Privacy notice for order.mach-mich.de

Version: DS-1.0 · Stand: 25.09.2026

1. Data controller

The data controller responsible for processing your personal data on this page is:

Karley Deutschland GmbH Herner Str. 15b 45657 Recklinghausen Germany

represented by managing director Karsten Ley Recklinghausen Local Court, HRB 5605 VAT ID DE251382615

Phone: +49 2361 979231-0 Email: canprintweb@karley.eu

For data protection questions, please contact Thomas Böttcher at the business address given above.

2. Purpose of this page

order.mach-mich.de lets you apply for an instance of our order software canprintweb, used to order printed cookies at market and fair stands. There are two paths: applying as a commercial market operator, or applying as a non-profit association or private individual with a voucher code for free use.

3. What data we process

When you submit an application, we process:

• all information from the form: country, company/association name, legal form, legal representative, address, email address, phone number, VAT ID or tax number, small-business status, register court and registration number, supervisory authority, requested username, and market name and period;
• for associations and private individuals, additionally: the voucher code, event start and end dates, an event description, the event website, the type of non-profit proof, a reference number, and — optionally — a proof PDF;
• the IP address the application was submitted from — it is stored together with the application;
• the time of the application and your chosen language;
• the consents you gave (privacy notice, terms of use), each with a timestamp and the version of the text you agreed to.

4. Spam and abuse protection

The form is protected against automated abuse: a form field that is invisible to humans (honeypot), a signed arithmetic challenge with a one-time nonce (captcha), and a limit on the number of applications per IP address and time period (rate limiting). For this we keep a table of IP addresses and timestamps, which is automatically deleted after one day. We do not use any external service for this — no reCAPTCHA and no comparable third-party offering.

5. Cookies

This page uses only strictly necessary cookies:

• a session cookie that protects the form against cross-site request forgery (CSRF); it expires when you close your browser session;
• a cookie named antrag_sprache that stores your chosen language for one year.

The legal basis for both cookies is § 25 (2) no. 2 TDDDG (the German Telecommunications Digital Services Data Protection Act), as they are strictly necessary to provide the function you explicitly requested (submitting the form in your chosen language). We do not set any analytics, tracking, or advertising cookies, do not use Google Fonts, and do not embed any other external services.

6. What happens to your application

After you submit the form, we send a confirmation link to the email address you provided. If you do not confirm your email address within 24 hours, the confirmation link expires; unconfirmed applications are then deleted automatically — at the latest after 7 days, including any uploaded proof PDF.

We manually review confirmed applications and inform you of the outcome by email. If your application is approved, we set up your instance, transfer the application data into our management application (contract data) as well as into the new instance's operator profile and legal notice, and send you your access credentials by email.

7. Legal bases

We process your data on the following legal bases:

• Art. 6 (1)(b) GDPR, to the extent processing serves to initiate and perform a contract for providing canprintweb;
• Art. 6 (1)(f) GDPR for spam and abuse protection and to prove your consents; our legitimate interest lies in a working, abuse-free application page and in being able to demonstrate contract negotiations;
• Art. 6 (1)(c) GDPR for the commercial- and tax-law retention obligations that apply once a contract has been concluded (6 or 10 years under German law, §§ 257 HGB, 147 AO).

Providing your data is not required by law. However, without the information marked as required, we cannot enter into a contract with you for providing a canprintweb instance.

8. Recipients and processors

Our servers are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany — hosting takes place exclusively within Germany. Our confirmation and outcome emails are sent from a mailbox with STRATO AG, Berlin. We do not transfer your data to countries outside the EU/EEA. No automated decision-making within the meaning of Art. 22 GDPR takes place.

9. Retention period if your application is rejected

If your application is rejected, we delete your data at the latest twelve months after the rejection.

10. Your rights

Under Articles 15 to 21 GDPR you have the right to access, rectify, erase, and restrict the processing of your data, as well as the right to data portability. You may object at any time to processing based on Art. 6 (1)(f) GDPR.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestr. 2–4 40213 Düsseldorf, Germany

11. Note on the individual order pages

This privacy notice applies only to order.mach-mich.de. The privacy notice for each individual order page (each canprintweb instance, e.g. <code>.mach-mich.de) is provided by that instance's operator — the operator is the data controller for the data of its own end customers.

---

In case of any discrepancy between this English translation and the German original, the German version (datenschutz.de.md) is authoritative.