English (UK) 
Deutsch 
Deutsch (Österreich) Data protection
PRIVACY POLICY
1. Controller
| Bermüller & Co GmbH
Rotterdamer Straße 7, 90451 Nuremberg Phone: +49 (0) 911 – 64200 – 0 | Telefax: +49 (0) 911 – 64200 – 90 E-Mail: info@beco-bermueller.de | Web: www.beco-bermueller.de |
2. Data Protection Officer
We have appointed a company data protection officer. Please contact her with any questions regarding data protection:
| Data Protection Officer of Bermüller & Co GmbH
E-Mail: datenschutz@beco-bermueller.de |
3. Principles of Data Processing (Art. 5 GDPR)
We process personal data in accordance with the principles of the GDPR: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation as well as integrity and confidentiality.
Personal data is processed only on the basis of a valid legal basis pursuant to Art. 6 GDPR. Where we obtain consent (Art. 6 (1) (a) GDPR), such consent is given freely, on an informed basis and may be withdrawn at any time. Contracts and pre-contractual measures are processed on the basis of Art. 6 (1) (b) GDPR. Legal obligations justify processing pursuant to Art. 6 (1) (c) GDPR. Legitimate interests are processed on the basis of Art. 6 (1) (f) GDPR, provided that your interests do not override ours.
4. Origin of the Data (Art. 13 and Art. 14 GDPR)
We collect personal data in the following ways:
- Directly from you (Art. 13 GDPR): when you use our website, contact us via form, telephone or email, and when you subscribe to our newsletter.
- Automatically through IT systems (Art. 13 GDPR): when you visit our website (server logs, cookies, tracking technologies).
- From third parties (Art. 14 GDPR): within the scope of tracking services (e.g. Meta Pixel, Google Analytics), data from third-party sources (social media platforms, advertising networks) may be linked with your website data. We inform you about these third-party sources in the relevant section of this policy.
Special Categories of Personal Data (Art. 9 GDPR)
| As a matter of principle, we do not collect any special categories of personal data pursuant to Art. 9 GDPR via our website (e.g. health data, political opinions, religious beliefs, biometric data). Should you transmit such data to us unsolicited, we will process it exclusively for the purpose of handling your enquiry on the basis of your implied consent pursuant to Art. 9 (2) (a) GDPR. |
5. Data Processing When Visiting the Website
5.1 Server-Logfiles
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device.
| Category | Details |
|---|---|
| Data processed | IP address, date and time of access, URL accessed, status code, volume of data transferred, referrer URL, browser type and version, operating system |
| Purpose | Ensuring technical functionality, detecting and defending against attacks, error diagnosis |
| Legal basis | Art. 6 (1) (f) GDPR – legitimate interest in the secure and fault-free provision of the website |
| Storage period | 7 days, followed by automatic deletion |
| Recipients | No third parties; processing on our own/rented servers |
5.2 Contact Form and Email Contact
If you contact us via the contact form or by email, the data you provide will be stored in order to process your enquiry.
| Category | Details |
|---|---|
| Data processed | Name, email address, telephone number (optional), message content, time stamp |
| Purpose | Handling and responding to your enquiry |
| Legal basis | Art. 6 (1) (b) GDPR (pre-contractual measures); Art. 6 (1) (f) GDPR (legitimate interest in customer communication); for statutory retention obligations: Art. 6 (1) (c) GDPR in conjunction with Sec. 147 German Fiscal Code (AO), Sec. 257 German Commercial Code (HGB) |
| Storage period | 3 years after completion of the matter (limitation period); up to 10 years where relevant under commercial or tax law |
| Recipients | Internal specialist departments; no third parties without a legal basis |
6. Cookies and Tracking Technologies
Our website uses cookies and similar technologies. Cookies are small text files stored on your terminal device. We distinguish between technically necessary cookies (no consent required) and optional cookies (only with your consent pursuant to Sec. 25 German Telecommunications Digital Services Data Protection Act (TDDDG/TTDSG) in conjunction with Art. 6 (1) (a) GDPR).
You may withdraw your consent at any time via our cookie consent tool.
