Privacy Policy

1. General information

Thank you for visiting our website www.bpanda.com. Protecting your personal data is important to us. That is why we treat your data confidentially and in accordance with the applicable data protection regulations. In this privacy policy, we inform you in accordance with Art. 12 and 13 of the General Data Protection Regulation (GDPR) about which personal data we process when you use our website, for what purposes, on which legal bases the processing is based and what rights you have. Personal data is any information relating to an identified or identifiable natural person.

Our website uses SSL or TLS encryption. This protects personal data and other confidential content during transmission.

2. Hosting and server log files

Our website is hosted by the following hosting provider:
ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany
When you visit our website, technical information that your browser transmits to our web server is processed automatically. This includes in particular:

• IP address
• Date and time of access
• Pages and files accessed
• Amount of data transferred
• Browser type and browser version
• Operating system used
• Referrer URL
• Technical status and error messages

This processing is carried out to provide our website, to ensure its technical operation, to analyze errors and to detect and defend against security attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website in a secure, stable and functional manner. The server log files are deleted once the technically defined retention period has expired, unless further storage is necessary to investigate security incidents or due to legal obligations. Insofar as ALL-INKL processes personal data on our behalf, this is done on the basis of a data processing agreement in accordance with Art. 28 GDPR.

3. Cookies and similar technologies

Our website uses cookies and similar technologies. These include, for example, local storage, tracking pixels and scripts. Cookies are small data records that are stored on your device and may contain certain information. We distinguish between technically necessary technologies and technologies that require consent.

Technically necessary technologies

Technically necessary technologies are required to provide basic functions of our website, to store security settings or to take your privacy settings into account. Insofar as storing information on your device or accessing information stored on your device is strictly necessary, this is done on the basis of Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The subsequent processing of personal data is carried out on the basis of Art. 6(1)(b), (c) or (f) GDPR, depending on the respective purpose.

Technologies requiring consent

For technologies used in particular to analyze user behavior, to measure the success of advertising campaigns or for personalized advertising, we always obtain your prior consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

Consent management with Borlabs Cookie

We use Borlabs Cookie to obtain, manage and document your consent to the use of cookies and similar technologies. Borlabs Cookie runs locally on our website. Information about your consent decisions is stored on your device or in our website environment. This information may include in particular:

• Consents given and refused
• Time or validity of the consent
• Version of the consent settings
• Randomly generated identifier
• Technical information for assigning the consent

The processing serves to take your privacy settings into account and to fulfill our legal obligations to provide evidence. The legal basis for documenting the necessary personal data is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. The technically necessary storage of the settings is carried out in accordance with Section 25(2) TDDDG. Strictly necessary cookies cannot be deactivated via the cookie banner on this website. However, you can manage and deactivate these cookies in your browser settings at any time.

4. Third-party providers

To provide our services and improve them continuously, we use the services of various third-party providers, which may also process personal data. For example, we use tracking technologies on our website to measure and analyze our website and to continuously improve our content. To protect our users and partners, we can also detect and defend against fraud and security risks.

4.1. Google Analytics 4

We use Google Analytics 4, a web analytics service provided by:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4, Ireland

Google Analytics enables us to statistically analyze the use of our website and to improve our online offering. The following information in particular may be processed:

• Pages accessed
• Duration of use and interactions
• Technical device and browser information
• Approximate geographic location information
• Online identifiers
• Events and conversion data
• Information about the source of website visits

Google Analytics 4 uses IP addresses, among other things, to derive geographic information. According to Google, complete IP addresses are not permanently logged or stored by Google Analytics 4. The processing serves to analyze and improve our website and to evaluate our online marketing activities. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Google may also process data outside the European Union. We explain the requirements for such transfers in the section “Data transfers to third countries”. For more information, see https://policies.google.com/privacy.

4.2. Google Ads

We use Google Ads, an advertising service provided by Google Ireland Limited. Google Ads allows us to place advertisements in Google Search and other Google advertising services. Information about interactions with advertisements may be processed in this context. This includes in particular:

• IP address
• Device and browser information
• Advertising and cookie identifiers
• Web pages accessed
• Interactions with ads
• Information about advertising campaigns
• Conversion events

Insofar as we use Google Ads for remarketing, information about previous visits to our website may be used to show you interest-based advertising. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. For more information, see https://policies.google.com/privacy.

