Privacy Policy

​

Last update: October 2026
This privacy policy explains which personal data we process when you visit our website www.curth-roth.de, for what purposes and on what legal basis.

 

1. Controller

CURTH+ROTH GmbH 
Bülaustraße 8
20099 Hamburg
Germany
Managing Director: Johannes Roth
Phone: +49 40 3600690
Email: datenschutz@curth-roth.de

​

2. Hosting and Provision of the Website

Our website is built with the Wix website builder and hosted on Wix servers. The provider is Wix.com Ltd., Yunitsman 5 St, Tel Aviv, Israel.

When you access the website, Wix automatically processes data transmitted by your browser (server log files): IP address, date and time of access, page accessed, referrer URL, browser type and version, and operating system. This data is technically necessary to display the website and to ensure its stability and security.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in presenting our website securely and reliably. We have concluded a data processing agreement with Wix pursuant to Art. 28 GDPR.

Wix also processes data outside the EU, in particular in Israel and the United States. The European Commission has issued an adequacy decision for Israel. Transfers to the United States are based on the European Commission's Standard Contractual Clauses and, where the respective recipient is certified, on the EU-U.S. Data Privacy Framework. More information: https://www.wix.com/about/privacy

​

3. Contacting Us

If you contact us by email or phone, we process the information you provide (e.g., name, company, contact details, content of your inquiry) in order to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to a contract or pre-contractual measures, and Art. 6(1)(f) GDPR otherwise. Our legitimate interest lies in responding to inquiries. We delete the data once your inquiry has been fully processed, unless statutory retention obligations apply.

 

4. Recipients and Transfers to Third Countries

We only share personal data where this is necessary for the purposes stated above. Recipients are mainly our hosting provider Wix and IT service providers that we have contractually bound as processors. Where data is transferred outside the EU or the EEA, we ensure an adequate level of data protection, either through an adequacy decision of the European Commission (e.g., for Israel or for U.S. companies certified under the EU-U.S. Data Privacy Framework) or through the European Commission's Standard Contractual Clauses.

​

5. Retention Period

We store personal data only for as long as is necessary for the respective purpose. After that, we delete it unless statutory retention obligations apply. Under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO), these are in particular:

• 10 years for books, records, annual financial statements and management reports

• 8 years for accounting vouchers, e.g., invoices

• 6 years for commercial and business letters received and sent

During these periods, we restrict processing; the data is no longer used for any other purpose.

​

6. Your Rights

You have the right at any time to:

• access the data we store about you (Art. 15 GDPR)

• rectification of inaccurate data (Art. 16 GDPR)

• erasure of your data (Art. 17 GDPR)

• restriction of processing (Art. 18 GDPR)

• data portability (Art. 20 GDPR)

• withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR)

​

Right to object under Art. 21 GDPR: Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defense of legal claims.

​

To exercise your rights, simply send an email to research@curth-roth.de.

​

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

The Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit)
Ludwig-Erhard-Straße 22, 7th floor
20459 Hamburg, Germany
https://datenschutz-hamburg.de

​

7. No Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

​

8. Changes to This Privacy Policy

We update this privacy policy when our website or the legal requirements change. The version published on this page applies.