Last updated: September 2026

This English version is a translation for your convenience. Only the German version is legally binding.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

RiLO Systemtechnik GmbH & Co. KG
Weinerpark 9-11
48607 Ochtrup
Germany

Phone: +49 2553 91 795 - 00
Email: info@rilo-systemtechnik.de

You can contact us about data protection matters using the contact details above.

2. General information

The protection of your personal data is important to us. We process personal data solely within the framework of applicable law, in particular the GDPR and the German Federal Data Protection Act (BDSG).

Personal data is any information relating to an identified or identifiable natural person, such as name, email address, telephone number or technical connection data.

The content pages of this website are static and there are no user accounts. We process personal data when you access the website (section 3), when you write to us using the contact form (section 4), when you request data sheets (section 5) and when you contact us by email or telephone or apply to us (sections 6 and 7). How we handle data on our LinkedIn and Instagram profiles is described in section 11.

3. Provision of the website and server log files

Each time this website is accessed, the hosting provider automatically processes information transmitted by your browser, in particular:

IP address of the accessing device
date and time of access
page or file requested
amount of data transferred and status message
browser type and version and operating system
the previously visited page (referrer), where transmitted

This processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional provision of the website and in preventing and investigating attacks. Transmission between your browser and the website is encrypted via HTTPS/TLS.

Hosting and email

This website is hosted by united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. The provider stores the website on its servers and delivers it. Our mailboxes, through which the contact form and the data sheet service send their emails, are also hosted there.

When the website is accessed, the provider processes the server log files described above where required for delivery, stability and security (Art. 6(1)(f) GDPR). It processes the data on our behalf; we have concluded a data processing agreement with it under Art. 28 GDPR.

4. Contact form

On the "Contact" page you can write to us using a form. Mandatory fields are your name, your email address and your message. Company, telephone number and the choice of what your enquiry is about are optional.

We process this information in order to handle and answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering your enquiry. We do not use the information for advertising or a newsletter and do not pass it on to third parties.

When you send the form, your enquiry reaches our mailbox at united-domains (section 3) as an email.

Protection against automated submissions

To prevent the form from being misused by programs, we check every submission. We use no third-party services and no cookies for this:

When the page is loaded, your browser receives a signed timestamp and a computational task from our server, which it solves itself while you fill in the form. Neither contains any information about you.
The form contains fields that only programs see and fill in.
We use the origin information sent by your browser to check whether the submission comes from this website.
To limit large numbers of submissions within a short time, our server stores the time of each submission. It is not linked to your IP address itself but to a value derived from it using a secret key (pseudonymisation). These entries are deleted after two days.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the form against spam and misuse.

Blocked addresses

Before we process a request, we check your email address against an internal list of addresses and domains from which we do not accept requests. If your address is on it, we do not process the request. Instead, we receive an email about the attempt with your email address, your name, your company and the topic you selected, but not your message. So that this happens at most once a day, the server stores a pseudonymised value derived from the address, which is deleted after two days.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in deciding for ourselves whom we deal with and in learning when a blocked address tries nonetheless.

5. Data sheets by email

We send you our data sheets as a link by email. Mandatory details are your name, your company and your email address. Your telephone number, your field of work ("I work in") and the request that we contact you about your project are optional.

We process this information in order to send you the link and to provide the data sheet under our terms of use. The legal basis is Art. 6(1)(b) GDPR.

At the same time we receive an email with your details, the data sheet requested and the time of the request. When you download a data sheet for the first time, we receive another one. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in knowing who uses our data sheets and in being able to handle project enquiries in a targeted way.

Before downloading, you agree to our terms of use for data sheets. The message about the first download records that you agreed and to which version. We keep it as proof until claims under these terms are time-barred (Art. 6(1)(b) and (f) GDPR).

If you have ticked the box asking us to contact you about your project, we will write to you, or call you if you have given a telephone number. The legal basis is then your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, for example by email to datenblatt@rilo-systemtechnik.de. Without this tick we do not use your details for advertising. There is no newsletter, and we do not pass your details on to third parties.

The emails are sent via our mailbox datenblatt@rilo-systemtechnik.de at united-domains (section 3). So that the link works, our server stores your details under a random identifier for as long as the link is valid: 7 days. After that it deletes them automatically. The link itself contains only this identifier and the data sheet requested, no information about you.

We protect this form against automated requests in the same way as the contact form (section 4). In addition, we limit how many links are sent to the same email address per day. For this the server does not store the address but a pseudonymised value derived from it, which is deleted after two days. The legal basis here is also Art. 6(1)(f) GDPR.

We treat blocked addresses in the same way as for the contact form (section 4), including downloads via a link sent earlier. If the address has been added to the list in the meantime, we delete the stored request and receive an email about the attempt with your details and the data sheet requested.

6. Contact by email and telephone

You can also reach us by telephone or email. In that case we process the information you provide (e.g. name, telephone number, email address and the content of your enquiry) in order to handle your enquiry and answer project-related questions.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR (handling general enquiries). When sending an email, the terms of your email provider additionally apply.

7. Applications by email

If you apply for an advertised position or send us an unsolicited application by email, we process the application data you provide (e.g. contact details, CV, qualifications, certificates and message text) solely to carry out the application process and decide whether to establish an employment relationship.

