Questions About Data Protection

As of 16 October 2026

Under the General Data Protection Regulation (GDPR) you have the right to clear information about what happens to your personal data. Below we answer the most common questions about how NCIEM handles it.

1. Who is responsible for my data, and whom can I contact?

The controller is National Company for Industrial Equipment Marketing NCIEM UG (haftungsbeschränkt), Lohmühlenstraße 65, 12435 Berlin, Germany, represented by its managing director Abdul Rahman Bunayya. Phone: +49 30 2325 8284, e-mail: [email protected]. For all questions about data protection, please write to this address with the subject “Datenschutz”.

2. What data do you use, and where does it come from?

We use the data you give us when you register, place an order, contact us or apply for a job, and the data generated while we fulfil your order. We do not buy address data.

We also keep records of the consents you give, for example to cookies, live chat or the map on the contact page. We do not run a newsletter and do not collect newsletter sign-ups.

3. Why do you use my data, and on what legal basis?

We process personal data in line with the GDPR, the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG):

• Contract (Art. 6(1)(b) GDPR): to process orders, deliver goods, take payment, handle withdrawals, returns and warranty claims, run your customer account and answer your questions before and after a purchase.
• Legal obligation (Art. 6(1)(c) GDPR): to meet duties under commercial and tax law, such as keeping invoices and accounting records, and to send and keep the confirmation of receipt of an online withdrawal.
• Legitimate interests (Art. 6(1)(f) GDPR): to prevent fraud and payment default, keep our website secure, enforce legal claims, and send product recommendations to existing customers (see question 4).
• Consent (Art. 6(1)(a) GDPR, § 25 TDDDG): for optional cookies, live chat and embedded maps. You can withdraw your consent at any time with effect for the future, for example via the cookie settings in the footer.

4. Do you use my data for advertising?

When you buy from us, we may use your e-mail address to recommend our own similar products (§ 7(3) UWG). This is the only advertising we send; we do not run a newsletter.

You can object to this at any time, completely or for single mailings, by e-mail to [email protected] or via the unsubscribe link in every e-mail. The only cost to you is the basic cost of sending your objection. We send any other advertising by e-mail only with your consent.

5. Who receives my data?

Within NCIEM, only the staff who need your data to handle your order or request can access it. All of them work in Germany; the shop, its administration area and the customer data are accessed only from Germany. No person or company outside Germany – including other NCIEM companies – has access to the data held on nciem.de. We pass data to external service providers only where this is necessary to fulfil your order or run our shop. Where they act on our behalf, they are bound by data processing agreements (Art. 28 GDPR) and may use the data only as we instruct.

Where the law requires it, we pass data to authorities, courts or law enforcement. Other NCIEM companies, such as nciem.us and nciem.com, are separate businesses and do not receive data from nciem.de orders.

6. How long do you keep my data?

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires:

• Customer account: until you delete it, or after 3 years without activity.
• Order, invoice and accounting records: 8 years (invoices and accounting vouchers) or 10 years (books and annual accounts) under the German Commercial Code (HGB) and the Fiscal Code (AO).
• Business letters and e-mails relevant to a contract, including online withdrawals and their confirmations of receipt: 6 years.
• Applications: 6 months after the hiring decision, unless you agree to a longer period.
• Chat transcripts and support messages: until your request is closed, plus the periods above where they relate to an order.

If data is evidence in a legal dispute, we keep it until the dispute is resolved.

7. Do you transfer my data to countries outside the EU?

Some service providers are part of groups based in the United States (Stripe, PayPal, Google, Cloudflare, GoDaddy, Microsoft, Mailgun). Data may therefore be processed in the US, even where we have chosen European data centres. This concerns only the technical processing by these providers; nobody outside Germany accesses the data on nciem.de on our behalf. These providers are certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide adequate protection (Art. 45 GDPR). Where there is no adequacy decision, we use the EU Standard Contractual Clauses (Art. 46 GDPR). We transfer data to other countries outside the EU only in individual cases, on these safeguards or with your explicit consent.

8. What are my rights?

You have the following rights over your personal data. To use them, write to [email protected]. We may ask you to confirm your identity.

• Access (Art. 15 GDPR): to learn whether we process your data and, if we do, which data and how.
• Rectification (Art. 16 GDPR): to have incorrect or incomplete data corrected.
• Erasure (Art. 17 GDPR): to have your data deleted, unless we must keep it by law or need it to establish, exercise or defend legal claims. We delete data on our own as soon as no retention duty applies.
• Restriction (Art. 18 GDPR): to have processing restricted, for example while the accuracy of your data is being checked, or if you need data that we would otherwise delete in order to assert legal claims.
• Data portability (Art. 20 GDPR): to receive data that you provided to us on the basis of consent or a contract in a structured, machine-readable format, or to have it sent directly to another controller where technically feasible.
• Withdrawal of consent (Art. 7(3) GDPR): to withdraw any consent at any time with effect for the future.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. We will then stop processing your data, unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. You can object to direct advertising at any time without giving reasons.

Right to complain (Art. 77 GDPR): If you think our processing breaches data protection law, please tell us first so we can put it right. You may also complain to any data protection supervisory authority, in particular the one in the EU member state where you live or work. The authority responsible for NCIEM is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
Phone: +49 30 13889-0, e-mail: [email protected]

9. Do I have to provide my data?

We need the data marked as required in the order form to conclude and fulfil the contract: your name, billing and delivery address, e-mail and payment details. Without them we cannot accept your order. Other information, such as your phone number, is optional. You do not have to give consent for anything that is not needed for the contract or required by law. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

As of 16 October 2026 · National Company for Industrial Equipment Marketing NCIEM UG (haftungsbeschränkt) · Lohmühlenstraße 65 · 12435 Berlin · Germany · [email protected]