Privacy notice

Last updated: 8 September 2026

This notice explains how we process personal data when you visit our website, contact us or use our shop.

Controller · Your rights · Website and logs · Cookies and settings · Contact · Account and orders · Payments · Google reCAPTCHA · Fonts and videos · Retention and recipients

1. Controller and contact details

The controller is Dr. Fritz Endoscopes GmbH, Almenweg 10, 88637 Buchheim-Tuttlingen, Germany.
Telephone: +49 7777 882300
Email: dr.fritz@dr-fritz.de

Please use these contact details for privacy enquiries and to exercise your rights.

2. Your rights

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20).

Right to object

Where processing is based on Article 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without providing reasons. This also applies to related profiling.

Withdrawing consent

You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing before withdrawal. Change your choices for optional services using Privacy settings, also available in the footer. Other consent can be withdrawn using the contact details above.

Complaints

Under Article 77 GDPR, you may complain to a supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. The authority generally responsible for our company is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany; email: poststelle@lfdi.bwl.de. See the authority's contact page.

3. Website operation and server logs

Accessing our website involves processing technically necessary connection and usage data, including your IP address, time, requested address, request status, browser and operating system information and, where transmitted, the referring page. Hosting and IT providers process these data to deliver, troubleshoot and secure the website.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are reliable operation, resolving faults and detecting and preventing abuse and attacks. Retention depends on the period required for these purposes. Records relevant to a specific security incident may be needed longer for investigation and legal claims. The deletion criteria in section 10 also apply.

HTTPS encrypts data in transit between your browser and our web server. This protects transmission but does not guarantee the security of every device or subsequent processing operation.

4. Cookies, local browser storage and privacy settings

The shop uses cookies and local browser storage. Storage or access strictly necessary to provide a service you explicitly request is based on section 25(2)(2) of the German TDDDG. Other storage or access requires prior consent under section 25(1) TDDDG. Subsequent processing of personal data also requires a GDPR legal basis.

Session: The session cookie connects related page requests and supports the cart and login. It is configured as a session cookie.
Time zone: This information supports the correct display of time-related information. Its configured lifetime is approximately 30 days.
Cookie and service choices: cookie-preference and cookie-config-hash remember your choice and the configuration version, with a planned lifetime of 30 days. The separate reCAPTCHA consent choice is also stored for 30 days.
Local browser storage: The shop stores, among other things, display components for the cart. These entries remain until replaced by the shop or removed by you or your browser.

Necessary personal data processing is based on Article 6(1)(b) GDPR for contractual functions and Article 6(1)(f) for reliable and secure operation. Managing and respecting your consent decision also serves legal privacy obligations under Article 6(1)(c). Optional services process data on the basis of consent under Article 6(1)(a).

You may reject optional services and change your selection at any time using Privacy settings. You can also delete or block cookies and website data in your browser. Blocking necessary storage may limit shop functionality.

5. Contact, enquiries and service

When you contact us by form, email or telephone, we process your contact details and enquiry content to handle your request and any necessary follow-up. Workshop registrations and repair enquiries also involve the information you provide for those purposes.

Article 6(1)(b) GDPR applies where processing is necessary for a contract with you or pre-contractual steps you request. Other enquiries, including communications with company representatives, are based on Article 6(1)(f). Our legitimate interest is appropriate business communication and handling your request. Separately provided consent applies only to the specified voluntary purpose.

Required form fields are marked. Without the information needed to handle the request, we cannot process the form or answer the enquiry. Your telephone number is optional. Ordinary contact enquiries do not require agreement to our terms and conditions. Please provide only information necessary for your request.

We need the data for the duration of the enquiry and any resulting contract. Additional criteria for business correspondence subject to retention obligations and for legal claims are explained in section 10.

6. Customer accounts, orders and delivery

Registration, login and account management involve identification and contact details, login credentials and saved addresses. Orders additionally involve purchased items, billing data, payment status and, where relevant, company details.

Processing serves account provision and order fulfilment under Article 6(1)(b) GDPR. Legally required documentation is based on Article 6(1)(c). Communication with company representatives and abuse prevention may be based on Article 6(1)(f).

