Privacy policy

Last updated: 16 October 2026

This English version is provided for convenience. In case of discrepancies, the German version shall prevail.

1. Controller

The controller responsible for the processing of personal data on this website is:

Sevban Baran
bxsiness
Marienstraße 10, 71083 Herrenberg, Germany
Email: info@bxsiness.com
Phone: +49 179 7030306

We have not appointed a data protection officer as we are not legally required to do so. For any privacy questions, please write to info@bxsiness.com.

2. Summary

• This website is directed exclusively at businesses.
• We use no cookies, no tracking, no analytics and no advertising tools.
• We do not embed third-party content (no Google Fonts, maps, videos or social media plugins). Fonts are loaded from your own device.
• We only process personal data to deliver the website technically and to handle your requests and applications.
• The WhatsApp button is a simple link. Data is only sent to WhatsApp once you tap it and write to us there (section 10).

3. Hosting and delivery of the website (Cloudflare)

This website is provided via Cloudflare Pages, operated by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). We do not run our own server.

When you visit the website, your request is routed and answered via Cloudflare’s global network. Cloudflare processes the technically necessary data (see section 4) to deliver the pages, encrypt the connection and protect against attacks (e.g. denial-of-service attacks).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, fast and reliable provision of the website.

Data processing agreement: We have concluded a data processing agreement with Cloudflare pursuant to Art. 28 GDPR (Cloudflare Data Processing Addendum).

Transfer to the USA: Cloudflare, Inc. is based in the USA and may process data outside the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). In addition, Cloudflare’s data processing agreement includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

More information: https://www.cloudflare.com/privacypolicy/

4. Server log data

When you access the website, data transmitted by your browser is processed automatically:

• IP address
• date and time of access
• page or file accessed
• amount of data transferred and status code
• browser type and version, operating system
• referrer URL (the previously visited page), if transmitted

This data is technically necessary to display the website and serves security purposes (detecting and preventing attacks). We do not combine this data with other data and do not use it to analyse user behaviour.

The processing is carried out by Cloudflare on our behalf. Cloudflare stores this data only as long as necessary for these purposes and then deletes or anonymises it in accordance with its own retention periods.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating and securing the website).

5. No cookies, no tracking

This website does not set cookies and does not use similar technologies (e.g. local storage, pixels, fingerprinting) that store or access information on your device, unless strictly necessary for the service you have explicitly requested (Section 25(2) of the German TDDDG). Therefore, we do not display a cookie banner.

6. Request form (“Request a quote”)

When you contact us via the “Request a quote” form, we process the following information:

• company, contact person, email address, phone number (optional)
• country, construction site location, product group, quantities and dimensions, preferred date, your message
• uploaded files (e.g. plans, photos; up to 4 MB in total)

Purpose: handling your request, obtaining quotes from manufacturers and preparing an offer for you.

Disclosure to manufacturers/suppliers: To prepare an offer, we pass on the technical project data (product group, quantities, dimensions, plans, delivery region, preferred date) to selected manufacturers and suppliers. We only pass on your contact details where this is necessary for preparing the offer or for delivery. Our suppliers are located in the EU and also outside the EU (e.g. in Turkey).

Please note: Plans and photos may contain personal data of third parties (e.g. names of building owners or addresses). Please only upload documents you are permitted to share for this purpose and redact personal details that are not needed.

Technical process: Your input is sent in encrypted form (HTTPS) to a function running on Cloudflare’s servers (section 3). This function checks the data and immediately forwards it to our email delivery service Brevo (section 8). The form data is not stored at Cloudflare. Brevo delivers the request as an email to our mailbox hosted by Strato (section 9). You do not receive any email from Brevo.

Legal bases:

• Where you yourself are our (prospective) contracting party (e.g. as a sole trader): Art. 6(1)(b) GDPR (pre-contractual steps taken at your request).
• Where you make the request as an employee or representative of a company: Art. 6(1)(f) GDPR. Our legitimate interest is handling the company’s request and communicating with its contact persons.
• Disclosure to manufacturers/suppliers: the same legal bases.

Mandatory fields are marked. Without this information, we cannot process your request.

7. Form “Apply for a business account”

When you apply for a business account, we process:

• company, commercial register / KvK number, VAT identification number, address
• contact person, email address, phone number (optional)
• product interests, your message

Purpose: verifying that you are a business (our offer is directed at businesses only), verifying the VAT identification number, activating you as a business customer and preparing the business relationship. Activation is done manually by us, not automatically.

To verify VAT identification numbers, we may use the public confirmation services of the German Federal Central Tax Office or the European Commission’s VIES system.

