How BrandLogistics.NET GmbH collects, uses, and protects your personal data on brandmediacloud.com.
We are pleased that you are visiting our websites. Protecting your personal data is important to us. Below we inform you which personal data we process when you use our websites, for which purposes and on which legal basis we do so, and what rights you have.
This Privacy Policy applies to the web offerings of BrandLogistics.NET GmbH, in particular:
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
BrandLogistics.NET GmbH
Galileistraße 1
69115 Heidelberg, Germany
Phone: +49 6221 40 50 850
Email: info@brandlogistics.net
Marvin Schmidt
DSEV Consulting & Akademie GmbH
Leopoldstraße 31
80802 Munich, Germany
Phone: +49 (0) 89 244 181 471
Email: beratung@dsev.online
Further details (including the authorised managing directors and commercial register information) can be found in our Legal Notice. For questions regarding data protection, you can reach us using the contact details above; for matters directed specifically to our Data Protection Officer, please use his contact details directly.
We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications-Digital-Services-Data-Protection Act (TDDDG). We only process personal data to the extent necessary for the respective purpose.
Depending on the purpose, processing is based in particular on the following legal grounds:
Where consent is required for access to, or storage of, information on your terminal equipment, this is carried out in accordance with § 25 TDDDG.
Recipients
Within our company, only those departments that need access to personal data to perform their tasks are granted such access. In addition, we engage carefully selected service providers who process personal data on our behalf. Where necessary, this is carried out on the basis of data processing agreements pursuant to Art. 28 GDPR.
Third-Country Transfers
Where personal data is transferred to, or processed by, recipients outside the European Union (EU) or the European Economic Area (EEA), this is only done in compliance with the requirements of Art. 44 et seq. GDPR. This may in particular involve adequacy decisions of the European Commission (including the EU-US Data Privacy Framework), as well as the European Commission's standard contractual clauses together with supplementary safeguards.
Retention Period
We only store personal data for as long as is necessary for the respective processing purpose or as required by statutory retention obligations. Once the respective purpose no longer applies, or statutory retention periods expire, the data is deleted, provided no further legal basis for storage exists.
Each time our websites are accessed, our hosting system automatically collects information from the accessing device. This may include, in particular:
This processing is carried out for the technical provision of our websites, to ensure stability and security, and to detect and defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and functional provision of our websites. The specific retention period for server log files depends on the technical configuration of our hosting infrastructure and is limited to what is necessary.
Our websites and the associated infrastructure are operated by the following service providers:
The hosting and infrastructure providers engaged process, in particular, technical connection data, server log files, and other data that technically arises from the use of our websites. This processing is carried out on our behalf on the basis of data processing agreements pursuant to Art. 28 GDPR; the legal basis is Art. 6(1)(f) GDPR. The specific allocation of individual processing activities between maxcluster and IONOS depends on the technical infrastructure used in each case.
We take appropriate technical and organisational measures to protect your data. Our websites use TLS/SSL encryption to secure data transmission, recognisable by the lock symbol in your browser's address bar and the "https://" prefix.
Our websites use cookies and similar technologies. Technically necessary cookies and similar technologies are used to the extent they are required to provide a digital service you have expressly requested (§ 25(2) TDDDG, Art. 6(1)(f) GDPR).
Cookies and similar technologies that are not technically necessary — in particular for analytics, marketing, or external media purposes — are only used if you have given your prior consent. The legal basis is Art. 6(1)(a) GDPR; § 25(1) TDDDG additionally applies to the storage of, or access to, information on your terminal equipment.
You may withdraw any consent given at any time with effect for the future, or change your selection via the settings of our consent management system.
We use WP Statistics for the statistical analysis of how our websites are used. WP Statistics runs on our own WordPress installation; analytics data is not transmitted to the plugin provider or to any third country.
The specific processing carried out — in particular the processing and anonymisation of IP addresses and the use of any cookies — depends on the configuration in use on our websites. The analysis serves the needs-based design and technical optimisation of our websites.
Where processing takes place without accessing your device and without any personal analysis, Art. 6(1)(f) GDPR is the legal basis. Where cookies are set for this purpose, or information on your device is accessed, and consent under § 25(1) TDDDG is required, processing only takes place after you have given the corresponding consent.
If you contact us by email or via our contact form, we process the data you provide. This may include, in particular: name, company, email address, phone number, other contact details, and the content of your message.
To manage contacts and customer relationships, we use the CRM system Pipedrive (provider: Pipedrive OÜ, Tallinn, Estonia; potentially involving Pipedrive, Inc., USA). Your contacts' personal data is stored and processed within Pipedrive. Pipedrive acts as a data processor in this context and processes the data solely on our instructions; according to the provider, data is hosted within the EU. We ourselves remain responsible for the data processing as the controller and determine the legal grounds for processing ourselves, e.g. consent or legitimate interest. Where a transfer to a third country occurs in individual cases, this is carried out on the basis of Art. 44 et seq. GDPR (see section 2).
Further information on data processing by Pipedrive can be found in Pipedrive's Privacy Notice and Data Processing Addendum: pipedrive.com/en/privacy.
