Privacy

PRIVACY POLICY

cncexperte.eu – ABARAD® CNC workshops in Europe

Last updated: November 2026 (Stand: November 2026)

This policy explains which personal data we process when you visit and use https://cncexperte.eu, for what purposes and on what legal basis, and what rights you have. The applicable law is the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications and Digital Services Data Protection Act (TDDDG).

The website is a directory of CNC workshops in Europe with a map view. It is aimed at businesses. Visitors can use the map without logging in. Workshops can apply for a free listing; on request, listed workshops can also be given access to a workshop area. In addition, there is a non-public area for invited helpers.

Section 1 Controller and general information

(1) Personal data means any information relating to an identified or identifiable natural person (Article 4(1) GDPR), such as a name, address, email address, phone number or IP address. Information about a business is personal data where it can be attributed to a natural person, for example in the case of sole traders.

(2) The controller within the meaning of Article 4(7) GDPR is:

Krisztián Molnár

ABARAD.eu
Grauwiesen Straße 17
73569 Eschach
Germany
Phone: +49 7175 3091801
Fax: +49 7175 3091802
Email: info@cncexperte.eu

Further details are given in our imprint: https://cncexperte.eu/en/imprint/

(3) We have not appointed a data protection officer. There is no obligation to do so (Section 38(1) BDSG), as personal data is processed solely by the operator himself. Please send any data protection questions to the contact details above. We reply in German, Hungarian or English.

(4) If you contact us by email, phone or fax, we process the details you provide (your email address or phone number, your name where given, and the content of your message) in order to deal with your request. The legal basis is Article 6(1)(b) GDPR where your request concerns a listing or another contractual relationship, and otherwise Article 6(1)(f) GDPR; our legitimate interest is in answering your request. We delete the data once it is no longer needed for this purpose, unless statutory retention obligations apply (see Section 20).

(5) We do not use your data for advertising, we do not sell it, and we do not pass it on to third parties except as described in this policy.

Section 2 Your rights

(1) You have the following rights regarding personal data concerning you:

• right of access (Article 15 GDPR),
• right to rectification (Article 16 GDPR),
• right to erasure (Article 17 GDPR),
• right to restriction of processing (Article 18 GDPR),
• right to data portability (Article 20 GDPR),
• right to object to processing (Article 21 GDPR, see Section 7),
• right to withdraw consent at any time with effect for the future (Article 7(3) GDPR).

An informal message to info@cncexperte.eu is sufficient.

(2) You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular the authority of your habitual residence or place of work or the authority responsible for us, which is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

Heilbronner Straße 35
70191 Stuttgart
Germany
Postal address: Postfach 10 29 32, 70025 Stuttgart
Phone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
Website: https://www.baden-wuerttemberg.datenschutz.de

(3) We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR. Whether a workshop is added to the map is decided by us personally (see Section 8).

Section 3 Visiting the website and server log files

(1) If you use the website for information only, that is, without applying or logging in, we process only the data your browser sends to our server for technical reasons:

• IP address,
• date and time of the request,
• time zone difference to Greenwich Mean Time (GMT),
• content of the request (the specific page),
• access status and HTTP status code,
• amount of data transferred,
• the website from which the request comes (referrer),
• browser, operating system and its interface,
• language and version of the browser software.

(2) This data is needed to display the website to you, to keep it stable and secure, and to fend off attacks. The legal basis is Article 6(1)(f) GDPR. The access and error logs are created by our hosting provider (Section 5). They are retained for [X days] and then deleted. We do not combine this data with other data sources.

(3) We use the preferred language sent by your browser (Accept-Language) to offer you the legal documents in the footer in a suitable language (German, Hungarian or English). No cookie is set for this and nothing is stored.

Section 4 Cookies and access to your device

(1) Cookies are small text files stored on your device. Under Section 25(2) no. 2 TDDDG, storing information on your device and accessing it is permitted without consent where this is strictly necessary for us to provide a service you have expressly requested. We use only such technically necessary cookies. We do not use analytics, marketing or tracking cookies, so no consent banner is required.

