Polityka prywatności

Last updated: 21 October 2026

This English version is provided for convenience. In case of discrepancies, the German version shall prevail.

1. Controller

The controller responsible for the processing of personal data on this website is:

Sevban Baran
bxsiness
Marienstraße 10, 71083 Herrenberg, Germany
Email: info@bxsiness.com
Phone: +49 179 7030306

We have not appointed a data protection officer as we are not legally required to do so. For any privacy questions, please write to info@bxsiness.com.

2. Summary

• This website is directed exclusively at businesses.
• We use no cookies, no tracking, no analytics and no advertising tools.
• We do not embed third-party content (no Google Fonts, maps, videos or social media plugins). Fonts are loaded from your own device.
• We only process personal data to deliver the website technically and to handle your requests and applications.
• If you register as a business customer, we store your details in our customer database located in the EU (section 7).
• The WhatsApp button is a simple link. Data is only sent to WhatsApp once you tap it and write to us there (section 10).

3. Hosting and delivery of the website (Cloudflare)

This website is provided via Cloudflare Pages, operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). We do not run our own server.

When you visit the website, your request is routed and answered via Cloudflare’s global network. Cloudflare processes the technically necessary data (see section 4) to deliver the pages, encrypt the connection and protect against attacks (e.g. denial-of-service attacks).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, fast and reliable provision of the website.

Data processing agreement: We have concluded a data processing agreement with Cloudflare pursuant to Art. 28 GDPR (Cloudflare Data Processing Addendum).

Transfer to the USA: Cloudflare, Inc. is based in the USA and may process data outside the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). In addition, Cloudflare’s data processing agreement includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

More information: https://www.cloudflare.com/privacypolicy/

4. Server log data

When you access the website, data transmitted by your browser is processed automatically:

• IP address
• date and time of access
• page or file accessed
• amount of data transferred and status code
• browser type and version, operating system
• referrer URL (the previously visited page), if transmitted

This data is technically necessary to display the website and serves security purposes (detecting and preventing attacks). We do not combine this data with other data and do not use it to analyse user behaviour.

The processing is carried out by Cloudflare on our behalf. Cloudflare stores this data only as long as necessary for these purposes and then deletes or anonymises it in accordance with its own retention periods.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating and securing the website).

5. No cookies, no tracking

This website does not set cookies and does not use similar technologies (e.g. local storage, pixels, fingerprinting) that store or access information on your device, unless strictly necessary for the service you have explicitly requested (Section 25(2) of the German TDDDG). Therefore, we do not display a cookie banner.

6. Request forms (“Request a quote” and “Request a project quote” for furniture)

When you contact us via the “Request a quote” form, we process the following information:

• company, contact person, email address, phone number (optional)
• country, construction site location, product group, quantities and dimensions, preferred date, your message
• whether you are already registered as a business customer (optional)
• uploaded files (e.g. plans, photos; up to 4 MB in total)

For the “Request a project quote” form (Furniture & Projects) we process the same contact details and files and, in addition: type of project, number of rooms/units, delivery location, desired timeframe, budget, scope, furniture categories required, style/references and project description.

Purpose: handling your request, obtaining quotes from manufacturers and preparing an offer for you.

Disclosure to manufacturers/suppliers: To prepare an offer, we pass on the technical project data (product group, quantities, dimensions, plans, delivery region, preferred date) to selected manufacturers and suppliers. We only pass on your contact details where this is necessary for preparing the offer or for delivery. Our suppliers are located in the EU and also outside the EU (e.g. in Turkey).

Disclosure to an assembly company (only at your request): If you expressly ask us, in the project form or later, to name an assembly company, we pass on the contact and project details it needs (company, contact person, contact details, delivery location, timeframe, scope of the furniture) to that company so that it can contact you. The assembly company is an independent business and processes the data as a controller in its own right; its own privacy policy applies to its processing.

