We primarily process data to provide this website and respond to your enquiries. The fonts and videos embedded by Charamel are hosted on our own servers. Optional third-party services — the Zapier contact form including its captcha and audience measurement with Google Analytics 4 — are loaded only after your express consent. Without your consent, no connection to Google or Zapier is established at all. You can withdraw or change your choice at any time using the “Open privacy settings” button in section 5.1 or the “Privacy settings” link in the footer of every page.
The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the member states and other data protection provisions is:
Charamel GmbH
Subbelrather Str. 13
50672 Cologne, Germany
Phone: +49 (0) 221 — 33 66 4-0
Email: contact@charamel.com
Represented by managing directors Alexander Stricker and Norbert Helff
Further information is available in our Legal notice.
You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request correction, restriction or deletion of this data. These and other data protection rights are described in detail in section 8. For any privacy-related matter, you may contact us at the address stated in the legal notice.
This website is hosted by an external service provider (hosting provider). Personal data collected through this website is stored on the provider's servers. This may include IP addresses, contact enquiries, metadata and communication data, contract data, contact details, names, website access data and other data generated through a website.
The hosting provider is used to operate this website on the basis of Article 6(1)(f) GDPR (our legitimate interest in providing a secure, fast and efficient online service) and, where corresponding consent has been requested, on the basis of Article 6(1)(a) GDPR. A data processing agreement pursuant to Article 28 GDPR is concluded with the hosting provider.
Whenever this website is accessed, our system automatically collects data and information from the accessing computer system in server log files. The following data is collected: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the server request and a shortened IP address. This data is processed solely to ensure reliable operation and the security of our information technology systems (Article 6(1)(f) GDPR) and is not combined with other data sources.
Where we obtain consent for processing personal data, Article 6(1)(a) GDPR serves as the legal basis. Where processing is required to perform a contract or take steps before entering into a contract, Article 6(1)(b) GDPR serves as the legal basis. Where processing is required to comply with a legal obligation, Article 6(1)(c) GDPR serves as the legal basis. Where processing is necessary for the purposes of a legitimate interest pursued by us or a third party, and the data subject's interests, fundamental rights and freedoms do not override that interest, Article 6(1)(f) GDPR serves as the legal basis.
Our website uses cookies and comparable storage technologies such as your browser's local storage. Cookies are small text files stored on your device and managed by your browser. We distinguish between the following categories:
Necessary — technically required for the website and consent management to function (e.g. storing your cookie choice in local storage under the key charamel_cookie_consent). The legal basis is Article 6(1)(f) GDPR; consent is not required under Section 25(2) TDDDG.
Functional — enables the embedded Zapier contact form, including the required captcha. The required third-party content is only loaded after you have given consent.
Analytics — enables audience measurement with Google Analytics 4 so that we can understand how this website is used and improve it. The cookies _ga and _ga_3HCBMG46LJ are set with a lifetime of up to 24 months. Details are set out in section 5.6.
Marketing — allows Google to also evaluate the data collected via Google Analytics for advertising purposes (conversion measurement, remarketing, cross-device reporting via Google Signals). Without your consent to this category, we permanently set the corresponding Google Consent Mode signals to “denied”. Beyond this, we do not embed any third-party advertising cookies.
When you first visit this website, our privacy banner informs you about the storage technologies and services in use. Optional services are loaded only after your informed consent; if you decline or make no choice, they remain fully deactivated and no connections to Google or Zapier are established. Your choice is stored locally in your browser, and declining is just as easy as accepting in the banner. You can reopen the settings at any time using the following button or the “Privacy settings” link in the footer of every page and withdraw your consent with effect for the future.
You can also configure your browser to notify you when cookies are set, allow cookies only in individual cases, exclude their acceptance in certain cases or in general, and automatically delete cookies when the browser is closed. Disabling cookies may limit the functionality of this website.
If you send us an enquiry using the contact form, we process the information entered there (name, email address, telephone number and message) to handle your enquiry and any follow-up questions. The form also includes a captcha to prevent automated submissions.
