Privacy Policy

This English version is provided for convenience. In case of any discrepancy, the German version prevails.

1. Controller

The controller responsible for the processing of personal data on this website is:

Brandpur GmbH
Wilfried-Diekmann-Straße 10
44536 Lünen, Germany
Tel: +49 (0) 231 53 48 84 47
E-Mail: info@brandpur.com

Brandpur GmbH is represented by its managing directors Said Aissaoui and Peter Fülöp. Further details can be found in the imprint. For questions about data protection, please contact us using the details above.

2. Overview

This privacy policy explains which personal data we process when you visit this website or contact us, for what purpose, on what legal basis and for how long. Personal data is any information relating to an identified or identifiable person, for example a name, an e-mail address or an IP address.

We do not embed maps, videos, social media plugins or externally loaded fonts. The fonts on this website are delivered from our own server. The Google measurement services that require consent are described in sections 6 and 7.

With your consent, we measure use of our website with Google Analytics 4. With additional consent to ad performance measurement, successfully submitted project enquiries can be attributed to our Google ads. Google measurement services load only after your consent. We do not use personalised advertising, remarketing or form contact details for this measurement (sections 6 and 7).

3. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel provides the servers, the content delivery network and the storage for images and other media files.

Each time a page is accessed, your browser automatically transmits technical data, which Vercel processes and records in server log files: IP address and the approximate location derived from it, date and time of access, the address accessed including parameters, request method and status code, as well as browser type and operating system (user agent).

The purpose is to deliver the website, keep it stable and secure, for example by fending off attacks, and to analyse errors. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely and without errors.

The server functions of this website run in a Vercel data centre in the USA (Washington, D.C. region). For transfers to the USA, see section 12. Vercel automatically deletes the log files we can access after a short time, currently after one day at the latest. Further information can be found in Vercel's privacy policy: https://vercel.com/legal/privacy-policy

4. SSL/TLS encryption

For security reasons, this website uses TLS encryption. You can recognise an encrypted connection by "https://" in the address bar and by the padlock symbol in your browser. Data you send to us, for example via the contact form, cannot be read by third parties.

5. Cookies and storage on your device

Cookies are small text files on your device. The website also uses local browser storage for your privacy choices. Necessary settings and optional measurement services are treated separately.

For the language you explicitly select, we use the following necessary cookie:

brandpur-locale: If you select a language in the language switcher (German, English or French), this cookie stores your choice so that the next time you open the home page you land directly in that language. The cookie contains only the language code and no identifier that identifies you. It is set by us, not passed on to third parties and deleted automatically after one year.

As long as you do not select a language, this cookie is not set. The home page then follows the language setting of your browser.

The legal basis for storing and reading the language cookie is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), because it is strictly necessary to provide the website in the language you have chosen. The legal basis for any further processing is Art. 6(1)(f) GDPR.

Storage of your privacy choices is described in section 6. Cookies for Google Analytics and, where applicable, ad performance measurement are used only with your corresponding consent (section 7).

You can delete cookies at any time in your browser settings and prevent new cookies from being set. If cookies are disabled, your language choice can no longer be saved.

6. Consent and cookie banner

On your first visit, the banner lets you choose separately between website analytics and ad performance measurement. Ad measurement uses Analytics events and therefore requires consent to website analytics. You can reject everything, choose analytics only, or consent to both purposes.

Until you have agreed, no Google scripts are loaded and no Google cookies are set. The website can be used in full without consent, and declining has no disadvantages for you. On the first level of the banner, declining is just as easy and just as prominent as accepting. No boxes are pre-ticked. Simply continuing to browse or closing the banner does not count as consent.

The legal basis for consent is Art. 6(1)(a) GDPR and, for storing and reading information on your device, additionally Section 25(1) TDDDG.

We store your latest choice, its timestamp and the banner version under “brandpur-consent” in your browser’s local storage. The choice is valid for 180 days; we ask again on your next visit after expiry or after a material change. This record contains no random user identifier and is not sent to Google as a separate record. You can delete it in your browser settings. Storage serves to implement and document your chosen privacy settings (Section 25(2) no. 2 TDDDG; Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

You can change or withdraw your consent at any time with effect for the future through “Privacy settings” in the footer of every page. You can disable ad performance measurement separately or use “Reject all” to disable all Google measurement services. On withdrawal, we stop the affected measurement, remove the Google measurement cookies set by our website and the local _gcl_ls entry, and reload the page. If consent to website analytics remains in place, its cookies may then be set again. Withdrawing consent is as easy as giving it. The lawfulness of processing carried out before withdrawal remains unaffected.

7. Google Analytics and ad performance measurement

Only if you have given your consent in the banner do we use Google Analytics 4, a service for analysing website usage. The provider in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the data on our behalf as a processor on the basis of the Google Ads Data Processing Terms (https://privacy.google.com/businesses/processorterms).

Google Analytics sets cookies that recognise your browser:

_ga: distinguishes browsers; duration up to two years.
_ga_ followed by the measurement identifier: stores session status; duration up to two years.
With additional consent to ad measurement, _gcl_ cookies may be used to attribute ad clicks; duration up to 90 days. Google may also store ad-click information in local browser storage under _gcl_ls. We remove this entry when consent is withdrawn through our privacy settings. Expiry may be extended during further use; browser settings may limit it.

Data processed includes a pseudonymous browser identifier, page views, usage timestamps, technical browser and device information, language, approximate location and visit source. A successfully submitted project enquiry is recorded as a “generate_lead” event. Names, email addresses, telephone numbers, companies, quantities and message text from the form are not sent to Google. Arbitrary URL parameters and fragments are removed from page addresses we send; fixed campaign tags and, with the relevant consent, ad click identifiers may be retained.

