Privacy Policy

Thank you for visiting the HF Boy Handelsgesellschaft mbH website. This Privacy Policy is intended to inform you in detail about the handling of your personal data when accessing this website.

Responsible body and definitions

Below you will find an overview of your contacts and an overview of the terms used in this Privacy Policy.

Responsible body

Responsible for this website:

HF Boy Handelsgesellschaft mbH, d. d. Managing Director, Mr. Holger Boy

Von Kurtzrock Ring 16

22391 Hamburg

Phone: +49 (0) 800 - 432 69 46

E-Mail: info[at]

(To use the e-mail address, the inserted an anti-spam square brackets [at] must be removed and replaced with @)



This Privacy Policy is based on the terms of the General Data Protection Regulation (GDPR). The individual definitions are listed in Art. 4 GDPR.

For the purposes of the GDPR and this privacy statement, the term:

  1. "Personal data" means any information relating to an identified or identifiable natural person ('the data subject'); a natural person is regarded as identifiable, which can be identified directly or indirectly, in particular by association with an identifier such as a name, an identification number, location data, an online identifier or one or more special features, the expression of the physical, physiological, genetic, mental, economic, cultural or social identity of this natural person;
  2. "Data subject" means any identified or identifiable natural person whose personal data are processed by the controller;
  3. "Processing" any process or series of operations performed with or without the aid of automated processes, such as collecting, organizing, storing, adapting or modifying, reading out, querying the use, disclosure by transmission, dissemination or other form of provision, matching or linking, restriction, erasure or destruction;
  4. "Restriction of processing" means the marking of personal data stored in order to limit its future processing;
  5. "Profiling" means any kind of automated processing of personal data which involves the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular aspects relating to job performance, economic situation, health, personal Analyze or predict preferences, interests, reliability, behavior, whereabouts or location of this natural person;
  6. "Controller" means the natural or legal person, public authority, or body that, alone or in concert with others, decides on the purposes and means of processing personal data; where the purposes and means of such processing are determined by Union law or the law of the Member States, the person responsible or the specific criteria for his appointment may be provided for under Union or national law;
  7. "Recipient" means a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether or not it is a third party. However, authorities which may receive personal data under Union or national law in connection with a particular mission are not considered to be recipients; the processing of such data by the said authorities shall be in accordance with the applicable data protection rules in accordance with the purposes for which they are processed;
  8. "Third party" means a personal or legal person, public authority, or body, other than the data subject, the controller, the processor and the persons authorized to do so under the direct responsibility of the controller or processor process;
  9. "Consent" of the data subject to any expression of intent, informed and unambiguous in the form of a statement or any other unambiguous confirmatory act that voluntarily indicates to the person concerned that he is involved in the processing of the data personal data in question.

General notes

Following are some first and general notes on data collection, data processing and data storage when you visit this website.

No obligation to provide data

You can visit this website without giving any personal information. The provision of personal data is not required by law or contract. You are not required to provide data. Insofar as personal data is collected or processed, you will receive further information in the context of this privacy policy and on the spot during the entry process.

If the provision of personal data is required for the particular service, you will be particularly advised of this in the context of the entry process, e.g. by the designation as "mandatory field".

Collection and storage of server data

Access data (server log files) is collected every time the server is stored on which the data of this website is stored. The access data includes

  • Name of the retrieved website,
  • file
  • Date and time of retrieval,
  • transferred amount of data,
  • Message about successful retrieval,
  • browser type and version,
  • User's operating system,
  • Referrer URL (previously visited page),
  • IP address of the site visitor,
  • requesting provider.

Server log files are stored for security reasons such as for the purpose of investigating abusive or fraudulent activities for a maximum of 7 days and then deleted. Data whose further retention is required for evidence purposes shall be exempted from the deletion until final clarification of the incident.

This data processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR for the protection of legitimate interests.

Legal Basis of Data Processing

If the legal basis for data processing is not mentioned in the further course of this privacy policy, the following applies: The legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 GDPR.

The legal basis for the processing of the performance of the person responsible and the execution of contractual measures as well as the answer to inquiries is Art. 6 para. 1 lit. b GDPR.

