Privacy policy

Last updated: November 2026

1. Controller

ETHMO GmbH, Muldenäckerstr. 24, 70378 Stuttgart, Germany
Represented by the managing director: Orhan Cicek
Email: info@fototalo.de

We have not appointed a data protection officer because we are not legally required to.

2. Overview

This is a static website. We use no cookies, no analytics or tracking tools, no advertising pixels, and no external fonts or social media plugins. We process personal data only when you visit the site (hosting) and when you contact us via the form or by email.

3. Hosting and server log files

The website is hosted by Cloudflare (Cloudflare Pages): Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you visit the site, Cloudflare processes technically necessary data such as your IP address, date and time, the page requested, browser type and operating system, in order to deliver the site and protect it from attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing the website securely and reliably). We have a data processing agreement (Data Processing Addendum) with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework. Transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR) or EU Standard Contractual Clauses. Cloudflare stores log data only for a short time.

4. Request form (mini-check and packages)

If you use the form, we process your name, email address, store URL, company, VAT ID (if provided), the package you selected and your message. We use this data to handle your request, to carry out the free mini-check of your publicly accessible store, to send you the result, and, if you order, to prepare the contract and invoice.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request and performance of a contract).

Form service: Form submissions are forwarded to our email inbox through FormSubmit (formsubmit.co, operated by DevSquad, USA). Your details and IP address are transmitted to FormSubmit and may be processed in the USA. The USA does not have a level of data protection equivalent to EU law unless the provider is certified under the EU-US Data Privacy Framework. In particular, US authorities may be able to access the data. The transfer is based on your consent (Art. 49(1)(a) GDPR), which you give by submitting the form. If you don't want this, please email us directly instead.

Requests are received in an email inbox managed for us by our service provider and stored in our business email account. We delete requests once they have been dealt with, unless statutory retention obligations apply (for example under the German Commercial Code (HGB) and Fiscal Code (AO) if a contract is concluded, for up to 10 years). Requests that do not lead to an order are deleted after 12 months at the latest.

5. Contact by email

If you email us, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR). The deletion periods in section 4 apply.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). To exercise these rights, contact info@fototalo.de.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

7. No automated decision-making

We do not use automated decision-making, including profiling, under Art. 22 GDPR. We use automated testing tools for the mini-check. They assess only the technical properties of your website, not you as a person.

8. Whether you must provide data

Providing data in the form is voluntary. Without your name, email address and store URL, however, we cannot carry out the mini-check.

This English privacy policy corresponds to the German version used for our sister service Barrierefix.