Regarding IP addresses, Google states that data from devices in the EU is collected via domains and servers in the EU and that individual IP addresses of users in the EU are not logged or stored. According to Google, the IP address is only used to derive the approximate location and is then discarded (https://support.google.com/analytics/answer/12017362).

With your additional consent to ad performance measurement, we also use the Google tag for Google Ads. Google Analytics may also be linked to a Google Ads account. Use of measurement data for ad attribution is enabled only with your additional consent. Ad click identifiers such as GCLID, GBRAID or WBRAID and the enquiry event may be processed to measure ad results and optimise campaigns. We do not use Google Signals, personalised advertising, remarketing or the transmission of hashed contact details (“enhanced conversions”).

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time via the link in the footer (section 6). In addition, you can prevent Google Analytics from collecting data with Google's browser add-on: https://tools.google.com/dlpage/gaoptout

Google Analytics retention for user and event data is set to 14 months; resetting the user-data retention period on new activity is disabled. This setting does not apply to already aggregated standard reports. Processing by Google LLC in the USA is possible (section 12). Further information: https://policies.google.com/privacy and https://policies.google.com/technologies/cookies

8. Contact form

If you write to us using the project enquiry form, we process the information you enter in the form. Mandatory fields are first name, last name, e-mail address, message and the confirmation that you have read this privacy policy. Phone number, company and planned quantity are optional. We also store the time of your enquiry.

We use the data to handle your enquiry and to communicate with you about it. We need the mandatory information to assign and answer your enquiry. Without it, the form cannot be submitted. You are under no legal or contractual obligation to provide this data and can also reach us by e-mail or phone instead.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or serves to carry out pre-contractual measures. In all other cases, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in answering the enquiries addressed to us.

Your information is stored in the database of our content management system. The database is operated by Neon, LLC, a Databricks, Inc. company, USA, in a data centre in Frankfurt am Main, Germany. In addition, the full content of your enquiry is sent by e-mail to contact@brandpur.com. For sending, we use the e-mail service Resend of Plus Five Five, Inc., USA. Resend stores the content of the e-mail and the delivery logs in the USA, currently for 30 days. Open and click tracking is not activated at Resend. Our mailbox is operated by Microsoft (see section 9). Our reply goes to the e-mail address you entered in the form.

We delete your enquiry six months after it has been closed. If your enquiry leads to a business relationship, we keep the correspondence for as long as commercial and tax retention obligations require (Section 257 HGB, Section 147 AO).

9. Contact by e-mail or phone

If you contact us by e-mail or phone, we process your name, your contact details and the content of your enquiry in order to handle it. The legal bases and retention period are the same as for the contact form (section 8).

E-mails to us are stored in our mailbox at Microsoft 365. Our contractual partner is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

10. Job applications

Our job advertisements ask for applications by e-mail to hr@brandpur.com. We process your application documents in order to decide on establishing an employment relationship. The legal basis is Art. 6(1)(b) GDPR. If you send us special categories of personal data on your own initiative, for example information about a severe disability, we only process it to the extent necessary for the procedure (Art. 9(2)(b) GDPR). Only the people involved in the selection have access. The e-mails are stored in our mailbox at Microsoft 365 (see section 9).

If no employment relationship is established, we delete your documents six months after the end of the procedure. This allows us to respond to possible claims under the German General Equal Treatment Act (AGG). The legal basis for this is Art. 6(1)(f) GDPR. If we hire you, your documents become part of your personnel file.

11. Recipients

The following service providers receive personal data from this website to the extent necessary for their task:

Vercel Inc., USA: hosting, content delivery network, server log files, storage for media files
Neon, LLC (Databricks, Inc.), USA: database with servers in Frankfurt am Main, storage of form enquiries
Plus Five Five, Inc. (Resend), USA: sending the e-mails from the contact form
Microsoft Ireland Operations Limited, Ireland: e-mail mailbox (Microsoft 365)
Google Ireland Limited, Ireland: website analytics and, with additional consent, ad performance measurement

Beyond this, we only pass on your data if we are legally obliged to do so or if you have consented. We do not sell personal data.

12. Transfers to third countries

Vercel, Neon and Resend are based in the USA. For Microsoft and Google, processing by Microsoft Corporation or Google LLC in the USA cannot be ruled out.

For the USA, the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR). It applies to companies certified under the EU-US Data Privacy Framework (DPF). Vercel Inc., Databricks, Inc. including Neon, LLC, Resend, Microsoft Corporation and Google LLC are certified under the DPF. The list of certified companies can be found at https://www.dataprivacyframework.gov/list. Resend, Microsoft and Google additionally base transfers on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

13. Retention period

We only store personal data for as long as is necessary for the respective purpose or as required by statutory retention obligations. The specific periods are set out in the sections above. After that, we delete the data.

14. Your rights

You have the right to access the data we process about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR). Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR), for Google Analytics via the link in the footer. An informal message to info@brandpur.com is sufficient.

Right to object under Art. 21 GDPR: Where we process your data on the basis of Art. 6(1)(f) GDPR, you can object to this processing at any time on grounds relating to your particular situation. This applies in particular to the server log files (section 3). We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf, Germany
Tel: +49 211 38424-0
E-Mail: poststelle@ldi.nrw.de
https://www.ldi.nrw.de

You can also contact the supervisory authority at your place of residence or work.

15. No automated decision-making

We do not make decisions based solely on automated processing and do not use profiling within the meaning of Art. 22 GDPR.

16. Objection to advertising e-mails

We hereby object to the use of the contact details published in the imprint for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising, for example through spam e-mails.

17. Changes to this privacy policy

We update this privacy policy when the website or the legal situation changes. The version published here applies.

Last updated: October 2026