Legal basis for the processing to fulfill the legal obligations of the person responsible is Art. 6 para. 1 lit. c GDPR. The legal basis for processing in order to safeguard the legitimate interests of the person responsible is Article 6 (1) lit. f GDPR.

Legal basis for the case where vital interests of the data subject or another natural person require the processing of personal data is Article 6 (1) lit. d GDPR.

Rights of the persons concerned

The Data Protection Act gives you a variety of rights to the entity responsible for managing this website. Your rights are shown below.

Right to information

Pursuant to Art. 15 GDPR, you have the right to ask for confirmation as to whether you are processing the data in question, for information about this data and for further information, as well as for a copy of the personal data that is the subject of the processing.

Rectification claim

According to Art. 16 GDPR you have the right to demand the completion of the data concerning you or the correction of the incorrect data concerning you.

Data deletion or processing restriction

In accordance with Art. 17 GDPR, you have the right to demand that the relevant data be deleted immediately. Alternatively, in accordance with Art. 18 GDPR, you have the right to demand a restriction of the processing of the data.

Data Portability Claim

In accordance with Art. 20 GDPR You have the right to receive the data concerning you and provided by you in a structured, common and machine-readable format and to request their transmission to other persons responsible.

Right of appeal

According to Art. 77 GDPR, you have the right to file a complaint with the competent supervisory authority.


Under Article 7 (3) GDPR, you have the right to revoke granted consent with effect for the future.

Right of

In accordance with Art. 21 GDPR, you have the right to object at any time to the future processing of your personal data. The objection may in particular be made against processing for direct marketing purposes. If you object to the processing for direct marketing purposes, your personal data will no longer be processed for these purposes.


When contacting HF Boy Handelsgesellschaft mbH, your details regarding the processing of the contact request and its processing in the context of pre-contractual or contractual relationships pursuant to Art. 6 para. 1 lit. b) GDPR, for processing and handling other requests pursuant to Art. 6 para. 1 lit. f) GDPR, processed. Your details can be stored in a Customer Relationship Management System ("CRM System") or in a comparable organizational system.

Your requests will be deleted by HF Boy Handelsgesellschaft mbH, as long as they are no longer required. HF Boy Handelsgesellschaft mbH checks the necessity every two years. In addition, the statutory archiving obligations apply.


When visiting this website, you have the opportunity to contact HF Boy Handelsgesellschaft mbH via a contact form. In this case, the information you provide will be stored for the purpose of processing your contact. A passing on to third does not take place. There will be no reconciliation of the data collected with data that may be collected through other components of this website.

This data processing is carried out with your consent in accordance with Art. 6 para. 1 lit. a) GDPR.

Data Processing for Contractual Purposes

Below you will find further information on how HF Boy Handelsgesellschaft mbH processes personal data for contractual purposes.

Pre-contractual measures and performance of contract

If you use the goods or services offered by HF Boy Handelsgesellschaft mbH or have sent a request to HF Boy Handelsgesellschaft mbH, HF Boy Handelsgesellschaft mbH will provide you with data for the purpose of pre-contractual measures and / or for the purpose of processìng of the contract. The data processed, the nature, scope and purpose and necessity of their processing are determined by the underlying contractual relationship. Conclusion of contract is not possible without providing this data.

The legal basis for processing is Art. 6 para. 1 lit. b) GDPR.

Data deletion / data lock after expiration of the collection purpose or retention period

The data stored and processed by HF Boy Handelsgesellschaft mbH are deleted or restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated otherwise in the context of this Privacy Policy, the stored data will be deleted as soon as they are no longer necessary for their intended purpose and the deletion does not conflict with any statutory storage requirements. Unless the data is deleted because it is required for other and legitimate purposes, its processing will be restricted. In this case, the data is locked and not processed for other purposes. This applies, for example for data that must be kept for commercial or tax reasons.

According to legal requirements in Germany the retention periods are 6 years according to § 257 Abs. 1 HGB for trading books, inventories, opening balance sheets, annual accounts, trade letters, accounting documents, etc. as well as for 10 years according to § 147 Abs. 1 AO for books, records , Management reports, accounting documents, commercial and business letters, documents relevant to taxation, etc.