Skip to content
FBZ
Legal

Privacy Policy

Last updated: 8 October 2026

1. Controller

The controller within the meaning of the GDPR and other national data protection laws of the member states as well as other data protection regulations is:

BBA GmbH
Silberberger Chaussee 14
15526 Bad Saarow, Germany
Phone: +49 33631 58374
Email: info@bba-badsaarow.de

Managing Director: Dr.-Ing. Jörn Budde

2. Data Protection Officer

The appointment of a data protection officer is not mandatory for us under § 38 para. 1 BDSG because fewer than 20 persons in our company are continuously involved in the automated processing of personal data. For privacy questions, please contact the address above.

3. Hosting via Vercel

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel.

When you access our website, Vercel automatically processes connection data and records it in server log files. These include, in particular:

  • IP address
  • date and time of access
  • requested URL and HTTP status code
  • user agent (browser type and version, operating system)
  • referrer URL

These data serve to ensure trouble-free operation, threat detection, and technical optimization; for counting short-link requests, see section 7. No merging with other data sources takes place.

The product video on the home page is only loaded when you click “Watch video”. It is then retrieved from the Vercel Blob storage service; in the process, your IP address is transmitted to Vercel.

Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in secure and efficient website operation).
Retention: in the logs accessible to us, these data can be viewed for no more than one day. Where Vercel processes operational and metadata for its own purposes (e.g. security, abuse prevention, billing), Vercel is itself the controller; details and retention periods: vercel.com/legal/privacy-policy.

4. Fonts (self-hosted)

This website uses the typefaces “Clash Display" and “Satoshi", which are embedded locally on our server. There is no connection to external font-CDN services such as Google Fonts or Fontshare. No data is transmitted to third parties when the website is loaded.

5. Cookies, local storage and consent

This website sets no cookies. In your browser's local storage (localStorage) we store only your decision in the consent banner (selection, time and banner version) for 12 months. This is necessary so that we respect your choice and do not ask you again on every page view (§ 25 para. 2 no. 2 TDDDG). In addition, your browser uses its usual cache.

Statistics and performance measurement (section 6) only take place if you expressly consent in the banner (§ 25 para. 1 TDDDG, Art. 6 para. 1 lit. a GDPR). Without consent, the related scripts are not loaded. Consent is voluntary; the website can be used without restriction without it. You can withdraw or change your consent at any time with effect for the future via “Privacy settings” in the page footer (Art. 7 para. 3 GDPR).

6. Statistics and performance (only with consent)

Statistics – Vercel Web Analytics. With your consent, Vercel records for each page view the time, the page visited (we remove URL parameters before transmission), the referring page (referrer), approximate location (country, region, city), operating system and browser with version, and device type. To distinguish visits, Vercel creates a hash value from characteristics of the request, which is discarded after 24 hours. If you have consented to statistics, we also record that an inquiry was sent via the inquiry form (section 8) (event “anfrage_gesendet”, without the content of the inquiry and without your details). No cookies are set and no user profiles are created. Purpose: understanding which content is used and how many inquiries the website generates, and improving the website.

Performance – Vercel Speed Insights. With your consent, a script measures the loading-time metrics (Web Vitals) of the page visited and transmits them to Vercel together with the page URL (without parameters), page type (route), the page element relevant to the measurement, network type, browser, operating system, device type, country and time of receipt. Purpose: detecting and fixing loading-time problems.

The recipient in each case is Vercel Inc. as a processor, including its sub-processors (section 3; where Vercel processes data for its own purposes, Vercel is itself the controller); for the transfer to the USA, see section 10. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG). Retention: in our Vercel account, statistics data can be evaluated for up to 12 months and performance measurements for up to 7 days; beyond that, Vercel's retention periods apply (vercel.com/legal/privacy-policy).

Beyond this, the website uses no analytics or tracking services (such as Google Analytics, Matomo, Facebook Pixel or comparable tools); for the consent-free counting of short-link requests, see section 7.

7. Short links and QR codes

On printed material (e.g. trade fair flyers) we use QR codes and short addresses of the form fb-zent.com/m/…. When you open one, you are redirected to this website immediately. To measure how often our promotional material is used, we count these requests.

