Privacy notice

Information under Art. 13 and Art. 14 GDPR.

1. Controller

Forgecraft
Einzelunternehmen
Münsterstraße 51
49525 Lengerich
Deutschland

No data protection officer has been appointed; the conditions of § 38 BDSG are not met. Please address data protection enquiries to the address above.

2. Processing when you visit the site

When the pages are called up, the server processes the IP address, the time, the address requested, the status code and the volume of data transferred, as far as this is necessary to deliver the site and to prevent abuse. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest lies in the secure operation of the service.

To limit abuse — mass password guessing, for instance — request counts are held briefly in memory. These counters are not stored permanently and are lost on restart.

3. Cookies

This website uses strictly necessary cookies only. No analytics, advertising or tracking cookies are set, no third-party services are embedded for analysis purposes, and no cross-device tracking takes place.

oi_at: Session token issued after sign-in. Lifetime about one hour.
oi_rt: Renewal token, so that you stay signed in. Lifetime 30 days.
oi_lang: Your chosen language, if you pick one in the footer. Lifetime one year; it contains nothing but "en" or "de".

The session cookies are HttpOnly and SameSite=Lax and are only set when you sign in. Because they are strictly necessary for the service you have expressly requested, no consent is required under § 25 (2) no. 2 TDDDG — and for the same reason this site shows no cookie banner. A banner asking for consent to cookies that are necessary anyway would be misleading.

4. Account, subscription and payment

For an account we process your email address, a hashed password and whether you are ordering as a consumer or as a business. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract).

Payment is handled by Stripe. Payment details are entered on Stripe's servers and never reach us; we store only the customer and subscription identifiers, the status and the end of the term. We retain invoices and tax records for up to ten years under § 147 AO and § 257 HGB (Art. 6 (1) (c) GDPR).

When you hide entries or create exports, we store the number and the identifiers concerned, so that your selection and your monthly allowance can be reflected.

5. Processors and transfers to third countries

Supabase: Authentication and subscription data. Supabase Inc., USA / EU region depending on project location.
Stripe: Payment processing. Stripe Payments Europe Ltd., Ireland, with transfer to Stripe Inc., USA.
Hostinger: Delivery of the pages, server operation and server logs. Hostinger International Ltd., Cyprus; the server itself is located in Paris, France.
Resend: Sending the confirmations required by law (cancellation confirmation under § 312k BGB, confirmation of early performance under § 356 (5) BGB). Resend, USA, where message content and delivery logs are also stored. The region setting affects only the sending route, not where data is held.

Data processing agreements under Art. 28 GDPR are in place with these providers. Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework or on standard contractual clauses under Art. 46 (2) (c) GDPR.

6. The entries in the directory (Art. 14 GDPR)

This directory contains around 22,354,096 business entries. They do not come from the data subjects themselves, but from the Overture Maps Foundation's open dataset, which in turn draws on OpenStreetMap, Meta, Microsoft and Esri. That is why we provide this information under Art. 14 GDPR.

Categories: Name, brand, sector, address, coordinates, telephone number, website, in some cases email address.
Source: Overture Maps Foundation, openly licensed under CDLA-Permissive 2.0.
Purpose: Operation of a searchable business directory for subscribers.
Legal basis: Art. 6 (1) (f) GDPR. Legitimate interest: a directory of business contact details drawn from open sources.
Recipients: Subscribers to the service. Exports may be passed on; the licence notice must remain attached.
Retention: Until you object, or until the entry disappears from the source dataset. The dataset is replaced in full every month.

Most entries concern legal persons and are then outside the scope of the GDPR. For sole traders and freelancers, however, the address and telephone number may be personal data — the following section applies to those cases.

7. Having an entry removed

If you are listed in this directory and would rather not be, an informal message to support@prospect-index.com giving the name and address of the entry is enough. We will then permanently suppress it from display — across the monthly re-import as well, so that it does not reappear.

An objection under Art. 21 GDPR does not have to be justified. We deal with it without undue delay and within one month at the latest (Art. 12 (3) GDPR). We cannot recall exports that subscribers have already downloaded; the respective subscriber is the controller for their further use.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may also lodge a complaint with a supervisory authority, for instance the State Data Protection Commissioner responsible for Lengerich.

9. Obligation to provide data

You need not provide anything to view the public pages. For a subscription an email address and payment details are required; without them the contract cannot come into being.

Last reviewed: 2 September 2026