PRIVACY POLICY
The protection of your personal data is important to us. Below we explain how personal data is processed when you use the IDIAL website, a solution of BxC GmbH & Co. KG.
Name and address of the controller
The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states, as well as other data protection provisions, is:
Föhrenweg 1
85399 Hallbergmoos
Germany
Data Protection Officer
The controller's Data Protection Officer is:
Datenzeit GmbH
Friedrich-Engels-Allee 200
D-42285 Wuppertal, Germany
General information on data processing
Scope of the processing of personal data
As a rule, we only process our users' personal data to the extent necessary to provide a functioning website along with our content and services. The processing of our users' personal data generally takes place only with the user's consent. An exception applies in cases where prior consent cannot be obtained for practical reasons and the processing is permitted by law.
Legal basis for processing
Where we obtain consent, Art. 6(1)(a) GDPR serves as the legal basis. For processing necessary to perform a contract, Art. 6(1)(b) GDPR applies; to comply with a legal obligation, (c); to protect vital interests, (d); and to safeguard legitimate interests, Art. 6(1)(f) GDPR serves as the legal basis.
Data erasure and storage duration
The personal data of the data subject is erased or blocked as soon as the purpose of storage no longer applies. Storage beyond this may occur if provided for by European or national legislation to which the controller is subject, or where continued storage remains necessary for the conclusion or performance of a contract.
Provision of the website and creation of log files
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:
- IP address; date and time of the request; time-zone difference from Greenwich Mean Time (GMT)
- Content of the request (specific page); access status / HTTP status code; volume of data transferred
- Website from which the request originates; browser; operating system; language and version of the browser software
This data cannot be attributed to specific individuals, and we do not merge it with other data sources. The legal basis for the temporary storage is Art. 6(1)(f) GDPR.
This website is hosted on our own infrastructure. No cookies are placed in the course of collecting this data; see the following section for the cookies used elsewhere on this website.
Purpose and duration of storage
Temporary storage of the IP address is necessary to deliver the website to the user's device, to ensure the website functions, and to optimise the website and ensure the security of our IT systems. No evaluation of the data for marketing purposes takes place. The data is erased as soon as it is no longer required for its purpose, at the latest after seven days; thereafter IP addresses may be anonymised. There is no right to object here, as collecting the data is strictly necessary to operate the website.
Contact form and email contact
Our website provides a contact form for electronic contact. If you use it, the data you enter (name, email address, company and message) is transmitted to us for processing.
For the technical handling of contact form submissions, we use monday.com, a work management platform operated by monday.com Ltd., as a data processor under a data processing agreement. The submitted data is stored as an item on an internal board within monday.com so that BxC staff can track and respond to your enquiry, and it is not used for any other purpose.
The legal basis for this processing is Art. 6(1)(b) GDPR, where your enquiry aims at the conclusion or performance of a contract, and/or Art. 6(1)(f) GDPR, on the basis of our legitimate interest in responding to enquiries addressed to us.
The data is used exclusively to handle your specific enquiry and is not shared with any other third party. It is erased as soon as the respective conversation has been conclusively resolved and no statutory retention obligation applies. You can object to this processing, or withdraw any consent given, at any time; see the section on your rights below.
Rights of the data subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights vis-à-vis the controller:
Right of access
You may request confirmation from the controller as to whether personal data concerning you is being processed.
Where such processing takes place, you may request information from the controller about the following:
- the purposes for which the personal data is processed;
- the categories of personal data being processed;
- the recipients, or categories of recipients, to whom your personal data has been or will be disclosed;
- the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- the existence of a right to rectification or erasure of your personal data, a right to restriction of processing by the controller, or a right to object to such processing;
- the existence of a right to lodge a complaint with a supervisory authority;
- where the personal data is not collected from you directly, any available information as to its source;
- the existence of automated decision making, including profiling, pursuant to Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved as well as the significance and envisaged consequences of such processing for you.
You have the right to request information as to whether your personal data is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.
Right to rectification
You have a right to rectification and/or completion if the personal data processed concerning you is inaccurate or incomplete.
Right to restriction of processing
Under the following conditions, you may request the restriction of the processing of your personal data:
- if you contest the accuracy of your personal data, for a period enabling the controller to verify the accuracy of the data;
- if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
- if the controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims; or
- if you have objected to processing pursuant to Art. 21(1) GDPR pending verification as to whether the legitimate grounds of the controller override your grounds.
Where processing of your personal data has been restricted, such data may, with the exception of storage, only be processed with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a member state.
If the restriction of processing has been imposed under the conditions above, you will be informed by the controller before the restriction is lifted.
Right to erasure
You may request that the controller erase your personal data without undue delay, and the controller is obliged to erase such data without undue delay, where one of the following applies:
- your personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- you withdraw the consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing;
- you object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR;
- your personal data has been processed unlawfully;
- the erasure of your personal data is required for compliance with a legal obligation under Union or member state law to which the controller is subject; or
- your personal data was collected in relation to information society services offered pursuant to Art. 8(1) GDPR.
The right to erasure does not apply to the extent that processing is necessary:
- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation which requires processing under Union or member state law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) as well as Art. 9(3) GDPR;
- for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to above is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
- for the establishment, exercise or defence of legal claims.
Right to information
If you have asserted the right to rectification, erasure or restriction of processing, the controller is obliged to notify all recipients to whom your data has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
Right to data portability
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the data was provided, provided that:
- the processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, or on a contract pursuant to Art. 6(1)(b) GDPR; and
- the processing is carried out by automated means.
In exercising this right, you further have the right to have your personal data transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.
The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Right to object
You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions.
The controller will no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where your personal data is processed for direct marketing purposes, you have the right to object at any time to such processing, including profiling to the extent it is related to such direct marketing. If you object, your personal data will no longer be processed for these purposes.
In connection with the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.
Right to withdraw consent
You have the right to withdraw your data protection consent at any time. The lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal remains unaffected.
Automated decisions in individual cases
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply where the decision:
- is necessary for entering into, or the performance of, a contract between you and the controller;
- is authorised by Union or member state law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or
- is based on your explicit consent.
Such decisions must not, however, be based on special categories of personal data referred to in Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests have been taken.
With regard to the cases referred to in points (1) and (3) above, the controller implements suitable measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.
The supervisory authority with which the complaint has been lodged will inform you of the progress and outcome of your complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
Changes to this privacy policy
The ongoing development of the internet and of our online offering may also affect the handling of personal data. We therefore reserve the right to amend this privacy policy in future within the framework of applicable data protection laws and to adapt it to changed data processing. The current version is always available under the "Privacy" section.
Version date: September 2026 · IDIAL is a solution of BxC GmbH & Co. KG.