Privacy Policy

Surventis is pleased about your visit to our website and your interest in our company.

The topic of data protection has the highest priority at Surventis. Therefore, we would like to inform you in detail about it in the following:

A. Who is responsible for data processing and who is our data protection officer?

B. What data do we process, for what purposes, for how long and on what legal basis?

C. Are you obliged to provide us with this data?

D. To whom do we pass on your personal data?

E. How do we safeguard your personal data?

F. What rights do you have?

G. Where can you complain?

H. Data protection for minors

This privacy policy applies to herefortrends.com and the Automotive Color Trends editions published under it, including the 2025 edition and the NEXISTENTIAL 2026/27 edition (together the “trend editions”).

Surventis GmbH

Legal Headquarters: 48165 Muenster, Germany

Registered at the Local Court in Münster

Company Registration No.: HRB 5144

Management Board: Markus Dinslacken, Michael Pontzen

Supervisory Board: Ewout van Jaarwarde, Chairman

Sales Tax Identification Number: DE811122710

A. Who is responsible for data processing and who is our data protection officer?

Responsible for data processing:

Surventis GmbH
Glasuritstraße 1
48165 Muenster, Germany
Phone: +49 2501 14-0
E-mail: info-coatings@basf.com

Lars Schrameyer
Global Data Officer
E-mail: lars.schrameyer@basf.com

Our external Group Data Protection Officer can be contacted via:

Thomas Rosin
Klaus-Groth-Str. 4
23611 Bad Schwartau
Germany
E-mail: datenschutz@thomasrosin.de

In the following, we inform you about the data processing on our site (a), its purposes and legal basis (b) as well as the respective storage period and, if applicable, specific objection and removal options (c).

1. Log files

a. Data processing

If you visit our website for information purposes only, i.e. if you do not register or transmit data in any other way (e.g. via a contact form), the following information is automatically transmitted from your browser to our server:

  • IP address of your device
  • Information about your browser
  • Name of the website from which you visit us
  • Name of the visited page (URL) or the opened file
  • Date and time of your visit
  • Status information such as error messages
  • Transferred data volume and the access status (file transferred, file not found, etc.)
  • Operating system and version of your computer’s operating system and the name of your access provider

When you visit our website, we use the IP address and other information automatically transmitted to our server by your browser under B. 1. a. to

(i) provide you with the requested content

(ii) ensure the security and stability of our website and to trace unauthorized use

(iii) enable a comfortable use of our website.

The legal basis for the data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest follows from the above listed purposes for data processing. Under no circumstances do we use the collected data for the purpose of drawing conclusions about your person.

c. Storage period

The data will be deleted as soon as they are no longer necessary for the purpose for which they were collected. In the case of the collection of data for the provision of the website, this is the case when the respective session is ended. In the case of storage of the data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses are anonymized by deleting the last eight bits, so that an identification of you is no longer possible.

2. Cookies

We use cookies on our website. These are text information that can be stored in the browser on the device of the viewer to a visited website (web server, server). The cookie is either sent from the web server to the browser or generated in the browser by a script (JavaScript). The web server can read this cookie information directly from the server when the user visits this page again or transfer the cookie information to the server via a script of the website. Cookies do not cause any damage to your device, do not contain viruses, trojans or other malware.

Information is stored in the cookie that is related to the specific device used. This does not mean, however, that we obtain direct knowledge of your identity.

We generally use the following cookies:

Strictly necessary cookies

These cookies are necessary for the functioning of the website. In general, these cookies are only set in response to actions you take in response to a service request, such as setting your privacy preferences, logging in, or filling out forms. You can set your browser to block these cookies or to notify you about these cookies. However, some areas of the website may not function properly.

The legal basis for the processing of these cookies is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest follows from the data processing purposes listed under B.1.b.

Web analytics without cookies

We do not use cookies or similar technologies for web analytics. Neither Plausible nor PostHog store or read any information on your device. You will find the details in section B.6.

A cookie is a small piece of data (text file) that a website - when visited by a user - asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies - which are cookies from a domain different than the domain of the website you are visiting - for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
Cookie Subgroup Cookies Cookies used Lifespan
Trend editions herefortrends.session First Party [to be confirmed]
Trend editions herefortrends.session_data First Party [to be confirmed]
Edition 2025 herefortrends.locale First Party 400 days

3. Contact form and e-mail

a. Data processing

Our web pages contain contact forms as well as links to send us an e-mail directly. If you use one of these contact forms, the data which you provide in such forms will be transmitted to us and processed. The mandatory data that must be filled in for electronic contact via the respective contact form are marked with (*). If you provide us with additional data, this is done voluntarily.

