Privacy

1. General information
This privacy policy informs you about the nature, scope and purpose of the processing of personal data when you visit this website and when you contact us. Personal data is any data that can be used to identify you personally.

2. Legal bases
We only process personal data if there is a legal basis for doing so, in particular:
• Consent (Art. 6(1)(a) GDPR) – e.g. for Google Analytics
• Contract / pre-contractual measures (Art. 6(1)(b) GDPR) – e.g. requests for quotes and bookings
• Legal obligation (Art. 6(1)(c) GDPR) – e.g. retention obligations under tax law
• Legitimate interests (Art. 6(1)(f) GDPR) – e.g. IT security, error analysis, prevention of misuse
Where information is stored on or read from your device (e.g. cookies), this is additionally governed by Section 25 TDDDG.

3. Hosting & server log files
This website is hosted by Alfahosting GmbH, Ankerstraße 3b, 06108 Halle (Saale), Germany. We have concluded a data processing agreement with the provider (Art. 28 GDPR); it processes the data only on our instructions.
When you visit the website, the server automatically records information in so-called server log files: page/file accessed, date and time, amount of data transferred, notification of successful retrieval, browser type and version, operating system, referrer URL and IP address. This processing takes place in order to deliver the website and to ensure its stability and security (Art. 6(1)(f) GDPR). This data is not combined with other data sources. The log files are deleted regularly unless a specific security incident requires longer retention.

4. Contacting us (email / phone / enquiry form)
If you contact us, we process the information you provide (e.g. name, email address, phone number, preferred date, message) in order to handle your enquiry and answer any questions. The legal basis is Art. 6(1)(b) GDPR insofar as your enquiry is aimed at concluding a contract, and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR).
Enquiry form: Your name and email address are mandatory; without them we cannot reply. All other information is voluntary. The information is sent to us by email via our hosting provider's mail server and is not stored in a database. To protect against misuse (spam), we store a hash value of your IP address created with a secret key, together with the times of your submission attempts, in order to limit the number of enquiries per connection. This information is no longer taken into account after one hour and is then deleted automatically (Art. 6(1)(f) GDPR).
Storage period: We delete your enquiry as soon as it has been dealt with conclusively. If a contract is concluded, we keep the related correspondence for the statutory retention periods (up to ten years, e.g. Section 147 of the German Fiscal Code, AO).

5. Consent management
On your first visit, a banner asks whether you consent to statistics (Google Analytics). We store your choice and when you made it in your browser's local storage (entry “bf_consent”). This information is not transmitted to us. It is necessary so that we can respect your choice and do not have to ask again on every page view (Section 25(2) No. 2 TDDDG; Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). We ask again after twelve months.
Language choice: This website is available in German and English. Based on your browser's language setting, we automatically take you to the matching version (German, otherwise English). For this, a script only evaluates this setting in your browser; no data is transmitted to us. If you choose a language yourself using the DE / EN switch, we store this choice and when you made it for twelve months in your browser's local storage (entry “bf_lang”) so that the automatic redirection no longer takes place (Section 25(2) No. 2 TDDDG).
You can change your choice or withdraw your consent at any time via the cookie settings. Details can be found in our cookie policy.

6. Google Analytics 4
Only if you have given your consent do we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) to analyse the use of our website and improve it. Without consent, Google Analytics is not loaded and no connection to Google is established.
Data processed: a pseudonymous identifier (cookie), pages viewed, time spent and interactions, the source of the visit, technical information about your device and browser, and the approximate location that Google derives from your IP address. IP addresses are not stored in Google Analytics 4.
Cookies: “_ga” and “_ga_CXSJKPX38K”, each stored for up to two years.
Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
Data processing and third countries: We have concluded a data processing agreement with Google. Data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which there is an adequacy decision by the EU Commission (Art. 45 GDPR).
Storage period: The analytics data is deleted automatically after the period set in our account (at most 14 months).
Withdrawal: You can withdraw your consent with effect for the future at any time via the cookie settings. We will then delete the Analytics cookies on your device and no longer load Google Analytics.
Further information: Google Privacy Policy.

7. Fonts
This website uses fonts to ensure a consistent appearance. The fonts are embedded locally and are loaded exclusively from our own server. No connection to servers of Google or other third parties is established.

8. Links to other websites and platforms
Our website contains links to our profiles on Facebook and Instagram, to our Google Business Profile, to our 3D tour on Matterport and to the websites of our partners and suppliers. These are simple links: the respective page is only accessed when you click on a link. No data is transferred to these providers beforehand. Once you leave our site, the privacy policy of the respective provider applies.

9. Recipients
We only pass on personal data if this is necessary for the performance of a contract, if there is a legal obligation or if you have given your consent. Recipients are our hosting and email service provider and – only with your consent – Google (see No. 6). These service providers process the data as processors only on our instructions.

10. Storage period
Unless a specific period is stated in this policy, we only store personal data for as long as is necessary for the respective purpose. It is then deleted, unless statutory retention obligations (e.g. under commercial or tax law) prevent this.

11. Your rights
Provided the legal requirements are met, you have the following rights:
• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
An informal message to info@barformat.de is sufficient for a request.

12. Right to object (Art. 21 GDPR)
If we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

13. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragter für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

14. No automated decision-making
No automated decision-making, including profiling (Art. 22 GDPR), takes place.

15. SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, such as your enquiries, this website uses SSL/TLS encryption.

16. Changes to this privacy policy
We adapt this privacy policy when the legal situation or our website changes. The version published here at any given time applies.

Last updated: 13 November 2026