Privacy policy

Introduction and general information

The protection of your personal data is very important to us. Below you will find information on how we handle the data collected through your use of our website. Your data is processed in accordance with the statutory data protection regulations.

Controller within the meaning of the GDPR

BRAND CONCEPTS GmbH
Westendstr. 30
80339 Munich, Germany
+49 (0)89-212312940
info@brandconcepts.de

Contact details of the data protection officer

Proliance GmbH / www.datenschutzexperte.de
Data protection officer
Leopoldstr. 21
80802 Munich, Germany
datenschutzbeauftragter@datenschutzexperte.de

When contacting the data protection officer, please state the company your enquiry refers to. Please do not attach sensitive information, such as a copy of your ID, to your enquiry.

Definitions

Our privacy policy is intended to be simple and understandable for everyone. As a rule, it uses the official terms of the General Data Protection Regulation (GDPR). The official definitions are explained in Art. 4 GDPR.

Access to and storage of information in terminal equipment

When you use our website, information (e.g. your IP address) may be accessed or information (e.g. cookies) may be stored in your terminal equipment. Such access or storage may involve further processing of personal data within the meaning of the GDPR.

Where such access to or storage of information is strictly necessary for the technically error-free provision of our services, this takes place on the basis of Section 25 (1) sentence 1, (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Where such a process serves other purposes (e.g. designing our website according to demand), it only takes place on the basis of Section 25 (1) TDDDG with your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future. The processing of your personal data is subject to the GDPR and the German Federal Data Protection Act (BDSG).

Further information on the processing of your personal data and the relevant legal bases can be found in the following sections on the specific processing activities on our website.

Web hosting

This website is hosted by an external service provider (host). The website is hosted in Germany. Personal data collected on this website is stored on the host’s servers. This may include, in particular, IP addresses, contact requests, meta and communication data, website access data and other data generated via a website.

We collect this data to ensure a smooth connection to the website and the technically error-free provision of our services. Processing this data is strictly necessary to make the website available to you. The legal basis for the processing is our legitimate interest in the correct presentation and functionality of our website pursuant to Art. 6 (1) (f) GDPR.

We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR, in which we oblige the provider to protect our customers’ data and not to pass it on to third parties.

Server log files

When you visit our website, it is technically necessary for data to be transmitted to our web server via your internet browser. The following data is recorded during an ongoing connection for communication between your internet browser and our web server:

• Date and time of the request
• Name of the requested file
• Page from which the file was requested
• Access status
• Web browser and operating system used
• (Complete) IP address of the requesting computer

We collect this data to ensure a smooth connection to the website and the technically error-free provision of our services. Processing this data is strictly necessary to make the website available to you. The log files are used to evaluate system security and stability and for administrative purposes. The legal basis for the processing is our legitimate interest in the protection and functionality of our website pursuant to Art. 6 (1) (f) GDPR.

For reasons of technical security, in particular to fend off attacks on our web server, we store this data for a short period. The data is deleted after 30 days at the latest.

In addition, the data may be processed in anonymised form for statistical purposes. This data is never stored together with other personal data of the user, compared with other data sets or passed on to third parties.

External links

Social networks (Instagram, LinkedIn) are only included on our website as links to the respective services. After clicking the text or image link, you are redirected to the website of the respective provider. User information is only transferred to the respective provider after this redirection. For information on how your personal data is handled when using these websites, please refer to the privacy policies of the respective providers.

Contact form and enquiries by email

If you contact us via the contact form on our website or by email, we process the data you provide (e.g. name, email address, company, subject and message) in order to handle and answer your enquiry. Mandatory fields are marked in the form.

The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to the performance of a contract or is necessary for taking steps prior to entering into a contract. In all other cases, the processing is based on our legitimate interest in handling the enquiries addressed to us effectively (Art. 6 (1) (f) GDPR) and on the consent you give in the form (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future.

The information from the contact form is sent to us by email and additionally stored in our website’s database so that no enquiry gets lost. In addition to your details, the page from which you sent the form as well as your browser and operating system are stored, but not your IP address. The database entries are deleted automatically after six months. We keep your enquiry itself until it has been dealt with conclusively; statutory retention obligations remain unaffected.

To protect against spam, the form contains invisible check fields (so-called honeypots). No cookies are set and no data is transferred to third parties for this purpose.