If you send us an e-mail, we will process the associated metadata and the content of the message.

Your data will be processed to enable us to contact you, to process your request and to provide you with our respective services, to prevent misuse of the contact form and to ensure the security of our information technology systems.

The legal basis for the processing of data classified as being mandatory is Art. 6 para. 1 sentence 1 lit. f GDPR. The aforementioned purposes also include a legitimate interest in the processing of the data. If the purpose of the contact is the conclusion of a contract, the additional legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b GDPR. The legal basis for the processing of the data that you have voluntarily provided us with is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR.

c. Storage period

The personal data of the person concerned will be deleted or made unavailable as soon as the purpose of the storage does no longer apply. Furthermore, data may be stored if this has been provided for by the European or national legislator in EU regulations, laws or other regulations to which the person responsible is subject. Data will also be deleted or made unavailable when a storage period prescribed by the above-mentioned provisions expires, unless there is a need to continue storing the data for the purpose of concluding or fulfilling a contract.

In case of a consent, you have the right to revoke such consent at any time, without affecting the lawfulness of the processing carried out on the basis of the consent until revocation.

4. Personalized Newsletter

If you have given us your consent to do so, we and, if and to the extent applicable, the companies mentioned in the newsletter application text for the respective newsletter you applied to (hereinafter referred to as “Consent Language”) (together “We”) will process your personal data as provided in the respective application form (e.g. e-mail-address, name, company, country, time-stamp of your subscription) in order to send you the requested newsletter at regular intervals to the e-mail address you have provided. We process your personal data other than your e-mail-address for personalizing your newsletter and for sending industry-relevant information about the industry your business is active in. Moreover, your personal data allows us to put you into defined target groups in order to improve the relevancy of the communicated content that you will receive (e.g. country-specific information to include content that is related to your country).

If mentioned in the Consent Language, we are tracking the reachability of your email-address, as well as certain of your interactions within the newsletter. These interactions include the opening of the newsletter, the opening of links in the newsletter, and the removal of consent. We process this information for the purpose of improving the relevancy of the communicated content. This includes, for example, checks on the overall open rate and which links were clicked the most, to see the overall relevancy of the newsletter’s content for the readers. With regards to the tracking of the consent removal, this is tracked to make sure you will not receive further communication after you clicked unsubscribe, if and to the extent it is necessary continuing to process your e-mail-address for other purposes.

We will share your personal data with other affiliated companies of Surventis if they provide IT services for us or if this is necessary for operational reasons. Furthermore, we will pass on your personal data to the technical IT service providers we use from whom we obtain services. Our IT service providers are carefully selected and regularly checked by us. They process personal data only on our behalf and strictly in accordance with our instructions on the basis of corresponding contracts for order processing.

We store your personal data collected within the scope of your consent for the above-mentioned purposes until your consent is revoked.

The legal basis for the processing of your personal data for the above-mentioned purposes is your consent, Art 6, paragraph 1, lit. a) GDPR.

You can revoke your consent at any time with effect for the future by unsubscribing from our newsletter via the unsubscribe link or as described in the consent language for the respective newsletter you applied to.

You are at liberty to grant or withhold consent. This has no effect on the use of this Website.

If you revoke your consent, we will delete your personal data immediately, provided that we process them for marketing purposes on the basis of your consent. Please note that the revocation does not result in the deletion of all your personal data which we process in the course of the business relationship with you, if there is another legal basis for this. The revocation of your consent does not affect the legality of the data processing that has taken place up to that point.

5. User accounts for the trend editions

a. Data processing

[To be confirmed by Surventis legal] Parts of the trend editions are only available after signing in. To sign in, you enter your e-mail address and we send you a one-time code by e-mail. The code expires after 10 minutes. If your e-mail address does not belong to an approved company domain, you can request access, and we store your request until it has been approved or rejected.

In this context we process:

  • your e-mail address and, if you provide it, your name
  • the internal ID of your user account
  • one-time codes and the status of your access request
  • for every sign-in session: session token, expiry date, IP address and information about your browser (user agent)

We send the e-mails with the one-time codes through the e-mail service Postmark, which processes your e-mail address and the content of the e-mail on our behalf. [to be confirmed: contracting entity and location of processing]

We process this data to give you access to the trend editions, to administrate your user account, to decide on access requests and to protect the accounts against misuse.

[To be confirmed by Surventis legal] The legal basis for this data processing is Art. 6 para. 1 sentence 1 lit. b GDPR, as far as the data is required to provide the user account you requested, and otherwise our legitimate interest in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR, which consists of the purposes mentioned above.

c. Storage period

We store the data of your user account as long as the account exists. Sign-in sessions end when they expire or when you sign out. [to be confirmed: storage period for session data, access requests and inactive accounts]

You can ask us to delete your user account at any time. You will find the contact details in section A.

