Information pursuant to Section 5 of the German Digital Services Act (DDG)

Histora UG (haftungsbeschränkt)
Fischmarkt 8 A
35578 Wetzlar, Germany

Represented by the Managing Director: Hasan Varli

Contact

Email: info@historaparaffin.com
Contact form: see section Contact

Register entry

Register court: Local Court (Amtsgericht) Wetzlar
Register number: HRB 9758

VAT identification number pursuant to Section 27a of the German VAT Act (UStG): DE465078092

Responsible for content pursuant to Section 18(2) of the German Interstate Media Treaty (MStV)

Hasan Varli, Fischmarkt 8 A, 35578 Wetzlar

Note: Our offer is aimed exclusively at companies, institutes and public institutions, not at consumers.

Last updated: 6 November 2026

This privacy policy informs you about how we process personal data when you visit our website, when you contact us and in the context of our business relationships. Personal data is any information relating to an identified or identifiable natural person. This also includes names and business contact details of contact persons at companies and institutions.

1 Controller and contact

The controller responsible for data processing is:

Histora UG (haftungsbeschränkt)
Represented by the Managing Director Hasan Varli
Fischmarkt 8 A
35578 Wetzlar
Germany
Email: info@historaparaffin.com

If you have any questions about data protection or wish to exercise your rights, you can contact us at this email address.

2 Visiting our website

Hosting by Netlify

We use Netlify for the technical provision and delivery of our website. The provider is Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA.

When the website is accessed, Netlify processes the technical data required for the connection and delivery. This includes in particular your IP address, the time and target of the access and the connection and device information transmitted by your browser. The processing serves to provide the website, analyse errors and defend against attacks and misuse.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable and secure provision of our website.

Netlify processes the personal data processed on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. Netlify uses sub-processors for its services. Information about them is available at https://www.netlify.com/trust-center/.

When Netlify is used, personal data may be processed in the USA. Netlify, Inc. participates in the EU-US Data Privacy Framework. Insofar as the specific data transfer is covered by it, the transfer is based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR. Where necessary, the further transfer safeguards agreed in the Netlify contract apply, in particular the EU Standard Contractual Clauses. The agreement, including the transfer safeguards, is available at https://www.netlify.com/pdf/netlify-dpa.pdf. You can also request a copy of the relevant safeguards from us. Information about the framework and the participating companies is available at https://www.dataprivacyframework.gov/.

Technical log data

To ensure operation and to detect errors and security incidents, technical access data is processed in logs. This may include the address accessed, IP address, date and time, response status, amount of data transferred, browser information and the previously visited page, insofar as this is transmitted.

For the technical infrastructure logs, Netlify describes in the technical and organisational measures of its data processing agreement a retention period of 90 days in online access and one year in offline archiving. This information relates to the central system and security logging of the hosting provider; the log history visible in the customer account may differ from this. The relevant provider information can be found in Exhibit II of the data processing agreement available at the link above.

Insofar as we secure individual logs to investigate a specific malfunction or security incident, their further storage period depends on what is necessary to investigate and remedy the incident and, where applicable, to secure and enforce related legal claims. These additional copies are then deleted unless there is a legal obligation to retain them further.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in secure operation and in the investigation of technical malfunctions and attacks.

Encrypted connection

Our website uses HTTPS with TLS encryption. This protects data transmission between your browser and our website. In the case of ordinary email communication, the protection of the transmission path also depends on the email services involved.

3 Fonts and browser functions

Fonts and embedded content

Fonts available on your device are used for display. No font files are retrieved from Google Fonts or other external font providers. The images used on the website are embedded in the website.

Cookies and browser data

The public website code provided by us does not use cookies. We use browser storage exclusively for the language selection, as follows: if you choose a language yourself using the “DE | EN” language switch, we store this choice (“de” or “en”) in your browser’s local storage. This means that the language version you selected is displayed again the next time you open our home page. This entry remains stored until you choose a different language or delete the website data in your browser.

