Privacy policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data on this website (bndr.company, sales-architecture.com and associated subdomains). The controller within the meaning of the GDPR is:

bndr GmbH Edelbergstrasse 52 76189 Karlsruhe, Germany Managing director: Felix Bender Email: hello@bndr.company

Each time this website is accessed, your browser transmits technical access data, which is processed in so-called server log files:

• page requested
• date and time of access
• volume of data transferred
• referrer (source page)
• browser and operating system used
• IP address (shortened/anonymised)

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in providing a stable, secure and functional website. The connection is always encrypted via TLS/SSL (indicated by “https://” and the padlock symbol in your browser).

For hosting, database, authentication and server-side functions of this website we use the Lovable platform (Lovable AB, Stockholm, Sweden). The underlying infrastructure is operated via Supabase (Supabase Inc.) in an EU region. Delivery, DNS and protection against attacks are provided by the content delivery network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

All data collected via the website is processed on these providers' servers. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the reliable operation of the website). Data processing agreements pursuant to Art. 28 GDPR are in place with these providers. For data transfers to the USA, Cloudflare and Supabase Inc. have committed to the EU-US Data Privacy Framework; in addition we rely on standard contractual clauses.

Further information: https://lovable.dev/privacy, https://supabase.com/privacy, https://www.cloudflare.com/privacypolicy/

This website uses only technically necessary cookies and local storage (localStorage), in particular to maintain your login to the protected area. The legal basis is Section 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) (f) GDPR. A cookie banner is not required because no marketing or tracking cookies are set.

We record anonymised usage events (e.g. page views, clicks on key elements) in our own database in order to improve the website's content. No third-party trackers, advertising cookies or cross-site tracking are used. IP addresses are not stored. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in designing our offering to meet demand).

6.1 Contact form and email: If you contact us via the contact form or by email, we process the data you provide (first and last name, email, phone number where applicable, topic selection, message) in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR (initiation or performance of a contract) or Art. 6 (1) (f) GDPR (legitimate interest in answering your enquiry). The data is deleted as soon as it is no longer required for that purpose and no statutory retention obligations (e.g. German Commercial Code, Fiscal Code) apply.

6.2 HubSpot CRM: We use the CRM system of HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland, to manage enquiries and prospects. Details submitted via the contact form (name, email, phone, topic, message) are automatically stored in HubSpot as a contact and note. The legal basis is Art. 6 (1) (b) and (f) GDPR. A data processing agreement is in place with HubSpot; transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses. Details: https://legal.hubspot.com/privacy-policy

6.3 Appointment booking (HubSpot Meetings): We use HubSpot Meetings for online appointment booking. When booking, your first and last name, email address and any further information you voluntarily provide are processed in order to organise the appointment. The legal basis is Art. 6 (1) (b) GDPR. The notes under 6.2 apply.

6.4 Contact via WhatsApp Business: On individual pages we offer direct contact via WhatsApp (WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). If you use this channel, we process the mobile number you transmit, the name stored in your WhatsApp profile and the content of your message in order to answer your enquiry. The legal basis is Art. 6 (1) (b) or (f) GDPR. Please note: WhatsApp processes metadata independently and may transfer data to the USA. Further information: https://www.whatsapp.com/legal/privacy-policy-eea

You can create a user account to access protected content. For this we process your email address, a password you choose (stored only as a cryptographic hash) and optional profile details. The legal basis is Art. 6 (1) (b) GDPR. Authentication takes place within our backend infrastructure (see section 3). You can have your account deleted at any time by sending a message to hello@bndr.company.

To deliver system and service-related emails (e.g. confirmations, password resets, replies to enquiries) we send emails via our own servers. The legal basis is Art. 6 (1) (b) or (f) GDPR. Where legally required, every email contains an unsubscribe link.

Personal data is only transferred to the processors named in this policy (hosting, CRM, communication). Transfers to third countries (in particular the USA) take place exclusively on the basis of appropriate safeguards under Art. 44 et seq. GDPR (EU-US Data Privacy Framework, standard contractual clauses).

We store personal data only for as long as required for the purposes stated, or as long as statutory retention periods require (in particular Section 257 German Commercial Code, Section 147 Fiscal Code: up to 10 years). Afterwards the data is deleted or its processing is restricted.

Under the GDPR you have the following rights:

• access to the data processed (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on legitimate interests (Art. 21 GDPR)
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
• complaint to a supervisory authority (Art. 77 GDPR), e.g. the State Commissioner for Data Protection and Freedom of Information of Baden-Wuerttemberg, Koenigstrasse 10a, 70173 Stuttgart, Germany

An informal message to hello@bndr.company is sufficient to exercise your rights.

You may object to the processing of your personal data for direct marketing purposes at any time without giving reasons. Following your objection, the data will no longer be processed for that purpose.

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

We update this privacy policy whenever the legal framework or our processing activities change. The current version is always available on this page.