The legal basis is Art. 6(1)(b) GDPR where processing is required to decide whether to establish an employment relationship. If you tell us about special categories of personal data, such as a severe disability, we process them under Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG. Where we ask for your consent, for example for an applicant pool, the legal basis is Art. 6(1)(a) GDPR.

Within our company, only persons involved in the application process have access to application data. Application data is deleted once the process has been completed and no statutory retention obligations or legitimate interests, in particular for the establishment, exercise or defence of legal claims, prevent deletion. Inclusion in an applicant pool takes place only with separate consent.

8. Cookies and local storage

This website sets no analytics, tracking or marketing cookies and does not use local storage in the browser (localStorage/sessionStorage). No analytics, tracking or marketing technologies are used. The contact form, data sheet requests and the protection against automated submissions also work without cookies.

For password-protected preview access, a technically necessary cookie named "rilo_gate" is set after successful login. The password entered is used solely to verify preview access and is not stored in plain text. The cookie stores only the access value for the preview, is limited to this domain, is set with HttpOnly and SameSite=Lax and expires after 7 days.

The legal basis for storing and reading this cookie is Section 25(2) no. 2 TDDDG. The related processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to protect the password-protected preview and to allow logged-in users access during the preview phase. Apart from this, no consent-requiring cookies or comparable technologies are used; no cookie banner is therefore displayed.

9. Fonts and other content

Fonts, images, 3D models, videos and PDF files are delivered by our own server. The website does not load any content from third-party servers; its security policy (Content Security Policy) does not technically permit this either. In particular, there is no connection to third-party font services (e.g. Google Fonts); no personal data is transmitted to third parties for this purpose.

10. Links to other websites

This website contains links to other websites, for example to our profiles on LinkedIn and Instagram, to map services (Google Maps, Apple Maps) on the "Directions & delivery" page and to external sources. This content is not embedded in the website and loads nothing unless you click the link. Only when you click do you leave our website; from that point the privacy policy of the respective provider applies.

11. Our profiles on LinkedIn and Instagram

We have company profiles on LinkedIn and Instagram. When you visit these profiles, follow us there, comment on posts or send us messages, the respective operator processes your data under its own privacy policy; data may also be transferred to the USA. We see what you share publicly there or write to us, such as your profile name and your message.

The operators also provide us with statistics on how our profiles are used, such as views and interactions. These statistics are aggregated and contain no information about individual persons. We are joint controllers with the respective operator for them (Art. 26 GDPR).

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. In an agreement, LinkedIn has taken on the obligations under Art. 12 to 22 and 32 to 34 GDPR for the statistics: joint controller agreement, LinkedIn privacy policy.
Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, for Instagram: Instagram privacy policy.

You can exercise your rights with us or with the respective operator. Usually only the operator can implement them, because only the operator has access to the user data.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in informing people about our company and our systems and being reachable there.

12. Services not used

In the current state of this website, the following services in particular are not used:

no Google Analytics or other web analytics
no externally loaded Google Fonts (fonts are delivered locally)
no YouTube or other video embed
no embedded Google Maps
no reCAPTCHA or other third-party captcha service
no social media plugins
no marketing, remarketing or social media tracking tools
no newsletter

13. Recipients, third-country transfers and automated decisions

Personal data is disclosed only as described in this privacy policy, where required to handle your enquiry or application, where legally required or where we have another legal basis. The main recipient is united-domains as our hosting and email service provider (section 3); IT and telecommunications service providers may also be recipients.

This website does not transfer personal data to a third country or an international organisation; for our profiles on social networks, see section 11. Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

14. Requirement to provide personal data

Providing personal data is neither legally nor contractually required for merely using the website. Technical access data is processed automatically for technical reasons when the website is accessed so that the website can be delivered.

If you contact us using the contact form, by email or by telephone or apply to us, the information required in each case is necessary so that we can process your enquiry or application. In the contact form, this is your name, email address and message; when requesting data sheets, your name, company and email address. Without this information, processing is not possible or is possible only to a limited extent.

15. Storage period

We process and store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods.

Enquiries you send us using the contact form, by email or by telephone are deleted once they have been dealt with conclusively and no statutory retention obligations or legitimate interests prevent deletion. The pseudonymised entries used to limit submissions and notifications about blocked addresses are deleted after two days. Entries on our block list remain for as long as the reason for the block persists. The details of data sheet requests are stored on our server for 7 days, as long as the link is valid. We delete our messages about them once we no longer need them to handle enquiries and no statutory retention obligations prevent deletion; the message about the first download once claims under the terms of use are time-barred. Server log files are stored by the hosting provider only for as long as necessary for operation and security and are then deleted.

16. Your rights

Subject to the statutory requirements, you have the following rights:

access (Art. 15 GDPR)
rectification (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
objection to processing (Art. 21 GDPR)

Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR).

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is in particular:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf, Germany

If you have any questions about data protection or the exercise of your rights, you can contact us at any time using the contact details above.

18. Status and changes to this privacy policy

This privacy policy reflects the currently published state of this website. As the website develops or due to changed legal requirements, adjustments may become necessary. The version published on this page applies.

Privacy policy