Privacy Policy

Below we provide information about the processing of personal data when using our website www.bestwater.de. Personal data are all data that can be personally attributed to you, e.g. name, address, email addresses, user behaviour. We have implemented extensive technical and organisational security measures to protect your data from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security procedures are regularly reviewed and adapted to technological progress.

1. Controller for data processing

2. Contact details of the data protection officer

3. Collection of personal data when visiting our website

4. Data protection information for customers and interested parties

5. Your rights

1. Controller for data processing

Controller according to Art. 4 para. 7 EU General Data Protection Regulation (GDPR) is

BWI BestWater GmbH
Hermann-Löns-Straße 17
14547 Beelitz
Email: info@bestwater.de

2. Contact details of the data protection officer

If you have any questions about data protection, please contact our external data protection officer:

Personal/confidential

To the Data Protection Officer of BWI BestWater GmbH
intersoft consulting services AG
Beim Strohhause 17
20097 Hamburg
Email: DSB-Bestwater@intersoft-consulting.de

3. Collection of personal data when visiting our website

3.1 Informational use of our website

When using the website purely for informational purposes, i.e. if you do not register or otherwise provide us with information (e.g. via a contact form), we collect the following technical information (log file data):

IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request, access status/HTTP status code, amount of data transferred, website from which the request originates, browser, operating system and its interface, language and version of the browser software.

The collection of this data is technically necessary to display our website to you and to ensure stability and security. We (and our service provider) do not regularly know who is behind an IP address. We do not combine the above data with other data.

The legal basis for this is Art. 6 para. 1 lit. f GDPR. The collection of data is necessary for the provision of the website and the storage in log files for the operation of the website and to protect against misuse, so our legitimate interest in data processing outweighs at this point.

Since the collection of data for the provision of the website and the storage in log files for the operation of the website and to protect against misuse is absolutely necessary, our legitimate interest in data processing outweighs at this point.

3.2 Registration on our website

You have the option to register with us and create a customer account. For registration, we collect and store the following data from you:

· Salutation

· First name

· Last name

· Email address

· Password

· Address

We use the so-called double opt-in procedure for registration, i.e. your registration is only completed when you have confirmed your registration by clicking on the link contained in a confirmation email sent to you for this purpose. If your confirmation does not take place within 3 days, your registration will be automatically deleted from our database. The provision of the aforementioned data is mandatory; all other information can be provided voluntarily by using our portal.

After successful registration, you will receive a personal, password-protected access and can view and manage the data you have stored. Registration is voluntary but may be a prerequisite for using our services.

If you use our portal, we store your data necessary for contract fulfilment, including payment details if applicable, until you permanently delete your access. Furthermore, we store the voluntary data you provide for the duration of your use of the portal, unless you delete them beforehand. All information can be managed and changed in the protected customer area. Legal bases are Art. 6 para. 1 a, b and f GDPR.

3.3 Contact via email, telephone and contact form

When you contact us by email, the data you provide (your email address, possibly your name, your telephone number, content of the message, possibly attachments as well as technical metadata) are stored by us to answer your questions. Your data will not be passed on to third parties. The data will only be used to process the enquiry.

The legal basis for processing the data when contacting us by email, which is necessary to answer your question and to process your request, is Art. 6 para. 1 lit. f GDPR. Additional information voluntarily provided by you as well as the use of certain communication channels (e.g. callback by telephone) are processed based on your consent (Art. 6 para. 1 lit. a GDPR), which you can revoke at any time with effect for the future. Depending on the specific design of your enquiry and our customer relationship, contact may also take place within the framework of a (pre-)contractual service relationship between us (Art. 6 para. 1 lit. b GDPR).

Your data received in the course of contact will be deleted as soon as they are no longer required to achieve the purpose for which they were collected, your request has been fully processed and no further communication with you is necessary or desired by you.

3.4 Newsletter

3.4.1 General information

You have the option to subscribe to our newsletter on our website, with which we inform you about our current offers. The legal basis for sending the newsletter is your consent according to Art. 6 para. 1 sentence 1 lit. a GDPR in conjunction with § 7 para. 2 no. 3 UWG or the legal permission according to § 7 para. 3 UWG.

