Privacy policy

POTEMA GmbH

1. Introduction

Below we explain how personal data is processed when you use

our website https://www.potema.de
our profiles on social media.

Personal data is any data that can be related to a specific natural person, for example their name or their IP address.

1.1. Contact details

The controller pursuant to Article 4 (7) of the EU General Data Protection Regulation (GDPR) is POTEMA GmbH, Adalperostraße 29, 85737 Ismaning, Germany, email: info@potema.de. Our legal representative is Oliver Fiederer.

You can reach our data protection officer at

Joachim Maaß
DATA PRO SECURITY @ Maass Consulting GmbH
Feichtelstraße 23, 82343 Pöcking / Starnberg, Germany
E: potema-vt@client.data-pro-security.com
F: +49 8151 4468967
W: www.data-pro-security.com

1.2. Scope of the data processing, purposes of processing and legal bases

We set out the scope of the data processing, the purposes of processing and the legal bases in detail below. In principle, the following legal bases may apply to data processing:

Article 6 (1) sentence 1 point (a) GDPR is our legal basis for processing operations for which we obtain consent.
Article 6 (1) sentence 1 point (b) GDPR is the legal basis where the processing of personal data is necessary for the performance of a contract, for example where a site visitor buys a mattress cleaning service or a product from us. This legal basis also applies to processing that is necessary for pre-contractual measures, such as enquiries about our services.
Article 6 (1) sentence 1 point (c) GDPR applies where we fulfil a legal obligation by processing personal data, as may be the case under tax law, for example.
Article 6 (1) sentence 1 point (f) GDPR is the legal basis where we can rely on legitimate interests for the processing of personal data, for example for cookies that are necessary for the technical operation of our website.

1.3. Data processing outside the EEA

Where we transfer data to service providers or other third parties outside the EEA, the security of the data during the transfer is guaranteed by adequacy decisions of the EU Commission wherever these exist (Article 45 (3) GDPR). Where no adequacy decision exists (for example for the USA), the legal basis for the transfer of data is generally standard contractual clauses. These are a set of rules adopted by the EU Commission and form part of the contract with the respective third party. Under Article 46 (2) point (b) GDPR they ensure the security of the data transfer.

1.4. Retention period

Unless expressly stated otherwise in this privacy policy, the data held by us is erased as soon as it is no longer required for its purpose and no statutory retention obligations stand in the way of its erasure. Where data is not erased because it is required for other, legally permissible purposes, its processing is restricted, i.e. the data is blocked and not processed for other purposes. This applies, for example, to data that we have to retain for commercial or tax law reasons.

1.5. Rights of data subjects

Data subjects have the following rights against us in respect of the personal data concerning them:

right of access,
right to rectification or erasure,
right to restriction of processing,
right to object to the processing,
right to data portability,
right to withdraw consent once given at any time.

Data subjects also have the right to lodge a complaint about the processing of their personal data with a data protection supervisory authority. The contact details of the German data protection supervisory authorities (Datenschutz-Aufsichtsbehörden) are available at https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

1.6. Obligation to provide data

Within a business relationship or other relationship, customers, interested parties or third parties only have to provide us with the personal data that is necessary for entering into, performing and ending the business relationship or the other relationship, or that we are legally obliged to collect. Without this data we will generally have to decline to conclude a contract or to provide a service, or will no longer be able to perform an existing contract or other relationship. Mandatory information is marked as such.

1.7. No automated decision-making in individual cases

In principle we do not use fully automated decision-making pursuant to Article 22 GDPR in order to enter into and perform a business relationship or other relationship. Should we use such procedures in individual cases, we will provide separate information about this where this is required by law.

1.8. Contacting us

When you contact us, for example by email or telephone, the data you give us (for example names and email addresses) is stored by us in order to answer questions. The legal basis for the processing is our legitimate interest (Article 6 (1) sentence 1 point (f) GDPR) in answering enquiries addressed to us. We erase the data arising in this context once storing it is no longer necessary, or restrict the processing where statutory retention obligations apply.

1.9. Customer surveys

From time to time we carry out customer surveys in order to get to know our customers and service partners and their wishes better. In doing so we collect the data requested in each case. It is our legitimate interest to get to know our customers and their wishes better, so that the legal basis for the data processing involved is Article 6 (1) sentence 1 point (f) GDPR. We erase the data once the results of the surveys have been evaluated.

2. Data processing on our website

2.1. Informational use of the website

When the website is used for information purposes only, that is, when site visitors do not send us any information separately, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This is our legitimate interest, so that the legal basis is Article 6 (1) sentence 1 point (f) GDPR. This data is: IP address; date and time of the request; time zone difference from Greenwich Mean Time (GMT); content of the request (the specific page); access status/HTTP status code; the volume of data transferred in each case; website from which the request comes; browser; operating system and its interface; language and version of the browser software. This data is also stored in log files. It is erased once storing it is no longer necessary, and at the latest after eight weeks.

2.2. Web hosting and provision of the website

Our website is hosted by IONOS. The provider is 1&1 IONOS SE, Elgendorfer Str. 57, 56410 Montabaur. In doing so, the provider processes the personal data transmitted via the website, for example content, usage, meta/communication or contact data, within the EU. Further information can be found in the provider’s privacy policy at https://www.ionos.de/terms-gtc/datenschutzerklaerung/. It is our legitimate interest to make a website available, so that the legal basis for the data processing described is Article 6 (1) sentence 1 point (f) GDPR.

