Data Protection Declaration

At bpExperts GmbH, we believe the protection of personal data involves far more than just complying with legislation. We process personal data such as name, address, e-mail address or phone number in accordance with the GDPR and the German Federal Data Protection Act (BDSG), and explain below the nature, scope and purpose of the data we collect, use and process — and the rights you have. Applicants: please see our separate Data Protection Policy for Applicants.

Controller

bpExperts GmbH
represented by Dr. Jochen König, Markus Wolf, Dr. Russell Gomersall
Frankfurter Straße 39 / Stadthof 16 A, 63065 Offenbach am Main, Germany
Tel: +49 172 7210876 · info@bpexperts.de
Register court: Offenbach am Main, HRB 49413 · VAT ID: DE 286811595

Data Protection Officer

HSDK GmbH, Dirk Schell
Eschersheimer Landstr. 42, 60322 Frankfurt am Main, Germany
www.hsdk-privacy.com · data-privacy@bpexperts.de

Legal bases

We process personal data on the basis of your consent (Art. 6(1)(a) GDPR), for the performance of a contract or pre-contractual measures (Art. 6(1)(b)), to comply with a legal obligation (Art. 6(1)(c)), and on the basis of our legitimate interests (Art. 6(1)(f)).

Hosting & delivery (server log files)

This website is hosted on Railway (EU region) and delivered via Cloudflare; static assets are stored on Cloudflare R2. When you visit, your browser transmits data to our server (“server log files” — e.g. IP address, date/time, requested resource, referrer, browser type), processed under Art. 6(1)(f) GDPR on the basis of our legitimate interest in the stability, security and functionality of the site. We reserve the right to review log files if there are concrete grounds to suspect unlawful use.

Contact form & enquiries

When you contact us via the contact form or by e-mail, we collect the data you provide (name, e-mail, company, message) and store it to answer your enquiry and for the associated administration (Art. 6(1)(f), and Art. 6(1)(b) where the contact concerns a contract). The submission may be delivered to us via a processor (an email/workflow service). Your data is erased once the enquiry is conclusively resolved and no statutory retention period applies.

AI chat assistant

Our website includes an AI chat assistant. The messages you enter are processed to generate responses and are transmitted to our chat backend and to an AI provider (Anthropic). Please do not enter sensitive personal data into the chat. Processing is based on our legitimate interest in offering an interactive support channel (Art. 6(1)(f)).

Embedded video (YouTube / Vimeo)

Some articles embed videos. YouTube is embedded in privacy-enhanced mode (youtube-nocookie.com); when you play a video, data may be transmitted to the respective provider (Google Ireland Ltd. / YouTube, Vimeo). We have no influence over this processing.

Cookies

We use only cookies that are technically necessary to operate the site and its functions; the embedded chat assistant may set functional cookies. You can disable and delete cookies in your browser settings; disabling them may limit some functionality.

Recipients & service providers

We use carefully selected service providers (processors) to operate the site — in particular for hosting, content delivery, asset storage and the AI chat assistant. They act on our instructions under data processing agreements. We do not sell your data, and we do not otherwise disclose it unless we are legally obliged to do so.

International transfers

Some of the providers above are based outside the EU/EEA or may process data there (e.g. the AI chat provider). Where that is the case, transfers are safeguarded by appropriate measures such as the EU Standard Contractual Clauses and/or an adequacy decision. Details are available from our Data Protection Officer on request.

Retention & deletion

We store personal data only for as long as necessary for the purpose for which it was collected, or as required by statutory retention periods. Once the purpose ceases and no retention obligation applies, the data is restricted from processing or deleted.

Your rights

You have the right to confirmation and access (Art. 15), rectification (Art. 16), erasure / “right to be forgotten” (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on your consent, you may withdraw that consent at any time with effect for the future; the data concerned will then be deleted unless another legal basis applies. The withdrawal does not affect the lawfulness of processing carried out before it. To exercise your rights, contact us or our Data Protection Officer at any time.

Right to complain

If you believe the processing of your personal data infringes the GDPR (Art. 77), you may lodge a complaint with our Data Protection Officer or with a supervisory authority. The authority with jurisdiction over us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.

Profiling

Automated profiling and scoring do not take place.

Last updated: June 2026.