No cookies or similar technologies are used and no information is stored on your device. We only evaluate information that is transmitted with every request anyway. For the counting, your IP address is neither stored by us nor transmitted to Convex; for processing by our host, see section 3. On Vercel's servers, a check value (hash) that changes daily is derived immediately from the shortened IP address, the browser identifier (user agent) and the date; it is created with a secret key and cannot be reversed without it. It serves solely to recognize repeated requests on the same day. The short link requested (codes not assigned by us only as “unknown”), the date and hour, the device class (smartphone, tablet, desktop, unknown), whether the request is automated (bot), and this check value are transmitted to Convex. Convex stores daily totals per short link from this; it stores the check value only together with the short link and the day (with a creation timestamp) in order to recognize repeated requests. It is deleted after around 27 hours, at the latest after two days; after that, only anonymous totals remain. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we treat it as an objection (Art. 21 para. 5 GDPR) and do not count the request; the redirect still works.

The data is stored by Convex, Inc., 444 DeHaro Street, Suite 218, San Francisco, CA 94107, USA, as a processor on servers in the EU (Ireland). The legal basis is our legitimate interest in measuring the reach of our promotional material (Art. 6 (1) (f) GDPR).

8. Contacting us (inquiry form, email, phone, fax)

Inquiry form. You can request a sample or a quote using the form in the contact section of our home page. Name and email address are required; company, phone, project/location, approximate linear meters, message and how you found us are optional. In addition, the language of the page and the time between loading the page and sending the form (for spam protection) are transmitted. The form data is received by a server function of our host Vercel in Frankfurt am Main (section 3), which checks the details and forwards them by email to our email mailbox. The server function does not store the form content and does not write it to logs. We do not use a database or CRM system for this.

The legal basis for handling your form inquiry is Art. 6 para. 1 lit. b GDPR (pre-contractual measures at your request). We process the optional information on how you found us on the basis of our legitimate interest in understanding how interested parties find us (Art. 6 para. 1 lit. f GDPR); it is not required to handle your inquiry. Spam protection is based on our legitimate interest in operating the form without abuse (Art. 6 para. 1 lit. f GDPR).

If you contact us by email, phone, fax or via the “Request a quote" link, the data you provide (e.g. name, email address, message, and project information such as required linear meters) will be stored by us for processing your inquiry and for possible follow-up questions. Our email mailboxes (including the mailbox to which the inquiry form forwards) are operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, as a processor.

Legal basis: Art. 6 para. 1 lit. b GDPR (initiation of a contractual relationship) or Art. 6 para. 1 lit. f GDPR (legitimate interest in answering inquiries).
Retention: until the processing of your inquiry is complete; if a contract is concluded, for the duration of the contractual relationship. If no contract is concluded, we delete inquiries submitted via the inquiry form no later than 6 months after their processing is complete. Mandatory statutory retention obligations under German commercial and tax law (up to 10 years pursuant to § 257 HGB, § 147 AO) remain unaffected.

Providing your data is neither required by law nor by contract. Without the technically transmitted connection data (section 3), the website cannot be delivered; without your name and email address in the form or the information in your email, we cannot process your inquiry. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

9. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the lock symbol in your browser's address bar and by the address starting with “https://".

10. Transfer to third countries

A transfer of personal data to the USA may take place in the context of hosting by Vercel (including the receipt of form data by the server function in Frankfurt am Main, section 8), statistics and performance measurement by Vercel (only with consent, section 6) and counting short-link requests by Convex (data stored in the EU, see section 7). According to its own statements, Vercel is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR). With Convex, EU Standard Contractual Clauses pursuant to Art. 46 para. 2 lit. c GDPR (Implementing Decision (EU) 2021/914, Module 2) have been agreed. You can find the text of the Standard Contractual Clauses at eur-lex.europa.eu/eli/dec_impl/2021/914/oj; a copy of the agreed version is available on request at info@bba-badsaarow.de.

11. Your rights as a data subject

You have the following rights with regard to personal data concerning you:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent with effect for the future (Art. 7 para. 3 GDPR), e.g. via “Privacy settings” in the page footer

For the short-link counting (section 7), we are generally unable to identify you due to the lack of identifying features; in that case, the rights under Art. 15 to 20 GDPR do not apply pursuant to Art. 11 para. 2 GDPR, unless you provide additional information enabling your identification.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent supervisory authority for BBA GmbH is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow, Germany
www.lda.brandenburg.de

12. Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 para. 1 lit. f GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise or defense of legal claims. Please send your objection to info@bba-badsaarow.de.

13. Currency of this privacy policy

This privacy policy is currently valid and was last updated on 8 October 2026. Due to the further development of our website or changing legal or regulatory requirements, it may become necessary to update this privacy policy.