Privacynotice.

1. Controller and contact

BAYSAL MEDICAL is the medical brand of
Baysal - Fördertechnik GmbH & Co. KG
Schubertweg 18
41836 Hückelhoven-Baal, Germany.

Represented by its general partner, U. Baysal Beteiligungs GmbH, which is represented by its Managing Director, Dipl.-Ing. Mahmut Baysal.

For privacy enquiries, contact us by email at vertrieb@baysal.info, by telephone on +49 2433 9539808 or at the postal address above.

2. Hosting and technical access data

Our website and the email inbox used for enquiries are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO processes the data necessary to provide these hosting services. According to STRATO, hosting takes place in data centres in Germany.

When you visit, your browser transmits technically necessary information, including your IP address, the time of access, the page or file requested, response status, volume of data transferred, browser information and, where applicable, the previously visited page (referrer). This information is used to deliver, troubleshoot and secure the website. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a reliably accessible service protected against attacks.

STRATO’s data processing agreement specifies a maximum retention period of seven days for visitor log files. These differ from the access logs available in the customer area: according to STRATO’s help documentation, these are accessible for six weeks and contain IP addresses or host names anonymised by STRATO; error logs are available for the last 24 hours. Under the agreement, other technical hosting log data is deleted after no more than twelve months. We do not combine these logs with your contact enquiries to create visitor profiles.

Provider information: STRATO access logs, data processing agreement and STRATO privacy information (in German). These external websites load only when you click their links.

3. Contact form, email and telephone

When you contact us, we process the contact details you provide and the content of your enquiry. The form requires your name, email address and message; your practice or company name is optional. We also process the selected enquiry topic, submission time and a technical enquiry reference.

Your enquiry is passed by email to vertrieb@baysal.info and handled by the responsible people within the company. There is no additional website database for messages, no automatic newsletter subscription and no automatic copy sent to your address. Your entries are not transmitted as you type.

If your enquiry concerns a contract with you or steps prior to entering into one, the legal basis is Article 6(1)(b) GDPR. For other enquiries and communication with company representatives, the basis is Article 6(1)(f) GDPR: our legitimate interest in handling enquiries and business correspondence. Retention required by law is based on Article 6(1)(c) GDPR.

Contacting us is voluntary. Without the required details, we cannot process or respond to an enquiry submitted through the form. Acknowledging the privacy notice confirms that you have read it; it is not consent to advertising. You can also contact us by email or telephone.

Please do not send patient, health or treatment data, scans or other sensitive documents through this form. It is intended for general business enquiries, not for submitting patient cases.

4. Necessary session cookie and abuse prevention

The session cookie baysal_contact is created only when you use the form. It contains a random session identifier, not your message. We use it to check that a submission belongs to the form session and to prevent duplicate submissions of the same enquiry. The cookie is restricted to this website and protected with Secure, HttpOnly and SameSite=Strict. It is a session cookie with no persistent expiry date; deletion depends on the end of your browser session or your browser’s session settings.

The server stores security tokens, timestamps, a checksum of the enquiry and the enquiry reference for this purpose, but not the message text in the session. Form tokens are valid for one hour; expired tokens are removed when the form is prepared again. Other inactive session data is removed by the hosting service’s session cleanup.

To limit automated submissions, a salted identifier that is not directly readable is derived from the IP address during a submission attempt. This identifier and timestamps are stored in the rate-limit file, not your raw IP address or your message. The checking window is one hour. Older entries are cleared during the next valid submission attempt; without further use, the form itself does not perform timed deletion. The file is access-protected outside the public web directory and is not used for advertising.

These measures serve only to operate the contact form you have requested securely. The legal basis for processing personal data is Article 6(1)(f) GDPR (protection against spam, manipulation and duplicate submissions). Necessary storage on or access to your device is based on § 25(2), point 2 TDDDG. No consent to advertising or analytics cookies is required for this purpose.

5. Retention periods and recipients

Enquiries and related emails are retained for as long as necessary to handle and conclude the matter. They are then deleted unless statutory retention duties or a need to establish, exercise or defend legal claims require continued storage. For contractual and business records, the type and content of the document and the applicable commercial and tax obligations determine any further retention period. STRATO specifies a maximum of six months from creation for technical email log files. Sections 2 and 4 explain the retention of other technical data.

Access is granted to the people responsible for handling the enquiry and to the hosting and email service providers needed for that purpose. Data is disclosed to other parties only where necessary for your enquiry or a contract, required by law or initiated by you. Form data is not sold or disclosed to advertising networks.

This website does not integrate services designed to transfer visitor data outside the European Economic Area. When we reply by email, your chosen email provider is also involved; its processing is governed by its service and your agreements with it.

6. No tracking services; secure transmission

We do not use tracking pixels, advertising cookies, analytics scripts, embedded maps, social media plugins or externally loaded fonts on this website. Fonts and images are served from our own webspace. We do not carry out automated decision-making with legal or similarly significant effects, or corresponding profiling.

The website and form submissions use HTTPS. Subsequent handling by email is not end-to-end encrypted communication. Please do not send particularly confidential or medical data through this channel.

7. Your data protection rights

Subject to the applicable legal conditions, you have the right of access to your data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where processing is based on your consent, you may withdraw that consent for the future; this does not retrospectively affect the lawfulness of earlier processing.

To exercise your rights, contact vertrieb@baysal.info or write to our postal address above.

You may also lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the place of your habitual residence, place of work or the place of an alleged infringement. The authority for our registered office is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Postfach 20 04 44, 40102 Düsseldorf, Germany.

8. Changes

This notice applies to the website and general contact form described here. We update this information if the services used or purposes of processing change. The date of the current version appears at the top of this page.