Privacy policy

01

Controller and contact

Email: hi@bonusleben.de
Phone: +49 89 2500 77 44 5

You can contact us at any time with questions about data protection or to exercise your rights.

02

Visiting this website

When you visit this website, we process your IP address, the date and time of access, the page requested, the HTTP status, and browser and device information. If your browser provides it, we also record the previously visited page. This data is necessary to provide the website, resolve technical errors and prevent unauthorised access.

We use Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, for hosting. Vercel processes data on our behalf. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to provide this website securely and reliably.

Application logs available through hosting are retained for no more than 30 days. If individual log entries are needed to investigate a specific security incident, we retain them until the investigation is complete and, where necessary, longer to establish or defend legal claims.

03

Contacting us

When you use our contact form or contact us by email or phone, we process your name, company, contact details and the information you provide about your enquiry. The contact form also records your selected workforce size; your phone number and message are optional. We use this data to handle your enquiry and related communications.

If your enquiry concerns entering into or performing a contract with you, the legal basis is Article 6(1)(b) GDPR. For other enquiries, or if you act as a company contact, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is handling business enquiries.

Providing your details is voluntary. Without sufficient information about your enquiry and a way to contact you, we may be unable to respond.

The contact form is transmitted using the Resend email service provided by Plus Five Five, Inc., 2261 Market Street STE 10407, San Francisco, CA 94114, USA. Resend processes form data on our behalf and forwards the enquiry to our mailbox. We use Microsoft 365 for subsequent email communications. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Access is granted to employees handling your enquiry and service providers engaged to operate and support our communications systems, insofar as necessary for their tasks.

We delete enquiry data once the matter has been fully resolved and there are no statutory retention obligations or legitimate reasons for further storage. Under section 257 of the German Commercial Code (HGB), commercial and business correspondence is generally retained for six years from the end of the calendar year in which it was received or sent. The legal basis is Article 6(1)(c) GDPR. Where data is needed to establish or defend legal claims, it is retained on the basis of Article 6(1)(f) GDPR until the claims have been resolved or the relevant limitation period has expired.

04

Transfers to third countries

When using Vercel, Resend and Microsoft, personal data may also be processed outside the European Union and the European Economic Area, particularly in the USA.

The providers’ data protection agreements include EU standard contractual clauses under Article 46(2)(c) GDPR for relevant transfers. These contractually require recipients to comply with data protection safeguards. The agreements are available at Vercel – Data Processing Agreement, Resend – Data Processing Agreement and Microsoft – Data Protection Addendum. You may also request a copy of the relevant safeguards from us.

05

Your data protection rights

Subject to the statutory requirements, you have the following rights:

• Access to information about the processing of your personal data (Article 15 GDPR);
• Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR);
• Erasure of your data (Article 17 GDPR);
• Restriction of processing (Article 18 GDPR);
• Data portability for automated processing based on consent or a contract (Article 20 GDPR).

Right to object under Article 21 GDPR: If processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

To exercise your rights, simply email hi@bonusleben.de or write to our postal address above.

06

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), particularly in the place of your habitual residence, place of work or the alleged infringement. The authority responsible for our registered office is:

Last updated: September 2026