Privacy policy
We process your information to review enquiries, coordinate projects and provide agreed services. Here we explain which data is processed when you use formact.de. Last updated: 23 September 2026.
1. Controller and contact details
The controller is WebTec Braun GmbH, Max-Hickl-Str. 10, 83026 Rosenheim, Deutschland, represented by managing director Tobias Braun. For questions about data protection or to exercise your rights, contact us at info@formact.de.
2. Website and technical hosting
This policy applies to formact.de and its associated enquiry management system. The website runs in a server environment managed by us using external technical infrastructure. Recipients of data required to provide the website may include the infrastructure and technical service providers we use for this purpose. Processing serves to deliver the website and keep it secure, on the basis of Article 6(1)(f) GDPR.
Fonts, images and other website files are served through our own domain. No analytics or advertising trackers, externally embedded maps, videos or CAPTCHA services are loaded. The website does not process online payments. For internal notifications of new enquiries, we use the email service of our existing Google Workspace account, as described under ‘Communication outside the form’. We do not make automated decisions about your enquiry or carry out profiling.
3. Enquiries and uploaded files
When you submit an enquiry, we process your customer type, contact person's name, email address, telephone number, company name where applicable, and project information. For each part, this includes the description, quantity or an indication that the quantity is still to be decided, dimensions, intended use, preferred material and colour, advice required, preferred date and associated files. If you include finder information in your enquiry, we save your answers, the material groups suggested at the time and the rule version used against that item. An explicit material preference remains separate from suggestions made by the finder. We also store the source of the enquiry within the website and the time of submission.
This information is needed to review your enquiry, ask follow-up questions and prepare an individual quotation. Model, drawing and image files may themselves contain personal information. Please submit only data that is necessary for the project and that you are permitted to share for this purpose.
An enquiry concerning a contract with you is processed on the basis of Article 6(1)(b) GDPR. For contact persons at a company, necessary business communication is based on Article 6(1)(f) GDPR; our legitimate interest is handling the requested business relationship. Without the information marked as required, we cannot meaningfully process the enquiry.
4. Storage and protected access
Received enquiries are analysed internally by material preferences, applications, quantities and processing status. A finder suggestion without an explicit selection is not counted as a material preference. The analysis is based on enquiries actually submitted and does not track visitor journeys or abandoned finder sessions.
Enquiry data is stored in a database in our server environment. Uploaded files are held in private storage, separately from publicly served website files. Data is transmitted using HTTPS encryption. Only authenticated, authorised administrators can access enquiry views and downloads. There are no customer accounts and no publicly accessible enquiry or file views.
Submitting a file does not automatically result in it being shared with a manufacturing or design partner. If a partner is needed for an agreed CAD service, they receive only the necessary information under appropriate confidentiality requirements. You will be informed of any further processing required in connection with the specific project.
5. Technical operation and sessions
When you visit the website, technically necessary connection data is processed, in particular your IP address, the time, the address requested and technical details of the request. To protect against abusive form submissions and login attempts, IP-related counters are kept exclusively in working memory. The time windows used are 15 minutes or one hour, depending on the function. The application does not maintain its own permanent IP database.
Regular access logs for the web server used for formact.de are disabled. Its warning and error logs may contain connection details, including IP addresses, if technical problems occur. These FORMACT web server logs are used to troubleshoot errors and protect the service. They are rotated daily; no more than seven rotated log files are retained in addition to the current file. Retention of other logs relating to server infrastructure security, such as those used to prevent unauthorised connections, depends on the relevant security purpose. The rotation described applies exclusively to the FORMACT web server's error logs. The legal basis for these technical safeguards is Article 6(1)(f) GDPR; our legitimate interest is reliable and secure operation.
The material finder initially processes your answers only in your browser. When you transfer a result to your enquiry, it is temporarily stored in sessionStorage in the same tab and remains valid for transfer for 30 minutes. Expired entries are removed on the next access; session storage is discarded when the tab is closed. Names, contact details and files are not stored there. Transferred finder information is sent to us only when you submit the enquiry. The finder remains usable even if browser storage is unavailable.
The formact_session cookie is used for administrator login and is valid for a maximum of eight hours. The formact_csrf cookie protects forms against abusive cross-site requests and is valid for a maximum of 24 hours. These cookies are used exclusively for necessary functionality and security, not advertising. They are stored or accessed pursuant to section 25(2), no. 2 TDDDG. Visitors do not need a customer account to submit an enquiry.
When you close our privacy notice, your browser stores the notice version and the time of your acknowledgement in localStorage under formact_privacy_notice. The record contains no user identifier and is not sent to our server. We honour the acknowledgement for 180 days so that the notice does not appear on every page visit. Expired or outdated records are removed on your next visit to the website. You can clear your browser storage at any time and reopen the notice through “Privacy & cookies” in the footer. Closing it does not give consent to analytics or advertising. This storage serves only your chosen display preference pursuant to section 25(2), no. 2 TDDDG; the legal basis is Article 6(1)(f) GDPR insofar as personal data is processed. Our legitimate interest is providing this setting in a user-friendly way.
6. Retention and deletion
Your files are used to process your enquiry and, where applicable, provide the agreed service. We do not offer a permanent customer archive. Please keep your own original files and backups; availability for repeat production at a later date is not guaranteed.
Regular uploaded files are retained for processing for a maximum of six calendar months from receipt. Once this period expires, they can no longer be retrieved. The application automatically removes expired files during operation; following an interruption to the service, cleanup takes place at the next start. This also applies to files associated with open enquiries. The team handling the enquiry is notified internally before expiry so that ongoing projects can be coordinated in good time. Earlier deletion is possible if the purpose ceases to apply sooner. This maximum period is not a guaranteed minimum availability period or a promise of recovery.
After a file is removed, metadata required to associate it with the enquiry and document its deletion, such as the filename and receipt and deletion dates, may remain with the record. Contact, enquiry and file metadata is deleted separately once it is no longer needed for the enquiry, an ongoing contract or the protection of legal rights.
Business records subject to statutory retention requirements are retained separately and only to the extent required. The legal basis for this mandatory retention is Article 6(1)(c) GDPR. Retention of business records does not create a CAD archive.
7. Communication outside the form
Quotations and further coordination take place personally, outside an automated website function. If you contact us by email, we process your sender details and the content to respond to you or fulfil the contract. The relevant legal bases are the same as for processing enquiries. The email service providers used are involved in transmission. Once an enquiry has been stored persistently, we send an internal notification via Google Workspace's email service to the responsible FORMACT contact. The email service receives the sender and recipient addresses, enquiry reference, enquiry ID and link to the protected administration system. The message contains no customer files, form content or publicly accessible file links. The enquiry remains stored in the protected administration system even if the notification cannot be sent. No automatic confirmation email is sent to the enquirer.
8. Your rights
Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may withdraw consent you have given with effect for the future. To exercise these rights, simply contact info@formact.de.
9. Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority, in particular in your place of habitual residence, place of work or the place of the alleged infringement. For private companies based in Bavaria, the Bavarian State Office for Data Protection Supervision is a competent authority.