6.1 Google Analytics
| Category | Details |
|---|---|
| Provider | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland |
| Purpose | Analysis of user behaviour, website optimisation, compilation of usage statistics |
| Data processed | Anonymised IP address, pages accessed, time spent on site, origin, device information, interactions |
| Legal basis | Art. 6 (1) (a) GDPR in conjunction with Sec. 25 (1) TTDSG (consent) |
| Storage period | Cookie lifetime: 2 years; data at Google: 14 months (configured) |
| Third-country transfer | USA; Google LLC is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) |
| Objection / opt-out | Cookie consent tool on this website; browser plug-in: https://tools.google.com/dlpage/gaoptout |
6.2 Newsletter via MailChimp
| Category | Details |
|---|---|
| Provider | Intuit Inc. / Mailchimp, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA |
| Purpose | Distribution of the company newsletter; performance measurement (open and click rates) |
| Data processed | Email address, time of confirmation (double opt-in), opening and click behaviour |
| Legal basis | Art. 6 (1) (a) GDPR (consent); consent is obtained via the double opt-in procedure |
| Storage period | Until withdrawal of consent (unsubscription); deletion without undue delay thereafter |
| Third-country transfer | USA; Intuit/Mailchimp is certified under the EU-US Data Privacy Framework; in addition, EU standard contractual clauses (Art. 46 (2) (c) GDPR) have been agreed |
| Withdrawal | Unsubscribe link in every newsletter or email to datenschutz@beco-bermueller.de |
6.3 Meta Pixel und Conversions API
| Category | Details |
|---|---|
| Provider | Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland |
| Purpose | Performance measurement of Facebook/Instagram advertisements; remarketing; audience building |
| Data processed | IP address (hashed), device information, pages accessed, interactions, where applicable email address (hashed) upon form submission |
| Origin of the data (Art. 14 GDPR) | Directly from the terminal device (pixel in the browser) as well as server-side (Conversions API); linking with Meta platform data by Meta (third-party source pursuant to Art. 14 GDPR) |
| Legal basis | Art. 6 (1) (a) GDPR in conjunction with Sec. 25 (1) TTDSG (consent) |
| Joint controllership | For processing on Meta platforms, a joint controllership agreement pursuant to Art. 26 GDPR has been concluded with Meta. Essence of the arrangement: Meta is primarily responsible for the processing on its platforms; we are responsible for obtaining consent. |
| Storage period | Cookie lifetime: 90 days; data storage at Meta in accordance with the Meta privacy policy |
| Third-country transfer | USA; Meta is certified under the EU-US Data Privacy Framework |
| Objection | Cookie-Consent-Tool; Meta-Datenschutzeinstellungen: https://www.facebook.com/privacy/policy/ |
6.4 Cloudflare Turnstile
| Category | Details |
|---|---|
| Provider | Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA |
| Purpose | Protection of our forms against spam and automated requests (CAPTCHA alternative) |
| Data processed | IP address, browser and device information, security-relevant characteristics, behavioural data |
| Legal basis | Art. 6 (1) (f) GDPR – legitimate interest in the security and functionality of our website and in preventing misuse |
| Storage period | Technical session data; no permanent storage of personal data by us |
| Third-country transfer | USA; Cloudflare is certified under the EU-US Data Privacy Framework |
| Further information | https://www.cloudflare.com/privacypolicy/ |
7. Social Media Presences
We maintain presences on the following platforms: Facebook, Instagram, LinkedIn. If you contact us via these channels, the privacy notices of the respective platform operator apply.
For Facebook and Instagram fan pages, joint controllership pursuant to Art. 26 GDPR exists between us and Meta Platforms Ireland Limited (CJEU judgment C-210/16). We have concluded a corresponding agreement with Meta. You may assert your rights against both us and Meta.
| Platform | Privacy information |
|---|---|
| Facebook / Instagram | https://www.facebook.com/privacy/policy/ |
| https://www.linkedin.com/legal/privacy-policy |
8. Security of Data Processing (Art. 25 and Art. 32 GDPR)
Technical and organisational measures (Art. 25 and Art. 32 GDPR)
We implement technical and organisational measures (TOMs) to protect your personal data against unauthorised access, loss or misuse. These include in particular:
Nevertheless, data transmission over the internet may in principle involve security risks. Absolute protection is not technically possible. For particularly sensitive information, we recommend contacting us by other means (e.g. by post or telephone). |
9. Your Rights as a Data Subject
You have the following rights against us with regard to personal data relating to you:
| Right | Legal basis / note |
|---|---|
| Access | Art. 15 GDPR – confirmation and information about the data processed |
| Rectification | Art. 16 GDPR – correction of inaccurate data |
| Erasure | Art. 17 GDPR – erasure subject to the statutory requirements |
| Restriction | Art. 18 GDPR – restriction of processing |
| Data portability | Art. 20 GDPR – receipt of your data in a machine-readable format |
| Objection | Art. 21 GDPR – objection to processing based on legitimate interests; in the case of direct marketing: absolute right to object without giving reasons |
| Withdrawal of consent | Art. 7 (3) GDPR – withdrawal possible at any time; the lawfulness of processing carried out up to that point remains unaffected |
| No automated decision-making | Art. 22 GDPR – we do not take any decisions based solely on automated processing that produce legal effects |
| Special categories of data | Art. 9 GDPR – as a matter of principle not collected on this website (see section 4) |
To exercise your rights, please contact: datenschutz@beco-bermueller.de
⚠ Important notice: Right to object to direct marketing (Art. 21 (4) GDPR)
| Where we process your personal data for the purpose of direct marketing (e.g. product information, offers), you have the right to object to such processing at any time and without giving reasons.
Following an objection, your data will no longer be processed for direct marketing purposes. This objection is not subject to any formal requirements and may be declared at any time by email to datenschutz@beco-bermueller.de. datenschutz@beco-bermueller.de . |
10. Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)
You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The supervisory authority responsible for us is:
| Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27, 91522 Ansbach Phone: +49 (0) 981 53 1300 | E-Mail: poststelle@lda.bayern.de |
11. Disclosure of Data and Processing on Our Behalf (Art. 28 GDPR)
We disclose your personal data only if:
- you have given your explicit consent (Art. 6 (1) (a) GDPR),
- the disclosure is necessary for the performance of a contract (Art. 6 (1) (b) GDPR),
- there is a legal obligation to do so (Art. 6 (1) (c) GDPR),
- the disclosure is necessary to safeguard legitimate interests (Art. 6 (1) (f) GDPR).
Where we engage service providers as processors, they are carefully selected and bound by a data processing agreement (DPA) pursuant to Art. 28 GDPR. Processors may process personal data exclusively in accordance with our instructions.
12. Validity and Amendments to This Privacy Policy
This privacy policy is currently valid and dated June 2026. As our website and offerings develop further, or as a result of changed statutory or regulatory requirements, it may become necessary to amend this privacy policy. The current version of the privacy policy can be accessed at any time on our website at www.beco-bermueller.de/en/data-security/ .