Controller

Further company details are in the legal notice (German).

Data protection contact

Dr.-Ing. Stephan Eckhardt
Email seckhardt@intronik.de · Phone +49 351 8821‑27

What this is about

The THERMONOM distribution portal at config.thermonom.de shows the product catalog, lets you configure devices and takes inquiries and support messages. Signed-in distribution partners prepare offers for their customers here. The portal is meant for businesses only; we do not conclude contracts with consumers through it.

The portal runs on Intronik GmbH's own servers in Dresden, Germany. It embeds no content or scripts from other providers, uses no analytics or advertising services and serves its fonts from its own server.

Visiting the portal and log data

With every request our server processes technically necessary data: IP address, date and time, the address requested, status code and amount of data transferred, the page visited before, and browser and operating system. While you use the portal, your browser keeps an encrypted connection to the server open for it.

We process this data to deliver the portal, keep it secure and investigate faults. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation. Log data is deleted after 7 days unless it is needed to investigate a specific security incident.

Cookies and browser storage

The portal only sets cookies that are strictly necessary for the service you asked for; no consent is required for them (Section 25(2) no. 2 TDDDG, the German telecommunications and digital services data protection act).

• Form protection (.AspNetCore.Antiforgery.…): prevents forms from being submitted from other sites. Set on the first visit, deleted when the browser closes.
• Language (.AspNetCore.Culture): remembers the language you chose. Only set when you switch languages; it is set for ten years, which most browsers cut down to a little over one year.
• Sign-in (.AspNetCore.Identity.Application, briefly Identity.TwoFactorUserId during two-factor sign-in): signed-in users only. Valid for the session, up to 14 days with "Stay signed in on this device".
• Remember device (Identity.TwoFactorRememberMe): only if you choose "Stay signed in on this device" during two-factor sign-in; spares this device the code prompt for up to 14 days.

The portal keeps your basket and your choice of catalog view in your browser's local storage (thermonom.basket, shop.view). This data only leaves your device when you send an inquiry; you can delete it at any time in your browser settings.

Inquiries from the basket

Without an account you can send your basket as an inquiry. We collect:

• company name and company address,
• contact person: title, first and last name, department, email address and phone number,
• your comment and the products requested with their configuration.

We need the company, its address and an email address or phone number to answer the inquiry; all other details are optional.

We use this data to answer your inquiry and make you an offer. To do so we pass it on to the THERMONOM distribution partner responsible for your company: if your company is already a customer of a distribution partner, the inquiry goes to them automatically; otherwise we assign it ourselves or answer it directly. The distribution partner then processes the data under its own responsibility. If you gave an email address, you receive a confirmation with the inquiry number and configuration ID; a PDF of the inquiry is saved directly by your browser.

The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to a contract) and, where you inquire on behalf of a business, Art. 6(1)(f) GDPR; our legitimate interest is answering business inquiries and serving them through our distribution partners.

Address completion by Google

To capture the company address completely and unambiguously, our server sends what you type into the address field and the address you pick to the Google Places API of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google does not receive your IP address or your browser's cookies, because the request comes from our server. A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a correct address by which we assign your company to the responsible distribution partner.

Configuration IDs

With every inquiry and every offer we store the basket's contents (products, quantities, chosen options) under a random configuration ID. It is printed on the document and reopens the configuration. This data contains nothing about you as a person; we keep it without time limit so that the IDs on issued documents remain valid.

Support requests

Through "Contact support" you can write to us without an account. We store your email address, the subject, your messages and our replies, and the language of the interface. The conversation is read and answered by the people at Intronik GmbH responsible for support; you receive our replies in full by email.

A personal link, sent to you after submitting and with every reply, leads back to the conversation. It contains a random key of 26 characters; anyone who knows the link can read the conversation and reply to it — so please do not pass it on.

The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract or its preparation, and Art. 6(1)(f) GDPR otherwise; our legitimate interest is answering questions about our products. The conversation is deleted automatically two years after its last message, and the link stops working with it.

Accounts for distribution partners

Distribution partners and employees of Intronik GmbH sign in with an account. For it we store the email address, user name, a hash of the password (not the password itself), optionally a phone number and two-factor sign-in data, the assignment to a distribution partner, roles, the email notification setting and the number of failed sign-in attempts — after five failures the account is locked for five minutes.

In the portal, distribution partners record their customers (company, address, contact persons with contact details), prepare offers and write messages. A distribution partner's customers are visible only to that partner and to Intronik GmbH's administration, which uses them to delimit sales territories and assign inquiries. The portal announces new messages and inquiries in the portal itself and, unless switched off in the account, by email.

The legal basis is Art. 6(1)(b) GDPR (distribution or employment contract), and for customer data Art. 6(1)(f) GDPR; our legitimate interest is preparing offers and coordinating sales territories. We keep account data for as long as the account exists. Messages between users are deleted two years after the last message, like support conversations.

Offers, inquiries and retention

We keep inquiries and offers with the related customer and contact data for as long as they are needed to process them and for the business relationship, and beyond that only where statutory retention duties apply — six years for commercial letters, ten years for accounting records (Section 257 HGB, Section 147 AO; legal basis Art. 6(1)(c) GDPR).

Sending email

We send notifications, confirmations and support replies through Google Workspace of Google Ireland Limited (address above) under a data processing agreement (Art. 28 GDPR). A transfer to Google LLC in the USA is possible; it is certified under the EU-US Data Privacy Framework.

Recipients at a glance

• the responsible THERMONOM distribution partner — for inquiries from the basket,
• Google Ireland Limited — for address completion and sending email.

Beyond that we only pass on data where the law requires us to.

Embedding on other websites

The configurator may be embedded in other websites, such as thermonom.de. This notice covers the processing inside the embedded configurator; the operator of the surrounding website is responsible for that website.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21). Please contact our data protection contact for this.

There is no automated decision-making within the meaning of Art. 22 GDPR.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Last updated: 9 October 2026