When you switch language, we also temporarily place the section of the page currently displayed, your product selection and any form entries you have already made but not yet sent in your browser’s session storage so that they are retained in the other language version. This data is deleted immediately after the other language version has loaded, and at the latest when the browser window or tab is closed. The information placed in this browser storage remains on your device and is not transmitted to us or to third parties.

Without a manual choice, the language version is selected when the home page is opened on the basis of the language setting provided by your browser; this evaluation takes place locally in your browser without anything being stored for this purpose.

The storage and access only take place if you switch the language yourself and are strictly necessary for this function, which you have expressly requested (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). Insofar as personal data is processed in this context, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing our website in German and English in a user-friendly manner.

We do not use any browser-based analytics, advertising or marketing tracking services. No HubSpot tracking code is loaded on the website either. The processing of the enquiries you actively submit in the CRM is described in section 5. We explain the technically necessary processing during hosting and form submissions in sections 2 and 4.

Access to protected website versions

Insofar as access to a website version is restricted by Netlify to authorised persons, Netlify processes the account, connection and session information required for login and for checking access authorisation. Any storage on or access to the device that is technically necessary for this purpose takes place on the basis of Section 25(2) no. 2 TDDDG. The processing of personal data initiated by us for this purpose is based on Art. 6(1)(f) GDPR; our legitimate interest is the protection of non-public website versions against unauthorised access. Information about Netlify can be found in section 2; for the administration of your own Netlify account, Netlify’s privacy notice at https://www.netlify.com/privacy/ also applies.

Links to other websites

Our website contains ordinary links to external websites, for example professional profiles or information services. A connection to these providers is only established through the respective link when you open it. The operator of the external website is responsible for the subsequent processing on that website.

4 Contact enquiries

Purposes and data

If you contact us via the contact form or by email, we process the data you submit. In the form, this includes in particular your name, company or institution, email address, subject of your enquiry, where applicable country, desired melting range and pack size, annual requirement and message. In addition, there are technical form identifiers for assigning the submission and the information as to which language version of the website (German or English) was used to send the enquiry. Emails may also contain further contact details and attachments provided voluntarily. We use the information to process your request, to answer queries and, where applicable, to prepare a quote, a test delivery or an order.

Contacting us is voluntary. In principle, there is no legal obligation to provide us with personal data via the contact form or by email. In the form, your name, laboratory or institution and email address are mandatory. When requesting a test package, the country is also required; if “Other country” is selected, it must be specified. Without the information required in each case, the form cannot be submitted in full. Further information is voluntary. If additional information is required for proper processing, we will ask for it. For the conclusion and performance of a contract, the contact, order and processing data required for this must be provided; otherwise, it may not be possible to conclude or perform the contract.

Please limit your information to what is necessary for your enquiry and do not submit any patient data or other health data via the general contact form.

Legal bases

Art. 6(1)(b) GDPR applies insofar as the processing is necessary for a contract with you as a natural person or for pre-contractual measures at your request.

If you act as a contact person for a company or institution, we generally process the business data required for this on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in communication and in the initiation and handling of business relationships with the respective organisation. This requires a balancing against your interests and rights. We also process other general enquiries on the basis of our legitimate interest in providing an appropriate response pursuant to Art. 6(1)(f) GDPR.

Insofar as we are subject to statutory documentation or retention obligations, the legal basis is Art. 6(1)(c) GDPR in conjunction with the relevant statutory provisions.

Contact form and Netlify Forms

Our contact form is processed via Netlify Forms. Your form entries are transmitted to Netlify, stored there and made available to us for processing. The information on Netlify relevant to hosting and transfers to third countries can be found in section 2. Insofar as we manage your enquiry in our CRM, section 5 also applies.

In addition, the form contains a spam field that regular visitors do not fill in, known as a honeypot. If this field is filled in, Netlify may reject the submission as automated misuse. Google reCAPTCHA is not integrated into the form.

