Privacy Policy for the Use of Our Websites

§ 1 Information on the Collection of Personal Data

Below, we provide information about the collection of personal data when you use our websites. Personal data refers to any data that can be linked to you personally, such as your name, address, email address, and user behavior.

The controller pursuant to Article 4(7) of the General Data Protection Regulation (GDPR) is the

BAYOONET Service GmbH & Co. KG
Europaplatz 5
D-64293 Darmstadt

represented by the management

Phone: +49 (0) 61 51 – 86 18 – 0
Email: [email protected]

(see our legal notice)

You can contact our Data Protection Officer at PRIVACY ONE GmbH, Lyoner Straße 15, 60528 Frankfurt am Main, at [email protected] or by mail, addressed to “Data Protection Officer.”

§ 2 Collection of Personal Data When Visiting Our Website

1. Server Log Files / Technical Access Data

When you use the website for informational purposes only—that is, if you do not register or otherwise provide us with information—we collect only the personal data that your browser transmits to our server. When you view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure or improve its stability and security:

  • IP address
  • Date and time of the request
  • Time Zone Difference from Greenwich Mean Time (GMT)
  • Content of the Request (specific page)
  • Access Status/HTTP Status Code
  • amount of data transferred in each instance
  • Website from which the request originates
  • Browser
  • Operating system and its user interface
  • Language and Version of the Browser Software

The legal basis is Article 6(1), sentence 1, subparagraph (f) of the GDPR.

2. Cookies

We use cookies on our website; that is, in addition to the data mentioned above, cookies are stored on your computer when you use our website. Cookies are small text files that are stored on your hard drive and associated with the browser you are using, and through which certain information is transmitted to the entity that sets the cookie (in this case, us). Cookies cannot run programs or transmit viruses to your computer. They serve to make the website more user-friendly and effective overall.

You can adjust your cookie settings yourself at any time. In most cases, you can restrict or prevent cookies from being set. You can also configure the settings so that cookies are automatically deleted when you close your browser. For more information, please contact the browser software provider.

You can also adjust your settings in the cookie banner on our website. Please note that you cannot restrict or prevent the use of technically necessary cookies. When using tools that transmit data to the tool provider, we obtain your consent via the cookie banner.

3. Consent Management Platform

On our website, we use the Cookiebot CMP consent management platform from Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, to obtain, manage, and document consent for cookies, similar technologies, and third-party services that require consent. To this end, Cookiebot stores and processes, in particular, information about your consent decision, the time of the decision, the selected categories or services, technical browser information, and a technical identifier to recognize your consent settings. The consent management tool is used to obtain and document consent required by law. The legal basis is Article 6(1)(c) of the GDPR, or alternatively Article 6(1)(f) of the GDPR. To the extent that the consent tool stores or reads technically necessary information on your device, this is done in accordance with § 25(2) of the TDDDG.

You give your consent to the use of cookies for analytics and/or marketing purposes by actively confirming their use in the cookie banner. You may revoke this consent at any time in the cookie banner, effective for the future, by deactivating the confirmation. Withdrawing your consent does not affect the lawfulness of the processing that took place up to that point. Of course, you can renew your consent at any time.

We use technically necessary cookies and similar technologies to the extent necessary to provide the website, transmit a message, ensure IT security, or store your consent settings. The legal bases are Section 25(2) of the TDDDG and Article 6(1), first sentence, subparagraph (f) of the GDPR; for the documentation of legally required consents, Article 6(1), first sentence, subparagraph (c) of the GDPR also applies.

We use cookies that are not technically necessary, as well as analytics, marketing, remarketing, and similar third-party services, only after obtaining your prior consent. The legal basis for this is Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect via the cookie settings.

4. Hosting, CDN, and Technical Deployment of the Website

We use Cloudflare services on our website. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare provides a content delivery network as well as security and performance features. This enables the content on our website to be delivered more quickly, reliably, and securely. At the same time, Cloudflare helps protect our website from unauthorized access, availability attacks, automated access, and other security risks.

