💳 Credit Card Payments
Credit card payments are now accepted for webshop purchases.
Thank you for your interest. The protection of your privacy and personal data is important to us. We collect and use your data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable national law. Below we inform you which data we collect and how we process it.
The data controller pursuant to Article 4(7) GDPR is:
EXC GmbH
Am Lenzenfleck 17b
85737 Ismaning
Germany
Phone: +49 (0)89 125033980
Fax: +49 (0)89 125033999
E-Mail: info@exc.de
Website: www.exc.de
We have not appointed a data protection officer, as the conditions of Section 38 of the German Federal Data Protection Act (BDSG) do not apply to us. For any data protection matter, please use the contact details in section 1.
Where we obtain your consent, Article 6(1)(a) GDPR is the legal basis. Where processing is necessary for the performance of a contract or to take steps prior to entering into a contract, Article 6(1)(b) GDPR applies. Where processing is necessary to comply with a legal obligation, Article 6(1)(c) GDPR applies. Where processing is necessary for the purposes of legitimate interests pursued by us or a third party, and your interests, rights and freedoms do not override those interests, Article 6(1)(f) GDPR applies.
Personal data is deleted, or its processing is restricted, as soon as the purpose of storage ceases to apply. Data is retained for longer where European or national law requires it.
The statutory retention periods under commercial and tax law are:
Once these periods expire, the data is deleted unless it remains necessary for the performance of a contract.
Our website is hosted by STRATO AG, Otto-Ostrowski-Strasse 7, 10249 Berlin, Germany. The provider processes data collected through the website solely on our instructions; the servers are located in Germany. This is governed by a data processing agreement under Article 28 GDPR.
For our e-mail and associated office software we use Microsoft 365, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. This involves processing the content and metadata of messages you send us. A data processing agreement under Article 28 GDPR is in place with Microsoft. According to the provider, data is stored within the EU Data Boundary; access from third countries, in particular for support and maintenance, cannot be ruled out. See section 14 for details.
The legal basis for both is our legitimate interest in secure and reliable operation, Article 6(1)(f) GDPR.
When you visit our website, information is automatically collected from the system of the device used. The following data is recorded:
This data serves to deliver the website, maintain system security and produce statistics. It is anonymised after 10 days. Legal basis: Article 6(1)(f) GDPR.
We use cookies on our website. Cookies are small text files stored on your device.
We use strictly necessary cookies only. These are required to operate the website and to provide the functions you request, in particular session management, login to the customer area and the shopping cart. They are deleted at the end of your session unless stated otherwise.
Strictly necessary cookies do not require consent under Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The legal basis for the subsequent processing of the data is Article 6(1)(f) GDPR.
We do not use cookies for analytics, tracking or advertising. You can delete cookies in your browser settings or prevent them from being stored. If you do, some functions of our website may not be available to you.
Registration is required to place an order and to use the customer area. Mandatory fields are marked as such; all other entries are optional.
We collect:
On registration we additionally store your IP address, the date and time, the referrer and your browser type. This serves as a record of the registration and helps prevent misuse; the legal basis is Article 6(1)(f) GDPR.
For persons placing an order, we process salutation, name and e-mail address.
Data is transmitted using SSL encryption. Invoices are sent by e-mail. The legal basis for processing in connection with registration, order handling and invoicing is Article 6(1)(b) GDPR.
Data is disclosed only to service providers required to fulfil your order, such as shipping and payment service providers. You may have your customer account deleted at any time; the data is then erased unless the retention obligations in section 4 apply.
Through the contact form we collect:
The data is used solely to handle your enquiry. The legal basis is Article 6(1)(f) GDPR; where your enquiry is aimed at entering into a contract, Article 6(1)(b) GDPR applies in addition. The data is deleted once your enquiry has been dealt with conclusively and no retention obligations apply.
To send our newsletter we process:
Subscription uses the double opt-in procedure: after you sign up, you receive an e-mail asking you to confirm. We store the IP address and the time of both the sign-up and the confirmation in order to demonstrate your consent.
The legal basis is your consent under Article 6(1)(a) GDPR. You may unsubscribe at any time, for example using the link at the end of every newsletter. Withdrawal does not affect the lawfulness of processing carried out before it. After you unsubscribe, your data is removed from the distribution list.
To handle complaints we process:
The legal basis is Article 6(1)(b) GDPR. Deletion follows section 4.
We process applicant data to assess suitability for the advertised position. The legal basis is Section 26(1) BDSG in conjunction with Article 6(1)(b) GDPR.
If no employment relationship results, we delete the documents six months after the procedure ends. This period allows us to defend against potential claims under the German General Equal Treatment Act (AGG); the legal basis for that is Article 6(1)(f) GDPR. With your consent, we will also keep your documents in our applicant pool.
Our offering is directed at businesses, not at minors. We do not knowingly collect personal data from persons under the age of 16.
We do not transfer personal data to countries outside the EU and the EEA on our own initiative. A transfer may nevertheless occur where it is necessary for the performance of a contract with you — for example deliveries and invoices to recipients outside the EU — or as a result of our use of Microsoft 365, in particular during support and maintenance access.
Microsoft is certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Article 45 GDPR). Microsoft has additionally agreed to standard contractual clauses under Article 46 GDPR. Transfers made to perform a contract are based on Article 49(1)(b) GDPR.
You have the following rights in respect of your personal data:
An informal message to the contact details in section 1 is sufficient to exercise these rights.
Independently of this, you have the right under Article 77 GDPR to lodge a complaint with a supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(f) GDPR. This concerns in particular the processing described in sections 5, 6, 7, 8 and 9.
If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
No particular form is required. Please address your objection to the contact details in section 1.
We update this privacy notice when our services or the legal requirements change. The version available on this page applies.
Last updated: September 2026. This English text is a translation for convenience. The German version is the legally binding one.