Privacy Policy

Review draft dated 3 August 2026. This version describes the technical implementation currently present in the website project. The items listed at the end must be confirmed and completed by PurPur before publication. It does not replace an individual legal review.

This privacy policy explains which personal data is processed when you visit www.purpur.de or use the contact options offered there.

1. Controller

PurPur GmbH
Kettenhofweg 1
60325 Frankfurt am Main
Phone: +49 69 96 21 94 - 0
Fax: +49 69 96 21 94 - 22
Email: team@purpur.de
Website: www.purpur.de

If a data protection officer has been appointed, their contact details must be added here before publication.

2. Website Access and Server Log Data

When you access the website, your browser transmits data required for technical communication to the web server. This may include, in particular, your IP address, the date and time of access, the requested address, referrer information, HTTP status code, volume of data transferred and information about your browser, operating system and device. This data may be stored in server log files.

The processing is necessary to deliver the website, maintain its stability and security, and investigate technical faults or abusive access. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.

The recipient is the hosting provider commissioned by PurPur. The specific hosting provider, server location and actual retention period for log data have not yet been confirmed in the current project and must be added before publication.

3. Cookies, Browser Storage and Services Requiring Consent

According to the current technical implementation, this website does not itself set cookies or store information in your browser's Local Storage or Session Storage. Your language selection is not stored permanently on your device. Google Analytics, advertising pixels, tracking tools and automatically loaded content from external platforms are not currently integrated.

For this reason, no cookie consent banner is currently displayed. If the website later uses technologies requiring consent or stores or accesses information on your device, those technologies will only be activated after your consent and this privacy policy will be updated accordingly. The production website delivered to visitors must be checked again before launch.

4. Contact Forms

When you submit a contact, enquiry, product or project form, we process the information you enter. Depending on the form, this includes your first and last name, email address, telephone number, message and type of enquiry. Technical context data such as language, source page, form label and, where applicable, a product or project reference is also transmitted to route the enquiry correctly. Connection data such as the IP address and time of the request is also generated for technical reasons.

We use this data to assign and process your enquiry and contact you. The legal basis is the consent you give when submitting the form in accordance with Art. 6(1)(a) GDPR. If your enquiry is aimed at entering into or performing a contract, Art. 6(1)(b) GDPR additionally or alternatively provides the legal basis.

The form data is transmitted directly to HubSpot's CRM and form service. It can be accessed by the recipients configured at PurPur or in HubSpot to handle the enquiry and, where necessary, commissioned technical service providers.

You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal. Where processing is necessary to take steps before entering into a contract or to perform a contract, withdrawal cannot retroactively remove that separate legal basis.

5. Newsletter

When you subscribe to the newsletter, we process your email address, your first name where provided, your selected language, the time and source of registration, and the consent and confirmation status. Your IP address and browser information may also be generated for technical reasons during transmission.

The data is processed to send the PurPur newsletter and document your consent. The legal basis is Art. 6(1)(a) GDPR; electronic marketing is sent only in compliance with Section 7 of the German Act Against Unfair Competition (UWG). Where the double opt-in process is enabled, the subscription only becomes effective after you confirm the link in the confirmation email.

You may withdraw your consent at any time by using the unsubscribe link in a newsletter email or by emailing team@purpur.de. Once you unsubscribe, your address will no longer be used to send the newsletter. Data required to demonstrate consent or permanently observe your objection may continue to be stored to the extent permitted by law.

6. Use of HubSpot

PurPur uses HubSpot services to process form enquiries, manage contact data and send newsletters. When you submit a form, the data is transmitted directly to HubSpot and processed there on PurPur's behalf.

The service provider and recipient is HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA, including affiliated companies and appointed sub-processors. HubSpot may process data globally, in particular in the United States. According to HubSpot's current Data Processing Agreement, necessary international transfers rely, among other mechanisms, on the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses. Further information is available in HubSpot's Privacy Policy.

The legal basis depends on the purpose of the relevant form: Art. 6(1)(a) GDPR for consent-based contact and newsletter subscriptions, and Art. 6(1)(b) GDPR for pre-contractual or contractual enquiries. Before publication, the parties must verify the execution of the data processing agreement, the HubSpot entity contracting with PurPur, the selected data region and the relevant sub-processors.

7. Contact by Email or Telephone

If you contact us by email or telephone, we process the contact details and content you provide to respond to your enquiry. Technical delivery and receipt data is also generated for emails. The legal basis is Art. 6(1)(b) GDPR where the communication concerns a contract or pre-contractual measures; in other cases it is Art. 6(1)(f) GDPR. Our legitimate interest is the appropriate handling of business enquiries.

Recipients may include the responsible internal staff, email and telecommunications providers and, where necessary, commissioned service providers.

8. External Links and Locally Hosted Content

According to the current project, fonts and media content are hosted locally. Merely visiting the website therefore does not establish a connection to providers such as Google Fonts, YouTube, Vimeo or map platforms. However, the website contains links to external websites. Only when you follow such a link will the relevant provider process data under its own privacy policy.

9. Retention

We store personal data only for as long as necessary for its relevant purpose. It is then deleted or anonymised unless statutory retention duties, legitimate interests in defending legal claims or another legal basis require further storage.

Form and other enquiries are generally retained for the period needed to process and appropriately follow up on them.
Newsletter data is processed until consent is withdrawn or you unsubscribe; necessary consent records or suppression data may be retained beyond that point.
Data in HubSpot is also subject to the deletion settings configured in PurPur's account and the service's contractual deletion rules.

PurPur must define specific internal deletion periods and confirm the retention period for hosting logs before publication, after which they must be added here.

10. Your Data Protection Rights

Subject to the statutory requirements, you have in particular the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR). Under Art. 7(3) GDPR, you may withdraw consent at any time with effect for the future.

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.

To exercise your rights, send a message to team@purpur.de. You also have the right to lodge a complaint with a data protection supervisory authority. For a company established in Hesse, the competent authority will generally be the Hessian Commissioner for Data Protection and Freedom of Information, P.O. Box 3163, 65021 Wiesbaden, Germany.

11. Automated Decisions

This website does not use solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

12. Data Security

We use appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access. The website is intended to be delivered exclusively through encrypted HTTPS connections. Please note that data transmission over the internet cannot be protected completely against every risk.

13. Changes to this Privacy Policy

We update this privacy policy when the website, the services used or legal requirements change. The version published on this page at the relevant time applies.

To Be Confirmed with PurPur Before Publication

complete company and contact details and whether a data protection officer has been appointed
hosting provider, server location, scope of server logs and their retention period
HubSpot contracting entity, data processing agreement, data region, sub-processors and final form recipients
activation and end-to-end testing of double opt-in and approval of all consent wording
specific deletion periods for enquiries, CRM contacts, newsletter data and consent records
final production check for cookies, browser storage, tracking and externally loaded content