When you visit our website, connection data may be processed via the Cloudflare network. This includes, in particular, your IP address, the date and time of access, the URL accessed, referrer information, browser and device information, technical HTTP headers, and security-related log data. This processing is necessary to technically deliver the website, optimize loading times, and ensure the security of the website.

The legal basis for the processing of personal data is Article 6(1), sentence 1, subparagraph (f) of the GDPR. Our legitimate interest lies in the secure, efficient, and reliable provision of our website, as well as in protection against cyberattacks, misuse, and disruptions. To the extent that Cloudflare processes technically necessary information on your device or requires access to information on your device for this purpose, this is done on the basis of Section 25(2)(2) of the TDDDG.

We cannot rule out the processing of personal data outside the European Union or the European Economic Area, particularly in Canada and the United States. We use Cloudflare on the basis of appropriate data protection safeguards, specifically a data processing agreement and, where necessary, appropriate safeguards for transfers to third countries.

For more information about Cloudflare’s data processing practices, please visit: https://www.cloudflare.com/privacypolicy/

5. Contact via email, contact form, and submission of documents

When you contact us via email or through one of our contact forms on this website, we will store the information you provide (name, phone number, email address, message) in order to answer your questions regarding existing contracts or to prepare a quote. The legal basis for this is Article 6(1)(b) of the GDPR.

If you send us a general inquiry, we process your data on the legal basis of Article 6(1), first sentence, letter f) of the GDPR. Our legitimate interest is to respond to your inquiry.

6. Compliance with statutory retention and documentation requirements

We are subject to various legal obligations, such as those under tax laws and the German Commercial Code, which require us to process your data to comply with the law. This data processing is based on legal requirements pursuant to Article 6(1), first sentence, letter c) of the GDPR.

7. Advertising via Email and Promotions for Existing Customers

You may also give us your consent to send you information and other offers via email for promotional purposes. You may revoke this consent at any time. The legal basis for this processing of personal data is Article 6(1), first sentence, letter a) of the GDPR. If we request your consent, you will receive a separate consent form that you may fill out voluntarily.

To the extent that you have provided us with your email address in connection with the purchase of goods, products, or services, or at the beginning of an existing customer relationship (existing customers), we will use this email address to send you promotional emails for our own similar products and services (Section 7(3) UWG, Article 6(1), sentence 1, subparagraph f) of the GDPR). We use the email address for advertising purposes only if you have not objected to such use. You may also object to this use at any time in the future without incurring any costs other than the transmission costs according to the standard rates. You can find our contact information in § 1 of this Privacy Policy.

8. Asserting, Exercising, and Defending Legal Claims

To the extent that we process personal data to assert, exercise, or defend legal claims, the legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in safeguarding and enforcing our rights, as well as in effectively defending our legal position.

9. Processing of Personal Data in the Hiring Process

If you apply for a position with us—whether through the contact form or by email—we will process the data you provide in connection with your application in order to assess your suitability for the position (or, if applicable, other open positions within our company) and to carry out the application process. The following categories of personal data are included: contact information (first and last name, address), communication details (phone number, cell phone number, fax number, email address, language of communication), personal data (date of birth, place of birth, nationality, marital status, gender), job-related and personal data (preferred work location and work hours, availability, desired salary, willingness to relocate and travel, work permit), qualification data (high school diploma, vocational training/college education, language skills, and professional abilities), data regarding assessment and evaluation in the application process, data regarding previous career history (resume, educational and employment certificates, proof of qualifications), application photo, and application history (consent to data storage). The legal basis is Art. 6(1), sentence 1, lit. b) of the GDPR in conjunction with Art. 88 of the GDPR and § 26 of the BDSG.

Personal data is processed in the applicant tracking system for the purpose of initiating employment contracts, specifically for the following purposes: matching job requirements with the applicant’s skills and qualifications, defending against legal claims, and communicating with the applicant.

