Last updated: 8 October 2026. This is a translation; in case of doubt, the German version applies.
1. Controller
The controller for data processing on this website and for handling your requests is:
Grexon GmbH
Dornierstraße 16
89231 Neu-Ulm, Germany
Phone: +49 731 80159 777
Email: info@grexon.com
Commercial register: Amtsgericht Memmingen, HRB 20842
Our sister company Grexon Elektronik Hizmetler ve Ticaret A.Ş., Kadıköy/İstanbul, Türkiye, looks after Turkish-speaking customers. Requests from our Turkish-language pages are forwarded to this team (see section 14).
Please send data protection questions to info@grexon.com.
2. General
We process personal data only where this is necessary to run this website, answer your request or prepare and perform a contract, or where you have given consent. You are not legally or contractually obliged to provide data, but without the details in the request form we cannot prepare a quote.
3. Hosting and server log files
This website runs on a cloud server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; the server is located in Nuremberg, Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner. When you visit the site, technically necessary data is processed: IP address, date and time, page requested, amount of data transferred, referrer, browser and operating system. The purpose is secure and stable operation of the website. Legal basis: Art. 6(1)(f) GDPR. Server log files are deleted after 14 days.
4. Quote request forms
When you request a quote through our forms, we process: the service you need (fulfillment and/or storage), approximate volume, name, company, email address, phone number, optionally your message, and the page language. We also store technical source information: page visited, referrer, campaign parameters (UTM) and, if you came from an ad, the ad click ID (e.g. gclid, gbraid, wbraid, fbclid). To prevent abuse, we use your IP address only in salted, hashed form: to limit requests per hour (the counter is deleted after one hour) and as a shortened hash stored with the request to detect spam.
The purpose is to handle your request, prepare a quote and contact you by email or phone. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps). We process the source information to measure the success of our advertising on the basis of Art. 6(1)(f) GDPR.
Requests are stored in our WordPress system and our sales team is notified by email. Emails are sent via SMTP2GO (Sand Dune Mail Ltd, 96–106 Manchester Street, Christchurch 8011, New Zealand); New Zealand has an EU adequacy decision. Older contact forms on the website (Contact Form 7) also store submissions in the Flamingo plugin on our server.
Retention: requests that do not lead to a contract are deleted automatically 24 months after the last processing step; submissions identified as spam after 30 days. If a contract is concluded, statutory retention periods apply (up to 10 years under German commercial and tax law).
5. Contact by email, phone and WhatsApp
If you contact us by email or phone, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR).
The website contains links to WhatsApp (wa.me). WhatsApp only opens when you click such a link; the provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and WhatsApp’s privacy policy applies. Transfers to the USA are possible. You can always reach us by form, email or phone instead.
6. Cookies and consent management
We use the consent tool Complianz. Technically necessary cookies are set on the basis of Section 25(2) TDDDG and Art. 6(1)(f) GDPR. All other cookies and similar technologies (statistics, marketing) are used only with your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You can change or withdraw your choice at any time via the cookie icon or cookie settings on the website. We use Google Consent Mode v2: without consent, no advertising or analytics cookies are set.
7. Google Tag Manager
We use Google Tag Manager by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager itself sets no cookies; it loads the services below according to your consent. Your IP address is transmitted to Google in the process. Legal basis: Art. 6(1)(a) GDPR.
8. Google Ads and conversion measurement
We advertise via Google Ads (Google Ireland Limited). With your consent, we measure whether a request was sent, or a phone, WhatsApp or email link was clicked, after an ad click (conversion tracking). Cookies are set and data such as click ID, time and type of action is sent to Google.
Enhanced conversions: after you submit the form, your email address and, if entered in international format, your phone number are hashed with SHA-256 in your browser and sent to Google only in this form, so the request can be matched to an ad. Google does not receive the plain-text data.
Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Transfers to Google LLC in the USA are possible; Google is certified under the EU-US Data Privacy Framework. More information: https://policies.google.com/privacy
9. Google Analytics 4 and Google Site Kit
With your consent we use Google Analytics 4 (Google Ireland Limited), integrated via the WordPress plugin Google Site Kit, to analyse website use statistically (e.g. pages viewed, time on page, device, approximate location, requests and contact clicks). IP addresses are not stored in the EU. Legal basis: Art. 6(1)(a) GDPR. Event data is kept for no more than 14 months.
10. Meta Pixel
With your consent we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure the effectiveness of ads on Facebook and Instagram and to build audiences. Cookies are set and data about your visit is sent to Meta; transfers to the USA are possible (Meta is certified under the EU-US Data Privacy Framework). We are joint controllers with Meta for collection and transmission (Art. 26 GDPR). Legal basis: Art. 6(1)(a) GDPR.
11. Contentsquare
With your consent we use Contentsquare (Contentsquare SAS, Paris, France) to improve the usability of the website. Mouse movements, clicks, scrolling and page views are recorded in pseudonymised form; entries in form fields are not recorded. Legal basis: Art. 6(1)(a) GDPR.
12. Google reCAPTCHA
To protect our general contact forms against spam we use Google reCAPTCHA (Google Ireland Limited). Among other things, your IP address and usage behaviour are sent to Google. Legal basis: Art. 6(1)(f) GDPR; where information is stored on or read from your device, Section 25 TDDDG. reCAPTCHA is not used on our quote pages.
13. External content: Google Fonts, YouTube, Gravatar
Google Fonts: some fonts are loaded from servers of Google Ireland Limited, which transmits your IP address to Google. Legal basis: Art. 6(1)(f) GDPR (consistent display).
YouTube: videos are embedded in privacy-enhanced mode (youtube-nocookie.com). Data is sent to YouTube (Google Ireland Limited) only when you play a video. Legal basis: Art. 6(1)(a) GDPR.
Gravatar: to display profile pictures, the Gravatar service of Automattic Inc., USA, may be called, which transmits your IP address. Legal basis: Art. 6(1)(f) GDPR.
14. Recipients and transfers to third countries
Recipients of your data are our sales team and the service providers named above, which we use as processors. Requests from our Turkish-language pages are forwarded to Grexon Elektronik Hizmetler ve Ticaret A.Ş. in İstanbul so that you can be served in Turkish. There is no EU adequacy decision for Türkiye; the transfer is based on EU standard contractual clauses (Art. 46(2)(c) GDPR). Transfers to other third countries take place only on the basis of an adequacy decision (e.g. EU-US Data Privacy Framework, New Zealand) or appropriate safeguards.
15. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Contact info@grexon.com.
Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.
Right to lodge a complaint: you may complain to a data protection supervisory authority. Our competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, poststelle@lda.bayern.de.
16. Changes
We update this privacy policy when our website or the legal situation changes. The version published here applies.