Privacy Notice
Information under Articles 13 and 14 GDPR · Updated 14 September 2026
Diese Erklärung auf Deutsch lesen
1. Scope and overview
This notice explains how Olariche processes personal data when you visit this website, submit a request for quotation (RFQ), contact us or deal with us as a customer, supplier or business contact. It also covers personal data in our internal trade and document workflows.
We receive information from you, collect technical information when you use the website and, where relevant, receive business contact information from the sources described below. The following sections explain the purposes, legal bases, recipients, retention criteria and your rights under the General Data Protection Regulation (GDPR).
2. Controller and privacy contact
Olariche UG (haftungsbeschränkt), Bismarckstraße 142, 47057 Duisburg, Germany. Managing director: Ifeanyi Dominic Godfrey.
For privacy questions or to exercise your rights, contact trade@olariche.com, telephone +49 174 4750241, or write to the address above. No particular form is required.
3. Website hosting, security and server logs
Our commissioned hosting and infrastructure providers process data needed to deliver and protect the website. Server logs may include your IP address, requested page, access time, browser information, referring page and response status. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in a reliable, secure website and the investigation of faults and abuse.
The web server is configured for daily log rotation with 14 rotated files. With daily rotation this normally covers about two weeks plus the current log; it is not a guarantee that every entry is deleted after exactly 14 days. Relevant records may need to be preserved longer to investigate a security incident or establish, exercise or defend legal claims.
RFQ abuse controls check submission timing, hidden form fields and content patterns and count requests by IP address over a 15-minute window. That window is a rate limit, not a fixed deletion period: in-memory entries may remain until cleanup or a server restart. This processing also relies on Article 6(1)(f) GDPR to prevent spam and protect service availability.
The website uses HTTPS to protect data in transit. Its fonts are served with the website rather than loaded from Google Fonts by your browser.
4. Requests for quotation and business dealings
When you submit an RFQ, we process the company, country, business email, product, quantity, delivery terms, currency, destination and any contact name or notes you provide. We use this information to assess feasibility, prepare and discuss quotations, answer questions and manage the resulting business relationship. Enquiries are recorded in our internal trade system and may be passed to the CRM and email services below.
Article 6(1)(b) GDPR applies where processing is necessary for a contract with you or steps you request before entering one. Where you act for a company, Article 6(1)(f) GDPR applies to our legitimate interest in conducting business with that company and communicating with its representatives. Article 6(1)(c) GDPR applies where commercial or tax law requires records.
Form fields marked as required are needed to process the request; without sufficient contact and transaction details we may be unable to provide a quotation. Other details are voluntary. Please avoid including unnecessary sensitive personal information in free-text fields.
The checkbox confirms that you have read this notice. It does not ask for consent as the legal basis for handling your enquiry, and an RFQ does not subscribe you to a newsletter or marketing list.
5. Email, telephone and WhatsApp
If you contact us by email or telephone, we process your contact details, message and related correspondence to handle the matter. The same contract or legitimate-interest bases described for enquiries apply. Our domain email uses Google services; Google and its service providers may process message content, attachments and technical delivery data. See the transfer and retention sections below.
WhatsApp is an optional contact channel reached through an external link. Opening it connects you to WhatsApp; simply visiting our page does not load an embedded WhatsApp chat. If you message us, we receive your phone number, any visible profile information and the content you share. You can use email instead.
WhatsApp Ireland Limited provides the service in the European region and processes information for its own purposes under its privacy policy, including through international infrastructure. Our handling of your enquiry remains subject to this notice; WhatsApp’s own processing is explained in its policy.
7. CRM and enquiry notification services
HubSpot is used to organise business enquiries and contacts. RFQ synchronisation includes company name, country, email address and a deal reference. The purpose is coordinated follow-up and management of customer relationships. HubSpot’s contracting entities and subprocessors are described in its data processing agreement and subprocessor list.
Resend (Plus Five Five, Inc., USA) is used to deliver transactional email notifications to our team. Notifications can contain the RFQ reference, company and contact details, product requirements, delivery details and notes. Resend states that service data is stored in the United States even when an EU sending region is selected.
These services support enquiry handling on the bases described above, including Article 6(1)(f) GDPR for efficient and reliable business communication. Their contractual processing terms and international-transfer mechanisms are linked below.
8. Internal document processing
Our staff tools can use the Google Gemini API to extract product information from supplier catalogues and technical documents. When a staff member starts extraction, document text is sent to Google and may contain business contact details appearing in that document. Submitting the public RFQ form does not itself trigger Gemini processing.