We use Zapier Forms (formerly Zapier Interfaces), a service provided by Zapier, Inc., 548 Market St. #62411, San Francisco, CA 94104-5401, USA, to provide and automatically process contact enquiries. The form is only loaded as external content after you have consented to the “Functional” category or clicked “Load form”. From that point, your browser establishes a direct connection to Zapier and loads the form page and technically required subresources, including the captcha. Even before submission, technical connection data such as your IP address, browser information, referrer, and the date and time of access may be transmitted to the providers involved.
When you submit the form, the information entered is transmitted directly to Zapier, recorded in the Zapier table connected to the form and processed within the automated workflow we have configured. This workflow may create a task from your enquiry in our Asana project management system. Data may be processed in the United States and other countries and stored in the Zap history in accordance with our Zapier account settings. According to Zapier, international data transfers are based, among other mechanisms, on the EU–US Data Privacy Framework and standard contractual clauses. Further information is available in Zapier's privacy policy and its data processing information.
The external form is loaded and accesses information on your device on the basis of your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG). You can withdraw this consent at any time with effect for the future using the button in section 5.1. An enquiry you actively submit is processed on the basis of Article 6(1)(b) GDPR where it relates to a contract or pre-contractual measures. In all other cases, processing is based on our legitimate interest in handling incoming enquiries effectively (Article 6(1)(f) GDPR).
Data stored by us remains with us until you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies, for example once your enquiry has been fully processed. Processing and retention by Zapier are additionally governed by our Zapier account settings and the agreements concluded with Zapier. Mandatory statutory provisions, especially retention periods, remain unaffected.
If you contact us by email or telephone, your enquiry, including all resulting personal data such as your name and request, will be stored and processed by us to handle your matter. We do not disclose this data without your consent. This data is processed on the basis of Article 6(1)(b) or (f) GDPR.
We use the Sora and Space Mono web fonts to design our website. These fonts are hosted entirely locally on our server; loading these local files does not establish a connection to Google or other third parties. The optional Zapier contact form, which is loaded only after consent, is separate third-party content; the information in section 5.2 applies to its resources.
We include video material on several pages. These videos are stored as files directly on our own server and delivered from there. They are not embedded from external platforms such as YouTube or Vimeo, so no data is transferred to such providers.
Provider and purpose. This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). For users in the European Economic Area, Google Ireland Limited is the responsible provider; processing may additionally be carried out by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The measurement ID we use is G-3HCBMG46LJ. We use Google Analytics to evaluate the use of our website statistically, identify technical problems and continuously improve our content.
Legal basis and consent. The use of Google Analytics, as well as the storage of and access to information on your device, takes place solely on the basis of your consent (Article 6(1)(a) GDPR and Section 25(1) TDDDG). As long as you have not consented to the “Analytics” category, no Google script is loaded; no connection whatsoever to Google servers takes place — not even a so-called cookieless ping. Only after your consent does your browser load the gtag.js file from googletagmanager.com, whereby technical connection data such as your IP address, browser information and time of access are transmitted to Google.
Data processed. When Google Analytics is active, the following in particular are processed: the pages viewed as well as the time and duration of the visit, the previously visited page (referrer URL), interactions such as clicks and scroll depth, device, browser and operating system information, screen resolution and language setting, the approximate location at country, region and city level (derived from the IP address), and a randomly assigned pseudonymous identifier stored in the _ga cookie. This identifier makes it possible to recognise repeat visits from the same browser. It does not allow us to identify you directly, and we do not combine this data with other data sources.
IP addresses. Google Analytics 4 uses the IP address to derive your approximate location. According to Google, IP addresses are generally truncated and are neither logged nor stored permanently; for access from the European Economic Area, collection and truncation take place on servers within the EU before data may be processed in data centres outside the EU. Separately enabling IP anonymisation is technically no longer necessary in Google Analytics 4, as it is built into the service.