This processing is carried out to handle your enquiry and — where the enquiry is aimed at concluding or performing a contract — to carry out pre-contractual or contractual measures. Depending on the content of the enquiry, the legal basis is Art. 6(1)(b) GDPR or our legitimate interest in handling and maintaining business contacts pursuant to Art. 6(1)(f) GDPR. The data is deleted once the purpose of processing no longer applies and no statutory retention obligations or other legal grounds for further storage exist.
For business electronic communication and the provision of our email mailboxes, we use IONOS (IONOS SE, Montabaur, Germany). When communicating by email, we process the personal data transmitted to the extent necessary to handle your enquiry or to carry out a business relationship. Depending on the context, the legal basis is Art. 6(1)(b), (c), or (f) GDPR.
If you sign up for our newsletter, we process your email address and, where applicable, other data you provide, in order to send you the newsletter. We use Mailchimp for this purpose.
Registration takes place via a double opt-in procedure: after signing up, you receive a confirmation email; the registration only becomes effective once you have confirmed it. Registration and confirmation may be logged for evidentiary purposes. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in every newsletter; the lawfulness of processing carried out prior to the withdrawal remains unaffected.
Mailchimp is a service of The Rocket Science Group LLC (part of the Intuit group of companies), headquartered in the USA. Mailchimp processes data on our behalf (Art. 28 GDPR). For transfers of personal data to the USA, Mailchimp states that it relies, among other things, on the EU-US Data Privacy Framework as well as on standard contractual clauses.
Our brand shop at https://shop.brandlogistics.net is operated using WooCommerce. When you place an order, we process the data required to conclude and process the purchase contract. This includes, in particular:
This processing is carried out to perform the purchase contract or pre-contractual measures pursuant to Art. 6(1)(b) GDPR. We also process order and invoice data to comply with commercial and tax-law retention obligations (Art. 6(1)(c) GDPR).
WooCommerce stores the customer data required for order processing in the database of our WordPress installation. Exactly which data is processed depends, among other things, on the WooCommerce features and extensions activated. Since we do not ship goods via external shipping providers, no personal data is passed on to an external shipping provider for shipping purposes as part of order processing.
We use Stripe to process payments in our online shop (provider for Europe: Stripe Payments Europe, Limited, Dublin, Ireland). As part of payment processing, the data required to carry out and verify the payment is transmitted to Stripe; this may include, in particular, name, email address, billing data, order or payment amount, and payment-related information. Exactly which data is transmitted in a given case depends on the payment method chosen and the technical integration.
The legal basis is Art. 6(1)(b) GDPR, to the extent processing is necessary to perform the contract. Stripe also processes personal data outside the EU/EEA (including via Stripe, Inc., USA). For international transfers, Stripe states that it relies, among other things, on the EU-US Data Privacy Framework as well as on EU standard contractual clauses.
Our websites may embed maps from the Google Maps service (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to display locations and geographic information. When a page with embedded Google Maps content is accessed, technical data — in particular the IP address and information about the use of the embedded service — may be transmitted to Google; this may also involve a transfer to Google LLC in the USA (basis: EU-US Data Privacy Framework or standard contractual clauses).
Where consent is required to load the embedded content, it is only loaded after you have given the corresponding consent. The legal basis for consent-based processing is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
Our websites may embed content and features from Meta's services (provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). Through this integration, data may be transmitted to Meta when the relevant pages are accessed; this may include, in particular, the IP address, technical information about the device, and information about the access to the website concerned. This may also involve a transfer to the USA (Meta Platforms, Inc.) (basis: EU-US Data Privacy Framework or standard contractual clauses).
Where consent is required for this integration, the relevant content is only loaded after you have given your consent. The legal basis for consent-based processing is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.
We maintain our own presence on social networks (LinkedIn, Facebook, and YouTube) in order to communicate with prospective customers and clients and to inform them about our services. When you visit these profiles, the respective platform operator processes personal data under its own responsibility; in some cases, joint controllership exists pursuant to Art. 26 GDPR. The legal basis for our processing is our legitimate interest in an effective public presence (Art. 6(1)(f) GDPR). For details on data processing, please refer to the privacy notices of the respective provider.
If you apply to work with us, we process the personal data submitted as part of the application process exclusively to carry out that process and to decide on establishing an employment relationship. The legal basis is § 26 BDSG in conjunction with Art. 6(1)(b) GDPR; for special categories of personal data, Art. 9 GDPR applies.
After the application process has concluded, application data is deleted as soon as it is no longer required for this purpose and no statutory retention obligations or other legitimate reasons (e.g. evidentiary obligations under the German General Equal Treatment Act, AGG) preclude deletion. Inclusion in a talent pool only takes place on the basis of corresponding consent.
Our websites may contain links to external third-party websites. We have no influence over their content or data processing. The respective operators' own privacy policies apply to the data processing they carry out.
Subject to the statutory requirements, you have, in particular, the following rights:
Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out prior to the withdrawal remains unaffected.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information, Baden-Württemberg)
Lautenschlagerstraße 20
70173 Stuttgart
Germany
https://www.baden-wuerttemberg.datenschutz.de
We do not use decisions based solely on automated processing — including profiling — that produce legal effects concerning you or similarly significantly affect you.
We update this Privacy Policy whenever the data processing activities we carry out, or the applicable legal framework, change. The version published on our websites at any given time shall apply.
Last revised: September 2026
Contact our team directly — we take data protection seriously and are happy to help with any questions.
English
Deutsch
Español