2.3. Contact form

If you contact us using the contact form on our website, we store the data requested there and the content of the message. The legal basis for the processing is our legitimate interest in answering enquiries addressed to us (Article 6 (1) sentence 1 point (f) GDPR). We erase the data arising in this context once storing it is no longer necessary, or restrict the processing where statutory retention obligations apply.

2.4. Appointment enquiry / booking an appointment with service partners

Site visitors can use our “appointment enquiry” to arrange an appointment with one of our specialist partner businesses near them. For this we process the data entered (for example name, contact details, preferred place and date) and, where applicable, meta or communication data, and pass it on to the responsible specialist partner in the enquirer’s region in order to arrange the appointment. We have a legitimate interest in offering interested parties a user-friendly way of arranging appointments. The legal basis for the data processing is Article 6 (1) sentence 1 point (f) GDPR, or Article 6 (1) sentence 1 point (b) GDPR where a contractual relationship already exists.

2.5. Offering services and products

Through our website and the linked online shop (www.potema.shop) we offer services and products (including mattress cleaning and Matratzen Cleanspray). In the course of an order or order enquiry we process, among other things, the following data:

name
address or property/room details (for example for hotels and clinics)
email address
telephone number
payment and order data (for orders in the online shop)

The data is processed in order to perform the contract concluded with the respective site visitor (Article 6 (1) sentence 1 point (b) GDPR).

2.6. Job advertisements

We publish vacancies in our company on our website or on third-party websites where appropriate. The data provided in an application is processed in order to carry out the application procedure; the legal basis is Article 88 (1) GDPR in conjunction with section 26 (1) BDSG (German Federal Data Protection Act). We ask applicants to refrain from giving information about political opinions, religious beliefs and similarly sensitive data in their CV and covering letter. If no employment relationship comes about, we erase the data at the latest six months after the rejection, unless consent to longer storage has been given.

2.7. Cookies, analytics and other services

This website does not set any cookies. No analytics, tracking or marketing tools are used, no user profiles are created and no data is passed to advertising networks. A consent request (“cookie banner”) is therefore not required. Simply opening a page does not load any content from third-party servers; your browser connects to our server only. In detail:

Map display in the partner finder: The map is delivered entirely by our own server. It is based on the public domain Natural Earth data set, which we host ourselves as a single geometry file. No map tiles and no other data are loaded from third-party map services — neither Google Maps nor any other map service receives your IP address. The legal basis is Article 6 (1) sentence 1 point (f) GDPR (showing the partner locations).
Location sharing: You can share your location using the “Partners near me” button. It is only requested in response to your express action and is secured by your browser (Article 6 (1) sentence 1 point (a) GDPR). Your coordinates are processed solely in your own browser in order to sort the partner businesses by distance. They are not transmitted to us or to third parties and are not stored. You can withdraw the permission at any time in your browser settings.
Fonts: The fonts used are embedded when the website is built and are delivered by our own server. There is no connection to Google Fonts or any other font service.
Product images: We take images from our online shop when the website is built, convert them to the sizes we need and deliver them from our own server. Your browser does not connect to the shop server for this.
Protection of our forms: To protect against automated submissions we use a form field that is invisible to you (honeypot), a check that the form was sent from our website (using the origin information your browser sends anyway), a minimum time between opening and sending the form, and a server-side limit on how often forms may be sent. For the minimum time, our server issues a time-stamped code when the form opens; it contains no personal data and is not stored, and no cookies are set. For the sending limit, our server derives a check value from your IP address from which the IP address cannot be reconstructed, and stores it for no more than ten minutes. The IP address itself is neither stored nor included in the email sent to us. The legal basis is Article 6 (1) sentence 1 point (f) GDPR (preventing abusive use).
Information pack: In return for your contact details, we send the information pack for specialist partner businesses by email to the address you give us. We process these details as described under section 2.3.
Confirmation of receipt: After you submit a form you receive an automatic confirmation at the email address you gave. It summarises your details and contains no advertising.
Link to potema.shop: Our online shop is a separate offering with its own privacy policy. You only move there once you actively click a corresponding link.

3. Data processing on social media platforms

We have a presence on social networks in order to introduce our company and our services there. The operators of these networks regularly process their users’ data for advertising purposes, among other things by creating user profiles and setting cookies. Where users of the networks contact us through our profiles, we process the data they give us in order to answer their enquiries (Article 6 (1) sentence 1 point (f) GDPR).

3.1. Facebook

We maintain a profile on Facebook. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy policy: https://www.facebook.com/policy.php. You can object through the advertising settings: https://www.facebook.com/settings?tab=ads.

3.2. Instagram

We maintain a profile on Instagram. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy policy: https://help.instagram.com/519522125107875.

3.3. TikTok

We maintain a profile on TikTok. The operator is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Privacy policy: https://www.tiktok.com/legal/privacy-policy.

3.4. LinkedIn

We maintain a company page on LinkedIn. The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy policy: https://www.linkedin.com/legal/privacy-policy. You can object through the advertising settings: https://www.linkedin.com/psettings/guest-controls. We are jointly responsible with LinkedIn for the statistics on our page (Page Insights); the agreement on this: https://legal.linkedin.com/pages-joint-controller-addendum.

4. Changes to this privacy policy

We reserve the right to change this privacy policy with effect for the future. The current version is always available here.

5. Questions and comments

If you have questions or comments about this privacy policy, we will be glad to help — please use the contact details given above.

(As at: October 2026)