Privacy information

Information on how personal data is processed when you visit this website or contact us.

1. Controller

Bahatin Topal · TOPAL Heizung + Sanitär
Emschermulde 7
45891 Gelsenkirchen, Germany
Phone: +49 2325 9080296
Email: info@heizungsanitaertopal.de

2. Hosting and server logs

This website and its email service are hosted by united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. Technical access data may include IP address, date and time, requested resource, HTTP method, referrer, status code and browser information.

Processing is necessary to deliver the site, secure systems, troubleshoot errors and prevent misuse. The legal basis is Article 6(1)(f) GDPR (legitimate interests). united-domains states a 14-day retention period for Apache access logs. Other log types used by the particular hosting plan may have different periods. Provider details: united-domains Datenschutzinformationen.

Administration and security logs: In the protected administration area, we record the timestamp, account, type of action and browser category for sign-ins, security operations and settings changes. To help investigate misuse, the IP address is also stored in encrypted form in non-public administration storage and displayed for up to 14 days. The encrypted IP is removed from the new log the next time it is accessed or written after the period expires; if there is no administrator activity, technical deletion may take place later. Event entries are removed in the same way after 90 days. Only super-administrators can view the log. The purpose and legal basis are administrative security and investigation of unauthorized access under Article 6(1)(f) GDPR (legitimate interests). Older logs contain only IP hashes and require a separate retention review.

3. Processors and recipients

A data processing agreement pursuant to Article 28 GDPR has been concluded with united-domains. Depending on the hosting or email plan, technical subprocessors, potentially including IONOS infrastructure, may be involved. The contractual documents and provider information govern details of subprocessors and any international transfers.

Personal data is disclosed to other recipients only as necessary to handle your enquiry or comply with legal obligations. We do not share enquiries for third-party advertising.

4. Contact by form, email or phone

When you contact us, we process your name, the email address or telephone number you provide, any optional postal address and your message. For general enquiries and online services, either contact method is sufficient. Appointment requests require an email address for electronic confirmation or rejection; the telephone number is optional. You may also voluntarily attach photographs or PDFs. Contact form submissions are emailed to info@heizungsanitaertopal.de. From this version onward, customer enquiries are also stored in an encrypted private inbox outside the publicly accessible website directory. This includes contact information, submitted answers, processing status, internal notes and optional attachments. Only staff with explicit access rights and individual two-factor authenticated accounts may view these records. Deleting an enquiry from the admin area removes its stored copy and attachments, but does not automatically delete emails or backups.

Depending on the form settings, an automated acknowledgment may be emailed to you. This does not constitute acceptance of an order.

Article 6(1)(b) GDPR applies to contractual and pre-contractual enquiries. Other enquiries are processed under Article 6(1)(f) GDPR based on our legitimate interest in responding to messages. Required fields are marked.

Our online services “Heating and heat pump check”, “Report a repair” and “Plan a bathroom” additionally collect details about your building, existing heating system, faults, installation address or intended bathroom works. These data are used solely to assess and respond to your enquiry. No automated technical suitability assessment takes place. Photo and PDF uploads are available only where enabled for the respective service.

5. File uploads and retention

Uploaded photos and PDF files are processed to transmit and respond to your enquiry. Temporary server files may be created during upload. Attachments are sent with the enquiry email.

We delete enquiry data when no longer needed unless statutory retention duties, contractual obligations or the establishment, exercise or defence of legal claims require longer storage. The actual period depends on the nature and outcome of the enquiry.

5a. Administration, page editor and backups

Enquiries are stored in the restricted, encrypted area described in section 4. Authorized administrators can manually delete an enquiry and its stored attachments. This does not automatically delete messages already sent by email or existing backup copies. The current software does not automatically delete enquiries or emails after a fixed period. Appropriate deletion must therefore be carried out as an administrative process, taking account of the purpose and any applicable retention obligations.

Encrypted full backups can be stored in a MySQL/MariaDB database and a non-public backup directory for disaster recovery. These copies may include personal enquiries, attachments, staff accounts, settings and uploaded photos. Decryption requires the recovery passphrase. No automatic deletion period is currently configured for backup snapshots. Copies that are no longer needed must be removed separately, including any externally held backups. Backup administration is restricted to specially authorized administrators. Article 6(1)(f) GDPR applies to necessary security and disaster-recovery processing where no overriding legal duty or other lawful basis applies.

The page editor may retain up to five previous versions of modified text, image references and alternative image descriptions, together with the account and time of modification. Versions involving published photographs may therefore also contain personal image information.

6. Necessary session data and consent choices

The technically necessary PHP session cookie topal_site is newly set only on pages containing a form, including the homepage, contact page and enabled online enquiry/appointment forms. Pure information pages do not set a new cookie when no session exists. It provides CSRF protection, abuse prevention and form feedback. It is configured as a session cookie; server-side session records may be retained longer under the host configuration. Article 6(1)(f) GDPR applies to associated personal data processing; section 25(2) TDDDG applies to essential device storage.

Your Google Maps choice, including the decision and timestamp, is stored locally in your browser under topal_consent_v2. It may remain until you clear browser data or change the choice. You can change it at any time through “Cookie settings”.

7. Google Maps

An interactive map provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, loads only after your express consent. Without consent it remains disabled. Google may receive your IP address, technical usage information and cookie data. Processing outside the EU/EEA may take place.

The legal basis is your consent under Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG. You can withdraw consent at any time through “Cookie settings”, with effect for the future. More details: Google-Datenschutzhinweise.

8. External links

Clicking external links, such as opening Google Maps outside our site or viewing the German Crafts Code, takes you to another provider. That provider is responsible for processing on its own website.

9. Data subject rights

Subject to statutory conditions, you may request access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20), and object (Article 21). You can withdraw consent under Article 7(3) at any time for future processing; prior processing remains lawful. Please contact info@heizungsanitaertopal.de to exercise your rights.

10. Complaints

You may lodge a complaint with a data protection supervisory authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

11. No analytics or automated decisions

The website code currently reviewed does not contain Google Analytics or a newsletter service. No automated individual decision-making, including profiling within the meaning of Article 22 GDPR, is intended for website enquiries.

12. Appointment requests and notifications

Only when enabled by us, the appointment request form collects your name, email address, an optional phone number, preferred date and time of day, reason, location and voluntary details. A preferred date is not a confirmed appointment. Your request is sent by email and stored encrypted in our restricted administration system, like other enquiries. We email you after accepting or declining your request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual communication), or Art. 6(1)(f) GDPR where appropriate.

13. Optional owner and team photos

If the “About TOPAL” section is enabled, we publish owner and optional team photographs provided by us together with verified biographical information. We check publication rights and, where necessary, the consent of identifiable persons before publication. Consent under Art. 6(1)(a) GDPR may be withdrawn by contacting the email address above. Images are hosted locally; files removed through our administration interface are deleted from the website server, although copies cached by third parties may remain temporarily.

14. Last updated

October 2026.

Static display of Google reviews

When the review area is enabled, manually selected excerpts are displayed from our own server with abbreviated names, dates and star ratings. Loading our website does not automatically connect to Google. Google may process data only when you choose to follow an external Google link. The legal basis for any personal data displayed is our legitimate interest under Article 6(1)(f) GDPR.