(2) We do not set any cookies ourselves for visitors who are not logged in. The country and category chosen on the map are part of the web address (parameters ?orszag= and ?kat=), not stored in a cookie. Filtering the list below the map by name or category takes place solely in your browser.

(3) Our service provider Cloudflare (Section 5(3)) sets the cookie __cf_bm to protect the website against automated access (bot protection). It is used to distinguish requests from humans and from bots, contains no information that directly identifies you, and expires after about 30 minutes. The legal basis is Section 25(2) no. 2 TDDDG and Article 6(1)(f) GDPR; our legitimate interest is in protecting the website against abuse and overload.

(4) If you log in as a workshop or helper, the system sets login cookies whose names begin with wordpress_logged_in_ and wordpress_sec_. They keep you logged in and secure your session. Without the "Remember me" option they are deleted when you close your browser; with this option they expire after 14 days. The legal basis is Section 25(2) no. 2 TDDDG and Article 6(1)(b) GDPR.

(5) You can delete cookies in your browser at any time or block them in general. Without login cookies, however, you cannot log in.

Section 5 Hosting, Cloudflare and transfers to third countries

(1) Our website is hosted by:

Tárhely.Eu Szolgáltató Kft.
Ormánság u. 4. X. em. 241.
1144 Budapest
Hungary
Company registration number: Cg. 01-09-909968

The servers are located in Budapest and therefore within the European Union. On our behalf, the hosting provider processes all data arising on the website, including server log files (Section 3) and backups (Section 19), and operates the mail server through which the confirmation email (Section 13) is sent. The data processing terms required by Article 28 GDPR form part of the hosting provider's general terms and conditions.

(2) The legal basis for hosting is Article 6(1)(f) GDPR; our legitimate interest is in providing the website reliably and securely. Where you apply or are logged in, Article 6(1)(b) GDPR applies in addition.

(3) All traffic between your browser and our server passes through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (proxy, attack protection and bot protection). As our processor, Cloudflare processes your IP address, the connection data listed in Section 3(1) and the content transmitted, including data entered in forms, to the extent necessary for forwarding and for the security functions. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is in protecting the website against attacks, overload and automated abuse. Cloudflare is certified under the EU-US Data Privacy Framework, so transfers to the USA are covered by an adequacy decision of the European Commission (Article 45 GDPR). Further information: https://www.cloudflare.com/privacypolicy/

(4) Apart from this, data is processed outside the European Union only by MapTiler AG in Switzerland (Sections 14 and 15) and by the OpenStreetMap Foundation in the United Kingdom (Section 15). Both countries are covered by an adequacy decision of the European Commission (Article 45 GDPR).

(5) We do not embed external fonts, web analytics services, advertising networks or social media plugins (see Section 17).

Section 6 Overview of legal bases

We process personal data on the following legal bases:

• Article 6(1)(a) GDPR (consent), for example for location detection via your browser (Section 15(4)),
• Article 6(1)(b) GDPR (contract and pre-contractual measures), in particular for applications, listings, workshop access and helper access,
• Article 6(1)(c) GDPR (legal obligation), for example for statutory retention obligations,
• Article 6(1)(f) GDPR (legitimate interests), in particular for operating and securing the website, the map display and the place search,
• Section 25(1) and (2) no. 2 TDDDG for storing information on your device and accessing it.

The relevant legal basis is stated for each processing operation.

Section 7 Withdrawal of consent and objection to processing

(1) You may withdraw any consent you have given at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal. You withdraw permission for location detection in your browser settings.

(2) Where we base processing on a balancing of interests, you may object to it. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

INFORMATION ON YOUR RIGHT TO OBJECT UNDER ARTICLE 21 GDPR: YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU WHICH IS BASED ON ARTICLE 6(1)(E) OR (F) GDPR, INCLUDING PROFILING BASED ON THOSE PROVISIONS. WHERE YOUR DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU MAY OBJECT TO SUCH PROCESSING AT ANY TIME WITHOUT GIVING REASONS. THE OBJECTION REQUIRES NO PARTICULAR FORM AND SHOULD PREFERABLY BE SENT TO: INFO@CNCEXPERTE.EU.

