Privacy policy

The controller for the processing of your data on this site is Brandcircuit UG (haftungsbeschränkt), Florastraße 34a, 13187 Berlin, Germany, reachable at mail@brandcircuit.de and at +49 176 72913634.

We have not appointed a data protection officer, because the conditions of Art. 37 GDPR and § 38 BDSG do not apply to us.

Every time you open a page your browser transmits technical data that our server records. These are the address requested, date and time, the amount of data transferred, the referring page, browser and operating system, and the IP address.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is the secure operation of the site and the investigation of faults. The IP address appears in the logs only in shortened form. The logs are deleted after seven days at most and are not combined with other data.

The site is operated for us by Era Digitalis GmbH, Ludolfingerplatz 1c, 13465 Berlin, Germany, as processor under Art. 28 GDPR. As a sub-processor it uses a server of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, located in the data centre in Helsinki, in Finland and therefore in the European Union. Data processing agreements are in place with both.

This site loads nothing from third party servers. There is no analytics, no advertising network, no embedded maps, videos or social networks.

The typefaces also come from our own server. They are downloaded once when the site is built and delivered along with it, so your browser makes no connection to Google when you open a page and your IP address is not transmitted there.

We set three cookies, and none of them serves advertising or measures your behaviour:

• NEXT_LOCALE remembers whether you read the site in German or in English and contains nothing else.
• __Host-bc_csrf holds a random string and protects forms from being submitted in your name by another site. It is set on every visit, with or without an account, and lasts 30 days.
• __Host-bc_sitzung keeps you signed in. It only appears once you sign in, holds a session identifier and no information about you, and disappears when you sign out.

In addition, the site keeps your basket in your browser's local storage (localStorage), meaning the varieties, cases and quantities you chose. It stays there so that your selection survives signing in or registering, leaves your device only when you submit an order, and is emptied afterwards. You can delete it at any time in your browser settings.

The three cookies and the basket are strictly necessary: the first cookie for the language you chose, the other two for security and for signing in, and the basket for the order you are expressly putting together. Under § 25 (2) no. 2 TDDDG no consent is required for them, and for the same reason there is no consent banner on this site.

To send an order you need an account. For that we process:

• Your email address and your password. We do not store the password, only a hash of it, from which it cannot be recovered.
• Your company details, meaning the company, VAT identification number or tax number and the billing address.
• Your delivery points, meaning the label, the address and any notes you leave for the driver.
• Your orders with their reference, so that you can find them again in your account.
• Your sign-ins: for each session the time, the expiry and a hash of your IP address and browser identifier. We store both only as a hash, because they serve solely to spot suspicious sign-in attempts and not to recognise you.
• Confirmation and password links, likewise only as a hash. A confirmation link is valid for 24 hours, a link to reset the password for one hour.

When you set a new password, our server checks whether it appears in publicly known data breaches. To do so it queries the Pwned Passwords service and transmits only the first five characters of a hash of your password. Neither the password nor your email address or IP address leaves our server in the process.

The legal basis is Art. 6 (1) (b) GDPR, because the account is the precondition for us to accept your orders. For the hashes of IP address and browser identifier it is Art. 6 (1) (f) GDPR, with our legitimate interest in keeping accounts secure. The details are required for the account; without them we cannot set one up.

You can have your account deleted at any time, informally at mail@brandcircuit.de. What we still have to keep afterwards is set out under “How long we keep your data”.

When you put an order together and send it, we process the details from your customer account and from the order form:

• Company, VAT identification number or tax number
• First name, last name, email address and phone number of the contact person
• Delivery address and, where different, billing address
• The cases chosen with their quantity, plus preferred delivery date and your message

We process these details in order to accept your order, confirm its receipt to you by email, contact you where there are questions, deliver the goods and enable the producer to invoice you. The legal basis is Art. 6 (1) (b) GDPR, because the processing is necessary for the performance of the contract of sale.

The details are required for the order; without them we cannot accept an order. Only the preferred delivery date and the message are optional.

We send confirmations, account links and our notices about orders and enquiries through a mailbox at ALL-INKL.COM, Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. ALL-INKL processes your email address and the content of the email on our behalf, for which a data processing agreement under Art. 28 GDPR is in place.

Your order first goes into our own customer management system, which we operate ourselves. From there we pass the details on to the producer whose goods you ordered, because they invoice you. Only what the producer needs for that is passed on.

The recipients are the producers of the brands you order. They are based in the European Union or in Switzerland; who stands behind a brand is shown on its brand page.

Switzerland is a third country for which the European Commission has found an adequate level of protection under Art. 45 GDPR, so transfers there require no additional safeguards.

Beyond that we pass your data on only where we are legally obliged to, for example to the tax office or to our tax adviser.

If you write to us or call us, we process your details in order to deal with your request. The legal basis is Art. 6 (1) (b) GDPR where a contract or its initiation is concerned, otherwise Art. 6 (1) (f) GDPR with our legitimate interest in answering.

Besides the order there are two further forms on the start page: one for a fridge at your location and one for support of an event. Both are available without a customer account.

We process the business or organiser, first name, last name, email address and, where given, phone number and message. A fridge enquiry adds the address of the location, because the fridge has to stand somewhere. A sponsoring enquiry adds the name of the event and, where already known, its date, venue and expected number of guests.

The legal basis is Art. 6 (1) (b) GDPR, because the processing is necessary to take steps at your request prior to entering into a contract. Where an enquiry leads nowhere we delete the details after two years. We do not pass these enquiries on to a producer.

At brandcircuit.de there is a form for brands and producers who want to bring their product to retail through us. It is available without a customer account.

We process the brand or company, the name of the contact person, the email address, your message and, where given, the phone number. The enquiry goes to a mailbox of Brandcircuit. We do not pass it on to producers, wholesalers or other third parties.

The legal basis is Art. 6 (1) (b) GDPR, because the processing is necessary to take steps at your request prior to entering into a contract. Where an enquiry leads nowhere we delete the details after two years.

To prevent misuse of the form we count, for at most one hour, how many enquiries come from one connection. For that we use a check value of your IP address formed with a secret key, which is held only in memory and is not stored. The legal basis is Art. 6 (1) (f) GDPR with our legitimate interest in protecting this form against misuse.

We delete your data as soon as the purpose for which we collected it no longer applies. Where an enquiry or an order does not lead to a delivery, that happens after two years.

Where an order leads to a delivery, statutory retention duties under § 147 AO and § 257 HGB apply. We keep accounting vouchers for eight years, commercial letters for six years, and books and financial statements for ten years. Each period starts at the end of the calendar year in which the document was created. While such a duty applies we restrict the data instead of deleting it.

You have the following rights in relation to us, which you can exercise informally at mail@brandcircuit.de:

• Access to the data we process about you, under Art. 15 GDPR
• Rectification of inaccurate data, under Art. 16 GDPR
• Erasure under Art. 17 GDPR, unless a retention duty prevents it
• Restriction of processing, under Art. 18 GDPR
• Receipt of your data in a common format, under Art. 20 GDPR

Right to object: where we process your data on the basis of Art. 6 (1) (f) GDPR, meaning because of a legitimate interest, you may object to this processing at any time under Art. 21 GDPR on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. An informal objection to mail@brandcircuit.de is sufficient.

Independently of that you can lodge a complaint with a supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59 to 61, 10555 Berlin, Germany.

We take no decisions based solely on automated processing, and we do no profiling. Every order and every enquiry is looked at by a person.

We update this policy when the processing changes, for example because a new feature is added. The version available here is the one that applies.