4.3. Google Ads Conversion Tracking

We use Google Ads Conversion Tracking to measure the effectiveness of our advertising campaigns. This allows us to see whether users take certain actions on our website after clicking on or viewing an advertisement. These may include in particular:

• Submitting a contact form
• Signing up for a free Bpanda trial account
• Requesting product information
• Other defined conversion events

Technical usage information, advertising identifiers, timestamps and information about the respective conversion may be processed in this context. The processing serves to statistically measure and optimize the success of our advertising activities. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

4.4. Google Ads Enhanced Conversions

To improve conversion measurement, we use the Enhanced Conversions feature of Google Ads. This feature allows conversion events to be attributed more accurately using additional contact data that you have provided. Depending on the respective input and technical configuration, the following data in particular may be processed:

• Email address
• First and last name
• Phone number
• Other suitable contact data

Before being transmitted to Google, this data is processed using a cryptographic hashing method, in particular SHA-256. Hashing converts the data into a standardized string of characters. However, this does not constitute complete anonymization. Google may compare the transmitted hash values with corresponding data from Google user accounts in order to attribute conversion events. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

4.5. Google Tag Manager

We use Google Tag Manager, a service provided by Google Ireland Limited. Google Tag Manager allows us to centrally manage and technically integrate various website tags. The service is used in particular to control analytics and marketing technologies on our website. When it is used, technical information, in particular the IP address, may be transmitted to Google. The technologies integrated via Google Tag Manager are activated in accordance with the applicable data protection requirements. Where consent is required, the relevant services are only loaded after you have given your prior consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

4.6. Google reCAPTCHA

We use Google reCAPTCHA to protect our website against spam, abusive entries and automated access. The provider is Google Ireland Limited. reCAPTCHA uses various technical information to analyze whether an entry is made by a human or by an automated system. The following information in particular may be processed:

• IP address
• Browser and device information
• Operating system
• Referrer URL
• Time of access
• Mouse movements and interactions

The processing serves the security of our website and protection against misuse. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. For more information, see https://policies.google.com/privacy.

4.7. Google Image CDN

Insofar as we provide images or other media content via Google Image CDN, your browser may establish a connection to Google servers. In particular, your IP address, technical browser information and information about the requested files may be transmitted. The processing serves to provide media content quickly and reliably. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. For more information, see https://policies.google.com/privacy.

4.8. Web analytics with Contentsquare (CSQ)

We use Contentsquare, a platform for analyzing and improving the digital user experience. Contentsquare enables us to analyze the use of our website, identify technical issues and improve the usability of our online services. The following information in particular may be processed:

• Pages accessed
• Click and scroll behavior
• Mouse movements
• Interactions with website elements
• Screen resolution
• Browser and device information
• Technical session information
• Pseudonymous user identifiers
• Information about navigation paths

Depending on the features used, heat maps, session analyses and similar reports may be created. Insofar as session recordings are used, they serve to better understand how our website is used and to identify possible usability issues. We make sure that confidential input fields and sensitive content are not recorded without protection. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. For more information, see https://contentsquare.com/privacy-center/.

4.9. OpenAI Ads

We use advertising services provided by the OpenAI group of companies (“OpenAI”) to promote our products and services within ChatGPT and, where applicable, other OpenAI advertising services. The ads are delivered by OpenAI in accordance with its applicable privacy policies. As part of our advertising activities, we may receive aggregated statistical information about the reach and effectiveness of our ads. Insofar as we are only provided with anonymized or aggregated information that does not allow conclusions to be drawn about individual persons, we do not process any personal data in this respect. If you reach our website via an advertisement, the corresponding provisions of this privacy policy apply to the analytics and tracking technologies used there. For more information, see https://openai.com/policies/privacy-policy/.