Section 8 Applying for a listing (registration)

(1) Workshops can apply for a listing on the map using the application form. We collect:

• company name,
• full address and country,
• specialties (at least one, at most twelve, from a predefined list),
• website (optional),
• phone number (optional),
• name of the contact person,
• name of the managing director or owner,
• email address,
• VAT identification number,
• confirmation that the application is submitted by the managing director personally or on their behalf.

(2) To protect against automated submissions, the form contains a field that is invisible to humans and a minimum completion time; no personal data is stored for this. To prevent mass sign-ups, no more than five applications per hour are possible from the same IP address. For this we do not store the IP address itself, only a one-way hash derived from it, for no longer than one hour.

(3) We use a double opt-in procedure: after submitting the form you receive an email with a confirmation link that is valid for 48 hours. We store the link only as a hash. Confirmation shows that the email address belongs to you. Unconfirmed applications are deleted by an automatic daily clean-up once they are older than 48 hours; in practice this happens no later than after 72 hours. If an email address is already linked to an application or listing, the form will tell you.

(4) We review every confirmed application personally. There is no entitlement to be listed. If we reject an application, we delete it immediately. If we accept it, we transfer the details to the workshop's listing (Section 10) and delete the application. No user account is created on acceptance.

(5) The legal basis is Article 6(1)(b) GDPR (pre-contractual measures and performance of the listing contract). Where data of the workshop's staff is concerned (contact person, managing director), the legal basis is Article 6(1)(f) GDPR; our legitimate interest is in being able to review the application, clarify questions and make sure the application comes from the workshop itself. The mandatory fields are required; without them we cannot process the application.

Section 9 VAT number check (VIES)

As our service is aimed exclusively at businesses, we check the VAT identification number provided using the European Commission's VAT Information Exchange System VIES (https://ec.europa.eu/taxation_customs/vies/). We send only the country code and the number to VIES. We store the result together with the application or listing. The legal basis is Article 6(1)(b) and (f) GDPR; our legitimate interest is in ensuring that only businesses are listed. If VIES is unavailable or the number is invalid, we will clarify this with you personally by email.

Section 10 Publication on the map

(1) For each listed and approved workshop, the following is publicly visible:

• company name,
• country,
• location on the map (the marker is placed on the basis of the address provided and shows its position precisely),
• specialties,
• website, if provided,
• phone number, if provided.

This information appears on the map, in the marker's pop-up and in the list below the map. For workshops with workshop access (Section 11), the address in text form and a link to the public profile page are added.

(2) The following is never published: the email address, the VAT identification number and the VIES result, the name of the managing director, the name of the contact person, and the private keywords (Section 11(4)).

(3) Publication serves to make the workshop findable for interested parties and other workshops; this is the core of our service. The legal basis is Article 6(1)(b) GDPR. For sole traders, the address, location and phone number are also personal data; the phone number is optional and can be removed at any time.

(4) We may temporarily hide a listing. It is then visible neither on the map nor as a profile page; the data is kept until the listing is made visible again or deleted.

Section 11 Workshop area ("Kezelő" access)

(1) At the request of a listed workshop, we set up access to the workshop area. For this we create a user account (username, email address, password). The password is stored only as a hash; we send you the login details personally by email. Workshop accounts have no access to the WordPress administration area.

(2) With access, the workshop receives a public profile page at https://cncexperte.eu/cnc/ followed by the workshop's name. In addition to the information listed in Section 10, it shows the address, a small map (Section 14(3)), the workshop's description, its machines (type, working area, materials) and the news published by the workshop with images and dates. The latest news items (up to six) are also shown on the home page.

(3) In the workshop area, the workshop can change its details itself. If the address changes, the location is determined again (Section 15(1)). Uploaded images are stored on our server. Please note that image files may contain metadata, such as the location where a photo was taken (GPS data), the date or the camera model, and that this may be stored with the file. We recommend removing such metadata before uploading.