For registration to our newsletter, we use the so-called double opt-in procedure. This means that after your registration, we send you an email to the specified email address asking you to confirm that you wish to receive the newsletter. If you do not confirm your registration within 3 days, your information will be automatically deleted.

The only mandatory information for sending the newsletter is your email address. Providing further data is voluntary: this data is used to address you personally. After your confirmation, we store your email address for the purpose of sending the newsletter until you revoke your consent.

We also store your current IP address at the time of registration, the time of registration and the confirmation for up to three years after registration (statute of limitations). The purpose of this procedure is to be able to prove your registration in case of doubt and, if necessary, to clarify misuse of your personal data. The legal basis for logging the registration is our legitimate interest according to Art. 6 para. 1 sentence 1 lit. f GDPR in proving a previously given consent, see also Art. 7 para. 1 GDPR.

You can revoke your consent to receive the newsletter at any time, e.g. by clicking on the link provided in every newsletter email, and unsubscribe from the newsletter.

3.4.2 Newsletter tracking

We point out that when sending the newsletter, we evaluate your user behaviour to determine whether and when the newsletter was opened. For this evaluation, the sent emails contain so-called web beacons or tracking pixels, which are stored on our server and loaded when the newsletter is opened. Technical information such as browser type, time of opening and IP address are transmitted. For the evaluations, we link the mentioned data and the web beacons with your email address and an individual ID. Links received in the newsletter also contain this ID and enable us to analyse your click behaviour.

With the data obtained in this way, we create a user profile to tailor the newsletter to your individual interests. We record when you read our newsletters, which links you click in them and infer your personal interests. We link this data with actions you have taken on our website. The legal basis for this data processing is your consent, Art. 6 para. 1 sentence 1 lit. a GDPR.

You can revoke your consent to tracking at any time with effect for the future by clicking the separate link provided in every email.

Such tracking is also not possible if you have disabled the display of images by default in your email program. In this case, the newsletter will not be displayed completely and you may not be able to use all functions. If you manually allow images to be displayed, the above-mentioned tracking takes place.

The information from the tracking is stored as long as you have subscribed to the newsletter. After unsubscribing, the data is anonymised and used for purely statistical purposes.

The data you have provided to us for the purpose of receiving the newsletter will be stored by us until you unsubscribe from the newsletter and deleted after unsubscribing. Data stored for other purposes remains unaffected.

3.5 Online orders - shop

If you place an order in our online shop, we process the data necessary for the conclusion, execution and processing of the purchase contract. This includes in particular master data (e.g. name, billing/delivery address), contact data (email, telephone), order data (items, shopping cart, prices, delivery/payment status, returns/warranty), communication content (e.g. queries, service cases) as well as payment data.

The processing is carried out for the purpose of contract initiation and fulfilment including necessary customer communication, shipping, payment processing, returns/warranty (Art. 6 para. 1 lit. b GDPR). In addition, processing takes place to fulfil legal obligations (e.g. commercial/tax retention, Art. 6 para. 1 lit. c GDPR). Furthermore, we process your data based on our legitimate interests in fraud/abuse prevention, IT/process security (Art. 6 para. 1 lit. f GDPR). If you create a customer account or consent to further uses (e.g. marketing, wish lists, reviews), processing also takes place on the basis of Art. 6 para. 1 lit. a GDPR. Consents can be revoked at any time with effect for the future.

We integrate payment service providers. These are independently responsible and receive the data necessary for the payment process directly from you or via a secure interface. We do not store complete payment data (e.g. credit card numbers), but possibly transaction IDs/tokens or the last digits for proof and assignment purposes. The legal basis is contract processing (Art. 6 para. 1 lit. b GDPR) as well as our legitimate interest in secure payment processing/fraud prevention (Art. 6 para. 1 lit. f GDPR).

3.6 Applications

You can apply to our company by post or electronically via email. Please note that emails sent unencrypted are not transmitted with access protection.

