Imprint

Disclaimer

Liability for Content

As a service provider, we are responsible for our own content on these pages in accordance with the general laws. For third-party information, the liability rules of Articles 4 to 6 of Regulation (EU) 2022/2065 (Digital Services Act) apply; there is no general obligation to monitor (Art. 8 DSA). Upon becoming aware of specific legal violations, we will remove the content concerned immediately.

Liability for Links

Our website contains links to external third-party websites over whose content we have no influence. We cannot assume any liability for third-party content. Upon becoming aware of legal violations, we will remove such links immediately.

Copyright

The content created by us is subject to German copyright law. Third-party contributions are marked as such. Reproduction, editing or distribution outside the limits of copyright requires the written consent of the respective author.

Privacy Policy

We take the protection of your personal data seriously. Below we inform you in accordance with Art. 13 GDPR which data we collect, for what purpose, on what legal basis, how long we store it, and to which recipients it may be passed on.

The use of contact data published within the framework of the imprint obligation by third parties for sending unsolicited advertising and information materials is hereby expressly prohibited. In the event of unsolicited sending of advertising information, such as spam emails, we reserve the right to take legal action.

1. Data Controller

The party responsible for data processing on this website is:
Sadaghian® e.K., Owner Arash Sadaghian
Leverkusenstr. 3, 22761 Hamburg, Germany
E-mail: mail@sadaghian.com · Phone: +49 40-228643240

For information requests, rectification, deletion and any other concerns regarding your personal data, please contact us informally at mail@sadaghian.com.

2. Data Collected and Processing Purposes

Depending on the nature of your contact with us, we process the following categories of data:

Repair order & DHL label request: first and last name, address, e-mail, phone, device serial number, fault description. Legal basis: Art. 6(1)(b) GDPR (initiation and performance of contract).
Shipping: full delivery or pickup address for the creation of the shipping label by DHL. Legal basis: Art. 6(1)(b) GDPR.
Invoice & bookkeeping: billing address, invoice line items, payment data. Legal basis: Art. 6(1)(b) and (c) GDPR (statutory retention obligation).
Payment processing: depending on the chosen payment method, see section 7.
Customer portal login: e-mail address and/or mobile phone number for sending a one-time code (OTP), session data. We store neither passwords nor password hashes. The one-time code is valid only briefly and is discarded after use. Legal basis: Art. 6(1)(b) GDPR.
E-mail correspondence: content of your message, sender, date. Legal basis: Art. 6(1)(b) and (f) GDPR (efficient customer communication).
Server log files: IP address, timestamp, requested URL, browser, operating system. Legal basis: Art. 6(1)(f) GDPR (IT security, availability, error analysis), see section 11.
Audience measurement (Cloudflare Web Analytics): aggregated page-view counts per page and technical details (e.g. referrer, browser type, device category, country), no cookies. Legal basis: Art. 6(1)(f) GDPR, see section 14.

3. Storage Period

We store personal data only as long as necessary for the respective processing purpose:

Repair and order data: for the duration of the business relationship.
Invoice and bookkeeping-relevant data: 10 years pursuant to § 257 HGB, § 147 AO.
Server log files: stored only briefly, see section 11.
E-mail correspondence: until the end of the business relationship plus statutory commercial and tax retention periods.
OTP one-time codes: discarded immediately after use or expiry of validity (a few minutes).
Anonymous usage raw data: 90 days, then automatic deletion.

4. Internal Workshop Management System (Local Operation)

We process order, repair and customer data in a workshop management system that we operate ourselves. It runs on a server located in our own business premises at Leverkusenstr. 3, 22761 Hamburg, i.e. at the same location as our workshop. There is no external hosting provider, no cloud replication and no remote access by third parties. Access is restricted to authorised employees.

Legal basis: Art. 6(1)(b) GDPR. Storage period: for the duration of the business relationship; invoice and bookkeeping data 10 years pursuant to § 257 HGB / § 147 AO.

5. Shipping via DHL

For shipping or returning your device we engage Deutsche Post DHL Group (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany). For this purpose we transmit to DHL the data necessary for creating the shipping label (first and last name, delivery address). DHL acts in this respect as a processor in the context of contract performance.

Legal basis: Art. 6(1)(b) GDPR. Further information: DHL Privacy Policy.

6. E-mail Processing via Microsoft 365

For sending and receiving business e-mail we use Microsoft 365 (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). When you send an e-mail to mail@sadaghian.com, the content, name and e-mail address are processed on Microsoft servers. Our tenant is registered on the EU Data Boundary; Exchange Online operates within the EU data area with committed target region Germany.

Legal basis: Art. 6(1)(b) GDPR or (f) (efficient customer communication). A data processing agreement with Microsoft is in place. Further information: Microsoft Privacy Statement.

7. Payment Processing

Online payments are handled via external payment service providers. Which data is processed depends on the chosen payment method. Full card data never reaches our server; it is transmitted directly between your browser and the respective payment provider.

7.1 Online payment via emonis.com

You pay invoices online in the customer portal on emonis.com, where the payment service provider Stripe is used (card, Apple Pay, Google Pay, Klarna, Amazon Pay, Link, SEPA Direct Debit) — details in the emonis.com privacy policy. Bank transfer to the account stated on the invoice is also possible.

7.2 Fiserv (card payment)

Card payments may also be processed via Fiserv. Fiserv processes your name, payment card data and technical transaction data to authorise and settle the payment. We do not store your full card data ourselves.

Legal basis: Art. 6(1)(b) GDPR. Fiserv Privacy Notice.

8. Customer Portal (emonis.com)

You will find your repair status, chat and invoices in the customer portal at emonis.com/me, which we run as the operator of the emonis platform; the privacy policy at emonis.com/datenschutz applies. The former address sadaghian.com/status/ redirects there.

