Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

BnB Academy UG (haftungsbeschränkt), Nördliche Auffahrtsallee 25, 80638 Munich, Germany, phone: +49 89 69314203, email: info@bnb-academy.de, represented by its managing director Laurin Henkel.

No data protection officer has been appointed, as the legal requirements for this are not met.

2. General information on data processing

We process personal data only to the extent necessary to provide a functional website and our content and services, or where permitted by law or based on your consent. The legal bases are in particular Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interest).

Personal data is deleted as soon as the purpose of storage no longer applies and no statutory retention obligations stand in the way. Retention periods under commercial and tax law are generally six or ten years (Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO)).

3. Accessing the website and server log files

When you access our website, information is automatically transmitted to the server and temporarily stored in a log file: IP address, date and time of access, page accessed, amount of data transferred, referrer URL, browser used and operating system.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free operation and delivery of the website and in ensuring IT security. The log data is deleted as soon as it is no longer required for the stated purposes.

Our website is hosted by an external service provider. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

4. Cookies and consent management

We use technically necessary cookies that are required for the operation of the website. The legal basis is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(f) GDPR.

Non-essential cookies and comparable technologies – for example for statistics or marketing – are only used with your express consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future via the cookie settings.

5. Contact and requesting an initial consultation

If you contact us via the contact or appointment form, by email or by phone, we process the data you provide – usually name, email address, phone number and details of your project – to handle your request.

The legal basis is Art. 6(1)(b) GDPR insofar as the request is aimed at concluding a contract, and otherwise Art. 6(1)(f) GDPR. The data is deleted once the request has been fully processed and no retention obligations apply.

6. Free guides and download offers

To deliver our free guides, we process your email address and the data you provide in order to send you the documents. The legal basis is Art. 6(1)(b) GDPR. If the download is combined with a subscription to our newsletter, section 7 also applies.

7. Newsletter

To send our newsletter, we process your email address and – where provided – your name. Subscription uses the double opt-in procedure: after signing up, you receive an email asking you to confirm your subscription. The time of sign-up, the time of confirmation and the IP address are logged as proof of consent.

The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the unsubscribe link in every email or by sending us a message. The lawfulness of processing carried out before withdrawal remains unaffected.

We use an external service provider for sending. A data processing agreement pursuant to Art. 28 GDPR is in place.

8. Contract performance, coaching and learning platform

To provide our coaching and training services, we process master, contract and billing data, the information about your project shared in the course of our cooperation, and your usage data on the learning platform and in the participant community.

The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for retention obligations under tax law.

Where we use external services for this – for example for video conferencing, the learning platform, the community or invoicing – data processing agreements pursuant to Art. 28 GDPR are in place with these providers.

Live sessions are only recorded with your prior consent (Art. 6(1)(a) GDPR).

9. Payment processing

For paid bookings, your payment data is transmitted to the payment service provider you select. The legal basis is Art. 6(1)(b) GDPR. The payment service providers are themselves responsible for processing within their own area of responsibility; their privacy notices apply in this respect.

10. Social media profiles

We maintain profiles on social networks in order to communicate with interested parties there. When you visit these profiles, the operators process your data under their own responsibility; in some cases there is joint responsibility pursuant to Art. 26 GDPR for page insights. The legal basis for our presence is Art. 6(1)(f) GDPR. Please refer to the privacy notices of the respective provider for details.

11. Recipients and transfers to third countries

Your data is only disclosed where necessary for the performance of the contract, where you have consented or where there is a legal obligation. Recipients are in particular IT service providers, payment service providers, our tax advisor and – in the event of legal enforcement – lawyers.

Where data is transferred to recipients in third countries, this is done on the basis of an adequacy decision of the European Commission (Art. 45 GDPR) or on the basis of the standard contractual clauses (Art. 46(2)(c) GDPR) together with supplementary safeguards.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and the right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object: you have the right to object at any time, on grounds relating to your particular situation, to the processing of your data based on Art. 6(1)(f) GDPR (Art. 21(1) GDPR). Where your data is processed for direct marketing purposes, you may object at any time without giving reasons (Art. 21(2) GDPR).

To exercise your rights, a message to info@bnb-academy.de is sufficient.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany, www.lda.bayern.de.

14. Obligation to provide data

You are neither legally nor contractually obliged to provide your data. However, without the data required for contract performance we cannot conclude or perform a contract with you. No automated decision-making, including profiling, pursuant to Art. 22 GDPR takes place.

15. Changes to this privacy policy

We adapt this privacy policy as soon as changes to our offers or to the legal situation require it. The version available on this page at the time applies.