Please note: Plans and photos may contain personal data of third parties (e.g. names of building owners or addresses). Please only upload documents you are permitted to share for this purpose and redact personal details that are not needed.

Technical process: Your input is sent in encrypted form (HTTPS) to a function running on Cloudflare’s servers (section 3). This function checks the data and immediately forwards it to our email delivery service Brevo (section 8). The form data is not stored at Cloudflare, nor in our customer database (section 7). Brevo delivers the request as an email to our mailbox hosted by Strato (section 9). You do not receive any email from Brevo.

Legal bases:

• Where you yourself are our (prospective) contracting party (e.g. as a sole trader): Art. 6(1)(b) GDPR (pre-contractual steps taken at your request).
• Where you make the request as an employee or representative of a company: Art. 6(1)(f) GDPR. Our legitimate interest is handling the company’s request and communicating with its contact persons.
• Disclosure to manufacturers/suppliers: the same legal bases.
• Disclosure to an assembly company: Art. 6(1)(b) GDPR (at your request); where you act for a company, Art. 6(1)(f) GDPR. Our legitimate interest is fulfilling the company’s request to be referred to an assembly company.

Mandatory fields are marked. Without this information, we cannot process your request.

7. Form “Register as a business customer”

When you register as a business customer, we process:

• company, commercial register / KvK number, VAT identification number, address, country
• contact person, email address, phone number (optional)
• product interests, your message
• website language, time of registration and processing status (new, checked, activated, rejected)

Purpose: verifying that you are a business (our offer is directed at businesses only), verifying the VAT identification number, activating you as a business customer and managing the business relationship, in particular so that offers and invoices contain verified company and tax data. Activation is decided by us personally, not automatically. There is no customer account with a login.

To verify VAT identification numbers, we may use the public confirmation services of the German Federal Central Tax Office or the European Commission’s VIES system.

Technical process and storage: Your input is sent in encrypted form (HTTPS) to a function running on Cloudflare’s servers (section 3). The function forwards it via Brevo (section 8) as an email to our mailbox at Strato (section 9) and additionally stores it in our customer database. For this we use Cloudflare D1, a database service of Cloudflare, Inc. (address in section 3), with the storage location European Union. We have concluded a data processing agreement with Cloudflare pursuant to Art. 28 GDPR. For a possible transfer to the USA, see section 3.

Internal customer management: We transfer your data from the customer database to our internal customer list. This list is kept as a file in our cloud storage at Apple (iCloud; provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). We also keep an internal overview containing only the company name and processing status; it is stored at Anthropic (provider of the AI service “Claude”, which we use to organise our work). Both service providers store the data on our behalf and may also process it outside the EU, in particular in the USA. Where data is transferred to the USA, this is done only on the basis of the safeguards provided for in Art. 44 et seq. GDPR (e.g. EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses). We do not sell your data and do not use it for advertising.

Legal bases: Art. 6(1)(b) GDPR (pre-contractual steps and performance of the business relationship); for contact persons of companies Art. 6(1)(f) GDPR (as in section 6; our legitimate interest additionally lies in orderly customer management). For VAT ID verification and the retention of invoices and business correspondence additionally Art. 6(1)(c) GDPR.

Retention and erasure: Registrations we do not activate are deleted 6 months after rejection or last contact. Data of activated business customers is stored for the duration of the business relationship and then deleted unless a statutory retention obligation applies (section 12). Erasure covers the customer database, the customer list and the internal overview. You can request erasure at any time by email to info@bxsiness.com (section 13).

8. Email delivery via Brevo

To send the form data to our own mailbox, we use Brevo, operated by Sendinblue SAS (brand “Brevo”), 17 rue de Salneuve, 75017 Paris, France.

Brevo processes the form data, your email address, attachments and technical delivery data (e.g. time, delivery status). Brevo stores delivery logs and the content of sent emails for a limited period to prove delivery and resolve errors. Brevo sends emails on our behalf only to our own mailbox, not to you. We do not use Brevo’s newsletter features.