We store your personal data for the purposes mentioned above. After the application process is complete, the data may also be processed for the duration of the retention period to assert, exercise, or defend legal claims. As a general rule, the data will be deleted six months after the application process is completed. If you have consented to storage beyond this period, the data will be deleted upon expiration of the period agreed upon with you.

For more information, please see our privacy policy regarding applicant management.

10. Data Processing on Behalf of Others, Service Providers, and Disclosure to Third Parties

In some cases, we use external service providers to process your data under a data processing agreement. We have carefully selected and engaged these providers; they are bound by our instructions and are regularly monitored to ensure they maintain the required technical and organizational measures. Consequently, data processors may only process your personal data in the manner we have explicitly instructed them to. The data processor must implement technical and organizational measures to ensure the secure processing of your data.

In addition, we may share your personal data with third parties if we offer contracts or similar services in collaboration with partners. You can obtain more detailed information about this when you provide your personal data or as part of the description of the offer.

If our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the implications of this in this Privacy Policy or in the description of the service. If we transfer personal data to third parties or processors located outside the European Economic Area, we ensure in advance that the recipient provides an adequate level of data protection. To this end, we either enter into EU Standard Contractual Clauses issued by the European Commission or ensure that the recipient is based in a country where an adequate level of data protection exists pursuant to an adequacy decision by the Commission (Art. 45 et seq. of the GDPR).

On July 10, 2023, the European Commission adopted a new adequacy decision for data transfers from the EU to certified data recipients in the U.S., known as the “EU-U.S. Data Privacy Framework” (EU-U.S. DPF). Under the GDPR, this decision guarantees that these certified U.S. companies maintain a level of data protection that is adequate according to GDPR standards. If an organization to which personal data is transferred is certified under the EU-U.S. Data Privacy Framework, personal data may once again be transferred from the EU to the U.S. without the need for further transfer mechanisms or additional measures.

§ 3 Duration of Storage

Your data will be processed for the first time as of the date it is collected, provided it is recorded by the system or you provide it to us. We will delete your personal data as soon as the purpose of processing no longer applies, all mutual claims have been settled, and there are no other legal retention obligations or legal grounds justifying storage. Data records containing personal data are sometimes stored for various purposes, as mentioned above. Different retention periods may apply depending on the purpose. If a purpose no longer applies, the data may no longer be processed for that purpose. If this data must remain available for another purpose, the data will no longer be used for the purpose that no longer applies and will be blocked. It will then only be available for the permitted purpose.

Personal data subject to the provisions of the German Commercial Code (Section 257 HGB), such as business letters, is destroyed or deleted after 6 years. Personal data subject to the provisions of the German Fiscal Code (§ 147 AO), such as payroll records and accounting documents, will be destroyed or deleted after 10 years. If your application is rejected, your application documents will be deleted no later than 6 months after the application process is completed. We delete data from prospective clients or data related to inquiries that do not pertain to an existing contractual relationship three months after receiving the inquiry if no contract is concluded or after your inquiry has been resolved.

§ 4 Tools

1. General Information About Google Services

On our website, we use the services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), which are described individually below. Google LLC and other Google companies may also be involved in the technical provision of these services.

If a Google service described below is used only with prior consent, it will not be loaded until you have given your consent via our consent management system. The legal basis for the subsequent processing of personal data is Article 6(1), first sentence, subparagraph (a) of the GDPR. To the extent that information is stored on or retrieved from your device, this is done on the basis of Section 25(1) of the TDDDG.

You may withdraw or change your consent at any time, effective for the future, through the cookie settings or our consent management system. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.

The processing of personal data by Google companies outside the European Union or the European Economic Area—in particular in the United States—cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework. To the extent that a transfer to a third country is not covered by an adequacy decision, it is carried out on the basis of the relevant safeguards under Art. 44 et seq. of the GDPR, in particular the European Commission’s Standard Contractual Clauses, to the extent that these have been agreed upon and are applicable.

