Privacy policy

Last updated: 27 September 2026

Your right to object to processing based on legitimate interests is highlighted in Section 15.

1. Controller

This policy applies to both online presences of ISM Zerspanung GmbH: the company website ism-zerspanung.de and the quoting tool under the brand Nemero (nemero.tech). Nemero is a brand, not a separate company; in both cases the controller is the company named above.

Under Section 38 of the German Federal Data Protection Act (BDSG) we are not required to appoint a data protection officer. Questions about data protection are answered by the management at the address above.

2. What we process – at a glance

There is no advertising, no audience measurement and no disclosure of your data for advertising purposes on our pages. We do not use any analytics or tracking tools, no advertising or third-party cookies and no social media buttons. We serve fonts, icons and program libraries from our own server – visiting our pages does not establish any connection to Google or any other third party. The only exception is the map on the contact page, and it only loads if you explicitly ask for it (Section 9).

3. Visiting the pages and hosting

When you open a page, your browser transmits technically necessary data to our server: IP address, date and time, the requested address, the amount of data transferred, the previously visited page and your browser identifier. No page can be delivered without this information. It is also used to detect faults and attacks. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR). Server logs are deleted after 7 days at the latest.

The platform runs on a dedicated server that we rent from netcup GmbH in Karlsruhe; it is located in a data centre in Germany. We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR. No transfer to countries outside the European Union takes place.

4. Cookies and browser storage

We only use cookies that are strictly necessary for operation:

• Session cookie – keeps you logged in after signing in. It becomes invalid when you log out and at the latest when you close your browser.
• Stay logged in – only if you explicitly choose this when signing in. It is then valid for up to 14 days.
• Protection against form misuse – a technical value that prevents other websites from submitting forms in your name.
• Colour theme – if you choose a colour theme for the site yourself, your browser remembers this choice in local storage (localStorage). The value stays on your device and is not transmitted to us. Nothing is stored unless you make a choice.
• Language choice – if you choose the German or English version of ism-zerspanung.de, or close the notice pointing to the other language, your browser also remembers this in local storage. This value, too, stays on your device and is not transmitted to us.

Under Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), no consent is required for these cookies or for the colour and language choice, because the service you requested would not work without them. That is why there is no consent banner here. We do not use cookies for advertising or analytics. Which cookies Google sets when you load the map is described in Section 9.

5. Account and login

An account is required to use the quoting tool. For this we process your username, email address, first and last name, phone number, company address and – if provided – your VAT identification number. We store your password only as a non-reversible check value (hash); we can neither see it nor tell it to anyone.

Your email address is verified by a confirmation message. Only then can you log in. This prevents anyone from creating an account using someone else's address.

If you enable two-factor authentication, we additionally store a secret key for your authenticator app as well as check values of your backup codes. The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR). We keep the account data until you delete the account (Section 14).

6. Your part files

We process uploaded 3D models and drawings exclusively to determine the price and – if you order – to manufacture the parts. As a rule they are not personal data, but they are part of your business know-how and are treated accordingly:

• They are visible only to your own account. Users of the same company see their company's files.
• Even we as the operator only see a file once you place an order – at that point we need it for manufacturing.
• They are stored on the server encrypted (AES-256-GCM). The key is held by a separate service that is isolated from the web interface. Backups therefore only contain ciphertext as well.
• They are not passed on to third parties. If, exceptionally, we use a subcontractor for an order (e.g. for a coating), they only receive the information required for that operation.

You can delete your files and projects yourself at any time. See Section 14 for details.

7. Orders, quotes and retention

When you order, we process the items, prices, delivery and billing address, the chosen payment and shipping method, and the time at which you accepted the terms and conditions. This is necessary for the performance of the contract (Art. 6(1)(b) GDPR).

We may not simply delete completed business transactions: commercial and tax law require us to retain them – invoices and accounting records for 10 years (Section 147 AO, Section 257 HGB), business letters for 6 years. The legal basis for this is Art. 6(1)(c) GDPR. During the retention period this data is restricted, meaning it is only used for the statutory purposes.

We also keep the manufacturing documents for an order (model, drawing, selected settings) after the order has been completed, so that an order can be traced and a repeat production to the same standard can be carried out (Art. 6(1)(b) and (f) GDPR). They are stored encrypted. If you delete your account, orders and their manufacturing documents are kept without any reference to you as a person.

8. Contact form and email

If you write to us via the contact form or by email, we process your details in order to answer your enquiry. If the enquiry concerns a contract or its preparation, the legal basis is Art. 6(1)(b) GDPR; otherwise it is our legitimate interest in answering it (Art. 6(1)(f) GDPR).

We store enquiries sent via the contact form on ism-zerspanung.de on our server and forward them, together with any attached files, by email to our mailbox. We do not store the files themselves on the server; there we only record their name and size. Emails are sent via our email provider IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, which acts on our behalf pursuant to Art. 28 GDPR. Our mailbox is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In the process, data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR).

How long: We delete the enquiry on our server 12 months after it has been dealt with, and an enquiry that remained unanswered no later than 24 months after receipt. We store the IP address from which the form was submitted only to protect against mass submissions and remove it after 7 days. If your enquiry leads to an order, we keep the business correspondence as a business letter for 6 years (Section 257 HGB, Art. 6(1)(c) GDPR).

To send system emails (address confirmation, password reset, order confirmation) we use an email service provider acting on our behalf pursuant to Art. 28 GDPR. Your email address and the content of the message are transmitted for this purpose.

