Privacy Notice

Controller and privacy contact

The controller responsible for this website and for the handling of enquiries is:

International Warehouse GmbH & Co. KG
Fröndenberger Straße 285
58708 Menden
Germany

For questions about personal data or to exercise your rights, contact info@luxor-tools.com.

This notice covers visits to luxor-tools.com, product and quotation enquiries, trade enquiries, and related business correspondence.

Website delivery, hosting and server logs

The website is hosted by Magicon in Germany. Delivering a website necessarily involves processing the connecting device’s IP address and the technical information sent with its request. Hosting access logs may also contain request time, requested resource, response status and browser or referrer information, depending on the hosting configuration.

The hosting provider has confirmed a 30-day retention period for server access logs. These hosting logs are separate from the RFQ application’s abuse-prevention records.

Website delivery, troubleshooting and protection against misuse are based on Article 6(1)(f) GDPR. Our legitimate interests are operating an accessible, reliable and secure business website. Any processing required by a specific legal obligation is based on Article 6(1)(c) GDPR.

Quotation and contact enquiries

When you contact us or use the Request a Quote form, we process the information you provide: company name, contact name, delivery country, email address, optional phone number, enquiry type, product brands, manufacturer part numbers, product descriptions, quantities, your message, and any optional purchasing-list attachment.

We use this information to review sourcing requirements, prepare quotations, respond to questions and manage the resulting business correspondence. We do not use the RFQ form to enroll you in advertising or a newsletter.

Fields marked as required are needed to process an online enquiry. Product lines require a manufacturer part number or description and a positive quantity. You can describe your requirements in a message or an attachment instead of providing individual product lines. A phone number and a purchasing-list attachment are optional. Without the required information, the application cannot accept an online submission.

Where you personally request steps before entering a contract, or the processing is necessary for a contract with you, the basis is Article 6(1)(b) GDPR. Where you act as the contact person for a business, or make another business enquiry to which that basis does not apply, the basis is Article 6(1)(f) GDPR: our legitimate interest in communicating with commercial contacts and handling professional purchasing enquiries. Processing required for statutory record-keeping is based on Article 6(1)(c) GDPR.

Necessary handling of an enquiry does not rely on a blanket consent to advertising. If we separately request consent for another purpose, that purpose and the right to withdraw consent will be explained at that time.

Optional purchasing-list attachments

You may attach one PDF, XLSX or CSV purchasing list, up to 10 MiB (10,485,760 bytes). The application validates file size, name, type and relevant file structure. It does not execute spreadsheet formulas or macros. Files are treated as untrusted attachments; these checks are not a malware-scanning service.

Attachments are handled in private temporary storage outside the public website directory and, if accepted, attached to the enquiry email. They are not published as website downloads.

The application attempts to delete its temporary attachment immediately after successful processing or a handled failure. A duplicate submission also triggers deletion of its newly uploaded temporary copy. Deletion failures, interrupted requests or process crashes may leave temporary files behind.

The cleanup script makes matching application-upload files and matching PHP temporary-upload files eligible for removal once their last file modification is more than 30 minutes old. Removal occurs on a subsequent successful cleanup run and requires the file to be accessible and not locked. The code does not itself schedule that run. This is therefore an age threshold, not an unconditional guarantee of deletion within 30 minutes. PHP’s initial upload-file handling also depends on the server configuration.

Deleting a temporary website file does not delete the copy delivered to the company mailbox. Email attachments follow the correspondence-retention rules below.

Form security, IP-based rate limits and duplicate prevention

The RFQ application uses request validation, a hidden anti-spam field, submission-timing checks, input limits, security tokens and server-side rate limits. These measures protect the form and mail service against automated abuse and duplicate delivery. The basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in protecting this service and the enquiries it handles.

The connecting IP address is converted into a secret-keyed hash (HMAC) for the application’s rate-limit filenames. Those files contain attempt timestamps rather than the original IP address or the enquiry text. This is pseudonymization, not a claim of anonymization. The hosting provider may separately retain an IP address in its access logs.

Rate limits use a rolling one-hour counting window. Older timestamps are filtered when the relevant record is processed; that one-hour window does not itself delete the record file. The cleanup script removes matching rate-limit files only when their last modification is more than two hours old, on a subsequent successful run. Further writes refresh that modification time.

For duplicate prevention, private session records can contain request identifiers, issuance times, a keyed digest of the submitted enquiry, a reference and delivery state. They do not contain the full company/contact fields, enquiry message or attachment content. A request identifier is accepted for submission for up to one hour after issuance. Expired records are pruned when a new request is initialized, and the number of records is limited; physical session-file retention is separate.

These automated checks concern validity and security. They do not make commercial purchasing or quotation decisions based on profiling.