Your information will be used to process your application and to decide on the establishment of an employment relationship. The legal basis is Art. 6 para. 1 lit. b GDPR. Furthermore, your personal data may be processed insofar as this is necessary to defend against asserted legal claims arising from the application process against us. The legal basis for this is Art. 6 para. 1 sentence 1 lit. f GDPR. The legitimate interest in processing is also contained in the stated purposes.

If an employment relationship is established between you and us, we may continue to process the personal data already received from you for the purposes of the employment relationship in accordance with Art. 6 para. 1 lit. b GDPR if this is necessary for the implementation or termination of the employment relationship or for the exercise or fulfilment of rights and obligations arising from a law or a collective agreement, company or service agreement (collective agreement) of the employees' representation.

No processing of your application data beyond the described use takes place.

Your personal data will be deleted after the application process is completed, at the latest after 6 months, unless there are other legitimate interests on our part opposing deletion or you have given us consent for longer storage. Other legitimate interests in this sense include, for example, an obligation to provide evidence in proceedings under the General Equal Treatment Act (AGG).

3.7 Cookies

Cookies are data stored on your computer by a website you visit and allow your browser to be reassigned. Cookies transmit information to the entity that sets the cookie. Cookies can store various information, such as your language setting, the duration of your visit to our website or your inputs made there. This avoids, for example, that you have to re-enter required form data every time you use it. The information stored in cookies can also be used to recognise preferences and tailor content to areas of interest.

There are different types of cookies: Session cookies are data amounts that are only temporarily held in memory and deleted when you close your browser. Permanent or persistent cookies are automatically deleted after a specified period, which can vary depending on the cookie. The information can also be stored in text files on your computer with this type of cookie. However, you can also delete these cookies at any time via your browser settings.

First-party cookies are set by the website you are currently visiting. Only this website may read information from these cookies. Third-party cookies are set by organisations that are not operators of the website you are visiting. These cookies are used, for example, by marketing companies.

The legal bases for possible processing of personal data by means of cookies and their storage duration may vary. If you have given us consent, the legal basis is Art. 6 para. 1 sentence 1 lit. a GDPR. If data processing is based on our overriding legitimate interests, the legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. The stated purpose then corresponds to our legitimate interest.

We use cookies to ensure the proper operation of the website, to provide basic functionalities, for reach measurement and - with your consent - to tailor our services to preferred areas of interest.

You can delete cookies already stored on your device at any time. If you want to prevent the storage of cookies, you can do so via the settings in your internet browser. Alternatively, you can also install so-called ad blockers. Please note that some functions of our website may not work if you have disabled the use of cookies.

When you visit our website, all users of our website are also informed by an info banner about the use of cookies by us and referred to this privacy notice. You as a user are also asked for your consent to the use of certain cookies, especially those relevant for personalising services and for marketing measures. Any consent you give here can be revoked at any time with effect for the future by accessing the cookie settings and removing the tick from the processing you had consented to.

3.8 Google Analytics

If you have given your consent, Google Analytics, a web analysis service of Google LLC, is used on this website. The responsible entity for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

Scope of processing

Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected by the cookies about your use of this website is usually transmitted to a Google server in the USA and stored there.

With Google Analytics 4, IP address anonymisation is activated by default. Due to IP anonymisation, your IP address is shortened by Google within member states of the European Union or other contracting states of the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser within the scope of Google Analytics is not merged with other data from Google.

During your website visit, your user behaviour is recorded in the form of "events". Events can be:

– Page views

– First visit to the website

– Session start

– Your "click path", interaction with the website

– Scrolls (whenever a user scrolls to the bottom of the page (90%))

– Clicks on external links

– Internal search queries

– Interaction with videos

– Viewed/clicked ads

Furthermore, the following is recorded:

– Your approximate location (region)

– Your IP address (in shortened form)

– Technical information about your browser and the devices you use (e.g. language setting, screen resolution)

– Your internet provider

– The referrer URL (which website/advertising medium you came from to this website)

Purposes of processing

On behalf of the operator of this website, Google will use this information to evaluate your pseudonymous use of the website and to compile reports on website activity. The reports provided by Google Analytics serve to analyse the performance of our website and the success of our marketing campaigns.