The specific function of each service, the data processed in connection with it, the retention period, and the allocation of roles under data protection law are described in the individual sections below.

For more information about Google’s data processing, please see Google’s Privacy Policy at: https://policies.google.com/privacy?hl=de.

Google Tag Manager

We use Google Tag Manager on our website. Google Tag Manager is a tag management system that allows website tags to be centrally managed and deployed. In particular, Google Tag Manager enables the technical integration and control of analytics, marketing, and other third-party services.

When Google Tag Manager is accessed, technical connection data—specifically the IP address, browser and device information, the URL accessed, referrer information, as well as the time and technical details of the request—may be transmitted to Google. Furthermore, we have entered into a data processing agreement with Google.

Google Tag Manager is not loaded on our website until you have given your consent through our consent management system. If any analytics, marketing, or other services requiring consent are integrated via Google Tag Manager, these services will also not be activated until you have provided the appropriate consent.

Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google, on our website. Google Analytics 4 enables us to statistically analyze the use of our website, measure the reach of our online offerings, and further develop our website to make it more user-friendly, secure, and tailored to user needs.

Google Analytics 4 will not be used on our website until you have given your consent through our consent management system. Without your consent, no Google Analytics cookies will be set, and no Google Analytics tracking will be triggered for analytical or marketing purposes.

When using Google Analytics 4, the following data in particular may be processed: IP address, device and browser information, pages visited, time spent on the site, referrer URL, interactions with the website, approximate location information, and technical usage and event data. According to Google, the IP address is not logged or stored, but is used only to derive general location information. We have also entered into a data processing agreement with Google based on the terms provided by Google.

The retention period for user and event data within Google Analytics is determined by the account settings we have configured and is 1 year and 1 month.

Google Ads / Conversion Tracking

We use Google Ads on our website, including conversion tracking, an advertising and analytics service provided by Google. Google Ads allows us to display ads on Google Search, the Google Display Network, and other Google-affiliated platforms. Conversion tracking allows us to track whether users perform specific actions on our website after clicking on a Google ad—for example, submitting a contact request, visiting a specific page, or performing any other action relevant to us.

If you have given your consent, the following data, in particular, may be processed as part of Google Ads / Conversion Tracking: IP address, browser and device information, referrer URL, pages visited, time of page visit, interactions with our website, ad and campaign information, information about ad clicks, and cookies or similar identifiers. Identifiers such as Google Click IDs or similar parameters may also be processed in order to statistically track ad clicks and subsequent actions on our website.

We use Google Ads and conversion tracking to measure the effectiveness of our advertising campaigns, optimize our ads, and evaluate the economic performance of our online marketing efforts. We do not directly identify individual website visitors in this process.

Google Ads / Conversion Tracking is only enabled on our website after you have given your consent through our consent management system. Without your consent, no Google Ads cookies will be set, and no tracking for advertising or conversion purposes will be triggered.

The Google Ads Controller-Controller Data Protection Terms generally apply to the processing of personal data in connection with Google Ads and Google Ads conversion tracking. Under these terms, we and Google each process personal data as independent data controllers within the meaning of the GDPR.

Google Ads Remarketing

We use Google Ads Remarketing, a service provided by Google. Google Ads Remarketing allows us to retarget users of our website with interest-based ads on other websites, in Google services, or on the Google Display Network based on their previous visits to our website.

To this end, with your consent, information about your usage behavior on our website may be processed and linked to pseudonymous identifiers. In particular, the following information may be processed: your IP address, browser and device information, pages visited, referrer information, time of visit, interactions with our website, cookies or similar identifiers, and information related to advertising campaigns.

The data is processed for the purpose of delivering more targeted advertising, measuring the reach of our offerings, and evaluating our marketing activities. We do not directly identify individual website visitors in this process.

Google Ads Remarketing is only used on our website after you have given your consent through our consent management system. Without your consent, no remarketing cookies will be set and no remarketing audiences will be created.

