Privacy Policy
Last updated: 28 October 2026
This Privacy Policy explains how personal data are processed when you visit the Düssel Pharma website, submit a business enquiry or communicate with us. It reflects the services and processing activities described below and will be updated when material processing activities change.
1. Controller
Düssel Pharma UG (haftungsbeschränkt), operating this website under the public brand Düssel Pharma.
Registered business address:
Sandkaule 9–11
53111 Bonn
Germany
Email: info@duessel-pharma.de
For privacy-related requests, please use the email address above and identify the subject of your request sufficiently for us to handle it securely.
2. Scope and principles of processing
We process personal data where necessary to provide and secure the website, respond to business enquiries, communicate with prospective or existing business partners, comply with legal obligations, or pursue legitimate business and security interests.
The applicable legal basis depends on the purpose and may include Article 6(1)(b), (c) and (f) GDPR and, where consent is expressly requested, Article 6(1)(a) GDPR.
We do not use data submitted through a business enquiry for newsletter or promotional email marketing merely because an enquiry has been submitted.
3. Hosting and server log data
The website is hosted using Hostinger Managed WordPress. For customers in EU countries, the contracting entity identified in our previous policy is Hostinger International Limited, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus.
Hosting services may involve infrastructure, storage, database, security, technical maintenance and server-log processing necessary to operate the website.
When you access the website, technical data may be processed automatically, including the requested page or file, date and time of access, IP address, browser and operating-system information, referrer information, data volume and technical status information.
This processing is carried out to deliver the website reliably, maintain technical security, diagnose faults and prevent misuse.
The legal basis is Article 6(1)(f) GDPR. Where hosting is required to provide services requested in a contractual or pre-contractual context, Article 6(1)(b) GDPR may also apply.
Hostinger acts as a service provider and processor to the extent that it processes personal data on our instructions. Where subprocessors or transfers outside the European Economic Area are involved, applicable safeguards under Chapter V GDPR are used where required.
4. Contact and B2B enquiries
The website provides contact details for business enquiries. Enquiries submitted by email may contain:
- name and company;
- business email address;
- telephone number;
- country or region;
- company website and business activity;
- area of interest and target markets;
- project or enquiry details; and
- any other information voluntarily included in the message.
The purpose of this processing is to assess and respond to enquiries, communicate with prospective business partners, prepare possible pre-contractual steps and document business correspondence.
For enquiries connected with a possible contract or business engagement, the legal basis is Article 6(1)(b) GDPR.
For general B2B communication that is not directly pre-contractual, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in receiving and responding to relevant business enquiries and maintaining business communications.
A structured website enquiry form may be introduced. Before activation, its fields, storage arrangements, technical metadata, notifications and data-retention settings will be assessed and reflected in this policy as appropriate.
5. Email communication and delivery
When you contact us by email, we process your email address, message content and related communication metadata to handle the correspondence.
Business email services may process sender and recipient information, message content, timestamps and technical delivery data for transmission, operation, security and troubleshooting.
Where authenticated SMTP delivery or local email-delivery logging is used, its service provider, data-processing arrangements and configured retention period will be considered in the applicable privacy information.
The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual communications and Article 6(1)(f) GDPR for other legitimate business correspondence.
6. Cookies, local storage and similar technologies
The website and its underlying WordPress components may use technical, session-based or browser-side storage where necessary for core functionality, security or compatibility.
Where storage or access on a user’s device is strictly necessary to provide a service expressly requested by the user, consent may not be required under the applicable German rules.
Non-essential analytics, marketing or tracking technologies are subject to review of the required consent mechanism and transparency information before activation.
Where consent is required, such technologies must not be activated for users who have not provided the necessary consent.
The website’s cookie and storage practices will be reassessed whenever plugins, third-party content or other relevant technologies are introduced or changed.
7. Web analytics
The use of website analytics must be assessed in accordance with applicable data-protection and consent requirements.
If analytics tools are introduced or activated to understand website usage, traffic sources, frequently visited pages, technical devices or conversion paths, the relevant processing activities, providers, legal basis and any necessary consent arrangements will be documented.
Where consent is legally required, analytics will be controlled through an appropriate consent mechanism.
8. Email marketing and Hostinger Reach
Hostinger Reach is available within the website’s WordPress environment.
Submitting a business enquiry does not constitute consent to receive marketing emails.
If newsletter or marketing-email functions are offered publicly, the required lawful basis and consent workflow will be implemented as applicable. This may include a separate marketing opt-in, confirmation or double opt-in where appropriate, unsubscribe functionality, retention rules and updated privacy information.
Business enquiry details will not automatically be treated as newsletter subscriptions.
9. Recipients and service providers
Personal data may be accessible to authorised persons within the business who need the data to process an enquiry or operate the website.
In addition, data may be processed by service providers acting on our behalf, in particular website hosting and infrastructure providers and email service providers.
We do not sell personal data.
We do not disclose enquiry data to unrelated third parties for their own marketing purposes.
Data may be disclosed where required by law, necessary to establish, exercise or defend legal claims, or necessary to protect the website and its users from misuse or security threats.
10. Retention and deletion
We retain personal data only for as long as necessary for the purpose for which they were collected, taking into account the status of the enquiry, any resulting business relationship, legitimate documentation needs and applicable statutory retention obligations.
General enquiry data may be deleted when the enquiry has been completed and no further business, legal or documentation need remains.
If an enquiry leads to a contractual relationship, relevant records may be retained for the periods required by applicable commercial, tax or other legal obligations.
Technical logs are retained for the configured or provider-defined operational periods, subject to applicable legal requirements.
11. Your data-protection rights
Subject to the statutory conditions, you may have the right to:
- request access to your personal data under Article 15 GDPR;
- request rectification under Article 16 GDPR;
- request erasure under Article 17 GDPR;
- request restriction of processing under Article 18 GDPR;
- receive applicable personal data in a portable format under Article 20 GDPR; and
- object to processing based on legitimate interests under Article 21 GDPR.
Where processing is based on consent, you may withdraw that consent at any time with effect for the future.
Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise your rights, contact:
We may need to verify your identity before fulfilling a request where this is necessary to protect personal data from unauthorised disclosure.
12. Right to lodge a complaint
You have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your personal data infringes applicable data-protection law.
The supervisory authority in North Rhine-Westphalia is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
You may also contact another competent supervisory authority in accordance with Article 77 GDPR.
13. Security
We use technical and organisational measures appropriate to the nature and risk of the processing to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
No method of transmission or storage can be guaranteed to be completely secure, so measures are reviewed in light of the actual systems and risks.
14. Automated decision-making
We do not currently use the website to make decisions based solely on automated processing that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.
15. Changes to this Privacy Policy
This Privacy Policy will be reviewed when the website, hosting, plugins, forms, email delivery, analytics, cookies, tracking, embeds, CRM, email marketing, portal, uploads, user accounts, e-commerce, payments or other data-processing workflows materially change.
The version and date shown at the top identify the date of this policy text.