9. Map on the contact page (Google Maps)

On the contact page you can display a map from the Google Maps service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded when you click “Load map from Google”; before that there is no connection to Google.

When you click, your browser retrieves the map directly from Google. Google thereby receives your IP address, information about your browser and device, and the fact that you visited our contact page; Google may set cookies and transfer data to Google LLC in the USA (EU-US Data Privacy Framework, Art. 45 GDPR). The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It applies only to this one page view – we do not remember your choice, and on your next visit the map is off again. How Google uses the data is described by Google at policies.google.com/privacy. We ourselves do not store anything in the process.

10. Job applications

If you apply to us – via the contact form, by email or by post – we process the information and documents you send us: name and contact details, cover letter, CV, certificates and proof of qualifications, a photo if provided, and our notes from interviews with you.

• Purpose: deciding whether to enter into an employment or apprenticeship relationship with you.
• Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract) in conjunction with Section 26 BDSG. If you tell us of your own accord about special categories of personal data – for example a severe disability, so that we can take it into account – we process them under Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG. Please do not send us information of this kind that is not required for the position (for example about health, religion or political opinions).
• Who sees them: only the management and, where necessary for the position, the responsible workshop manager. They are not passed on to third parties. Technically, applications sent via the form or by email reach us in the same way as other messages, i.e. via IONOS into our mailbox at Google (Section 8). An ordinary email is not always encrypted in transit; the form is transmitted encrypted. If you prefer, send your documents by post.
• How long: if we hire you, we add the documents to your personnel file. Otherwise we delete them 6 months after the application process is completed – on the server, in the mailbox and on paper. We need this time to be able to defend ourselves against claims under the German General Equal Treatment Act, which must be asserted within two months and brought to court within a further three months (Section 15(4) AGG, Section 61b ArbGG); the legal basis for this is our legitimate interest (Art. 6(1)(f) GDPR). An application on which no decision was made is deleted no later than 12 months after receipt.
• Longer only with your consent: if we would like to keep your documents for future positions, we will ask you explicitly beforehand (Art. 6(1)(a) GDPR). You can withdraw your consent at any time. Without it, we do not keep a pool of applicants.
• Obligation to provide data: you are not obliged to give us any data. Without documents, however, we cannot consider your application.

11. Security log and protective measures

Logins, failed login attempts and security-relevant changes to accounts are logged with time, user and IP address. This serves to detect attacks and, in the event of a dispute, to trace who initiated what (Art. 6(1)(f) GDPR). These entries are deleted after 12 months.

To protect against unauthorised access we also use: encryption in transit (TLS), encrypted storage of part files, a limit on login attempts, automatic logout after inactivity and – on request – two-factor authentication.

Backups: so that nothing is lost in the event of a failure, we back up the data regularly, including at a second location in Germany. Deleted information does not disappear from these backups immediately but when the respective backup expires, after 12 months at the latest. Until then it is not used; should we ever have to restore a backup, we delete it again.

12. Who receives data from us

We do not sell data and do not pass it on for advertising purposes. Recipients are only those necessary for the respective purpose:

• Service providers acting on our behalf (Art. 28 GDPR): netcup GmbH (server, Section 3), IONOS SE (sending the contact form by email, Section 8) and the provider for system emails.
• Google Ireland Limited for our mailbox (Section 8) and – only after your click – for the map (Section 9), in each case with a possible transfer to Google LLC in the USA.
• Parcel service or freight forwarder: name, delivery address and, if needed for delivery, phone number – so that the parts arrive (Art. 6(1)(b) GDPR).
• Subcontractors for individual operations, such as a coating: only the information required for that operation (Section 6).
• Tax advisers and banks: billing and payment data for bookkeeping and payment transactions (Art. 6(1)(b) and (c) GDPR).
• Authorities, where we are legally obliged to disclose data (Art. 6(1)(c) GDPR).

Data is transferred to a country outside the European Union only in the two cases involving Google mentioned above.

13. Automated decisions

Pricing is automated: the application calculates key figures from your 3D model and from these a price proposal. This calculation has no legal effect on you – it is non-binding information, and a contract is only concluded through our order confirmation. An automated decision within the meaning of Art. 22 GDPR, such as an automatic rejection of your order, does not take place.

14. Your rights

You have the following rights towards us:

• Access (Art. 15 GDPR) – which data we process about you.
• Rectification (Art. 16 GDPR) – correcting inaccurate data.
• Erasure (Art. 17 GDPR) – unless a retention obligation prevents it.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) – your data in a common, machine-readable format.
• Objection (Art. 21 GDPR) – see Section 15 below.
• Withdrawal of consent (Art. 7(3) GDPR) – with effect for the future. The lawfulness of processing up to the withdrawal remains unaffected.
• Complaint to a supervisory authority (Art. 77 GDPR) – see Section 16.

For everything else, an informal message to info@ism-zerspanung.de is sufficient.

15. Your right to object (Art. 21 GDPR)

16. Complaint to the supervisory authority

You can lodge a complaint with a data protection supervisory authority at any time. The authority responsible for us is:

17. Provision of your data

The information in your account and for an order is required to conclude and perform the contract. Without it we cannot maintain an account or deliver. There is no further obligation to provide us with data.

18. Changes to this policy

If our processing changes, we update this policy accordingly. The version published here applies. The date at the top tells you when it was last revised.