6. Web analytics on the trend editions

We analyze how herefortrends.com and the trend editions are used, so we can see which content is of interest, find and fix errors and improve them. The 2025 edition uses Plausible Analytics. herefortrends.com, the press access page and the NEXISTENTIAL 2026/27 edition use PostHog.

6.1 Plausible Analytics (2025 edition)

a. Data processing

Plausible Analytics is a service of Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia (“Plausible”). Plausible does not use cookies and does not store or read any information on your device. The requests are sent via our own domain to Plausible.

When you open a page, Plausible processes the address (URL) of the page, the referring website, your browser, operating system and device type, and the country, region and city derived from your IP address. On the 2025 edition, Plausible also records clicks on links to other websites and file downloads, together with the page on which they took place.

To count unique visitors, Plausible creates a daily identifier from your IP address and browser information using a hash function with a salt that is deleted after 24 hours. According to Plausible, the IP address and the complete browser information are not stored, and the visitor identifiers cannot be linked across days. We only receive aggregated statistics.

Plausible processes and stores the data on servers in Germany, within the European Union. Plausible processes the data on our behalf on the basis of a data processing agreement.

We use Plausible to evaluate the use of our websites in aggregated form and to improve their content.

[To be confirmed by Surventis legal] Plausible does not store or read any information on your device. The legal basis for the processing is our legitimate interest in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR in analyzing the use of our websites and improving them.

c. Storage period and objection

Plausible stores only aggregated statistics without personal reference. The salt used to create the daily identifier is deleted after 24 hours. [to be confirmed: how long we keep the aggregated statistics]

You can object to the processing at any time for reasons arising from your particular situation. You will find the contact details in section A. Further information is available in Plausible’s data policy (https://plausible.io/data-policy).

6.2 PostHog (herefortrends.com, press access page and NEXISTENTIAL 2026/27 edition)

a. Data processing

herefortrends.com, the press access page and the NEXISTENTIAL 2026/27 edition use PostHog, a service of PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA (“PostHog”). We use PostHog Cloud EU, which is hosted on servers in Frankfurt, Germany. The requests from your browser are sent to our own domain first, and we forward them to PostHog without your IP address and without cookies.

We use PostHog anonymously. PostHog does not store or read any information on your device, neither cookies nor entries in the local storage of your browser. A random identifier is only kept in the memory of the open browser tab and is discarded when you close or reload the tab. We therefore cannot recognize your browser across visits, and we do not link the data to your user account, your e-mail address or your name, even if you are signed in or have logged in to the press access page.

With PostHog we process:

  • page views, including the address (URL) of the page, the referring website and the time of the visit, and when you leave a page
  • clicks and other interactions with the page
  • information about your browser, operating system, device type and screen size
  • anonymous recordings of your visit (session replay): the content of the pages you view, mouse movements, clicks and scrolling. The content of all input fields is masked and not recorded, and your e-mail address is excluded from the recordings. On the press access page, the e-mail address and name you enter are masked as well
  • errors that occur in your browser while you use our websites
  • errors that occur on our server while it processes your request, together with the requested page but without any information about you

We use PostHog to analyze how our websites are used, to find and fix errors and to improve them.

[To be confirmed by Surventis legal] Since PostHog does not store or read any information on your device, Section 25 TDDDG does not apply. The legal basis for the processing, including the anonymous session recordings and the recording of errors in your browser and on our server, is our legitimate interest in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR in analyzing the use of our websites, operating them without errors and improving them.

c. Recipients and transfer to third countries

PostHog processes the data on our behalf on the basis of a data processing agreement in accordance with Art. 28 GDPR. PostHog uses subprocessors, for example Amazon Web Services for storing the data in Germany (https://posthog.com/subprocessors).

PostHog, Inc. is based in the USA. According to its data processing agreement, PostHog may also process data outside the European Economic Area, including in the USA. PostHog, Inc. is certified under the EU-U.S. Data Privacy Framework, on the basis of which the European Commission has determined an adequate level of data protection. In addition, standard contractual clauses of the European Commission have been agreed with PostHog. [to be confirmed: signed data processing agreement with PostHog in place]

d. Storage period

The random identifier is discarded as soon as you close or reload the browser tab.