Netlify automatically checks form submissions for spam using Akismet. For this purpose, Netlify uses Automattic, Inc., USA, as a sub-processor. The check may cover the submitted form content and the accompanying technical data transmitted for the spam check. The purpose is to detect unwanted and abusive submissions and to protect our communication channels. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protection against spam and misuse. The sub-processing takes place within the framework of the conditions agreed with Netlify. The sub-processing and any international data transfers are integrated into the data protection terms and safeguards agreed with Netlify; see section 2. For the majority of its spam-related data, Akismet states retention periods of two weeks to 90 days and, for a small portion, longer storage. These provider periods must be distinguished from the storage of your actual enquiry at Histora and in Netlify Forms. Further information is available at https://akismet.com/privacy/.

Processing of emails

For receiving, sending and storing our emails, we use goneo Internet GmbH, Dresdener Straße 18, 32423 Minden, Germany. In doing so, goneo processes in particular sender and recipient addresses, communication metadata as well as message content and attachments, insofar as this is necessary for the provision and security of the email service. The processing serves communication and the handling of your enquiry; the legal bases stated above apply. The retention of messages is governed by the rules on enquiries and business records in this policy. Further information about goneo is available at https://www.goneo.de/datenschutz.

Storage period of enquiries

Simple enquiries that have been fully processed, have not led to a contract and are not subject to any statutory retention obligation are deleted no later than two years after processing has been completed. The decisive point is the last substantive communication with which the matter was conclusively resolved. This period allows foreseeable follow-up questions to be handled and the preceding communication to be assigned. If this need evidently ceases earlier, we delete the data earlier. This rule also applies to the corresponding copies in Netlify Forms, our email inbox and HubSpot.

If your enquiry develops into a business relationship or forms part of business correspondence subject to retention requirements, the following rules on customer and contract data apply. Data required to secure, assert or defend specific legal claims is stored for the period required for this on the basis of Art. 6(1)(f) GDPR. Once these reasons no longer apply, the data concerned is deleted.

5 Business relationships and HubSpot

Customer and contract data

For the initiation, performance and handling of our business relationships, we process in particular names and functions of contact persons, information about the company or institution, contact, delivery and billing data as well as information about enquiries, quotes, products, quantities, orders, deliveries and payments.

Insofar as you yourself are a contracting party as a natural person, we base the necessary processing on Art. 6(1)(b) GDPR. In the case of contact persons of our business partners, we generally base the processing on Art. 6(1)(f) GDPR after weighing the interests concerned. Our legitimate interest is the proper initiation, organisation and handling of the business relationship. Legally required processing and retention are based on Art. 6(1)(c) GDPR in conjunction with the relevant statutory provisions.

Delivery and other recipients

For storage, order picking and shipping, our commissioned warehousing and shipping service providers as well as transport companies receive the delivery and contact data required in each case. A telephone number is only transmitted insofar as this is necessary for the agreed delivery.

For accounting, tax advice and the fulfilment of legal obligations, the data required in each case may be transmitted to our tax advisers and competent authorities, in particular tax authorities. Legally required transfers are based on Art. 6(1)(c) GDPR. Otherwise, depending on the data subject and purpose, the legal bases under Art. 6(1)(b) or (f) GDPR explained above apply.

We engage service providers who process personal data exclusively on our behalf and in accordance with our instructions on the basis of a contract pursuant to Art. 28 GDPR. Other recipients may themselves be responsible for their own processing as determined by law or contract.

HubSpot CRM

We use HubSpot for the structured processing of enquiries and for managing contacts, quotes, orders and business relationships. In the context of the provision, HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA, in particular is involved in the processing.

