Privacy Policy

This English version is provided for convenience only. The German version (switch to DE at the top of the page) is legally binding.

1. Controller

KFRNTL is the rental service of KNITTERFISCH GbR
represented by the partners Alexander Fuhrmann and Manuel Kerstan
Arndtstr. 11, 01099 Dresden
Phone: +49 351 82 107 205
Email: rental@knitterfisch.de

We have not appointed a data protection officer because we are not legally required to do so. If you have any questions about data protection, you can reach us using the contact details above.

2. The essentials at a glance

This website does not use any analytics or advertising trackers and does not load any fonts or scripts from third-party servers.
When you submit a rental inquiry, we process your details in order to send you a quote and to handle the rental contract. For this we use our rental software Rentman.
At pick-up, we check your ID (Section 8).
Google Maps is only loaded once you activate the map yourself.

3. Legal bases

We process personal data on the basis of:

Art. 6(1)(a) GDPR (consent),
Art. 6(1)(b) GDPR (contract and pre-contractual measures, e.g. your inquiry),
Art. 6(1)(c) GDPR (legal obligations, e.g. retention under commercial and tax law),
Art. 6(1)(f) GDPR (legitimate interests, which we specify in each case).

In addition, § 25 TDDDG applies to storing information on your device or accessing it (e.g. cookies).

4. Hosting and server log files

The website is hosted by Host Europe GmbH, Hansestraße 111, 51149 Köln, on servers in Germany. We have a data processing agreement with Host Europe pursuant to Art. 28 GDPR.

Each time the website is accessed, the server automatically stores:

IP address,
date and time,
page accessed,
referrer (previously visited page),
browser and operating system.

This is technically necessary to deliver the website and to ensure its security, e.g. to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted after 7 days.

The connection to the website is encrypted via TLS (recognizable by “https://”).

5. Cookies and browser storage

We only store information on your device that is necessary for functions you use yourself (§ 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR):

Name	Type	Purpose	Duration
`wp_woocommerce_session_*`	Cookie	Remembers your inquiry list and your rental period	2 days
`woocommerce_cart_hash`, `woocommerce_items_in_cart`	Cookie	Indicates whether there are items in the inquiry list	Session
`kfr_saved`	Local storage	Your saved items, only in this browser	until you clear them

These cookies are only created once you add something to the inquiry list. We do not set analytics or marketing cookies. That is why we do not need your consent and do not show a cookie banner. You can delete cookies and local storage in your browser at any time. Should we later use services that require consent, we will ask for it beforehand.

6. Rental inquiry and rental contract

Via the inquiry list you can request equipment for a period of time. You do not need a customer account for this. In doing so, we process:

name,
company (optional),
address,
email address,
phone number,
project name,
shoot days,
pick-up and return dates,
the requested equipment,
your comments.

Mandatory fields are marked. Without them, we cannot prepare a quote.

The purpose is to process your inquiry, prepare a quote and handle the rental contract. This includes the invoice and, where applicable, a deposit, for which we process the necessary payment data. The legal basis is Art. 6(1)(b) GDPR. You will receive a confirmation by email.

We retain contract-related documents in accordance with the statutory retention periods: 6 years for business letters, 10 years for accounting records (§ 257 HGB, § 147 AO; Art. 6(1)(c) GDPR). Inquiries that do not result in an order are deleted after 12 months.

7. Rental software Rentman

Inquiries are automatically transferred to our rental software Rentman, where we plan availability, quotes, contracts and invoices. The provider is Rentman B.V., Drift 17, 3512 BR Utrecht, Netherlands. We have a data processing agreement with Rentman in accordance with Art. 28 GDPR.

The following data is transferred:

name,
company,
address,
email,
phone,
project,
period,
requested equipment,
comments.

The legal basis is Art. 6(1)(b) GDPR.

The website also queries Rentman for the days on which an item is available. No data about you is transferred in the process.

8. Identity check at pick-up

Our rental equipment is often very valuable. That is why, at pick-up, we ask to see your ID card or passport and, with your consent, take a photo of it. You may cover details that are not needed (e.g. access number and photo) beforehand.

The purpose is to protect against fraud and against the loss of the rental items. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 20(2) PAuswG. Our legitimate interest is being able to reliably identify the renter in the event of loss or non-return.

The photo is not passed on to third parties. We delete it as soon as the equipment has been returned in full and settled. In the event of damage, loss or outstanding claims, we retain it until the matter is resolved.

9. Contact by email, phone and WhatsApp

If you contact us by email, phone or WhatsApp, we process your details in order to handle your request. The legal basis is Art. 6(1)(b) GDPR where a contract is concerned, otherwise Art. 6(1)(f) GDPR.

Email: Our emails run via Google Workspace of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The website also sends its confirmation emails via the same service. We have a data processing agreement with Google pursuant to Art. 28 GDPR. Google may transfer data to the USA. Google is certified under the EU-US Data Privacy Framework; in addition, the EU Standard Contractual Clauses apply.

WhatsApp: You can also message us via WhatsApp. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The WhatsApp link on our website only transfers data once you click it.

In doing so, WhatsApp receives your phone number, your metadata (time, device) and, where applicable, your profile picture and your name. Message contents are end-to-end encrypted. WhatsApp may transfer data to the USA. Meta Platforms Inc. is certified under the EU-US Data Privacy Framework.

We use WhatsApp Business on a company device. If you do not want to use WhatsApp, you can reach us by email or phone at any time. WhatsApp privacy notice: https://www.whatsapp.com/legal/privacy-policy-eea

10. Google Maps

On the contact page you can display a map from Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded when you click “Load map”. Only then is data transferred to Google, including your IP address.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it by reloading the page. The map will then no longer be displayed automatically.

Google may transfer data to the USA. Google is certified under the EU-US Data Privacy Framework. Google privacy policy: https://policies.google.com/privacy

11. Google Merchant Center

Using the “Google for WooCommerce” extension, we transfer our product data (name, description, image, price) to Google Merchant Center. This allows our equipment to appear in Google Search. No personal data of visitors is transferred in the process. The extension does not set any cookies or tracking on our website.

Should we later use Google Ads conversion tracking, this will only happen with your prior consent.

12. Protection against attacks

To protect the login against attacks, we store the IP address and the time of failed login attempts (plugin “Kadence Security”, locally on our server). The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the security of the website. The entries are deleted after 30 days.

13. Your rights

You have the right to:

access (Art. 15 GDPR),
rectification (Art. 16),
erasure (Art. 17),
restriction of processing (Art. 18),
data portability (Art. 20).

You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). An email to rental@knitterfisch.de is sufficient.

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden.

14. Right to object (Art. 21 GDPR)

If we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defense of legal claims.

15. Changes

We will adapt this privacy policy if our website or the legal situation changes. Last updated: October 2026