Data protection information
1. Controller and contact
CliFar GmbH, Josef Str. 37, D-78166 Donaueschingen, Germany, is responsible for the processing described here. Contact info@clifar.de or +49 (0)771 9294 7404 for privacy questions and requests.
2. Hosting and technical logs
The website is hosted by IONOS. Technical access and security records can include the requested resource, date and time, response status, transmitted data volume, browser information and IP-related data. IONOS describes anonymisation of visitor IP addresses in its hosting logs. Processing supports secure and reliable operation on the basis of Article 6(1)(f) GDPR. Our application also uses keyed rate-limit records to help prevent abusive form submissions and sign-in attempts; these records do not contain enquiry text. Rate-limit records older than 30 days are removed during routine cleanup. Hosting log retention follows the applicable hosting service and configuration. Further information: https://www.ionos.de/hilfe/datenschutz/datenverarbeitung-durch-ihr-ionos-produktes/ionos-webhosting/
3. Enquiries, quotations and portal-access requests
We process the information you send us, such as your name, company, telephone number, email address, subject and message. Quotations can additionally require origin, destination, transport mode, package count, dimensions, weight and Incoterms. Portal-access requests are sent to our team for individual review; submitting a request does not create an account automatically. We use this information to respond, prepare or perform a contract and administer the request, based on Article 6(1)(b) GDPR or, for business contacts and general enquiries, Article 6(1)(f) GDPR. Website enquiries are forwarded to the responsible business mailbox and are not stored as enquiry records in the website database. Email providers and, where necessary to perform your requested service, transport, customs or logistics partners may receive relevant details. Correspondence is retained for the time needed to handle the matter and fulfil applicable retention obligations. Required fields are identified in the forms; without the necessary information we may be unable to process the request.
4. Newsletter and Mailchimp
Newsletter registration is voluntary and based on your consent under Article 6(1)(a) GDPR. Registration is sent to Mailchimp, operated by The Rocket Science Group LLC, an Intuit company in the United States. We submit your email address, language and available signup information; Mailchimp records subscription and confirmation information. A confirmation email is used to verify the signup before newsletters are sent. Existing subscriptions are not replaced by a new pending signup. You can unsubscribe using the link in each newsletter or contact info@clifar.de. Withdrawal applies for the future and does not affect earlier lawful processing. Subscription data is retained while the subscription is active; necessary consent records and suppression information may be retained to demonstrate compliance and respect an unsubscribe request. The website integration does not enable campaign open/click tracking. Mailchimp's processing and international-transfer safeguards are described at https://mailchimp.com/legal/privacy/ and https://mailchimp.com/legal/data-processing-addendum/
5. Cookies, local storage and administrator access
Necessary session cookies support form security and administrator sign-in. A language cookie remembers the selected language. Local browser storage records optional-technology choices, their time and notice version, and can remember a newsletter dismissal. These preferences are not linked to your name or email in the website database. Necessary storage is used under Section 25(2) TDDDG, with personal-data processing based on Article 6(1)(b) or (f) GDPR as appropriate. Analytics and external media require a separate choice; their storage/access is based on Section 25(1) TDDDG and personal-data processing on Article 6(1)(a) GDPR. Continuing to browse does not give consent. You can change your choices through Cookie settings in the footer. Administrators' credentials, encrypted authenticator secrets, hashed recovery codes and account information are stored to protect and operate the administration area.
6. Google Analytics, Tag Manager, Maps and external links
Google analytics or tag scripts load only when configured and after analytics consent. Google Maps loads only after external-media consent. Google services can receive technical and usage information, including IP-related data, device details and the requested page. Google Ireland Limited and other Google group companies may process data outside the EEA, including in the United States; applicable transfer safeguards and service details are available at https://policies.google.com/privacy and https://business.safety.google/adsprocessorterms/ . External websites and social networks process data under their own notices when you follow a link. Optional services can be declined without preventing use of the general website.
7. Your rights and complaints
Subject to the applicable legal requirements, you have rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw consent. Requests do not have to be made exclusively by post or fax. Contact us using the details above. You may complain to a supervisory authority, including the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg: https://www.baden-wuerttemberg.datenschutz.de/beschwerde/ . Data is deleted when no longer needed, unless a legal duty or another valid basis requires continued retention. We do not use this website to make automated individual decisions with legal or similarly significant effects.
8. Security and updates
We use HTTPS and access controls to protect transmitted and stored information. No method of transmission provides absolute security. Please ask us for an appropriate secure channel before sending particularly confidential material. We update this notice when website functions or processing change. Status: 15 October 2026.
Additional information on applications, quotations and form security
Job applications: We process your contact details, message, selected vacancy and PDF application to assess and respond to your application, under Section 26(1) BDSG and, where applicable, Article 6(1)(b) GDPR. The form sends the application to job@clifar.de through our mail service. The website does not place your PDF in a public uploads folder or retain an additional permanent copy on the web server. The attachment remains in the recruitment mailbox and associated mail-provider backups. If we hire you, relevant data is transferred to your personnel records; otherwise, application data is normally deleted within six months after the procedure ends, unless a legal requirement or the defence of claims requires longer retention. Inclusion in a talent pool requires a separate agreement. Avoid sending unnecessary sensitive personal information.
To prevent repeated applications, the website stores a keyed hash derived from the internet connection's IP address, daily/monthly counters and processing timestamps. It allows one application per IP address per day and three per calendar month, using Europe/Berlin dates. People sharing a connection share this limit. These abuse-prevention records are deleted after 62 days on a later application request. They are not linked to the applicant's name or PDF. Processing is based on our legitimate interest in secure, reliable recruitment communication under Article 6(1)(f) GDPR. Hosting access logs are governed by the hosting provider's separate retention arrangements.
Form security uses a locally hosted ALTCHA proof-of-work check and a necessary session cookie. Challenge data, completion state and expiry information are held in the session to prevent replay. The integration makes no requests to an external CAPTCHA provider and uses no advertising or analytics cookies. Necessary security storage is separate from optional cookie choices. You can reject analytics and external media and still apply or request a quotation. The form acknowledgement confirms that you have read this information; it is not bundled marketing consent.
Quotation spreadsheet files and pasted tables are parsed in your browser. Only the fields you review and submit are transmitted to CliFar; the original spreadsheet is not uploaded or attached. Shipment, cargo and contact data is processed to prepare an offer or answer your request, under Article 6(1)(b) GDPR or Article 6(1)(f) GDPR for business contacts. Both departmental notifications and sender confirmations include your submitted details. Application PDFs are sent only to the recruitment department, not repeated as attachments in the sender confirmation.
If a live Google rating is configured, it is requested only after your external-media choice permits it. Our server requests the rating and review count for CliFar from Google Places; it does not include your name, application, enquiry or IP address in that request. The displayed number is not stored as a website rating record. Following the review links opens Google Maps, where Google's privacy terms apply.
