Privacy Policy

Last updated: October 5, 2026

Thank you for your interest in webuyyourmachinetools.com. Protecting your personal data is a central concern for us. Below, we explain in detail the nature, scope, and purpose of the data processing we carry out, as well as your rights under the EU General Data Protection Regulation (GDPR) and the German Telecommunications-Digital-Services-Data-Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG, formerly TTDSG).

1. Controller

The controller within the meaning of Art. 4(7) GDPR is:

MBR GmbH Mergenthaler Allee 15-21 65760 Eschborn Germany

Phone: +49 (0) 6196 9727560 Email: [email protected]

Managing Director: Marcel Brockmann Commercial Register: Amtsgericht Frankfurt am Main (Frankfurt am Main Local Court), HRB 118884 VAT ID: DE331712934

A data protection officer is not legally required: as a rule, fewer than 20 people are constantly engaged in the automated processing of personal data at our company (Section 38(1) BDSG), and there is no core activity within the meaning of Art. 37(1) GDPR. For data protection questions, please contact us directly at the email address above.

2. Provision of the website and server log files

2.1 Hosting through Cloudflare Pages

This website is served as a static site through Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare operates a globally distributed content delivery network with servers within the EU as well; requests from Europe are primarily served through European nodes.

Every time a page is accessed, the following access data is technically necessarily collected in server log files:

• IP address of the requesting device (truncated when stored)
• Date and time of access
• URL accessed and HTTP status code
• Volume of data transferred
• User-agent string (browser, operating system)
• Referrer URL (if transmitted)

This data is processed exclusively to ensure smooth operation, to defend against attacks (e.g., DDoS), and for statistical analysis. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and stable web presence). Logs are deleted after a maximum of 30 days, or anonymized before then.

2.2 Transfer to third countries

Cloudflare is a company headquartered in the USA. Data transfers to the USA are based on a data processing agreement under Art. 28 GDPR, as well as on the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission dated July 10, 2023). Cloudflare is certified under the Data Privacy Framework. The EU Standard Contractual Clauses (SCCs) apply in addition.

3. Contact and machine valuation form

3.1 Valuation form

When you fill out the valuation form, we process the data you provide to respond to your inquiry and prepare an offer:

• Required fields: name, company, email address, phone number, country and location of the machine, machine type, manufacturer, model and a short description of the machine, and your consent to the processing
• Optional: year of manufacture, operating hours, control, condition rating, video link, photos and documents of the machine

Processing channels:

• Form contents are transmitted via an encrypted HTTPS connection to our own n8n backend at n8n.mbrmachinery.de. This backend runs on a server located in Germany; the data does not leave the EU.
• Uploaded images and documents are transmitted for storage and delivery to Cloudinary, Inc., 3400 Central Expressway, Suite 110, Santa Clara, CA 95051, USA. Cloudinary is certified under the EU-U.S. Data Privacy Framework. A data processing agreement under Art. 28 GDPR and EU Standard Contractual Clauses are in place.

Image and document uploads are transmitted to Cloudinary as soon as a file is selected in the form — i.e., before the rest of the form is submitted. The legal basis for this is Art. 6(1)(b) GDPR; where files are transmitted before the form is submitted, Art. 6(1)(f) GDPR (legitimate interest in processing your intended inquiry promptly).

The legal basis otherwise is Art. 6(1)(b) GDPR (steps taken prior to entering into a contract). We store your inquiry for 24 months after the last contact, unless a contract is concluded; the data is then deleted. If a business relationship results, the statutory retention periods apply (generally 6, 8 or 10 years under Section 257 of the German Commercial Code (HGB) / Section 147 of the German Fiscal Code (AO) for business correspondence and accounting records).

3.2 Callback form on the home page

In the callback form we ask for the machine, postcode, company, email address and phone number so that we can call you back about a valuation. Depending on the configuration, the details are sent via an encrypted HTTPS request to our n8n backend (server in Germany), or your browser opens a pre-filled email draft to us that you send yourself. The legal basis is Art. 6(1)(b) GDPR; retention is as in section 3.1.