Technical process and recipients: as in section 6 (Cloudflare function without storage → Brevo → mailbox at Strato).

Legal bases: Art. 6(1)(b) GDPR (pre-contractual steps); for contact persons of companies Art. 6(1)(f) GDPR (as in section 6). For VAT ID verification additionally Art. 6(1)(c) GDPR (VAT obligations for intra-community supplies).

8. Email delivery via Brevo

To send the form data to our own mailbox, we use Brevo, operated by Sendinblue SAS (brand “Brevo”), 17 rue de Salneuve, 75017 Paris, France.

Brevo processes the form data, your email address, attachments and technical delivery data (e.g. time, delivery status). Brevo stores delivery logs and the content of sent emails for a limited period to prove delivery and resolve errors. Brevo sends emails on our behalf only to our own mailbox, not to you. We do not use Brevo’s newsletter features.

According to Brevo, the data is processed in the EU. We have concluded a data processing agreement with Brevo pursuant to Art. 28 GDPR.

Legal basis: as for the respective form (sections 6 and 7) and Art. 6(1)(f) GDPR (legitimate interest in reliable email delivery).

More information: https://www.brevo.com/legal/privacypolicy/

9. Email mailbox at Strato

Our mailbox info@bxsiness.com is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Your form requests and emails are received and stored there. We have concluded a data processing agreement with Strato pursuant to Art. 28 GDPR. The data is processed in data centres in Germany.

If you email us directly, we process your email address and the content of your message to handle your enquiry (legal bases as in section 6).

10. Contact via WhatsApp

Our website includes a “WhatsApp” button (on the contact page, in the footer and, on smartphones, at the bottom right). This button is a simple link. Our website does not load any content, scripts or cookies from WhatsApp or Meta for it. As long as you do not tap the button, no data is transmitted to WhatsApp. Only when you tap it does WhatsApp (app or WhatsApp Web) open with a pre-filled message, and you leave our website. The message is only sent when you tap “Send” yourself.

For users in the EU, WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“WhatsApp”), a company of the Meta group.

What data: When you write to us via WhatsApp, we receive your phone number, your WhatsApp profile name (depending on your settings also your profile picture and “about” text), the content of your messages and any files you send us. WhatsApp also processes its own connection and usage data (e.g. phone number, time of the message, device information, IP address). According to WhatsApp, message content is end-to-end encrypted, whereas this connection and usage data (metadata) is not.

Purpose: handling your request and communicating with you, just as with an email.

How we use WhatsApp: We use the “WhatsApp Business” app on a separate business number that is used only for bxsiness. The app has no access to our address book. We therefore do not transmit any contact data from our address book to WhatsApp.

Legal bases: as in section 6 (Art. 6(1)(b) GDPR where you yourself are our prospective contracting party; Art. 6(1)(f) GDPR where you write on behalf of a company). Our legitimate interest is handling the request and offering business customers a fast contact channel of their own choice.

WhatsApp’s responsibility: WhatsApp also processes data for its own purposes and under its own terms. WhatsApp is itself responsible for this. We have no influence on it.

Transfer to third countries: WhatsApp may transfer data to Meta Platforms, Inc. in the USA and to other companies of the Meta group. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). In addition, according to WhatsApp, it relies on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Retention: We store and delete your WhatsApp messages in the same way as requests by email (see section 12). At WhatsApp itself, WhatsApp’s retention periods apply.

Voluntary, alternatives available: Using WhatsApp is voluntary. You can always reach us by email at info@bxsiness.com or via our forms. Please send plans and confidential documents via the request form or by email.

More information: https://www.whatsapp.com/legal/privacy-policy-eea

11. Spam protection without third parties

Our forms contain a field that is invisible to humans and a time check (a form submitted within a few seconds is treated as automated). No additional personal data is collected and no third-party providers are used for this.

12. How long do we store your data?

Retention periods start at the end of the calendar year in which the document was created. During a retention period, the data is restricted and used only for that purpose.

13. Your rights

You have the right at any time to:

• access your data stored by us (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR), unless a retention obligation applies
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR): Where we process your data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

A short email to info@bxsiness.com is sufficient.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You may lodge a complaint with any data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement (in the Netherlands, e.g. the Autoriteit Persoonsgegevens). The authority competent for us is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart, Germany (postal address: Postfach 10 29 32, 70025 Stuttgart)
https://www.baden-wuerttemberg.datenschutz.de

14. No automated decision-making

We do not make decisions based solely on automated processing, including profiling (Art. 22 GDPR). Decisions on activating business accounts and on offers are made by us personally.

15. Data security

The connection between your browser and the website is encrypted via TLS/HTTPS (indicated by the padlock symbol in the address bar).

16. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.