Google Consent Mode v2 and advertising signals. We transmit the choice you made in the privacy banner to Google via Google Consent Mode v2. If you do not consent to the “Marketing” category, we permanently set the ad_storage, ad_user_data and ad_personalization signals to “denied” and additionally disable Google Signals and ad personalisation. The data collected is then not used for advertising purposes, remarketing or cross-device reporting. Only if you additionally consent to the “Marketing” category do we enable these signals.
Cookies and retention. Google Analytics stores the identifier described above in the _ga cookie and session-related information in the _ga_3HCBMG46LJ cookie, each with a lifetime of up to 24 months. In our Google Analytics property we have set the retention period for event data to 2 months and for user data to 14 months; once these periods expire, Google deletes the data concerned automatically. Aggregated reporting data is not affected by this.
Data processing agreement and transfers to the USA. We have concluded a data processing agreement with Google pursuant to Article 28 GDPR in the form of the Google Ads Data Processing Terms. A transfer of personal data to the USA cannot be ruled out. Google LLC is certified under the EU–US Data Privacy Framework; in addition, Google bases transfers on the European Commission's standard contractual clauses. By consenting to the “Analytics” category, you also expressly consent, pursuant to Article 49(1)(a) GDPR, to your data being processed in the USA. We expressly point out that the USA does not offer a level of data protection equivalent to European Union law: in particular, it cannot be ruled out that US authorities may access your data for monitoring and surveillance purposes without you having effective legal remedies against this.
Withdrawal and objection. You can withdraw your consent at any time with effect for the future — using the button in section 5.1 or the “Privacy settings” link in the footer of every page. Upon withdrawal we stop collection immediately by setting Google's opt-out flag ga-disable-G-3HCBMG46LJ and by deleting the cookies set by Google Analytics in your browser. Independently of this, you can prevent collection by Google Analytics across your whole browser by installing the Google Analytics opt-out browser add-on provided by Google.
Further information on how Google handles user data is available in Google's privacy policy, in the Google Ads data processing terms and in the notes on data collection in Google Analytics.
We do not transfer your personal data to third parties for purposes other than those listed below. We only disclose your personal data to third parties if you have given express consent under Article 6(1)(a) GDPR, disclosure is required under Article 6(1)(f) GDPR to establish, exercise or defend legal claims, a legal obligation to disclose exists under Article 6(1)(c) GDPR, or disclosure is legally permissible and required under Article 6(1)(b) GDPR to process contractual relationships with you, for example to hosting or email providers acting as processors pursuant to Article 28 GDPR.
Recipients of data in connection with the consent-based services on this website are Zapier, Inc. (contact form, section 5.2) and Google Ireland Limited or Google LLC (audience measurement, section 5.6). Both processing operations may involve a transfer to the USA and take place only if you have previously consented to the respective category.
For security reasons and to protect the transmission of confidential content, such as enquiries you send to us, this website uses SSL or TLS encryption. You can recognise an encrypted connection when the browser address changes from “http://” to “https://” and a lock symbol appears in your browser. When SSL or TLS encryption is active, data you transmit to us cannot be read by third parties.
Within the scope of applicable law, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients, and the purpose of processing. Where applicable, you also have the right to correction (Article 16 GDPR), deletion (Article 17 GDPR) or restriction of processing (Article 18 GDPR).
Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
Many data processing operations are only possible with your express consent. You may withdraw consent already given at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. For consent relating to optional website services, this function is available using the button in section 5.1.
You have the right to receive data that we process automatically on the basis of your consent or in performance of a contract in a commonly used, machine-readable format, or to have it transmitted to a third party.
If you believe data protection law has been infringed, you have the right to lodge a complaint with the competent supervisory authority. The supervisory authority responsible for privacy matters concerning Charamel GmbH, based in Cologne, North Rhine-Westphalia, is:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
www.ldi.nrw.de
We reserve the right to amend this privacy policy so that it continues to meet current legal requirements or reflects changes to our services, for example when new services are introduced. The revised privacy policy will apply to your subsequent visits.
Last updated: August 2026