3.3 Email, phone, WhatsApp

If you contact us by email, phone, or WhatsApp, we process the data you provide to handle your request (Art. 6(1)(b) or (f) GDPR).

If you contact us via WhatsApp, WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, processes your data under its own privacy policy. Data may also be transferred to countries outside the EEA; please see the privacy policy for details. Contact via WhatsApp occurs solely on your own initiative.

4. Cookies and consent management

4.1 Klaro consent manager

To obtain, manage, and document your consent under Section 25 TDDDG and Art. 7 GDPR, we use the open-source consent manager Klaro (KIProtect GmbH, Berlin). Klaro is served directly from our own servers via Cloudflare Pages; no data is transmitted to third parties.

Klaro stores one technically necessary first-party cookie:

The legal basis for this cookie is Art. 6(1)(c) GDPR in conjunction with Section 25(2) No. 2 TDDDG (legal obligation to document consent).

You can withdraw or adjust your consent at any time via the “Cookie settings” link in the footer.

4.2 Storage in your browser (sessionStorage)

While you fill in the valuation form, the website keeps one entry in your browser’s sessionStorage. It is deleted when you close the tab and is not transmitted to third parties:

The legal basis is Section 25(2) No. 2 TDDDG (strictly necessary for the form you are using).

4.3 Optional cookies and technologies

Optional cookies and third-party services (in particular Google Analytics 4) are loaded only after your explicit consent.

5. Web analytics: Google Tag Manager and Google Analytics 4

5.1 Google Tag Manager (container)

We use Google Tag Manager (container ID GTM-5XMCC447), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The Tag Manager is deactivated by default and is loaded only once you actively consent to the “Google Analytics 4” service in the Klaro banner — no connection to googletagmanager.com or any other Google server is established before your consent. The Tag Manager itself does not store cookies or collect any personal data beyond that.

If you later withdraw your consent via “Cookie settings” in the footer, the associated GA4 cookies are deleted and no further data is transmitted to Google.

5.2 Consent Mode v2 (default denied)

Before loading the Tag Manager, we signal to Google via Google Consent Mode v2 that all analytics and advertising storage purposes are denied by default (analytics_storage = denied, ad_storage = denied, ad_user_data = denied, ad_personalization = denied). Only once you actively consent via the Klaro banner is the signal updated to granted and Google Analytics loaded.

5.3 Google Analytics 4

Once consent is given, Google Analytics 4 (Google Ireland Limited / Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) is activated for statistical analysis of website usage. GA4 sets, in particular, the following cookies:

The IP address is received at a data center within the EU, used there solely to derive location (country/region), and not stored. The maximum retention period for event data in our GA4 property is configured at 14 months.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent).

Transfer to third countries: Data may be transmitted to Google LLC servers in the USA. The transfer is based on the EU-U.S. Data Privacy Framework (Google LLC is certified), supplemented by EU Standard Contractual Clauses. A data processing agreement under Art. 28 GDPR is in place with Google.

Withdrawal: You can withdraw your consent at any time via the “Cookie settings” button in the footer. The lawfulness of processing carried out before the withdrawal remains unaffected.

6. Embedded third-party content

6.1 Fonts (self-hosted)

We use web fonts for consistent display of the website. These are served exclusively from our own servers / the Cloudflare Pages origin. There is no connection to Google servers or any other external font CDN; in particular, no data is transmitted to Google Fonts (fonts.googleapis.com / fonts.gstatic.com).

7. Recipients and processors at a glance

8. Your rights as a data subject

You have the following rights at any time regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent given (Art. 7(3) GDPR), with effect for the future

To exercise your rights, an informal message to [email protected] is sufficient.

9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The authority with local jurisdiction over our company is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information) Postfach 3163 65021 Wiesbaden, Germany https://datenschutz.hessen.de/

You may also contact the supervisory authority in your habitual place of residence or workplace.

10. Currency and changes to this privacy policy

This privacy policy is dated October 5, 2026. Further development of our website or changes in legal or regulatory requirements may make it necessary to update this privacy policy. The current version is always available at /privacy-policy/.