Privacy Policy

The German version of this privacy policy is authoritative.

In this privacy policy, we inform you which personal data we process when you visit the helaspice.com website or write to us using a form, for what purpose and on what legal basis this takes place, and what rights you have.

1. Controller

The controller responsible for data processing on this website is:

Hela Gewürzwerk Hermann Laue GmbH
Beimoorweg 11
22926 Ahrensburg

Phone: +49 (0) 41 02/ 496-0
Email: willkommen@hela.eu

2. Data protection officer

We have appointed a data protection officer. Contact: datenschutz@hela.eu

3. What this website does and does not do

This website has a deliberately simple structure:

It does not set any cookies and does not use any comparable storage technologies in your browser.
There are no analytics or tracking tools.
No content from other providers is embedded, such as videos, maps, social media plug-ins or translation services.
Fonts are loaded from the web server of this website, not from Google or other providers.
There is no captcha service.

When you call up a page, your browser therefore only establishes a connection to the web server of this website.

4. Hosting

This website is hosted by an external service provider (hosting provider): Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

The hosting provider processes the data generated when you visit the website (section 5) and the form entries when they are sent (section 7) only on our behalf and in accordance with our instructions. This is based on a data processing agreement pursuant to Art. 28 GDPR, which forms part of our service agreement with Cloudflare. This does not apply to analyses that Cloudflare creates for its own purposes from server, network and traffic data (Network Data), for example to defend against malicious activity. According to Cloudflare, it is itself the controller for these analyses (www.cloudflare.com/privacypolicy/).

Transfer to the USA

Cloudflare is based in the USA. According to Cloudflare, it processes log data on visits to its customers’ websites in data centres in the USA and in Europe. In the process, personal data, including your form entries (section 7), may be transferred to the USA.

Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework. For transfers to companies holding this certification, the European Commission has decided that the USA ensures an adequate level of protection (Art. 45 GDPR, Commission Implementing Decision (EU) 2023/1795). If this basis ceases to apply, the European Commission’s standard contractual clauses apply under Cloudflare’s data processing agreement (Art. 46(2)(c) GDPR). The certification can be viewed at www.dataprivacyframework.gov, and Cloudflare’s data processing agreement can be found at www.cloudflare.com/cloudflare-customer-dpa/.

5. Server log files

Each time a page is called up, your browser transmits data to the web server for technical reasons. The hosting provider stores this data in log files (server log files). Typically, these are:

IP address of the requesting device
Date and time of access
Page or file accessed
Amount of data transferred and status code
Website from which you came to us (referrer), if your browser transmits it
Browser type and version, as well as operating system

The purpose is the secure and trouble-free operation of the website, in particular detecting and fending off attacks and analysing errors. The legal basis is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR). We do not combine this data with other data sources and do not evaluate it to analyse your usage behaviour.

Storage period: Cloudflare does not specify a fixed period for this and, according to Cloudflare, stores the data only for as long as is necessary to operate its service or to comply with statutory obligations.

6. Encrypted transmission

This website is delivered via an encrypted connection (HTTPS with TLS). You can recognise this by ‘https://’ in the address bar of your browser. This means that data you transmit to us, such as form entries, cannot be read by third parties while in transit.

7. Contact form and career form

On the ‘Contact Us’ and ‘Career’ pages, you can write to us using a form.

Which data

Contact form: name, email address, phone number, company name, region, country and your message
Career form: first name, last name, email address, phone number, region, country and your message

In addition, the form transmits the page from which and the language in which it was submitted. The email to us also contains the time of receipt.

All fields are mandatory. Providing this information is voluntary, but without it we cannot receive your message via the form. You can also reach us by email or phone (section 1).

Purpose and legal basis

We process your details in order to respond to your enquiry. If it relates to a contract or the initiation of a contract, such as an enquiry about our products, the legal basis is Art. 6(1)(b) GDPR. For all other enquiries, the legal basis is our legitimate interest in responding to enquiries addressed to us (Art. 6(1)(f) GDPR).

We process applications and enquiries submitted via the career form for the purpose of initiating an employment relationship (Art. 6(1)(b) GDPR).

Sending and recipients

The form sends your details as an email via the email service of our hosting provider (Cloudflare Email Service) to our mailbox contact@helaspice.com. The content is not stored on the web server; it is only passed on to the email service for sending. According to Cloudflare, this service is used for transmission, not for permanent storage. The preview of sent emails, which Cloudflare would otherwise retain for about seven days, is switched off for our website. No automatic confirmation email is sent to you.

Within our company, we forward your message to the department responsible for your matter.

Protection against misuse

To prevent the form from being misused on a large scale for unwanted messages (spam), we limit the number of requests per sender per hour. For this purpose, the web server generates a shortened check value (hash) from your IP address and a random key that is newly generated every day, and stores it together with the times of your requests. The IP address itself is not stored for this purpose. Times older than one hour are no longer taken into account and are deleted with the next request via the form or during a regular clean-up run. The key from the previous day is likewise deleted; after that, a check value can no longer be attributed to any IP address.

In addition, the web server checks whether the request comes from this website and detects automated entries by means of an invisible field. This information is not stored. The legal basis for protection against misuse is our legitimate interest in a functional and secure form (Art. 6(1)(f) GDPR).

An error log only records which form could not be sent, when, and for what technical reason. It contains neither your entries nor your IP address.

8. Enquiries by email or phone

If you contact us by email or phone, we process your details in order to deal with your enquiry. Section 7 applies accordingly to the legal basis.

9. Links to other websites

This website contains links to other websites, such as our country websites (for example hela.eu, hela.nl, helaspice.ca), websites of our sales partners and LinkedIn. No data is transferred to these providers when you call up our pages. Only when you click on such a link does your browser call up the third-party website. Its operator then receives, among other things, your IP address and, where applicable, the information as to which page you came from. The respective operator is responsible for the data processing there.

10. Your rights

Under the GDPR, you have the following rights, provided that the statutory requirements are met:

Access to the data processed by us (Art. 15 GDPR)
Rectification of inaccurate data (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection to processing (Art. 21 GDPR, see below)

If you have given us your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). To do so, contact us using the contact details in section 1 or contact our data protection officer.

Right to object (Art. 21 GDPR)

If we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Postfach 71 16
24171 Kiel
Phone: 0431 988-1200
Email: mail@datenschutzzentrum.de
www.datenschutzzentrum.de

11. No automated decision-making

We do not use your data for automated individual decision-making or profiling (Art. 22 GDPR).

Last updated: 7 October 2026