Delivery and logistics providers receive the data necessary for delivery, especially names and shipping addresses. Payment providers receive data necessary for payment. You can request account deletion through our contact details; legally required retention of order and invoice records is unaffected.

When you withdraw from a contract, we process your name, email address, contract number and any comment to identify and handle the withdrawal and send an acknowledgement of receipt. The bases are Article 6(1)(b) GDPR for contractual processing and Article 6(1)(c) GDPR for statutory obligations relating to withdrawal. The retention criteria in section 10 apply.

7. Advance bank transfer and PayPal

For advance bank transfers, we process payment and order details needed to allocate the payment. The banks involved process data as part of the transfer.

If you select PayPal, the order, contact, billing and transaction information necessary for payment is sent to PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Necessary payment processing is based on Article 6(1)(b) GDPR and statutory retention on Article 6(1)(c). These purposes are separate from any additional voluntary consent.

PayPal also processes data as an independent controller, for example to meet legal obligations and prevent fraud. See the PayPal privacy statement for recipients, international transfers, retention and your rights.

8. Google reCAPTCHA: only after your choice

We use Google reCAPTCHA Enterprise to protect the contact, withdrawal and password recovery forms against automated abuse. The service loads only after you voluntarily enable it in the privacy settings. Without enabling it, you can contact us by email or telephone, including for assistance accessing your account.

Loading and using the service involves processing IP addresses, browser and device information and interaction data used to assess abuse. Google may use cookies and access device information. Connections include recaptcha.net and gstatic.com; font files may also load from fonts.gstatic.com. The legal bases are Article 6(1)(a) GDPR and, where device storage or access is involved, section 25(1) TDDDG.

For Google Cloud customers with a billing address in the European Economic Area, Google generally identifies Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, as the contracting entity. Since 2 April 2026, Google processes reCAPTCHA customer data as a processor under its service terms. Google Cloud terms and data processing agreements govern these customer data; general Google end-user terms do not replace this information.

Processing by Google companies or subprocessors outside the EEA, particularly in the USA, is possible. Details of terms, retention and deletion, subprocessors and international safeguards are provided in the Google Cloud Data Processing Addendum and the provider's reCAPTCHA data processing information. See section 10 for additional information about transfer bases.

We store your activation choice in our own drfritz-recaptcha-consent cookie for 30 days. Withdraw it at any time through Privacy settings. This prevents further loading of the service; processing that has already taken place is unaffected.

9. Fonts and external video links

The main and icon fonts used to style this website are served from our own web server and do not require a Google Fonts connection. This is separate from the font requests within the voluntarily enabled reCAPTCHA service described in section 8.

Our video page links to YouTube. An ordinary external link does not transmit data to YouTube merely because you visit our video page. Following the link takes you away from our website; the respective provider's privacy information then applies.

10. Recipients, retention and international processing

Data are received by internal departments and providers that need them for the relevant purpose. These include hosting, email and IT providers, payment and delivery providers for orders, and Google where you voluntarily enable spam protection. Data are provided to public authorities or other recipients where there is a legal obligation or another applicable legal basis. These recipient categories do not authorise unrestricted further processing.

Retention depends on the purpose: handling ongoing enquiries, maintaining an account you use, fulfilling contracts, handling complaints, statutory retention and establishing or defending claims. Once necessary purposes no longer apply, data must be deleted or restricted to retention purposes where legal obligations prevent deletion. Please contact us to exercise your rights.

Statutory periods generally include eight years for accounting vouchers, six years for commercial and business correspondence and ten years for certain accounting records. Periods generally begin at the end of the relevant calendar year. Statutory exceptions and extensions, for example pending tax proceedings, must be taken into account. These periods do not apply indiscriminately to all enquiry or account data.

Personal data transfers outside the EEA must also comply with Articles 44 onwards GDPR. An adequacy decision applies only where the recipient and processing are covered. The EU-US Data Privacy Framework requires corresponding participation by the US recipient. Otherwise, appropriate safeguards, particularly EU Standard Contractual Clauses, or a statutory exception are required. Information and safeguards for each service are accessible through the provider links above. You may request further information or a copy of relevant safeguards using our contact details.