Skip to Content
B2B wholesale · No minimum order value · Warehouse Mettmann · Ships in 24–48 h 🎁 Refer a friend = €40 voucher

Privacy Policy

Last updated: October 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

MDH Distribution GbR
Hochstraße 17
47228 Duisburg, Germany
E-mail: info@mdh-distribution.com
Phone: +49 15563 188241
VAT ID: DE455079255

2. Data Protection Officer

We are not legally required to appoint a data protection officer. If you have any questions about data protection, you can reach us using the contact details above.

3. General Information and Business Model

We process personal data only to the extent necessary to provide a functioning website and our content and services, or where consent or a statutory permission exists.

B2B focus: our online shop is aimed exclusively at businesses and entrepreneurs within the meaning of § 14 BGB (German Civil Code). We mainly process contact details of contact persons at companies; these are also personal data within the meaning of the GDPR.

4. Provision of the Website and Server Log Files

Each time our website is accessed, the system automatically records technical access data: browser type and version, operating system, date and time of access, the previously visited page (referrer URL) and the IP address of the requesting device.

Purpose: delivering the website, ensuring stability and security, preventing misuse.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure, error-free provision).

Processing: the website is hosted by Odoo S.A. (see section 5); the server log data is generated there.

5. Hosting (Odoo.sh)

Our website and shop are operated as software-as-a-service in the cloud of Odoo S.A., Rue Laid Burniat 1, 1348 Ottignies-Louvain-la-Neuve, Belgium (Odoo.sh). All data collected via the website (e.g. account creation, orders, contact enquiries, server logs) is processed and stored on Odoo's infrastructure.

Roles: we are the controller for our database; Odoo S.A. is our processor and processes the data exclusively on our instructions.

Legal basis: Art. 6 (1) (b) GDPR (initiation and performance of a contract) and Art. 6 (1) (f) GDPR (secure, efficient provision).

6. Cookies, Consent and Advertising Measurement

We use strictly necessary cookies (e.g. for the shopping cart, login and language setting) without consent. Legal basis: § 25 (2) TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6 (1) (b) or (f) GDPR.

All other services that store or read information on your device are only loaded once you choose "Accept all" in the cookie notice. The legal basis is then your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). If you choose "Only essentials", these services stay off. You can withdraw your consent at any time with effect for the future by reopening the cookie notice on our cookie policy page or by deleting this website's cookies in your browser.

With your consent, these are:

  • Origin of your visit: if you arrive via a tagged link (e.g. from an advertisement or a newsletter), we store source, medium and campaign for 31 days (cookies odoo_utm_source, odoo_utm_medium, odoo_utm_campaign) in order to attribute enquiries and orders to the respective campaign.
  • the measurement pixel for advertisements in ChatGPT (see below)
  • the TikTok Pixel for measuring advertisements on TikTok (see below)
  • the embedded TikTok video on our home page (see below)

Google reCAPTCHA on forms is described in section 9. An overview of all cookies can be found in our cookie policy at www.mdh-distribution.com/cookie-policy.

Measuring advertisements in ChatGPT (OpenAI Ads Measurement Pixel)

We run advertisements in ChatGPT. To find out whether these advertisements lead to registrations and orders, we use, with your consent, the measurement pixel of OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland ("OpenAI").

Data processed: pages viewed and the start of the checkout; for an order, the order number, the value of the goods (net), the currency as well as item numbers, item names and quantities; for a confirmed registration, an internal reference number. In addition, technical data such as IP address, browser and device information and an identifier if you came to us via an advertisement in ChatGPT. Depending on the settings, OpenAI may also receive contact details you enter into forms (e.g. your e-mail address) in hashed, i.e. pseudonymised, form in order to attribute the visit to an advertisement. We do not transmit names, addresses or payment details from your order.

For this purpose, the cookie __obref (up to 1 year) is stored on our domain, technical cookies of the network provider Cloudflare (_cfuvid, __cf_bm) on OpenAI domains, and an entry in your browser's session storage.

Purpose: measuring the success of and billing for our advertisements. Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). We are responsible for the collection on our website and the transmission to OpenAI; further processing takes place under the responsibility of OpenAI. A transfer to the USA is possible, based on appropriate safeguards (EU standard contractual clauses or EU-US Data Privacy Framework). More information: openai.com/policies/privacy-policy.

Measuring advertisements on TikTok (TikTok Pixel)

We run advertisements on TikTok. To find out whether these advertisements lead to registrations and orders, we use, with your consent, the TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland ("TikTok").

Data processed: pages viewed and the start of the checkout; for an order, the order number, the value of the goods (net), the currency as well as item numbers, item names, quantities and prices; for a confirmed registration, an internal reference number. In addition, technical data such as IP address, browser and device information and an identifier if you came to us via an advertisement on TikTok. We have switched off the automatic transfer of contact details (advanced matching) and the extended data sharing; we do not transmit names, e-mail addresses, phone numbers, addresses or payment details.

For this purpose, the cookies _ttp and ttcsid (up to 13 months) are stored on our domain.

Purpose: measuring the success of our advertisements. Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). We and TikTok are jointly responsible for the collection on our website and the transmission to TikTok (Art. 26 GDPR); further processing takes place under the responsibility of TikTok. A transfer to third countries (including the USA and China) is possible. More information: tiktok.com/legal/privacy-policy-eea.

TikTok video on our home page

On our home page we embed the latest videos of our TikTok channel. The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland. The video is only loaded after your consent; before that you only see a link to our channel. Once loaded, TikTok receives, among other things, your IP address, browser information and the page visited, and may set cookies (e.g. ttwid, msToken). Legal basis: your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). A transfer to third countries (including the USA and China) is possible. More information: tiktok.com/legal/privacy-policy-eea.