9. SMS Delivery via sipgate

For sending SMS one-time codes (OTP) as part of the customer portal login, we use the German telecommunications provider sipgate GmbH, Gladbacher Str. 74, 40219 Düsseldorf, Germany. We transmit to sipgate your mobile number and the respective one-time code. sipgate processes this data exclusively to deliver the SMS and is subject to German telecommunications and data protection law. No transfer to third countries takes place.

Legal basis: Art. 6(1)(b) GDPR. sipgate Privacy Policy (German).

10. Telephone

Calls to us are handled by the telephony provider sipgate; we store the phone number, time and duration of calls in our customer system in order to match call-backs and link calls to orders; voicemail messages you leave are stored there for processing (Art. 6(1)(b) and (f) GDPR). Calls are not recorded.

11. Hosting and Delivery (Cloudflare Pages)

This website is hosted on Cloudflare Pages and delivered via the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you access the website, Cloudflare processes access data (IP address, date and time, requested URL, amount of data transferred, browser type, operating system, referrer) for delivery, security (e.g. defending against attacks) and error analysis; this data is stored only briefly.

Legal basis: Art. 6(1)(f) GDPR. A data processing agreement with Cloudflare is in place (Art. 28 GDPR); transfers to the USA are based on the EU Standard Contractual Clauses, and Cloudflare is also certified under the EU-U.S. Data Privacy Framework. Cloudflare Privacy Policy.

12. TikTok

Content from the TikTok platform may be embedded on our pages. The data controller for users in the EEA is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, a subsidiary of the parent group ByteDance Ltd. (Cayman Islands). A connection to TikTok is only established after you actively click the play button (click-to-load). TikTok or affiliated ByteDance entities then receive the information that you have visited our site with your IP address; data may also be processed outside the EU. If you are logged into your TikTok account, you can link content from our pages with your TikTok profile. Further information: TikTok Privacy Policy.

Legal basis: your consent, given by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG); the associated transfer to third countries is based on Art. 49(1)(a) GDPR. No data is transmitted until you click.

13. WhatsApp

Functions of the messaging service WhatsApp (WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) are integrated on our pages. When you click on the WhatsApp button, a connection to WhatsApp's servers is established and you will be redirected to wa.me. WhatsApp receives the information that you have visited our site with your IP address. Further information: WhatsApp Privacy Policy.

Legal basis: your consent, given by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG); the associated transfer to third countries is based on Art. 49(1)(a) GDPR. No data is transmitted until you click.

14. Audience Measurement (Cloudflare Web Analytics)

To measure how this website is used we use Cloudflare Web Analytics, provided by Cloudflare, Inc. (USA) — the same processor that delivers this website under section 11. It records only aggregated page-view counts per page together with technical details such as referrer URL, browser type, operating system, device category and country. The service is cookieless, stores no identifier in your browser, performs no fingerprinting and does not track you across websites; no usage profiles are created. The legal basis is Art. 6(1)(f) GDPR (legitimate interest: understanding which content is found and used). The measurement script sets no cookies, stores no identifiers and reads no information stored on your device; only the technical details and load times transmitted when a page is requested are evaluated. We base the measurement on Art. 6(1)(f) GDPR; in our assessment, § 25 TDDDG does not preclude it, because nothing is stored on your device. A data processing agreement under Art. 28 GDPR is in place with Cloudflare; transfers to the USA are covered by the EU Standard Contractual Clauses, and Cloudflare is certified under the EU-U.S. Data Privacy Framework. We use no other tracking, analytics or advertising services.

If you reach us through one of our ads, the link carries a campaign code. If you continue from here to emonis.com, we pass this code on in the link so emonis can tell which ad an order came from – no cookies, nothing stored on your device.

The website sets a cookie ("lang") only if you actively choose "Deutsch" in the language selector; it stores this choice for one year and is exempt from consent under § 25(2) no. 2 TDDDG.

15. Backups

We store backups of our systems exclusively on our own systems in our business premises in Hamburg; they are not stored with external providers.

16. Your Rights as a Data Subject

You have the following rights vis-à-vis us with regard to personal data concerning you:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, please contact us informally at mail@sadaghian.com. We will respond within the statutory period of one month (Art. 12(3) GDPR).

17. Right to Lodge a Complaint with the Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority. The authority competent for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
(The Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Str. 22, 7th floor, 20459 Hamburg, Germany
Phone: +49 40 / 428 54 - 4040 · Fax: +49 40 / 428 54 - 4000
E-mail: mailbox@datenschutz.hamburg.de
datenschutz-hamburg.de

Currency of this Privacy Policy

Last updated: 26 September 2026. We reserve the right to amend this privacy policy if changes to our data processing make this necessary.

Repair Terms and Liability

Before handing over your device, you are advised to create a complete backup of your data; analysis and repair work can, for technical reasons, result in the loss of stored data.

We are liable without limitation for intent and gross negligence, for injury to life, body or health, under the provisions of the German Product Liability Act, within the scope of any guarantee we have assumed, and for fraudulently concealed defects. In the event of a slightly negligent breach of an obligation whose fulfilment is essential to the proper performance of the contract and on whose observance you may regularly rely (material contractual obligation), liability is limited in amount to the foreseeable damage typical of this type of contract at the time of conclusion. In all other respects, liability is excluded. In the event of data loss, your duty to back up your data is taken into account as contributory negligence (Sec. 254 German Civil Code, BGB).

A cost estimate is non-binding for you; the workshop honours the quoted price for 60 days. Stated repair times are estimates. Payment is made after the repair – in the shop on collection, or for mail-in repairs via emonis once the repair is finished; the return shipment follows once payment is in. For data recovery orders: payment only on success — if the recovery fails, no payment is due.