Privacy Policy

Controller

BL GmbH
Dantestraße 19, 70197 Stuttgart
Represented by: Ivan Lukenda

Phone: 07152 3597020
Email: info@teile-universum.de

Data protection at a glance

We take the protection of your personal data very seriously. This privacy policy informs you about which data we collect when you visit this website and what we use it for. Personal data is any data that can be used to identify you personally.

This website generally works without consent-requiring cookies. Optional statistics, marketing and map services are loaded exclusively after your explicit consent; Google Analytics and the Meta Pixel additionally require a configured production ID. Your selection is stored exclusively locally in your browser (localStorage) and can be changed or withdrawn at any time with effect for the future via the “Privacy settings” button in the footer.

Storage period

Unless a more specific storage period is stated within this privacy policy, the duration of storage depends on the respective purpose of processing: your personal data will be deleted once the purpose for which it was collected no longer applies, unless statutory retention obligations (e.g. commercial or tax law periods) or a legitimate interest in abuse prevention require otherwise.

If you assert a justified request for deletion or withdraw consent to data processing, your data will be deleted unless we have other legally permissible reasons for continued storage; in the latter case, deletion takes place once these reasons no longer apply.

Legal bases for processing

Where you have consented to processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR or Section 25 (1) TDDDG, insofar as the consent covers the storage of information or access to information on your device. Consent can be withdrawn at any time.

Where your data is required to perform a contract or to carry out pre-contractual measures, we process it on the basis of Art. 6 (1) (b) GDPR. To comply with legal obligations, we process data on the basis of Art. 6 (1) (c) GDPR. In addition, we process data on the basis of our legitimate interest under Art. 6 (1) (f) GDPR in the secure and functional provision of this website, including protecting our contact form against automated abuse using Cloudflare Turnstile.

Hosting and delivery (Cloudflare Pages)

This website is hosted and delivered as a content delivery network via Cloudflare Pages, provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, and/or Cloudflare Germany GmbH. Processing the contact form additionally uses a same-origin Cloudflare Pages Function as a proxy and a separate Cloudflare Worker, hosted under a workers.dev subdomain, which forwards the request for further processing to the email delivery service Resend.

Cloudflare processes IP addresses and technical access and security data in particular in order to deliver content and protect against attacks. Cloudflare's technical logs do not intentionally record contact-form content. Processing is based on our legitimate interest in the secure, fast and reliable provision of our online offering (Art. 6 (1) (f) GDPR). Because Cloudflare operates a global network, data may be transferred to third countries, in particular the USA; where applicable, this is based on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. Cloudflare's privacy policy provides further information.

Technical log files

As part of hosting, Cloudflare automatically collects and stores technical information in so-called log files, which your browser transmits automatically. These are in particular the browser type and version, the operating system used, the referrer URL, the resource requested, the time of the request and the IP address. Contact-form content is not intentionally logged in the process.

This data is not merged with other data sources. Collection takes place on the basis of Art. 6 (1) (f) GDPR; we have a legitimate interest in the technically error-free presentation and the security of our website. The log files are stored only for the period required for security and error analysis.

Contact form, email and phone

If you send us enquiries via the contact form, by email, phone or WhatsApp, we process the data you provide there for the purpose of processing your enquiry and in case of follow-up questions.

The contact form may process the following details: name, optionally company, email address, optionally phone number, optionally details of a vehicle, chassis number (VIN) and/or part numbers, your message, the language you selected, and your confirmation of this privacy policy. To protect against automated abuse, we additionally process technical data, in particular a verification token from Cloudflare Turnstile as well as the IP address and further request metadata.

Technically, your input is received via a same-origin Cloudflare Pages Function and forwarded to a separate Cloudflare Worker hosted under workers.dev. This Worker checks the request for automated abuse using Cloudflare Turnstile and then hands it off for delivery via the HTTP API of the email delivery service Resend. Each contact-form submission generates two separate transactional emails: an internal notification to us and a confirmation email to the address you provided. Our emails are received and managed via our mailbox hosted with STRATO AG.

This data is processed on the basis of Art. 6 (1) (b) GDPR where your enquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of your enquiry and in protecting against automated abuse using Cloudflare Turnstile (Art. 6 (1) (f) GDPR). In connection with email delivery via Resend and processing by Cloudflare, data may be transferred to third countries, in particular the USA; where applicable, this is based on the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework. The data remains with us until the purpose of storage no longer applies or you request its deletion; mandatory statutory retention periods remain unaffected.