4.10. HubSpot

We use HubSpot, a software platform for managing customer contacts and carrying out marketing and communication activities. For this purpose, we use services provided by the HubSpot group of companies. HubSpot supports us in particular with:

• Managing prospect and customer contacts
• Handling contact requests
• Analyzing landing pages
• Carrying out marketing activities
• Sending newsletters
• Evaluating communication and marketing activities

The following personal data in particular may be processed:

• Name and business contact details
• Company affiliation
• Content of communications
• Information about contact requests
• Technical usage data
• Interactions with marketing content

Insofar as HubSpot uses cookies or similar technologies to analyze user behavior, this is done exclusively with your prior consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Insofar as the processing of your personal data in connection with the use of HubSpot is necessary to manage and maintain customer and prospect relationships, to handle business inquiries and to organize and document our business communication, it is based on our legitimate interest in accordance with Art. 6(1)(f) GDPR.

Our legitimate interest lies in particular in managing existing business relationships efficiently, handling business inquiries in a structured manner, ensuring communication with customers and prospects, and organizing our internal sales and communication processes in an economically and organizationally efficient way. The processing is limited to the personal data necessary to achieve the purposes mentioned above. When balancing interests, we take into account in particular the type and scope of the data processed, the business context of the respective contact and your reasonable expectations regarding the use of your data. We assume that our legitimate interests do not override the interests or fundamental rights and freedoms of the data subjects, provided that the processing remains limited to customary business contact management and communication and that no further profiling or behavioral analysis requiring consent takes place.

Insofar as the processing is necessary to take steps at your request prior to entering into a contract or to perform a contract concluded with you, it is based on Art. 6(1)(b) GDPR. Insofar as HubSpot processes personal data on our behalf, this is done on the basis of an agreement in accordance with Art. 28 GDPR.

Insofar as we use HubSpot to send marketing communications that require consent, for tracking or to analyze your user behavior using non-essential cookies or similar technologies, the corresponding processing takes place exclusively with your prior consent in accordance with Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, where applicable.

In accordance with Art. 21(1) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR. Where data is processed for direct marketing purposes, you have the right to object at any time and without giving reasons in accordance with Art. 21(2) GDPR. For more information, see https://legal.hubspot.com/privacy-policy.

4.11. Salesforce CRM

We use Salesforce as a customer relationship management system to manage business contacts and to support our customers and prospects. The provider is the Salesforce group of companies. The following information in particular may be processed:

• First and last name
• Business contact details
• Company affiliation
• Information about business relationships
• Communication history
• Information about customer inquiries

The processing is carried out to organize and maintain our business relationships and to take contractual and pre-contractual measures. The legal basis is Art. 6(1)(b) GDPR. Insofar as Salesforce processes personal data on our behalf, this is done on the basis of an agreement in accordance with Art. 28 GDPR. For more information, see https://www.salesforce.com/company/privacy/.

5. Social Plugins

We use social plugins from various social network providers. Social plugins make it possible to share website content via social networks. On this website, you will find social plugins from various internet services. The individual plugins are explained on the corresponding detail page, together with examples of their use and integration.

5.1. Meta Pixel

We use the Meta Pixel, a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The Meta Pixel allows us to analyze the effectiveness of our advertisements on Meta platforms and to deliver interest-based advertising. The following data in particular may be processed:

• IP address
• Browser and device information
• Pages accessed
• Interactions with our website
• Cookie and advertising identifiers
• Information about conversion events

Under certain conditions, Meta may link the transmitted information to existing user accounts. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. For more information, see https://www.facebook.com/privacy/policy/.

5.2. LinkedIn Insight Tag

We use the LinkedIn Insight Tag, a service provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. This service allows us to evaluate the effectiveness of our LinkedIn advertisements and to deliver interest-based advertising. The following information in particular may be processed:

• IP address
• Device and browser information
• Pages accessed
• Interactions with advertisements
• Cookie identifiers
• Conversion events

LinkedIn may link this information to existing LinkedIn user accounts. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. For more information, see https://www.linkedin.com/legal/privacy-policy.

5.3. Google DoubleClick and remarketing

We use features of the Google advertising network, in particular to deliver interest-based advertising and measure its success. Cookies and similar technologies may be used to process information about the use of our website and interactions with advertisements. The processing serves to deliver advertisements based on needs and to analyze their effectiveness. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

6. Social media

We maintain online presences on social networks in order to communicate with the users active there and to provide information about us. However, when you visit our website, no direct connection is established between your browser and the servers of the respective social networks. Data is only forwarded after you have consented to the data transfer by clicking in the privacy settings. This tool does not automatically transfer user data to the operators of these platforms.