The Google Controller-Controller Data Protection Terms provided by Google apply to the processing of personal data in connection with Google Ads Remarketing. Pursuant to these terms, we and Google process the personal data falling within our respective areas of responsibility as independent data controllers within the meaning of the GDPR.

You can also turn off personalized ads in your Google Account settings.

Google reCAPTCHA

On our website, we use Google reCAPTCHA, a service provided by Google. reCAPTCHA is used to protect our website from malicious automated access, spam, and other attacks, and to determine whether entries are made by a human or automatically by a program.

reCAPTCHA evaluates the behavior of website visitors using a risk score. In particular, the IP address, device and browser information, time spent on the site, as well as information about mouse movements, clicks, scrolling, and keyboard behavior may be processed and transmitted to Google. Based on this information, the system assesses the likelihood that a visit is made by a human or by an automated program.

In connection with reCAPTCHA, cookies with a retention period of six months may be stored in the device’s local storage.

We use Google as a data processor to provide reCAPTCHA. Google processes the personal data collected through reCAPTCHA in accordance with our instructions and based on the data protection terms for data processing that apply to Google.

§ 5 Social Media

1. LinkedIn

Our website includes a link to our LinkedIn company profile. You can find it at: https://www.linkedin.com/company/BAYOONET AG/

The provider of the LinkedIn social network for users in the European Economic Area is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

The LinkedIn icon embedded on our website is simply a link. To the best of our knowledge, simply visiting our website does not result in any personal data being transmitted to LinkedIn. Only when you click on the LinkedIn link do you leave our website and are redirected to LinkedIn.

From that point on, LinkedIn processes personal data on its own behalf. If you are logged into your LinkedIn account while visiting LinkedIn, LinkedIn may associate your visit with our LinkedIn company profile or your LinkedIn account. We have no control over the nature or scope of the subsequent data processing by LinkedIn.

For more information about LinkedIn’s data processing practices, please see LinkedIn’s Privacy Policy at: https://www.linkedin.com/legal/privacy-policy

§ 6 Your Rights

If you have any questions or complaints regarding data protection, please contact our company. You can find our contact information in Section 1 of this Privacy Policy.

Provided that the legal requirements are met, you also have the following rights:

  • You may request confirmation from us as to whether we process personal data about you. If this is the case, you have the right under Article 15 of the GDPR to access this personal data and the information listed in Article 15 of the GDPR, such as details regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing, or objection, the existence of a right to lodge a complaint, and the source of your data, provided it was not collected by us;
  • in accordance with Art. 16 GDPR, to immediately request the correction of incorrect or incomplete personal data stored by us;
  • to request, pursuant to Article 17 of the GDPR, the erasure of your personal data stored by us, unless processing is necessary to comply with a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims;
  • in accordance with Art. 18 GDPR, to demand the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful but you refuse to delete it and we no longer need the data, but you need it to assert, exercise or defend legal claims or you have lodged an objection to the processing in accordance with Art. 21 GDPR;
  • In accordance with Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transferred to another controller, and
  • to file a complaint with a supervisory authority in accordance with Article 77 of the GDPR. As a general rule, you may contact the supervisory authority in your usual place of residence, your place of work, or where our company is headquartered. You can contact the supervisory authority with jurisdiction over us as follows:

The Hessian Commissioner for Data Protection and Freedom of Information
Wilhelmstraße 7
65185 Wiesbaden
Phone: +49 611 1408-0
Fax: +49 611 1408-900
Email: [email protected]

You can find other German regulatory agencies at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

In addition, you have the right to object to the processing of your personal data at any time, provided that we are processing your personal data to pursue legitimate interests and there are reasons arising from your particular situation. We will then no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing is necessary for the establishment, exercise, or defense of legal claims, Art. 21 GDPR.

§ 7 Amendments

We reserve the right to make changes and will update this Privacy Policy as necessary.

As of: August 2026