follow-up questions in accordance with Article 6 (1) (b) GDPR. The form transmits your details to our server in encrypted form, which forwards them as an email to our mailbox. To protect against automated entries, the server checks technical characteristics of the submission (including an invisible form field and the time taken to fill in the form) and limits the number of submissions per sender address; for this purpose the IP address is held briefly in memory and not stored permanently. We delete enquiries once they are no longer required and review the necessity every two years; statutory archiving obligations remain unaffected.

Privacy information for the application process

We process applicant data only for the purpose and within the scope of the application process in accordance with the statutory requirements. Processing takes place to fulfil our (pre-)contractual obligations in the application process within the meaning of Article 6 (1) (b) GDPR and Section 26 BDSG (German Federal Data Protection Act), as well as Article 6 (1) (f) GDPR where data processing becomes necessary for us, e.g. in the context of legal proceedings.

The application process requires applicants to provide us with their applicant data. The required information is marked in the online form; in principle this includes personal details, contact details and the documents belonging to the application such as cover letter, CV and certificates. In addition, applicants may voluntarily provide us with further information. Where special categories of personal data within the meaning of Article 9 (1) GDPR are provided voluntarily (e.g. health data such as a severe disability), their processing is additionally based on Article 9 (2) (b) GDPR.

Applicants can submit their application via the online form on this website; the data and attachments are transmitted to our server in encrypted form and forwarded from there as an email to our applications mailbox. Alternatively, applications can be sent by email to bewerbung@sandhas.com. Please note that emails are not always transmitted with end-to-end encryption. Applications by post remain possible, of course.

If an application is successful, the data provided by applicants may be further processed for the purposes of the employment relationship. Otherwise, applicants’ data is deleted, as it is when an application is withdrawn, which applicants are entitled to do at any time. Subject to a justified revocation, deletion takes place after six months so that we can answer any follow-up questions and meet our obligations to provide evidence under the German General Equal Treatment Act. Invoices for any reimbursement of travel expenses are archived in accordance with tax law requirements.

Booking introductory meetings

In the online application, applicants can book an appointment for a first meeting. For this purpose we store the appointment, type of meeting, name and email address on our server so that the same appointment is not booked twice. This data is deleted automatically one day after the appointment. Applicants receive a confirmation by email with a calendar entry; the legal basis is Article 6 (1) (b) GDPR.

Talent pool

As part of the application, we offer applicants the option of being included in our “talent pool” for a period of two years on the basis of consent within the meaning of Article 6 (1) (a) and Article 7 GDPR. Documents in the talent pool are processed solely in connection with future job advertisements and destroyed at the latest when the period expires. Consent is voluntary, has no influence on the current application process and can be revoked at any time with effect for the future.

Registration for events (workshops)

Details you provide via the registration form for a workshop are processed to organise and hold the event in accordance with Article 6 (1) (b) GDPR. The data is deleted after the event unless statutory retention obligations prevent this.

Online furniture planner

On the “furniture configurator” page we embed our online furniture planner as a frame (iframe) from the address moebelplaner.sandhas.com. When you open this page, a connection to this service is established and technically necessary data (in particular your IP address) is transmitted. Details you enter in the planner are used solely to create your design and any enquiry.

Google Maps

On the contact page we offer a directions map from the Google Maps service (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded when you click “Load map”. Only then is data (including your IP address) transmitted to Google; the legal basis is your consent given by clicking, Article 6 (1) (a) GDPR. Further information: policies.google.com/privacy.

Audience measurement

Where activated, we measure the use of this website with the self-hosted open-source software Umami. No cookies are set and no data is transferred to third parties; the IP address is not stored but used only to form a daily changing, non-reversible identifier for counting visits. The legal basis is our legitimate interest in improving the offering (Article 6 (1) (f) GDPR).

Cookies and language setting

This website does not use cookies for analysis or advertising purposes. Only technically necessary storage in the browser is used where required for a page to function. When you switch languages using the language switch, a technically necessary cookie (“lang”) stores your choice for one year so that the homepage appears in that language in future; it contains only the language code and is not used for any other purpose.

Online presences on social media

We maintain online presences within social networks (currently Facebook) in order to communicate with the customers, prospects and users active there and to inform them about our services. No social media plugins are embedded on this website; they are simple links. When you visit the respective networks, the terms and conditions and data processing policies of the respective operators apply.

Deletion of data

The data we process is deleted or its processing restricted in accordance with Articles 17 and 18 GDPR. Unless expressly stated otherwise, the data stored by us is deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent deletion. Under German statutory requirements, retention is in particular 10 years pursuant to Sections 147 (1) AO and 257 (1) nos. 1 and 4, (4) HGB (books, records, accounting documents, etc.) and 6 years pursuant to Section 257 (1) nos. 2 and 3, (4) HGB (commercial letters).

Rights of data subjects

• You have the right to request confirmation as to whether data concerning you is being processed, and to information about this data as well as further information and a copy of the data in accordance with Article 15 GDPR.
• In accordance with Article 16 GDPR you have the right to request the completion of data concerning you or the rectification of inaccurate data.
• In accordance with Article 17 GDPR you have the right to request that data concerning you be deleted without undue delay, or alternatively to request restriction of processing in accordance with Article 18 GDPR.
• You have the right to receive the data concerning you that you have provided to us in accordance with Article 20 GDPR and to request its transmission to other controllers.
• In accordance with Article 77 GDPR you have the right to lodge a complaint with the competent supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Right of withdrawal

You have the right to withdraw consent given in accordance with Article 7 (3) GDPR with effect for the future.

Right to object

You may object to the future processing of data concerning you at any time in accordance with Article 21 GDPR. The objection may in particular be made against processing for direct marketing purposes.

Last updated: October 2026