PostHog keeps events (such as page views, clicks and errors) for one year on the free plan and for seven years on paid plans. Session recordings are kept for the period set in our project, which depending on the plan can be up to 30 days, 90 days, one year or five years. [to be confirmed: our PostHog plan and the configured retention period for events and session recordings]

e. Objection

You can object to the processing at any time for reasons arising from your particular situation. You will find the contact details in section A. Further information is available in PostHog’s privacy policy (https://posthog.com/privacy).

C. Are you obliged to provide us with this data?

When you visit our website, the information specified in section B. 1. a. as well as the information from the cookies classified as strictly necessary is processed automatically. The transfer of this information is voluntary. Without the provision of this personal data, we cannot display the requested page.

If you

  • allow us to use cookies that are not classified as strictly necessary,
  • sign in to the trend editions or
  • want to see embedded YouTube videos

the transfer of the information is voluntary.

If you contact us, we cannot answer your inquiry in the chosen way without the provision of the personal data required in the individual case. As far as cookies are concerned, the lack of consent can lead to a restriction of the functionality of the website or parts of it. Embedded videos cannot be played without your consent.

D. To whom do we pass on your personal data?

Within our company, only persons and departments are granted access to your personal data as far as they need it to fulfil the abovementioned purposes.

We also involve service providers. These service providers will only act on our instructions and are contractually obliged to comply with the applicable data protection requirements.

Our websites (herefortrends.com, the trend editions and the press access page) and the content management system of the trend editions are hosted by Vercel Inc., USA (“Vercel”). The data we store, for example user accounts, access requests and logins to the press access page, is kept in a database of Neon, USA (“Neon”). Vercel and Neon process the data on our behalf on the basis of data processing agreements in accordance with Art. 28 GDPR. The servers that process your requests, the database and the storage for images and videos are located in Frankfurt, Germany. Pages and files are delivered through Vercel’s global network, so your request may be answered by a location near you. [to be confirmed: certification of Vercel and Neon under the EU-U.S. Data Privacy Framework and standard contractual clauses for transfers to the USA]

Otherwise, we will only pass on your data to third parties if:

  • you have given your express consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR,
  • the disclosure pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR is necessary for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,
  • there is a legal obligation for us to pass on the data in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR, or
  • this is legally permissible and, in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR, is necessary for the fulfilment of contractual relationships with you.

A transfer of your personal data to service providers in a third country will only take place if the special requirements of Art. 44 ff. GDPR are fulfilled.

E. How do we secure your personal data?

Surventis uses technical and organizational security measures to protect your personal data from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security measures are continuously revised in line with technological developments.

F. What rights do you have?

You have certain rights under the General Data Protection Regulation including the right to request a copy of the personal information we hold about you, if you request it from us in writing:

Right to access: the right to obtain access to your information (if we’re processing it), and certain other information (like that provided in this Privacy Policy);

Right to correct: if your personal information is inaccurate or incomplete you have the right to have your personal information rectified;

Right to erasure: this is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your information where there’s no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions. For example, we have the right to continue using your personal data if such use is necessary for compliance with our legal obligations or for the establishment, exercise or defense of legal claims;

Right to restriction of processing: the right to suspend the usage of your personal information or limit the way in which we can process it. Please note that this right is limited in certain situations: When we are processing your personal information that we collected from you with your consent you can only request restriction on the basis of: (a) inaccuracy of data; (b) where our processing is unlawful and you don’t want your personal information erased; (c) you need it for a legal claim; or (d) if we no longer need to use the data for the purposes for which we hold it. When processing is restricted, we can still store your information, but may not use it further. We keep lists of people who have asked for restriction of the use of their personal information to make sure the restriction is respected in future;

Right to data portability: the right to request that we move, copy or transfer (where technically feasible) your personal information in a structured, commonly used and machine-readable format, for your own purposes across different services;

**Right to object:**the right to object to our processing of your personal information including where we process it for our legitimate interests, direct marketing;

Right to withdraw consent: if you have given your consent to anything we do with your personal information, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal information with your consent up to that point is unlawful).

Exercising these rights is free of charge. However, you are required to prove your identity by means of a two-factor-authentication. We will engage reasonable efforts consistent with our legal duty to supply, correct or delete personal information about you.

To exercise your rights, please contact us, for example by e-mail or by post. You will find the contact details in section A.

G. Where can you complain?

You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

Our Lead Data Protection Authority:

State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen)
Kavalleriestr. 2-4
40213 Düsseldorf
Germany

Should you have a reason to make a complaint, you are welcome to contact our Group Data Protection Officer at any time (for contact details see Section A).

H. Data protection for minors

This website is intended for persons who are at least 18 years old. If a minor submits personal data via this website, we will delete this data and not process it further as soon as we become aware of this fact.