The contact and communication data you submit as well as the quote and order information required for the respective business relationship may be stored in HubSpot. The legal bases are Art. 6(1)(b) GDPR in the case of a contract or corresponding contract initiation with you as a natural person and otherwise Art. 6(1)(f) GDPR after balancing of interests. Our legitimate interest lies in orderly, reliable management of customers and prospective customers and in the traceable processing of business transactions. Art. 6(1)(c) GDPR applies to statutory retention obligations.

HubSpot processes the data processed on our behalf on the basis of an agreement pursuant to Art. 28 GDPR. When it is used, personal data may also be processed in or accessed from the USA. HubSpot, Inc. participates in the EU-US Data Privacy Framework. Insofar as a data transfer is covered by it, it is based on the adequacy decision pursuant to Art. 45 GDPR. For any further safeguards required, the contractually incorporated EU Standard Contractual Clauses apply. The data processing agreement, including the transfer provisions, is available at https://legal.hubspot.com/dpa. You can also request a copy of the relevant safeguards from us. Information on sub-processors and processing countries is available at https://legal.hubspot.com/sub-processors-page.

Deletion is governed by the rules for enquiries and for customer and contract data described in this policy. Data relating to ongoing customer relationships is processed for the duration of the necessary support and handling. When the relationship ends, operational contact and CRM data that is no longer required is deleted; business records subject to retention requirements are retained separately in accordance with the following statutory rules.

Retention of business records

We store customer and contract data insofar as this is necessary for the performance and handling of the business relationship. The data is then deleted unless statutory retention obligations or other valid legal bases preclude this.

Under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO), depending on the type of record, retention periods apply in particular of six years for commercial and business letters, eight years for accounting vouchers such as invoices and ten years for certain accounting records and financial statements. The start and duration depend on the respective statutory provision; the periods generally begin at the end of the relevant calendar year. Statutory extensions, in particular for records that are still relevant for tax purposes, must be observed. These periods apply only to the records covered in each case and not across the board to all data of a contact.

Insofar as data is only stored because of a retention obligation, we restrict its processing to this purpose. Art. 6(1)(f) GDPR applies to any further storage necessary for the assertion or defence of legal claims. After expiry of the respective periods and once further legitimate reasons for retention no longer apply, the data is deleted.

6 Your data protection rights

Insofar as the respective statutory requirements are met, you have the right of access to your personal data under Art. 15 GDPR, to rectification under Art. 16 GDPR, to erasure under Art. 17 GDPR and to restriction of processing under Art. 18 GDPR.

Under Art. 20 GDPR, you can request to receive data that you have provided to us and that we process by automated means on the basis of your consent or a contract in a structured, commonly used and machine-readable format. Where technically feasible, you can also request that it be transmitted to another controller.

Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected. A statutory obligation to continue storage may exist irrespective of this.

To exercise your rights, a message to info@historaparaffin.com is sufficient. Processing is generally free of charge; the statutory exceptions apply. We generally respond to your request within one month of receipt. If a legally permissible extension is required, we will inform you of this within this period. Where necessary for secure identification, we may request additional information to confirm your identity.

Objection to processing based on legitimate interests

If we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right under Art. 21(1) GDPR to object at any time on grounds relating to your particular situation. This also applies to profiling based on these provisions.

Following such an objection, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Insofar as personal data is processed for direct marketing, you can object to this processing at any time without giving reasons. This also applies to profiling associated with it. The data concerned will then no longer be processed for direct marketing.

Complaint to a supervisory authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. This applies in particular to the authority in the place of your habitual residence, your place of work or the place of the alleged infringement.

The following supervisory authority in particular is responsible for our registered office in Hesse:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Postfach 3163
65021 Wiesbaden
Phone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
Website and complaint form: https://datenschutz.hessen.de/service/beschwerde-uebermitteln

7 Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The technical spam check is explained in section 4.

8 Promotional contact

Submitting an enquiry does not constitute consent to receive a newsletter. Any later promotional contact will only take place insofar as the applicable statutory requirements are met. We object to the use of the contact details published in the legal notice for unsolicited advertising.