Privacy policy

1. Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

BM Defence & Security AG
Forstweg 4 f
86420 Diedorf
Germany

Phone: +49 8238 9682800
E-mail: info@bm-ds.com

Further company details are given in the imprint.

2. Data protection officer

No data protection officer has been appointed. The legal requirements for a mandatory appointment are not met.

3. Overview

This website provides information. We process personal data only where this is technically required to provide the website, or where you send us details via a form or by email. We use no cookies, no audience measurement, no advertising or analytics services and no third party embeds such as maps, videos or social networks.

4. Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. On our behalf, the host processes the data that arise when the website is accessed (section 5). This is based on a data processing agreement pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in providing the website securely and reliably (Art. 6(1)(f) GDPR).

5. Server log files

Each time a page is accessed, your browser automatically transmits information to the server, which is stored in log files:

• IP address of the requesting device
• date and time of access
• requested address (URL) and amount of data transferred
• HTTP status code
• previously visited page (referrer), if your browser transmits it
• browser type, browser version and operating system

These data are not combined with other data sources. They serve the secure operation of the website, in particular the detection and prevention of attacks and errors. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted as soon as they are no longer required for these purposes.

6. Inquiry and datasheet forms

On the Engage page we offer two forms. We process the details you enter there:

• Secure inquiry: who is asking, name, organisation, work e-mail address, country of end use, end user, intended use and message
• Datasheet request: name, organisation, work e-mail address, country and the system or capability you are interested in
• in both forms, the confirmation that you have read this privacy policy

In addition, the form transmits technical details for spam protection: the time the form was loaded, the time until it was submitted and the content of a control field that is not visible to people. No third party spam protection service is used.

The purpose is to handle your inquiry, to assess every inquiry against European and national export control rules and, after checking the recipient, to send the requested datasheet by e-mail. The legal bases are Art. 6(1)(b) GDPR (pre-contractual measures at your request), Art. 6(1)(c) GDPR where export control obligations apply, and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering business inquiries).

On submission, the details are transmitted in encrypted form to our own server (section 4). No third party form service is involved. The server checks the details and forwards them by e-mail to our mailbox for inquiries. Our mailboxes and the sending of e-mail are provided by Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Microsoft processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR and stores it in data centres in the European Union (currently in Germany). To protect against mass submissions we store, per sender and for at most 24 hours, a non-reversible hash of the IP address formed with a secret key, together with the time of submission.

So that no inquiry is lost and we can track how it is handled, we also store the details from the form in a database on this server (section 4), together with the time of submission and the result of the spam check. The database is outside the publicly accessible area. Only employees named by us have access, through a protected login, and every access is logged. Purposes and legal bases are the same as above.

Providing the details is voluntary. Without the fields marked as required we cannot handle the inquiry. We delete the data once the inquiry has been fully handled, unless statutory retention obligations apply. Inquiries stored in the database are deleted automatically at the latest twelve months after receipt. If the inquiry leads to a contract, the retention periods under commercial and tax law apply.

7. Contact by email or phone

If you contact us by email or phone, we process your details to handle your request. Purpose, legal bases and retention period are as described in section 6.

8. Cookies, audience measurement and third party content

This website sets no cookies and uses no comparable techniques for recognising visitors. There is no audience measurement, and no advertising or analytics services are used. We therefore do not ask for consent. Only in the non-public administration area of the website do we set a technically necessary session cookie for logged-in employees.

Fonts and scripts are served from our own server. Opening the website establishes no connections to third party servers. The only exception is submitting a form (section 6).

9. Transfers to third countries

We do not transfer personal data to countries outside the European Union and the European Economic Area ourselves. Microsoft (section 6) stores the data of our mailboxes within the EU Data Boundary. Access from the United States cannot be ruled out in individual cases, for example for support or security operations. Microsoft Corporation is certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of data protection (Art. 45 GDPR). In addition, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR).

10. Encryption

The website is delivered exclusively over an encrypted connection (HTTPS). This also applies to the transmission of form data.

11. Your rights

With regard to personal data concerning you, you have the following rights towards us:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.

To exercise your rights, a message to info@bm-ds.com is sufficient.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

13. Automated decisions

No automated decision making, including profiling (Art. 22 GDPR), takes place.

14. Changes

We update this privacy policy when the website or the services used change. The version published here applies.