Privacy Policy

1. Controller and contact details

The controller within the meaning of Art. 4 (7) GDPR is:

For all questions regarding data protection you can reach us at hallo@texunity.de or by post at the address above.

2. Data protection officer

We are not required to appoint a data protection officer under Sec. 38 BDSG and have therefore not appointed one. Please address all data protection enquiries — in particular the exercise of your data subject rights — directly to the controller named above at hallo@texunity.de.

3. Definitions and scope

This privacy policy uses the terminology of the GDPR. “Personal data” means any information relating to an identified or identifiable natural person (Art. 4 (1) GDPR). “Processing” means any operation performed on personal data, such as collection, storage, use, transfer or erasure (Art. 4 (2) GDPR). A “processor” is an entity that processes data on our behalf (Art. 4 (8) GDPR).

This policy applies to:

• the website at texunity.de including all subpages
• the installable TexUnity web app (PWA)
• the mobile applications for iOS and Android
• email communication and the notifications we send you as part of the platform

TexUnity is a B2B network for textile finishing. Users of the platform are companies; we therefore process personal data mainly in relation to their contact persons.

4. Purposes, legal bases and principles of processing

We only process personal data where a legal basis exists. Depending on the processing we rely on:

• Art. 6 (1) (a) GDPR — your consent, e.g. for non-essential cookies, the newsletter or loading external map services;
• Art. 6 (1) (b) GDPR — performance of the user agreement or pre-contractual measures, e.g. registration, operation of the account, order brokerage, billing;
• Art. 6 (1) (c) GDPR — compliance with legal obligations, in particular commercial and tax retention duties;
• Art. 6 (1) (f) GDPR — our legitimate interests, in particular IT security, prevention of misuse, stability and further development of the platform.

We observe the principles of Art. 5 GDPR: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. We only collect data required for the respective purpose and erase it once the purpose ceases to apply and no statutory retention obligation applies.

5. Provision of the website and server log files

When you access our pages, technically necessary data automatically transmitted by your browser or app is processed:

• IP address of the requesting device
• date and time of access
• page or file requested and volume of data transferred
• notification of successful retrieval or errors that occurred
• browser type, browser version and operating system
• where applicable, the previously visited page (referrer)

The purpose is the technical delivery of the pages, system security and the analysis and correction of errors. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and trouble-free operation of the platform. Server and error logs are generally erased or anonymised after no more than 30 days unless they are required to investigate a specific security incident.

6. Cookies, local storage and consent management

We use cookies and comparable technologies (localStorage, sessionStorage). Storing information on your device and accessing it is governed by Sec. 25 TDDDG. Technically necessary storage takes place without consent under Sec. 25 (2) no. 2 TDDDG; all other storage only after your express consent under Sec. 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR.

We distinguish between:

• Necessary storage — login and session information (authentication tokens), security and abuse protection, storage of your cookie decision, language selection and display settings. Without these the platform cannot be used.
• Functional embeds — external content such as the map view, which is only loaded after your consent.
• Analytics and reach measurement — aggregated evaluations of usage behaviour that do not relate to individuals, provided you have consented.

You make your choice via our cookie notice. You may withdraw consent at any time with effect for the future by clearing your browser storage and choosing again, or by contacting us at hallo@texunity.de. You can also block or delete cookies generally in your browser settings; this may limit the functionality of the platform.

7. Registration, user account and company profile

A user account is required to use TexUnity. In this context we process:

• name and email address of the acting person and an encrypted password
• company name, address, phone number and contact person
• company profile details: services, machinery, capacities, descriptions, company logo
• location data of the business address for display in the partner search
• time of registration, last login and account status information

The purpose is to provide the account, allow users to identify one another and facilitate cooperation. The legal basis is Art. 6 (1) (b) GDPR. A company profile released for publication is visible to other users and, depending on your settings, publicly; you decide which details you provide. Account data is stored for the duration of use and erased after account deletion unless retention obligations apply.