Applications

If you apply to us via the application form on our website or by email, we process your details (e.g. name, contact details, the position you are applying for and your message) and the documents you submit (e.g. CV, cover letter, references) in order to decide on establishing an employment relationship. The legal basis is Art. 6 (1) (b) GDPR. If you voluntarily provide us with special categories of personal data (e.g. information on health or severe disability), we process them in accordance with Art. 9 (2) (b) GDPR.

The application form sends your details and documents by email to the persons in our company responsible for the application process. Uploaded files are only stored temporarily on the web server in a directory that is not publicly accessible, solely for sending, and are then deleted automatically. We do not store applications in the website’s database. You can attach up to three files in PDF, JPG or PNG format with a maximum of 5 MB each.

If no employment relationship is established, we delete your application documents no later than six months after the end of the application process, unless you have consented to longer storage or longer retention is necessary for the establishment, exercise or defence of legal claims (e.g. under the German General Equal Treatment Act). If an employment relationship is established, we add your documents to your personnel file.

Data transfer and recipients

Your personal data will not be transferred to third parties, except

• where we have explicitly pointed this out in the description of the respective data processing,
• where you have given your express consent in accordance with Art. 6 (1) sentence 1 (a) GDPR,
• where the transfer is necessary in accordance with Art. 6 (1) sentence 1 (f) GDPR for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in your data not being transferred,
• where there is a legal obligation for the transfer in accordance with Art. 6 (1) sentence 1 (c) GDPR, and
• where this is necessary in accordance with Art. 6 (1) sentence 1 (b) GDPR for the performance of contractual relationships with you.

In addition, we use external service providers to deliver our services. We have selected them carefully, commissioned them in writing and, where necessary, concluded data processing agreements with them in accordance with Art. 28 GDPR. They are bound by our instructions and are checked by us regularly. These include, among others, service providers for hosting, sending emails and the maintenance and support of our IT systems. The service providers will not pass this data on to third parties.

Data security

In accordance with Art. 32 GDPR, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. For security reasons and to protect the transmission of confidential content, this website uses SSL encryption.

Storage period of personal data

The storage period of personal data is based on the relevant statutory retention periods (e.g. under commercial and tax law). After the respective period has expired, the data is routinely deleted. Where data is required for the performance or initiation of a contract or where we have a legitimate interest in continued storage, the data is deleted when it is no longer required for these purposes or when you exercise your right of withdrawal or objection.

Your rights

Below you will find information on the rights that applicable data protection law grants you as a data subject vis-à-vis the controller with regard to the processing of your personal data:

The right to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you can request information about the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data if it was not collected by us, and the existence of automated decision-making including profiling and, where applicable, meaningful information about its details.

The right to request the immediate rectification of incorrect or the completion of your personal data stored by us in accordance with Art. 16 GDPR.

The right to request the erasure of your personal data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.

The right to request the restriction of the processing of your personal data in accordance with Art. 18 GDPR if you contest the accuracy of the data, if the processing is unlawful but you oppose its erasure, if we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or if you have objected to the processing in accordance with Art. 21 GDPR.

The right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller in accordance with Art. 20 GDPR.

The right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of the federal state in which our registered office stated above is located or, where applicable, the authority of your usual place of residence or workplace.

The right to withdraw consent in accordance with Art. 7 (3) GDPR: you have the right to withdraw consent to the processing of data at any time with effect for the future. In the event of withdrawal, we will delete the data concerned without delay, unless further processing can be based on a legal basis for processing without consent. Withdrawing consent does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal.

Right to object

If we process your personal data on the basis of legitimate interests in accordance with Art. 6 (1) sentence 1 (f) GDPR, you have the right under Art. 21 GDPR to object to the processing of your personal data on grounds relating to your particular situation. If your objection concerns the processing of personal data for direct marketing purposes, you have a general right to object without having to state a particular situation.

If you would like to exercise your right of withdrawal or objection, simply send an email to info@brandconcepts.de.

Legal obligations

Providing personal data for the decision on concluding a contract, for the performance of a contract or for taking steps prior to entering into a contract is voluntary. However, we can only make a decision in the context of contractual measures if you provide the personal data required for concluding the contract, performing the contract or taking pre-contractual steps.

Automated decision-making

There is no automated decision-making or profiling in accordance with Art. 22 GDPR.

Changes to this privacy policy

We reserve the right to adapt or update this privacy policy where necessary in compliance with the applicable data protection regulations. This allows us to adapt it to current legal requirements and to take changes to our services into account, e.g. when introducing new services. The current version applies to your visit.

Version of this privacy policy: September 2026