Privacy policy
Information pursuant to Article 13 of the General Data Protection Regulation (GDPR). The German version is legally authoritative.
1. Controller
XB Distribution UG (haftungsbeschränkt)
Bleichstraße 45, 63065 Offenbach am Main, Germany
E-mail: datenschutz@vis-kautabak.de
Phone: +49 (0)69 000000
No data protection officer has been appointed, as the statutory requirements for this are not met.
2. Server log files
When you access this website, our hosting provider automatically processes the data transmitted by your browser: IP address, date and time of access, page requested, volume of data transferred, status message, referring page and details of your browser and operating system. The purpose is technical delivery of the site, system security and defence against attacks. The legal basis is Article 6 (1) (f) GDPR. Log data is deleted or anonymised after 30 days at the latest.
3. Hosting
This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel processes the data described in section 2 as a processor on the basis of a data processing agreement under Article 28 GDPR. Transfers to the USA are based on the European Commission's standard contractual clauses together with supplementary safeguards.
4. Age confirmation
Before accessing the content you confirm that you are at least 18 years old. This confirmation is stored exclusively in your browser (local storage entry „vis-alter-bestaetigt") so that the prompt does not reappear on every page view. No data is transmitted to us. The storage is strictly necessary within the meaning of Section 25 (2) no. 2 TDDDG, so no consent is required. You can delete the entry at any time via your browser settings.
Your acknowledgement of the data storage notice is also stored locally (entry „vis-hinweis-gelesen") so that the notice does not reappear on every visit. No data is transmitted to us in this case either.
5. Closed trade area
The product area is reserved for persons active in the tobacco trade. On sign-in, the password entered and your confirmation of trade activity are verified on the server. After successful verification a strictly necessary cookie („vis_fh") is set which contains only an expiry timestamp and a cryptographic signature, but no personal data. The cookie expires after 12 hours and is used solely for access control. The legal basis is Article 6 (1) (f) GDPR together with Section 25 (2) no. 2 TDDDG. Passwords entered are not stored.
6. Contact by e-mail
If you contact us by e-mail, we process the data you provide in order to answer your enquiry. The legal basis is Article 6 (1) (b) GDPR where the enquiry relates to a contract, otherwise Article 6 (1) (f) GDPR. We delete the data once it is no longer required and no statutory retention obligations apply.
7. No analytics, no advertising networks
This website uses no analytics or tracking services, no advertising networks, no social media plugins and no externally loaded fonts. No profiling or automated decision-making takes place.
As only strictly necessary storage within the meaning of Section 25 (2) no. 2 TDDDG is used, no consent is required. The data storage notice shown on the site therefore serves information purposes only and does not collect consent. Should services requiring consent be introduced in future, consent will be obtained beforehand via a consent banner and those services will only load after you have agreed.
8. Your rights
You have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and the right to object to processing based on Article 6 (1) (f) GDPR on grounds relating to your particular situation (Article 21 GDPR).
You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.
Last updated: September 2026