7. B2B Customer Account and Registration

Placing orders requires a password-protected customer account. When you register, we collect the following data:

  • Company name and legal form
  • Name of the managing director or representative and of the contact person
  • Address (street, postcode, city, country)
  • VAT ID (if provided), phone, e-mail address and website where applicable
  • Access credentials (password, stored encrypted)
  • Proof of trade: upload of a commercial register or trade register extract as evidence of business status
  • Confirmation of business status (§ 14 BGB) and acceptance of the terms and conditions and the privacy policy

Purpose: creating and administering the customer account, verifying and documenting business status, processing orders.

Legal basis: Art. 6 (1) (b) GDPR (initiation and performance of a contract); with regard to the proof of trade additionally Art. 6 (1) (f) GDPR (legitimate interest in demonstrably restricting the shop to business customers).

Retention period: for the duration of the customer account; statutory retention obligations remain unaffected (section 12).

Address suggestions

When you enter your address during registration and checkout, we suggest matching addresses. From the fourth character onwards, the text entered is transmitted together with your IP address to the Photon service (photon.komoot.io) of komoot GmbH, Potsdam, Germany, which is based on OpenStreetMap data. No cookies are set. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in quick and error-free address entry).

8. Order Processing and Payment

To process orders we handle order, invoice and delivery data (items ordered, quantities, prices, company and contact details, delivery and billing address, VAT ID).

Payment: bank transfer, cash on delivery and card payment via our payment service provider Stripe are available. If you choose a Stripe payment method, the data required for processing (amount, currency, order number and your contact and billing details) is transmitted to and processed by Stripe Payments Europe Ltd., 25/28 North Wall Quay, Dublin 1, Ireland. You enter your card or account details directly with Stripe; we neither see nor store them. Stripe may transfer data to Stripe, Inc. in the USA on the basis of the European Commission's standard contractual clauses. For details of Stripe's data processing see: stripe.com/de/privacy. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

Shipping: for delivery we pass the necessary address data to the relevant shipping or logistics provider (e.g. DHL for parcels or the appointed freight forwarder for pallet shipments), or you collect the goods yourself.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (c) GDPR (commercial and tax law obligations).

9. Google reCAPTCHA

To protect our forms (e.g. registration, contact form) against abusive and automated submissions we use reCAPTCHA provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA analyses user behaviour on the basis of various characteristics (including IP address, time spent on the page, mouse movements) in order to distinguish humans from bots.

Purpose: protection against spam and misuse, security of our forms.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in preventing misuse and in the security of the website). This may involve a transfer of data to Google, including to the USA, based on appropriate safeguards (EU-US Data Privacy Framework or EU standard contractual clauses).

10. Contact Form and Getting in Touch

When you use the contact form we process your first and last name, company, type of business, e-mail address, phone number (if provided) and your message. The entries are delivered to us by e-mail.

Purpose: handling and answering your enquiry.

Legal basis: Art. 6 (1) (b) GDPR for contract-related enquiries, otherwise Art. 6 (1) (f) GDPR.

11. E-mail Delivery and Other Processors

Microsoft 365: we send and receive e-mail (including the messages triggered by the contact form) via Microsoft 365 (Microsoft Ireland Operations Ltd., Dublin, Ireland). Microsoft processes the e-mail content and metadata as a processor.

Additional Odoo services: for certain functions, data is transmitted to Odoo S.A. or associated services, including for the verification of VAT IDs (EU VIES check), automated document recognition (OCR of uploaded invoices and receipts) and the enrichment of business contacts. This processing serves the correct handling of contracts and accounting.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract), Art. 6 (1) (c) GDPR (tax obligations, e.g. VAT ID verification) and Art. 6 (1) (f) GDPR (efficient processes).

12. Retention Periods and Statutory Retention Obligations

We store personal data only for as long as is necessary for the respective purpose or as we are legally required to. Business letters and accounting records are subject to commercial and tax law retention obligations (including § 257 HGB, § 147 AO) of up to 10 years; during this period the processing of the data concerned is restricted.

13. Recipients / Categories of Recipients

Recipients or categories of recipients of your data may be:

  • Odoo S.A. (hosting/SaaS and additional services such as VAT ID verification and document OCR) – processor
  • Microsoft Ireland Operations Ltd. (Microsoft 365 e-mail service) – processor
  • Google Ireland Limited (reCAPTCHA spam protection)
  • Stripe Payments Europe Ltd. (card payments, see section 8)
  • komoot GmbH (address suggestions via Photon, see section 7)
  • OpenAI Ireland Ltd. (measuring advertisements, only with consent, see section 6)
  • TikTok Technology Limited (embedded video and measuring advertisements, only with consent, see section 6)
  • Shipping and logistics providers (e.g. DHL, freight forwarders) for the delivery of the goods
  • Tax advisors as well as tax and customs authorities within the scope of statutory obligations

With Microsoft, Google, Stripe and OpenAI, a transfer to the USA may take place, based on appropriate safeguards (EU-US Data Privacy Framework or EU standard contractual clauses). For TikTok, see section 6.

14. Your Rights as a Data Subject

You have the following rights:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR) to processing based on Art. 6 (1) (f) GDPR
  • Withdrawal of consent (Art. 7 (3) GDPR) with effect for the future

To exercise these rights, an informal message to the following address is sufficient: info@mdh-distribution.com.

15. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Phone: +49 211 38424-0
E-mail: poststelle@ldi.nrw.de
Web: www.ldi.nrw.de

16. Data Security

We use TLS/SSL encryption (recognisable by the padlock symbol and “https://” in the address bar) as well as appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

17. Automated Decision-Making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

18. Currency and Amendments

This privacy policy is dated October 2026. We will adapt it as the website develops or the legal situation changes; the current version is always available on our website.