For a detailed description of the respective types of processing and the options to object, please refer to the privacy policies and information provided by the operators of the respective networks.

6.1. LinkedIn

Our website uses the “share” feature of the LinkedIn network. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. When you click the LinkedIn button, you are redirected to your user account in a separate browser window, provided you are logged in to your LinkedIn account. The plug-in establishes a direct connection between your browser and the LinkedIn server. LinkedIn thereby receives the information that you have visited our website with your IP address. LinkedIn can also link your visit to our website to you and your user account. Please note that we have no knowledge of the content of the transmitted (personal) data or of its use by LinkedIn. You can find more information on this in LinkedIn’s privacy policy.

6.2. Facebook (fan page)

We operate a so-called “fan page” on Facebook to provide information about the activities of MID GmbH. With it, we want to give prospective customers, customers and job applicants an impression of our company culture and the topics we work on. This is a service provided by Facebook Ireland Ltd (hereinafter “Facebook”), 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

In accordance with Art. 26 GDPR, we are jointly responsible with Facebook for operating our Facebook fan page. To this end, we have set out in an agreement with Facebook who fulfills which data protection obligations. This agreement can be accessed [here](LINK WIE IM DEUTSCHEN). According to this agreement, Facebook is primarily responsible for providing data subjects with information about the joint processing and for enabling them to exercise their data protection rights. Regardless of this, we hereby inform you about your visit to our fan page.

If you are a Facebook user, Facebook collects the data described in the Facebook data policy. This includes:

• Registration data, such as user name, password, email address
• Profile information, such as first and last name, phone number, picture
• Log file information, such as web request, IP address, browser type, landing pages, pages accessed
• Device ID
• Metadata, such as hashtags, geotags, comments

If you are not a Facebook user, cookies with identifiers (small text files) may nevertheless be stored in your browser, which enable your user behavior to be tracked. As a rule, Facebook also processes user data for market research and advertising purposes. Based on user behavior (including when visiting our social media pages), complex user profiles are created that Facebook can use to show visitors personalized advertisements on and off Facebook. You can also find more information on this in the respective data policy.

Using statistics provided by Facebook, we could analyze the use of our Facebook fan page. This would allow us to continuously improve our offering on Facebook. For this purpose, Facebook would place our fan page cookie on your device and collect so-called “Insights data” about the use of our fan page:

• Information about your visit to our Facebook fan page (your IP address, last website visited, file name, URL)
• Information about your Facebook interactions with our content (“likes”)
• Your comments, if any, together with a timestamp

However, we do not make use of this.

It is not possible to identify you at any time during your visit to our fan page using the Insights function and the statistics it provides. As the operator, we do not make any decisions regarding the processing of data or regarding any further information resulting from Art. 13 GDPR, such as the storage period of cookies on users’ devices. Primary responsibility for the processing of the data lies with Facebook.

In connection with Facebook, your data may be transferred to Facebook Inc. (USA). Data processing may therefore take place outside the EU or EEA. With regard to Facebook Inc., an adequate level of data protection can therefore not be assumed due to the processing in the USA. There is a risk that authorities may access the data for security and surveillance purposes without you being informed or being able to take legal action. We have no influence on whether and to what extent Facebook processes your data for its own purposes or links it to other user profiles of yours.

This fan page is operated on the basis of our legitimate interests in accordance with Art. 6(1)(f) GDPR in offering up-to-date and supportive ways to inform and interact with our users and visitors. If you wish to object to the embedding, we recommend that you no longer use our fan page in future. The transfer to a third country is based on Art. 49(1)(a) GDPR.

You can find information on how to contact Facebook, on the settings for advertisements and on the data policy here (im Deutschen fehlt der Link, siehe Korrekturen DE). You can find more information about our [joint controllership with Facebook](LINK WIE IM DEUTSCHEN) here.

6.4. YouTube

Videos from the YouTube platform may be embedded on our website. YouTube is a service of the Google group of companies. When an embedded YouTube video is loaded, personal data may be transmitted to Google. This includes in particular:

• IP address
• Device and browser information
• Website accessed
• Date and time of access
• Information about video usage

If you are logged in to your Google account, Google may link the processing to your user account. We only load YouTube content that requires consent after you have given your prior consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. For more information, see https://policies.google.com/privacy.