8. Sign-in with Google (OAuth)

Alternatively you can sign in with a Google account. If you choose this option you are redirected to Google and sign in there. Google then transmits your email address, your name and an identifier of the Google account to us; we do not receive a password.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is Art. 6 (1) (b) GDPR, as the sign-in serves to establish and perform the user relationship; where you voluntarily choose this sign-in method, additionally Art. 6 (1) (a) GDPR. Google is responsible for processing within your Google account; please refer to Google's privacy policy for details.

9. Processing when using the platform

During ongoing operation we process the data that you and your business partners enter into the platform:

• Order marketplace and enquiries — order descriptions, quantities, deadlines, prices, status and history of an enquiry and the companies involved;
• Messages and chat — content, sender, recipient and time of messages as well as read and delivery information;
• Files and mockups — uploaded documents, images, thumbnails and related comments and markings;
• Proofs — versions, annotations, approvals and approval timestamps;
• Ratings — stars and review texts after completed orders; these are displayed in anonymised form or in relation to the company;
• Logs (audit log) — status changes and security-relevant events to keep processes traceable.

The legal basis is Art. 6 (1) (b) GDPR for handling the cooperation and Art. 6 (1) (f) GDPR for logging and abuse prevention. Content you make available to another business is visible to that business; we have no influence over its further use. Transaction data is erased after completion and expiry of any retention periods.

10. Contact, feedback and newsletter

If you write to us by email or via the contact or feedback form, we process your details to handle your request. The legal basis is Art. 6 (1) (b) GDPR for contract-related enquiries, otherwise Art. 6 (1) (f) GDPR based on our interest in a proper response. Enquiries are erased once they have been finally dealt with and no retention obligations apply.

We only send our newsletter with your express consent under Art. 6 (1) (a) GDPR or, to existing customers, on the basis of Sec. 7 (3) UWG. We log the sign-up in order to be able to demonstrate it. You can unsubscribe at any time via the link in every email or by writing to hallo@texunity.de; the withdrawal does not affect the lawfulness of processing carried out beforehand.

11. Email and push notifications

To perform the user relationship we send you system emails, e.g. about new enquiries, status changes, new messages, proofs, deadlines and account or billing matters. The legal basis is Art. 6 (1) (b) GDPR. For delivery we use an email service provider acting as a processor under Art. 28 GDPR; recipient address, content, sending and delivery status are processed.

You only receive push notifications if you actively allow them in your browser or app. A device or browser identifier is stored and delivery takes place via the push services of the respective providers (Apple Push Notification service, Google Firebase Cloud Messaging and your browser's push service). The legal basis is your consent under Art. 6 (1) (a) GDPR. You can deactivate notifications at any time in the platform settings or on your device; the stored identifier is then deleted.

12. Payment processing and billing

For paid plans we use the payment service provider Stripe (Stripe Payments Europe, Ltd., The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland). You enter payment details such as card data directly with Stripe; we do not receive complete payment data, only information on the plan, payment status, invoicing and a customer identifier.

The legal basis for payment processing is Art. 6 (1) (b) GDPR and, for retaining invoices and accounting records, Art. 6 (1) (c) GDPR in conjunction with commercial and tax retention obligations under Sec. 257 HGB and Sec. 147 AO (generally six or ten years). Stripe acts as an independent controller in this respect and also processes data for fraud prevention; details can be found in Stripe's privacy policy.

13. Map display (Google Maps)

To show partner businesses on a map we embed Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is only loaded once you have consented. When loading, your IP address and technical details of your device are transmitted to Google; Google may set cookies and process usage data. A transfer to the USA is possible.

The legal basis is your consent under Art. 6 (1) (a) GDPR and Sec. 25 (1) TDDDG. You may withdraw consent at any time with effect for the future; the map will then no longer be loaded. Business addresses are converted into coordinates (geocoding) for display on the map.

14. Hosting, database and processing on our behalf

The platform is operated with specialised cloud service providers. They provide web hosting, database, authentication, file storage and server functions and process the resulting data exclusively on our instructions. Data processing agreements under Art. 28 GDPR are in place with all providers used.

Categories of processors used:

• hosting and delivery of the website and server functions
• database, authentication and file storage
• sending of transactional emails and newsletters
• payment processing and invoicing
• error and security logging

The legal basis is Art. 6 (1) (b) and (f) GDPR. On request we will inform you about the specific providers used.