Recipients

Recipients of the data are/can be

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor according to Art. 28 GDPR)

Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

Alphabet Inc., 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

It cannot be ruled out that US authorities access the data stored by Google.

Third country transfer

If data is processed outside the EU/EEA and no data protection level corresponding to the European standard exists, we have concluded EU standard contractual clauses with the service provider to establish an adequate level of data protection. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be excluded. The USA are currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not have legal remedies against access by authorities.

Storage duration

The data we send and link to cookies are automatically deleted after 14 months. The deletion of data whose retention period has been reached takes place automatically once a month.

Legal basis

The legal basis for this data processing is your consent according to Art. 6 para. 1 sentence 1 lit. a GDPR and § 25 para. 1 TTDSG.

Revocation

You can revoke your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. The legality of the processing carried out on the basis of the consent until revocation remains unaffected.

Alternatively, you can prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may lead to restrictions in functionality on this and other websites. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by

a. not giving your consent to the setting of the cookie or

b. downloading and installing the browser add-on to deactivate Google Analytics HERE.

Further information on the terms of use of Google Analytics and on data protection at Google can be found at https://marketingplatform.google.com/about/analytics/terms/de/

and at https://policies.google.com/?hl=de.

3.9 YouTube

We use services from YouTube, LLC, 901 Cherry Ave., 94066 San Bruno, CA, USA, a subsidiary of Google Inc., Amphitheatre Parkway, Mountain View, CA 94043, USA, on our website. For users who have their usual residence in the European Economic Area or Switzerland, Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland, is the responsible controller for your data.

We use a two-click solution to protect your personal data. When you visit a page where a YouTube video is embedded, a connection to the YouTube servers is only established when you click the "Confirm" button. YouTube will then set cookies and use your visit data for its own purposes. If you are logged into YouTube at this time, the information about the videos you have watched will be assigned to your YouTube member account. You can prevent this by logging out of your member account before visiting our website. If data is processed outside the European Economic Area / EU, where no data protection level corresponding to the European standard exists, Google states that it uses standard contractual clauses.

Further information on YouTube's data protection is provided by Google at the following link: https://www.google.de/intl/de/policies/privacy/

3.10 Data transmission and recipients

Your data will generally not be transmitted to third parties unless we are legally obliged to do so, or the data transfer is necessary for the execution of the contractual relationship, or you have previously expressly consented to the transfer of your data.

External service providers and partner companies only receive your data to the extent necessary to process your order. In these cases, however, the scope of the transmitted data is limited to the necessary minimum. To the extent that our service providers come into contact with your personal data, we ensure within the framework of order processing according to Art. 28 GDPR that they comply with the provisions of data protection laws in the same way. Please also note the respective data protection notices of the providers. The respective service provider is responsible for the content of third-party services, whereby we check the services for compliance with legal requirements within the scope of reasonableness.

We place great value on processing your data within the EU / EEA. However, it may happen that we use service providers who process data outside the EU / EEA. In these cases, we ensure that an adequate level of data protection is established with the recipient before transferring your personal data.

4. Your rights

You have the following rights towards us regarding your personal data:

4.1 General rights

You have the right to information, correction, deletion, restriction of processing, objection to processing and data portability. If processing is based on your consent, you have the right to revoke it with effect for the future.

4.2 Rights regarding data processing based on legitimate interest

You have the right according to Art. 21 para. 1 GDPR to object at any time for reasons arising from your particular situation to the processing of personal data concerning you which is carried out on the basis of Art. 6 para. 1 e GDPR (data processing in the public interest) or Art. 6 para. 1 f GDPR (data processing to protect a legitimate interest), including profiling based on this provision. In the event of your objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

4.3 Rights regarding direct marketing

If we process your personal data for direct marketing purposes, you have the right according to Art. 21 para. 2 GDPR to object at any time to the processing of personal data concerning you for such marketing purposes, including profiling insofar as it is related to such direct marketing.

In the event of your objection to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

4.4 Right to complain to a supervisory authority

You also have the right to complain to a competent data protection supervisory authority about the processing of your personal data by us.

As of 06.2026