7. Newsletter

You can subscribe to our newsletter on our website. For this purpose, we process in particular your email address and, where applicable, other contact details you provide voluntarily. The processing is carried out for the purpose of sending information about our products, services and company activities. The legal basis is Art. 6(1)(a) GDPR. To document your consent, we may log your subscription and its confirmation. We use HubSpot to send the newsletter. Insofar as we evaluate opening and click behavior on a personal basis and consent is required for this, this evaluation is only carried out with your corresponding consent. You will find an unsubscribe link at the end of every newsletter.

8. Contacting us by email or contact form

If you contact us by email or via a contact form, we process the data you provide in order to handle your request. This includes in particular:

• First and last name
• Company name
• Email address
• Content of your message
• Other voluntary information

Insofar as your request serves to take steps prior to entering into a contract or to perform a contract, the processing is carried out in accordance with Art. 6(1)(b) GDPR.

9. Free Bpanda trial account

You can sign up for a free Bpanda trial account on our website. For this purpose, we process in particular:

• First name
• Last name
• Company
• Email address
• Registration and access data
• Data you provide while using the trial account

The processing is carried out to set up, provide and manage the trial account. The legal basis is Art. 6(1)(b) GDPR. The free trial account is generally limited to 30 days. If no permanent business relationship is established afterwards, the data stored for the trial account is deleted in accordance with our deletion policy, unless statutory retention obligations or other lawful reasons for storage apply.

10. Data transfers to third countries

When using certain service providers, personal data may be transferred to countries outside the European Union or the European Economic Area. Such transfers are carried out in compliance with the requirements of Art. 44 et seq. GDPR. Where an adequacy decision of the European Commission in accordance with Art. 45 GDPR exists for the third country concerned, the transfer may be based on this decision. For data transfers to the USA, the EU-U.S. Data Privacy Framework may apply in particular, provided that the respective recipient is certified accordingly and the processing in question falls within the scope of the adequacy decision. Where no such adequacy decision exists, appropriate safeguards may be used, in particular standard data protection clauses in accordance with Art. 46(2)(c) GDPR. Where necessary, supplementary protective measures are taken into account.

11. Your rights as a data subject

In connection with the processing of your personal data, you have the following rights:

• Right of access in accordance with Art. 15 GDPR
  You have the right to request information as to whether and which personal data we process about you.
• Right to rectification in accordance with Art. 16 GDPR
  You can request the correction of inaccurate personal data or the completion of incomplete personal data.
• Right to erasure in accordance with Art. 17 GDPR
  You can request the erasure of your personal data, subject to the statutory requirements.
• Right to restriction of processing in accordance with Art. 18 GDPR
  You can request the restriction of the processing of your personal data, subject to the statutory requirements.
• Right to data portability in accordance with Art. 20 GDPR
  You can request to receive your personal data in a structured, commonly used and machine-readable format, subject to the statutory requirements.
• Right to withdraw consent in accordance with Art. 7(3) GDPR
  You can withdraw any consent you have given at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.
• Right to object in accordance with Art. 21 GDPR
  Insofar as we process your personal data on the basis of Art. 6(1)(e) or (f) GDPR, you can object to the processing at any time on grounds relating to your particular situation. If your personal data is processed for direct marketing purposes, you can object to this processing at any time.
• Right to lodge a complaint in accordance with Art. 77 GDPR
  You have the right to lodge a complaint with a data protection supervisory authority.

The data protection supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (Bavarian State Office for Data Protection Supervision)
Promenade 18
91522 Ansbach
Germany

www.lda.bayern.de

12. Controller and data protection officer

The controller within the meaning of Art. 4(7) GDPR is:

MID GmbH
Data Protection Officer
Kressengartenstraße 10
90402 Nuremberg
Germany

If you have any questions about the processing of your personal data or would like to exercise your data protection rights, you can contact our data protection officer.

Email: datenschutzbeauftragter@mid.de

13. Final provisions

We reserve the right to amend this privacy policy if this becomes necessary due to changes in legislation, technical developments or changes to our services. The version published on our website at any given time applies.

Last updated: November 2026