(4) The workshop can save up to 20 private keywords. These are never displayed publicly. Logged-in workshops can search for other workshops in the workshop area (by name, category, country, distance and keyword). The results show the public information listed in Section 10 and only those keywords that match the search; all other keywords stay hidden. Searches are not stored.

(5) If access ends at the workshop's request or by our decision, the account initially remains but can no longer be used to log in: the password is invalidated and all open sessions are ended. The profile page is then no longer public. On request, we delete the account.

(6) The legal basis is Article 6(1)(b) GDPR.

Section 12 Helper area

(1) At https://cncexperte.eu/segito/ we run a non-public area for helpers who support us in building the directory in their country. Helper access is set up exclusively by us, by invitation; there is no self-registration. For this we store the helper's real name, email address and country, the username and the password as a hash. We hand over the login details personally; the system sends no email for this.

(2) On first login, the helper chooses a nickname from three suggested names of CNC tools. The nickname is unique and can only be reset by us.

(3) Helpers see only helpers from their own country, and only by nickname. Only we can see real names and email addresses.

(4) There is one idea wall per country. Ideas (up to 1000 characters) and comments are shown with nickname, date and time and are visible to helpers from the same country. Helpers and the operator can also exchange private messages; we store whether a message has been read. No email notifications are sent. We can see and delete all posts.

(5) All pages of the helper area are excluded from search engine indexing and are not cached. Helper accounts do not appear in public user lists or author archives.

(6) If a helper account is deleted, all ideas, comments and messages of that helper are deleted with it.

(7) The legal basis is Article 6(1)(b) GDPR (the relationship governing use of the helper area), alternatively Article 6(1)(f) GDPR; our legitimate interest is in organising our cooperation with the helpers.

Section 13 Email communication

(1) The system sends only one email automatically: the confirmation email with the link described in Section 8(3). It is sent through our hosting provider's mail server (Section 5(1)).

(2) All other emails, for example questions about an application or a VAT number, or the delivery of login details, are written by us personally from our mailbox info@cncexperte.eu.

(3) We do not send newsletters or promotional emails.

(4) The legal basis is Article 6(1)(b) GDPR and, for follow-up questions, also Article 6(1)(f) GDPR.

Section 14 Map display (MapTiler)

(1) To display the map we use the Leaflet map library, which we serve from our own server, and map tiles from MapTiler AG, Zugerstrasse 22, 6314 Unterägeri, Switzerland. Your browser retrieves the tiles directly from MapTiler. For technical reasons MapTiler receives your IP address, information about your browser, the address of our website (referrer) and the map section displayed.

(2) The map is designed so that you make a selection first. Simply opening the map page does not load any map tiles from MapTiler. Your browser loads the tiles only when you choose a country or a specialty, filter by company name, search for a place, use the "My location" function, or open a web address that already contains a country (parameter ?orszag=).

(3) The workshops' profile pages (Section 11(2)) show a small map with the location. Here the MapTiler tiles are loaded when the page is opened.

(4) The legal basis is Article 6(1)(f) GDPR; our legitimate interest is in an attractive and working map display, which is the core of our service. Switzerland is covered by an adequacy decision of the European Commission. Further information: https://www.maptiler.com/privacy-policy/

Section 15 Place search (geocoding) and location detection

(1) Geocoding of workshop addresses: to show a workshop on the map, our server determines coordinates from the address. For this we send only the address (without company name or contact details) to MapTiler. If MapTiler returns no result, we query the Nominatim service of the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, as a fallback (no more than one request per second). We store the coordinates with the listing and may correct them manually if needed.

(2) Place search by visitors: if you enter a town or postal code on the map, your browser sends the search term to our server. Our server forwards only the search term to MapTiler, or as a fallback to Nominatim. Your IP address is not passed on to these services. We keep the search term and result in a cache for up to seven days (one hour if nothing was found), without any link to you, so that repeated searches do not have to be forwarded again.

(3) To prevent abuse, no more than 30 searches are possible within ten minutes. For this we do not store your IP address, only a hash value created with a secret key (HMAC), for no longer than ten minutes.

