Data Protection Declaration

At bpExperts GmbH, we believe the protection of personal data involves far more than just complying with legislation. We process personal data such as name, address, e-mail address or phone number in accordance with the GDPR and the German Federal Data Protection Act (BDSG), and explain below the nature, scope and purpose of the data we collect, use and process — and the rights you have. Applicants: please see our separate Data Protection Policy for Applicants.

Controller

bpExperts GmbH
represented by Dr. Ikemefuna Allen
Frankfurter Straße 39 / Stadthof 16 A, 63065 Offenbach am Main, Germany
Tel: +49 172 7210876 · info@bpexperts.de
Register court: Offenbach am Main, HRB 49413 · VAT ID: DE 286811595

Data Protection Officer

HSDK GmbH, Dirk Schell
Eschersheimer Landstr. 42, 60322 Frankfurt am Main, Germany
www.hsdk-privacy.com · data-privacy@bpexperts.de

Legal bases

We process personal data on the basis of your consent (Art. 6(1)(a) GDPR), for the performance of a contract or pre-contractual measures (Art. 6(1)(b)), to comply with a legal obligation (Art. 6(1)(c)), and on the basis of our legitimate interests (Art. 6(1)(f)).

Hosting & delivery (server log files)

This website is hosted on Railway (EU region); static assets such as images are stored on Cloudflare R2. When you visit, your browser transmits data to our server (“server log files” — e.g. IP address, date/time, requested resource, referrer, browser type), processed under Art. 6(1)(f) GDPR on the basis of our legitimate interest in the stability, security and functionality of the site. We reserve the right to review log files if there are concrete grounds to suspect unlawful use.

Asset storage (Cloudflare R2)

Images and other static files on this website are stored on and delivered from Cloudflare R2, a storage service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which acts as our processor. When your browser loads such a file, Cloudflare processes connection data — in particular your IP address, the requested file, date/time and browser information — to deliver it and to protect its network against attacks. Legal basis: our legitimate interest in fast and secure delivery of the website (Art. 6(1)(f) GDPR). Cloudflare’s data processing addendum applies; Cloudflare is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR), and the EU Standard Contractual Clauses apply in addition. Further information: cloudflare.com/privacypolicy.

Web analytics (Umami)

To understand how our website is used and to improve it, we use Umami, an open-source analytics tool that we host ourselves on our own infrastructure (Railway, EU region). No data is passed to the provider of the software or to other third parties. Umami does not set cookies and does not store or read any information on your device. It records the pages visited, the referring website, the time of the visit, browser, operating system, device type, screen size, language and the country derived from your IP address. Your IP address is not stored; a visit is only recognised via a non-reversible identifier that changes regularly, so you cannot be identified or tracked across websites. The results are evaluated only in aggregate. Legal basis: our legitimate interest in the statistical analysis and improvement of our website (Art. 6(1)(f) GDPR). As no information is stored on or read from your device, no consent under §25 TDDDG is required. You may object to this processing at any time (Art. 21 GDPR): if your browser sends a “Do Not Track” signal, no visit is recorded at all; you can also contact us or block JavaScript from our analytics domain in your browser.

Contact form & enquiries

When you contact us via the contact form or by e-mail, we collect the data you provide (name, e-mail, company, message) and store it to answer your enquiry and for the associated administration (Art. 6(1)(f), and Art. 6(1)(b) where the contact concerns a contract). The submission may be delivered to us via a processor (an email/workflow service). Your data is erased once the enquiry is conclusively resolved and no statutory retention period applies.

AI chat assistant

Our website includes an AI chat assistant. The messages you enter are processed to generate responses and are transmitted to our chat backend and to an AI provider (Anthropic). Please do not enter sensitive personal data into the chat. Processing is based on our legitimate interest in offering an interactive support channel (Art. 6(1)(f)).

Embedded video (YouTube / Vimeo)

Some articles embed videos. YouTube is embedded in privacy-enhanced mode (youtube-nocookie.com); when you play a video, data may be transmitted to the respective provider (Google Ireland Ltd. / YouTube, Vimeo). We have no influence over this processing.

Cookies

We use only cookies that are technically necessary to operate the site and its functions; the embedded chat assistant may set functional cookies. You can disable and delete cookies in your browser settings; disabling them may limit some functionality.

Recipients & service providers

We use carefully selected service providers (processors) to operate the site — in particular for hosting (Railway), asset storage (Cloudflare R2) and the AI chat assistant (Anthropic). They act on our instructions under data processing agreements. We do not sell your data, and we do not otherwise disclose it unless we are legally obliged to do so.

International transfers

Some of the providers above are based outside the EU/EEA or may process data there (e.g. Cloudflare and the AI chat provider). Where that is the case, transfers are safeguarded by appropriate measures such as the EU Standard Contractual Clauses and/or an adequacy decision. Details are available from our Data Protection Officer on request.

Retention & deletion

We store personal data only for as long as necessary for the purpose for which it was collected, or as required by statutory retention periods. Once the purpose ceases and no retention obligation applies, the data is restricted from processing or deleted.

Your rights

You have the right to confirmation and access (Art. 15), rectification (Art. 16), erasure / “right to be forgotten” (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on your consent, you may withdraw that consent at any time with effect for the future; the data concerned will then be deleted unless another legal basis applies. The withdrawal does not affect the lawfulness of processing carried out before it. To exercise your rights, contact us or our Data Protection Officer at any time.

Right to complain

If you believe the processing of your personal data infringes the GDPR (Art. 77), you may lodge a complaint with our Data Protection Officer or with a supervisory authority. The authority with jurisdiction over us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.

Profiling

Automated profiling and scoring do not take place.

Last updated: October 2026.