15. Transfers to third countries

Where data is processed outside the European Union or the European Economic Area, this only happens if the requirements of Art. 44 et seq. GDPR are met. We base such transfers on an adequacy decision of the European Commission — for example the EU-U.S. Data Privacy Framework for certified US providers — or on the European Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR, supplemented by additional technical and organisational safeguards.

Despite these measures, access by government authorities in third countries cannot be entirely excluded. Where a transfer is based on your consent, it takes place on the basis of Art. 49 (1) (a) GDPR.

16. Specifics of the mobile apps

Our iOS and Android apps only access device functions that are necessary for the respective feature, and always only after you have granted permission in the operating system:

• Camera — to scan QR codes and take photos for orders and proofs. QR scanning is processed on your device; no camera images are transmitted to us without your action.
• Photo library — to select existing images for upload.
• Notifications — to deliver push notifications.
• Network access and local storage — for synchronisation and caching of content.

The legal basis is Art. 6 (1) (b) GDPR for providing the features and Art. 6 (1) (a) GDPR where you expressly grant a permission. You can revoke granted permissions at any time in your device settings. Downloading via the Apple App Store or Google Play takes place with the respective store operator, which processes data on its own responsibility.

17. Data security

We take technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, manipulation and unauthorised access. These include in particular:

• encrypted transmission via TLS (HTTPS) on all pages and in the apps
• encrypted storage of passwords
• a role and permission concept with row-level access rules in the database
• access restrictions on files and uploads
• logging of security-relevant events and regular security reviews
• regular updates of the systems and libraries used

Please note that data transmission over the internet can have security gaps; complete protection against access by third parties is not possible.

18. Your rights as a data subject

You have the following rights vis-à-vis us:

• Access (Art. 15 GDPR) — as to whether and which data we process about you, including purposes, recipients and storage period;
• Rectification (Art. 16 GDPR) — of inaccurate or incomplete data;
• Erasure (Art. 17 GDPR) — unless a retention obligation or other exception applies;
• Restriction of processing (Art. 18 GDPR);
• Data portability (Art. 20 GDPR) — receipt of your data in a structured, commonly used and machine-readable format;
• Objection (Art. 21 GDPR) to processing based on legitimate interests.

An informal message to hallo@texunity.de is sufficient to exercise these rights. We answer requests without undue delay, at the latest within one month of receipt; we may request additional information to verify your identity.

19. Right to object and withdrawal of consent

Right to object under Art. 21 GDPR: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) (f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where data is processed for direct marketing purposes, you may object at any time without giving reasons; the data will then no longer be used for that purpose.

Withdrawal of consent: You may withdraw consent given at any time with effect for the future pursuant to Art. 7 (3) GDPR. The lawfulness of processing carried out before withdrawal remains unaffected.

20. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement.

The authority responsible for us is:

21. Necessity of providing data

Providing personal data is in part required by law (e.g. tax-related information) or necessary for concluding and performing the user agreement. Without the information marked as required we cannot create an account or provide the platform. All other details, in particular voluntary profile content, are optional and only affect the visibility and usability of individual features.

22. Automated decision-making and profiling

Automated individual decision-making including profiling pursuant to Art. 22 GDPR does not take place. The automatic matching of orders with suitable businesses is based solely on the services and locations the businesses have entered themselves and serves brokerage purposes; it produces no legal effects concerning data subjects and does not similarly significantly affect them.

23. Deletion of the account and data

You can terminate and delete your account at any time. After termination your profile and the associated personal data are erased or anonymised as soon as no statutory retention obligations and no open matters prevent this. Invoices and accounting records are retained for six or ten years due to legal obligations and are blocked for ongoing use. Messages and content you exchanged with other businesses may remain with them within the scope of their own retention obligations.

24. Currency and amendments to this privacy policy

This privacy policy is dated September 2026. Further development of the platform or changed legal or regulatory requirements may make amendments necessary. The current version is always available on this page. In the event of material changes we will additionally inform registered users by email or via a notice in the platform.