Consent management

To manage your consent to optional services (statistics, marketing and map display), we use our own, technically simple solution without any third-party provider. Your selection is stored exclusively locally in your browser (localStorage); no cookies are set and no data is transferred to third parties.

This storage is technically necessary in order to document and respect your privacy decision (Art. 6 (1) (c) or (f) GDPR, Section 25 (2) TDDDG). You can adjust or withdraw your selection at any time via the “Privacy settings” button in the footer.

Google Analytics 4

This website is prepared for the use of Google Analytics 4. Once a production measurement ID is configured, the service will be loaded exclusively after your explicit consent to the “Statistics” category. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses technologies to analyse user behaviour, including pages viewed, time spent and approximate origin; the IP address is processed in shortened form.

The sole legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. Google Analytics is not loaded without consent. Data may also be transferred to the USA, in particular on the basis of the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses. You can withdraw your consent at any time with effect for the future via the privacy settings in the footer.

Meta Pixel (Meta Ads)

This website is prepared for the use of the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Once a production pixel ID is configured, the service will be loaded exclusively after your explicit consent to the “Marketing” category. The pixel is used for reach and conversion measurement, assessing advertisements on Facebook and Instagram and, where applicable, creating audiences for interest-based advertising.

The sole legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. The Meta Pixel is not loaded without consent. Meta may associate collected data with an existing Meta account; transfers to the USA may be based on the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses. You can withdraw your consent at any time via the privacy settings.

Map display (OpenStreetMap)

On our contact page we embed a map from OpenStreetMap as an iframe. The provider is the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The iframe is only loaded once you expressly confirm this by clicking the button or by activating the “Maps” category in our privacy settings.

Only after this confirmation is a connection to OpenStreetMap servers established and your IP address transferred; without your consent no such transfer takes place. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. Further information can be found in the privacy policy of the OpenStreetMap Foundation.

WhatsApp

On our website we link the option to contact us via WhatsApp. No WhatsApp scripts are embedded in our website; an exchange of data with WhatsApp only takes place once you actively use the link and write to us via WhatsApp.

The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland (part of the Meta group). If you contact us via WhatsApp, the provider processes the communication data in accordance with its own privacy policy; data may also be transferred to the USA. The provision of this contact option is based on our legitimate interest in being easily reachable (Art. 6 (1) (f) GDPR) or on Art. 6 (1) (b) GDPR where the contact serves to initiate a contract. Please do not send us any particularly sensitive data via WhatsApp.

Fonts (locally hosted)

This website uses so-called web fonts for a uniform display of typefaces. The fonts used are loaded exclusively from our own server; there is no connection to third-party servers (in particular not to Google Fonts), and no personal data is transferred to third parties in the process.

Links to social networks

On our website we link to our profiles on Instagram, TikTok and Facebook. These are merely simple links without embedded scripts or plugins; data is only transferred to the network operators once you actively click one of these links and visit the respective platform.

The providers are Meta Platforms Ireland Limited (Instagram, Facebook) and TikTok Technology Limited, Ireland (TikTok). We have no influence over the data processing that takes place after you visit the respective platform; the privacy policy of the respective provider applies. Data may also be transferred to third countries (e.g. the USA).

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, such as enquiries you send to us, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser's address bar changes from “http://” to “https://” and by the lock symbol in your browser bar. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Your rights

Within the framework of the applicable statutory provisions, you have the following rights at any time with regard to your personal data:

• the right to information about the stored data, its origin, recipients and the purpose of processing (Art. 15 GDPR),
• the right to rectification of inaccurate data (Art. 16 GDPR),
• the right to erasure (Art. 17 GDPR) and to restriction of processing (Art. 18 GDPR),
• the right to data portability (Art. 20 GDPR),
• the right to object to processing where this is based on Art. 6 (1) (e) or (f) GDPR (Art. 21 GDPR),
• the right to withdraw consent given at any time with effect for the future (Art. 7 (3) GDPR),
• the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Competent supervisory authority

In the event of breaches of data protection law, you have the right to lodge a complaint with the competent supervisory authority. The competent authority is:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany (www.baden-wuerttemberg.datenschutz.de).

Objection to advertising emails

We hereby object to the use of contact data published within the framework of the legal notice obligation for sending unsolicited advertising and information materials. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example through spam emails.

This version is a translation provided for convenience. The German version prevails.