Last updated: 9 October 2026
1. Who we are
This website is operated by RLK GmbH under the RLK Group brand. RLK GmbH is the controller for personal data collected through this website within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR).
RLK GmbH
Gnarrenburger Straße 35
27432 Bremervörde
Germany
Commercial register: Amtsgericht Tostedt, HRB 208526
VAT identification number: DE336102980
Managing Director: Hendrik Muehler
For all data protection matters, including the exercise of the rights set out in section 8: eu@rlk-group.com
2. What this policy covers
This is a business-to-business website. It provides product and capability information and allows prospective customers to send an enquiry. It is not an online shop, it processes no payments, and it operates no newsletter or subscription list.
We do not sell your data and we do not combine website data with data from other sources. Analytics and advertising measurement run only with your consent, as described in sections 3.4 to 3.6.
3. What we collect, why, and for how long
3.1 Enquiries sent through our forms
We collect the name, company, email address, country, the product categories and timing you tell us about, and the content of your message. Which of these fields appear depends on the form you use.
Purpose: to receive, assess and respond to your enquiry, and to conduct the pre-contractual and contractual correspondence that follows from it.
Lawful basis: Article 6(1)(b) GDPR where the enquiry relates to a contract or its negotiation; Article 6(1)(f) GDPR (our legitimate interest in responding to business enquiries addressed to us) where it does not.
Form entries are not stored in the website’s database. They are sent to us by email, as described in section 3.2.
Retention: enquiries that lead to a business relationship are retained for the duration of that relationship and thereafter for the statutory retention periods under German commercial and tax law, which are up to ten years. Enquiries that lead to no business relationship are deleted after 24 months.
3.2 Email delivery of enquiries (Brevo)
The notification email that carries your enquiry to us is delivered through Brevo, a service of Sendinblue SAS, 9-17 rue Salneuve, 75017 Paris, France. Brevo processes the data you enter in the form on our behalf and only for the purpose of delivering that email. It keeps delivery logs for a limited period under its terms of service.
Lawful basis: as in section 3.1.
3.3 Server log files
Our hosting provider records the requesting IP address, the date and time of the request, the page or file requested, the referring URL, the browser and operating system identification, and the volume of data transferred.
Purpose: to deliver the website, to maintain its stability and security, and to investigate misuse or attack.
Lawful basis: Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.
Retention: log files are kept by our hosting provider for a short period and are then deleted. Logs are not combined with other data and are not used to identify individual visitors.
3.4 Analytics
With your consent we use Google Analytics 4 (measurement ID G-YBSKVWHXVX), delivered through Google Site Kit and Google Tag Manager, to understand how the website is used: which pages are visited, how visitors arrive, and where they leave.
Google Analytics 4 does not store IP addresses. IP addresses are used in transit to derive an approximate location and are then discarded.
Purpose: measurement and improvement of the website.
Lawful basis: Article 6(1)(a) GDPR (your consent), and §25(1) TDDDG for the storage of and access to information on your device. You may withdraw your consent at any time with effect for the future, using the cookie settings link in the footer.
Retention: event data is retained in our Google Analytics property for 2 months and user-level data for 14 months.
3.5 Site statistics and security
With your consent for the statistics category we use Jetpack, provided by Automattic, for aggregate site statistics.
We use Jetpack and Wordfence (Defiant Inc.) to protect the website against automated login attempts and attacks. For this purpose IP addresses of requests are checked on our server. Lawful basis: Article 6(1)(f) GDPR, our legitimate interest in the security of the website.
3.6 Advertising measurement (LinkedIn Insight Tag)
With your consent for the marketing category we use the LinkedIn Insight Tag, provided by LinkedIn Ireland Unlimited Company. It tells us in aggregate form whether visitors who saw our content on LinkedIn came to this website and which professional groups they belong to. We receive no data that identifies you as a person.
Lawful basis: Article 6(1)(a) GDPR (your consent) and §25(1) TDDDG. You may withdraw your consent at any time with effect for the future, using the cookie settings link in the footer.
3.7 Embedded maps
Our contact page embeds Google Maps. The map does not load until you click to load it. Once you do, your IP address and browser information are transmitted to Google in order to deliver the map. Lawful basis: Article 6(1)(a) GDPR, your consent given by clicking.