Essential session cookie and server-side session files

When the RFQ backend is active, it uses the first-party cookie luxor_rfq to associate your request with a protected session. The cookie has the path /api/ and is marked Secure, HttpOnly and SameSite=Strict. It contains an opaque session identifier rather than your message or purchasing list.

The cookie is configured as a session cookie with no preset expiry date. It normally ends with the browser session; browser session-restoration features can preserve it. The one-hour request-identifier limit is not a one-hour cookie expiry.

PHP’s configured session garbage-collection lifetime is 7,200 seconds (two hours). This setting does not guarantee deletion at that exact time: PHP garbage collection depends on the server’s execution settings. Independently, the cleanup script makes matching session files eligible for deletion when their last modification is more than two hours old, on a successful later run. Further session activity may refresh the file’s modification time. The CSRF token has no separate hard-coded one-hour expiry; submission validity is checked through the associated request identifier.

This cookie is used to provide the secure enquiry functionality requested by the visitor, rather than for advertising. The device-storage basis for a strictly necessary cookie is Section 25(2) no. 2 TDDDG; the associated personal-data processing is based on Article 6(1)(f) GDPR for secure operation of the enquiry service.

Email delivery and business correspondence

Accepted enquiries are sent to the company mailbox using authenticated SMTP with encrypted TLS transport. The submitted address is used as Reply-To so we can answer the sender. The application does not send an automatic customer-confirmation email. A website success message confirms acceptance by the configured mail transport; it does not guarantee final inbox placement.

Business enquiries and email correspondence, including delivered attachments, remain in the company’s correspondence environment accessed through Outlook. Outlook is an email client; its use alone does not identify the hosting operator or storage location of the mailbox.

We retain correspondence for as long as it is needed to handle the enquiry, manage any resulting business relationship, and meet applicable statutory document-retention obligations. Relevant criteria include completion of the matter, the document category and any legal retention or preservation requirement. Internal deletion rules apply to correspondence not subject to continued retention. The RFQ code does not define a fixed mailbox-retention period and does not delete emails, email archives or mail backups.

Requests for erasure are assessed against applicable retention duties and any other lawful reason for continued processing. Where continued retention is required, access and use must remain limited to that purpose.

Recipients, service providers and external websites

Enquiries are accessible to company personnel handling purchasing requirements and business correspondence. Hosting and email-service providers process the information needed to operate the website and deliver or store correspondence. Competent authorities may receive information where disclosure is legally required.

The confirmed website-hosting location is Germany. This does not establish every processing or backup location for the separate email service. You may contact our privacy contact for further information about the service providers involved in your correspondence and any applicable international-transfer safeguards.

Manufacturer and catalog links lead to external websites. Their operators process data under their own privacy notices when you visit them. Catalog PDFs are linked rather than embedded or automatically downloaded by this website.

Analytics, advertising and fonts

The reviewed website files do not include analytics tools, advertising trackers, third-party CAPTCHA services or externally hosted font services. The pages use system fonts and locally hosted website assets. External manufacturer links do not by themselves load those websites when you view our pages.

RFQ drafts and application logging

Download RFQ Draft creates a text file locally in your browser. Downloading that draft does not submit the enquiry. The reviewed form scripts do not store the form contents in localStorage, sessionStorage or IndexedDB. A downloaded draft remains wherever you save it, subject to your own device and file-management choices.

The RFQ application does not create a permanent database record of each enquiry and does not write full enquiry messages or attachment contents to its own log files. Hosting, PHP-FPM and mail-server operational logs are separate systems; the confirmed 30-day period above applies to hosting access logs.

Private administrative delivery-test and readiness files contain test timestamps, a synthetic reference and a keyed configuration fingerprint, not customer enquiries. They have no automatic expiry or cleanup rule in the application. They remain until overwritten or removed administratively. A 24-hour rule limits when a test can be used to confirm readiness; it is not a 24-hour deletion period.

Your rights

Subject to the requirements and exceptions of the GDPR, you have the right to request access to your personal data (Article 15), correction (Article 16), erasure (Article 17), and restriction of processing (Article 18). You may request data portability where Article 20 applies, in particular to qualifying automated processing based on consent or a contract.

Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation under Article 21. If processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. The enquiry processing described above is not made conditional on advertising consent.

Contact info@luxor-tools.com to exercise your rights. We may request information reasonably necessary to establish identity and locate the relevant records. Erasure is not absolute where a legal retention obligation or another applicable exception requires continued storage.

You also have the right to lodge a complaint with a data-protection supervisory authority, including in the EU member state of your habitual residence, workplace or the alleged infringement. The supervisory authority for our establishment in North Rhine-Westphalia is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Postfach 20 04 44
40102 Düsseldorf
Germany

LDI NRW contact and complaint information