(4) "My location" function: the website asks for your location via your browser only if you click this button. Your browser first asks for your permission. Your exact location stays in your browser and is used only to calculate distances for that search. Only if you also tick "Only in my country" does your browser send coordinates rounded to about ten kilometres to our server, which uses MapTiler (or, as a fallback, Nominatim) to determine the country. We do not store your location. The legal basis is your consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG), which you give via your browser's prompt and can withdraw there at any time.

(5) The legal basis for paragraphs 1 to 3 is Article 6(1)(f) GDPR; our legitimate interest is in a working map and proximity search. Switzerland and the United Kingdom are covered by adequacy decisions of the European Commission. Further information: https://www.maptiler.com/privacy-policy/ and https://osmfoundation.org/wiki/Privacy_Policy

Section 16 Page cache

To deliver the website quickly, we use the WordPress plugin WP Super Cache. It stores ready-made pages for visitors who are not logged in on our server. No personal data of visitors is stored in the process. Pages for logged-in users, forms, the workshop area and the helper area are not cached. The legal basis is Article 6(1)(f) GDPR.

Section 17 No web analytics and no external content

We do not use web analytics or statistics services, advertising or tracking services, or social media plugins. Fonts and program libraries are loaded from our own server; we do not use external font services. External content is loaded only for the map display described in Section 14.

Section 18 Minors

Our service is aimed at businesses, not at children. Persons under 16 may not provide us with personal data. If we learn that this has happened, we delete the data.

Section 19 Backups

Our hosting provider regularly creates backups of the website, including the database. The backups are used solely for restoring the system after technical faults or data loss and are overwritten after a retention period of [X days]. Deleted data may therefore still be contained in a backup until this period has expired; it is not restored from the backup unless this is unavoidable for restoring the system as a whole. The legal basis is Article 6(1)(f) GDPR in conjunction with Article 32 GDPR.

Section 20 Retention and deletion

(1) We store personal data only for as long as necessary for the purpose concerned. In detail:

• unconfirmed applications: deleted after 48 hours, at the latest after 72 hours (Section 8(3)),
• rejected applications: deleted immediately,
• accepted applications: transferred to the listing and the application deleted,
• listings, workshop accounts and helper accounts: until deleted at your request or until the listing or access ends,
• hash values used to prevent abuse: between ten minutes and one hour at most (Section 8(2), Section 15(3), Section 21(2)),
• server log files: [X days] (Section 3),
• backups: [X days] (Section 19).

(2) If a workshop is deleted, we also delete all associated content, in particular news, images and other attachments, as well as the workshop account. If a helper is deleted, we also delete their ideas, comments and messages.

(3) Statutory retention obligations remain unaffected. The listing is currently free of charge, and we do not issue invoices for it. Should paid services be agreed in future, the periods under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO) will apply in particular: six years for commercial and business letters received and sent, eight years for accounting vouchers such as invoices, and ten years for books, annual financial statements and other records under Section 147(1) no. 1 AO. Since the Fourth Bureaucracy Relief Act (Bürokratieentlastungsgesetz IV), the period for accounting vouchers has been eight instead of ten years. The period begins at the end of the calendar year in which the document was created. During retention we restrict processing. The legal basis is Article 6(1)(c) GDPR.

Section 21 Data security

(1) The website is delivered exclusively over encrypted HTTPS (TLS) connections. Passwords are stored only as hashes. We take technical and organisational measures under Article 32 GDPR to protect your data against loss, manipulation and unauthorised access, and we keep them up to date with the state of the art.

(2) To protect the login, a username is locked for 15 minutes after five failed login attempts from the same IP address. Regardless of the username, no more than 20 failed attempts within 15 minutes are possible from one IP address. Here too we do not store the IP address, only a one-way hash derived from it, for no longer than 15 minutes.

Section 22 Updates and language versions

(1) We update this privacy policy when our service or the legal situation changes. The version published on the website applies.

(2) This policy is available in German, Hungarian and English:
https://cncexperte.eu/de/datenschutz/
https://cncexperte.eu/hu/adatvedelem/
https://cncexperte.eu/en/privacy/

German law applies. Only the German version is legally binding; the Hungarian and English versions are provided for information.