3.8 Contact widget
Our website displays a contact widget (Chaty, provided by Premio) that offers direct links to email and messaging channels. The widget stores its display state locally in your browser. It transmits no data to us until you choose to use one of the channels it offers, at which point the communication is governed by the provider of that channel.
3.9 Fonts
Typefaces used on this website are served from our own server. No request is made to Google Fonts or any other third-party font service.
4. Cookies
Our cookie policy sets out every cookie and comparable technology used on this website, by category, with provider and storage period: Cookie Policy
Consent management. We use the consent management tool Real Cookie Banner, a WordPress plugin provided by devowl.io GmbH, Germany. The plugin runs on our own web server, and no personal data is sent to devowl.io GmbH. It asks for your consent to cookies and comparable technologies that are not strictly necessary, and it stores your choice (consent or refusal), the date and time, and the version of the banner shown, in a cookie on your device (365 days) and in a consent log on our server. Lawful basis: Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR (our obligation to prove consent), and Section 25(2) No. 2 TDDDG for the consent cookie. Retention: the consent cookie is valid for 365 days. The consent log is kept for 3 years (36 months), in line with the regular limitation period for claims, and is then deleted automatically. We do not store your IP address with your consent.
5. Recipients and processors
We disclose personal data only where it is necessary for the purposes set out above. We do not sell personal data and we do not transfer it for any third party’s own purposes.
Two service relationships support this website. In both, RLK GmbH determines the purposes and essential means of processing and remains the controller.
(a) Website operation. Ceedaa Limited acts as our website service provider. It administers the hosting account, the content management system and the plugins, and it engages the technical suppliers listed below as our authorised sub-processors.
(b) Sourcing enquiry handling. Roxto Limited, our partner company in Hong Kong, handles sourcing and product enquiries on our instructions as our processor.
Each is engaged under a written data processing agreement meeting Article 28 GDPR, including sub-processor terms under Article 28(2) and (4): a named list, flow-down of obligations, notice of changes, and our right to object.
Sub-processors and recipients engaged for the operation of this website:
| Hostinger International Ltd | Web hosting and server infrastructure |
| Sendinblue SAS (Brevo) | Delivery of enquiry emails |
| Google Ireland Limited | Analytics, tag management, embedded maps |
| Automattic Inc. | Site statistics and security (Jetpack) |
| Defiant Inc. | Website security (Wordfence) |
| LinkedIn Ireland Unlimited Company | Advertising measurement (Insight Tag), only with consent |
6. International transfers
Website data is hosted in Germany.
Processing by Roxto Limited and Ceedaa Limited takes place in Hong Kong, for which the European Commission has issued no adequacy decision. That transfer is made on the basis of the European Commission’s Standard Contractual Clauses, Module Two (controller to processor), supported by a transfer impact assessment and by additional technical and organisational measures.
Where a sub-processor established in the United States receives personal data, the transfer is made on the basis of that provider’s certification under the EU-US Data Privacy Framework or, where it does not hold one, on the Standard Contractual Clauses.
A copy of the relevant transfer mechanism is available on request from eu@rlk-group.com.
7. Security
This website is served exclusively over an encrypted TLS connection. Access to enquiry data is restricted to the personnel who need it to respond to enquiries, and our processors are bound by confidentiality obligations.
8. Your rights
Under the GDPR you have the right to request access to your personal data (Article 15), its rectification (Article 16), its erasure (Article 17), the restriction of its processing (Article 18), and its portability (Article 20).
Where processing is based on our legitimate interests under Article 6(1)(f), you have the right to object to it (Article 21). Where processing is based on your consent under Article 6(1)(a), you may withdraw that consent at any time with effect for the future, without affecting the lawfulness of processing already carried out.
Please address any request to eu@rlk-group.com. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority. The authority competent for RLK GmbH is:
Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover (visitors)
Postfach 221, 30002 Hannover (post)
Telephone: 0511 120-4500
Email: poststelle@lfd.niedersachsen.de
9. Provision of data
You are under no statutory or contractual obligation to provide personal data to us. If you do not complete a form we cannot respond to an enquiry, but no other consequence follows.
10. Automated decision-making
We carry out no automated decision-making and no profiling within the meaning of Article 22 GDPR.
11. Children
This website is directed at businesses and public sector organisations. It is not directed at children and we do not knowingly collect data from them.
12. Changes to this policy
We review this policy at least annually and whenever the processing it describes changes. The date at the top shows when it was last revised.