According to Brevo, the data is processed in the EU. We have concluded a data processing agreement with Brevo pursuant to Art. 28 GDPR.

Legal basis: as for the respective form (sections 6 and 7) and Art. 6(1)(f) GDPR (legitimate interest in reliable email delivery).

More information: https://www.brevo.com/legal/privacypolicy/

9. Email mailbox at Strato

Our mailbox info@bxsiness.com is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Your form requests and emails are received and stored there. We have concluded a data processing agreement with Strato pursuant to Art. 28 GDPR. The data is processed in data centres in Germany.

If you email us directly, we process your email address and the content of your message to handle your enquiry (legal bases as in section 6).

10. Contact via WhatsApp

Our website includes a “WhatsApp” button (on the contact page, in the footer and, on smartphones, at the bottom right). This button is a simple link. Our website does not load any content, scripts or cookies from WhatsApp or Meta for it. As long as you do not tap the button, no data is transmitted to WhatsApp. Only when you tap it does WhatsApp (app or WhatsApp Web) open with a pre-filled message, and you leave our website. The message is only sent when you tap “Send” yourself.

For users in the EU, WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“WhatsApp”), a company of the Meta group.

What data: When you write to us via WhatsApp, we receive your phone number, your WhatsApp profile name (depending on your settings also your profile picture and “about” text), the content of your messages and any files you send us. WhatsApp also processes its own connection and usage data (e.g. phone number, time of the message, device information, IP address). According to WhatsApp, message content is end-to-end encrypted, whereas this connection and usage data (metadata) is not.

Purpose: handling your request and communicating with you, just as with an email.

How we use WhatsApp: We use the “WhatsApp Business” app on a separate business number that is used only for bxsiness. The app has no access to our address book. We therefore do not transmit any contact data from our address book to WhatsApp.

Legal bases: as in section 6 (Art. 6(1)(b) GDPR where you yourself are our prospective contracting party; Art. 6(1)(f) GDPR where you write on behalf of a company). Our legitimate interest is handling the request and offering business customers a fast contact channel of their own choice.

WhatsApp’s responsibility: WhatsApp also processes data for its own purposes and under its own terms. WhatsApp is itself responsible for this. We have no influence on it.

Transfer to third countries: WhatsApp may transfer data to Meta Platforms, Inc. in the USA and to other companies of the Meta group. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). In addition, according to WhatsApp, it relies on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Retention: We store and delete your WhatsApp messages in the same way as requests by email (see section 12). At WhatsApp itself, WhatsApp’s retention periods apply.

Voluntary, alternatives available: Using WhatsApp is voluntary. You can always reach us by email at info@bxsiness.com or via our forms. Please send plans and confidential documents via the request form or by email.

More information: https://www.whatsapp.com/legal/privacy-policy-eea

11. Spam protection without third parties

Our forms contain a field that is invisible to humans and a time check (a form submitted within a few seconds is treated as automated). No additional personal data is collected and no third-party providers are used for this.

12. How long do we store your data?

Retention periods start at the end of the calendar year in which the document was created. During a retention period, the data is restricted and used only for that purpose.

13. Your rights

You have the right at any time to:

• access your data stored by us (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR), unless a retention obligation applies
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR): Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

A short email to info@bxsiness.com is sufficient.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You may lodge a complaint with any data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement (in the Netherlands, e.g. the Autoriteit Persoonsgegevens). The authority competent for us is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart, Germany (postal address: Postfach 10 29 32, 70025 Stuttgart)
https://www.baden-wuerttemberg.datenschutz.de

14. No automated decision-making

We do not make decisions based solely on automated processing, including profiling (Art. 22 GDPR). Decisions on activating business customers and on offers are made by us personally.

15. Data security

The connection between your browser and the website is encrypted via TLS/HTTPS (indicated by the padlock symbol in the address bar).

16. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.