The purpose is to structure product information for our trade operations, based on Article 6(1)(f) GDPR and our legitimate interest in efficient, accurate document handling. Google’s API terms govern its processing, including applicable EEA provisions and limited safety-related logging. Processing may take place outside the EEA. Extraction does not make decisions about granting credit or accepting a contract.
9. Other recipients and sources
Access is limited to people and service providers who need the data for the relevant task. Depending on a transaction, necessary information may also be shared with suppliers, transport and customs partners, payment or financing providers, professional advisers and public authorities. These parties may act as processors or as independent controllers depending on their role. Sharing must be necessary for the relevant contract, legitimate business purpose or legal obligation; this is not permission to distribute all enquiry data to every category.
Where contact data is not supplied directly by you, it may come from your employer, an authorised colleague, a trading partner, a public company website or a business register. It may include your name, business role, work contact details and the associated enquiry or transaction. We use it for relevant business communication under Article 6(1)(f) GDPR or to meet a legal obligation under Article 6(1)(c). You can ask us for the source of information held about you.
10. International data transfers
We do not promise that all personal data remains in Germany or the European Economic Area (EEA). The services and business partners described above may process information in other countries, including the United States. Hosting location alone does not determine where email, CRM, support or document processing occurs.
Transfers outside the EEA must meet the applicable requirements of Articles 44–49 GDPR. Depending on the recipient and transfer, this can involve an adequacy decision under Article 45 or appropriate safeguards under Article 46, including EU Standard Contractual Clauses and supplementary measures where required. The EU–US Data Privacy Framework applies only to transfers covered by a recipient’s valid participation, not to every US company.
HubSpot’s DPA describes reliance on the Data Privacy Framework for covered transfers and Standard Contractual Clauses where applicable. Resend’s DPA includes Standard Contractual Clauses. Google’s applicable processing terms describe its transfer arrangements. The provider links in this notice explain these mechanisms; contact us for information or a copy of the safeguards relevant to your data.
11. How long we keep information
Enquiry and business records are kept while needed to assess and answer a request, conduct an ongoing business relationship or handle an outstanding matter. After that, the criteria are any continuing follow-up need, statutory recordkeeping and the establishment, exercise or defence of legal claims. Data no longer needed for these purposes should be deleted or anonymised. An unanswered or unsuccessful RFQ does not itself justify indefinite retention.
Where the relevant German recordkeeping rules apply, commercial correspondence is generally retained for six years, accounting vouchers for eight years, and books and annual accounts for ten years under section 257 HGB and section 147 AO. The period generally begins at the end of the relevant calendar year; statutory exceptions and pending tax proceedings can affect it. These periods apply to qualifying records, not automatically to every website enquiry.
Server-log rotation is described above. Resend publishes a standard 30-day retention period for email data and logs on its standard plans; enterprise terms can differ. This does not delete copies in our mailbox, CRM or trade system. Provider logs and backup copies can follow separate deletion cycles. Contact us for information about the records held in your particular case.
12. Your privacy rights
Subject to the conditions in the GDPR, you can request access to your personal data and a copy (Article 15), correction of inaccurate or incomplete information (Article 16), erasure (Article 17) and restriction of processing (Article 18). Restriction can apply, for example, while accuracy is checked or an objection is assessed, or where you need data for legal claims even though we no longer need it.
Article 20 gives you a right to receive data you have provided in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller, where processing is automated and based on consent or a contract. If processing is based on consent, you may withdraw it at any time with effect for the future; earlier lawful processing is unaffected.
These rights are subject to their statutory conditions. For example, legal retention obligations can prevent immediate erasure. We normally respond within one month. If a complex or numerous request requires an extension of up to two further months, we inform you within the first month and explain why. We may request proportionate additional information where we have reasonable doubts about identity. Requests are generally free of charge, subject to the exceptions for manifestly unfounded or excessive requests.
13. Your right to object — Article 21 GDPR
Where we rely on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation, including to profiling based on that provision. We must then stop the processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.
If your data is processed for direct marketing, you may object at any time without giving a reason, including to related profiling. We will then stop using your data for those marketing purposes. You can send either objection to trade@olariche.com.
14. Automated decisions
Our RFQ workflow does not use solely automated decisions producing legal or similarly significant effects within Article 22 GDPR. Automated spam controls can reject a submission; if that happens, email trade@olariche.com so our team can review your enquiry. Internal product-data extraction does not replace a commercial decision by our team.
15. Complaints and updates
Under Article 77 GDPR you may complain to a supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. You do not have to contact us first. The authority for our registered office is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
Last updated: 14 September 2026. We will update this notice when relevant services or processing activities change. Where required, we will provide information about a new purpose before further processing for that purpose.