1. Controller
The controller responsible for the processing of personal data on this website is:
Bernhardt Apparatebau GmbH & Co. KG
Bredhornweg 39
25488 Holm
Germany
Telephone: +49 4103 125-0
E-mail: info@secumar.com
Bernhardt Apparatebau GmbH & Co. KG is represented by its general partner, SECUMAR-Rettungsgeräte GmbH, which is in turn represented by its managing director, Benjamin Bernhardt, Dipl.-Wirtsch.-Inf. (FH).
2. Data Protection Officer
Our external data protection officer is:
Dr Sebastian Kraska
IITR Datenschutz GmbH
Marienplatz 2
80331 Munich
Germany
Telephone: +49 89 1891 7360
E-mail: email@iitr.de
If you have any questions about the processing of your personal data or wish to exercise your data protection rights, you may contact our data protection officer directly.
3. General Information on Data Processing
We process personal data only to the extent necessary to provide this website, to handle enquiries, to carry out pre-contractual measures and contracts, to provide our customer and shop functions, to comply with legal obligations, or on the basis of valid consent.
Depending on the specific processing activity, the processing is based in particular on the following legal grounds:
Art. 6(1)(a) GDPR, where you have given your consent.
Art. 6(1)(b) GDPR, where the processing is necessary for the performance of a contract or the implementation of pre-contractual measures.
Art. 6(1)(c) GDPR, where we are subject to a legal obligation requiring the processing.
Art. 6(1)(f) GDPR, where the processing is necessary to safeguard our legitimate interests or those of a third party, provided that such interests are not overridden by your interests or fundamental rights and freedoms.
The storage of information on your terminal device, or access to information already stored there, is additionally subject to the requirements of Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
4. Retention Period
We store personal data only for as long as necessary for the respective purpose of processing.
Where statutory retention obligations exist under commercial, tax, or other law, we store the relevant data for the duration of the applicable statutory retention period. Once this period expires, the data is deleted, unless another legal basis exists for further storage.
Where processing is based on your consent, the data is generally stored until you withdraw your consent or until the purpose of processing no longer applies, unless statutory provisions require further storage.
5. Recipients of Personal Data
Within our company, only those departments that require personal data to perform their tasks are given access to it.
We engage external service providers for certain technical and organisational tasks. These may include, in particular, providers of hosting, website maintenance and support, IT services, newsletter dispatch, payment processing, and shipping and logistics.
Where such service providers process personal data on our behalf, they are engaged on the basis of a data processing agreement pursuant to Art. 28 GDPR.
Data is disclosed to other recipients only where this is necessary for the performance of a contract, where a legal obligation exists, where you have given your consent, or where another legal basis permits the transfer.
6. Hosting and Server Log Files
When you access our website, technically necessary data is processed by the web server. This may include, in particular:
The IP address of the accessing device, the date and time of access, the page or file accessed, the amount of data transferred, browser type and version, operating system, the previously visited website, and messages indicating successful retrieval.
The processing of this data is necessary to technically provide the website, to ensure its stability and security, and to detect technical faults and unauthorised access attempts.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and uninterrupted operation of our website.
Server log data is stored only for as long as necessary for secure operation, fault analysis, and defence against unauthorised access. Longer storage takes place only where there is a specific reason or a legal obligation to do so.
7. Encrypted Data Transmission
Our website uses TLS encryption. This protects data transmitted between your browser and our server from unauthorised access during transmission.
You can recognise an encrypted connection in particular by the use of https in your browser’s address bar.
8. Cookies and Other Storage Technologies
Our website uses cookies and, where applicable, comparable technologies. These allow information to be stored on your terminal device or existing stored information to be accessed.
We use technically essential cookies and storage access where necessary to provide a digital service that you have expressly requested. This may include, in particular, functions for page navigation, security functions, the storage of your privacy preferences, login to your customer account, the shopping basket, and the wish list.
For such strictly necessary operations, no consent is required pursuant to Section 25(2) TDDDG. Where personal data is processed in this context, the legal basis depends on the specific purpose and may in particular be Art. 6(1)(b) or Art. 6(1)(f) GDPR.
Technologies that are not strictly necessary, in particular for reach measurement, analytics, or the embedding of external content, are used only if you have previously given your consent. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
A current overview of the cookies and comparable technologies we use, including the respective providers, purposes, and retention periods, can be found in our consent management tool, which is displayed when you visit our website and which you can access again at any time via the corresponding link in the website footer.
9. Consent Management
When you first visit our website, you can decide which non-essential services and technologies you wish to consent to.
Your selection is stored so that the website can take your decision into account on subsequent visits. The storage of your consent decision is technically necessary and takes place pursuant to Section 25(2) TDDDG. The associated processing serves to document and manage your data protection decisions.
You may change or withdraw any consent given at any time with future effect. The function for changing your privacy settings is available on our website at all times.
Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent prior to its withdrawal.
10. Contact Form
If you contact us via our contact form, we process the data you enter in order to handle your enquiry and, where applicable, for any follow-up correspondence.
This includes, in particular, your name, e-mail address, any telephone number you provide voluntarily, the subject, and the content of your message.
Where your enquiry relates to an existing contract or serves to initiate a contract, the processing is based on Art. 6(1)(b) GDPR.
For all other enquiries, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the appropriate handling of incoming business and general enquiries.
The data is deleted once your enquiry has been fully processed and no statutory retention obligations or other legitimate grounds for further storage apply.
11. Contact by E-mail, Telephone, or Post
If you contact us by e-mail, telephone, or post, we process the personal data you provide in order to handle your request.
Where your contact relates to an existing contract or to pre-contractual measures, Art. 6(1)(b) GDPR is the legal basis.
For all other enquiries, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the handling and documentation of the respective communication.
Statutory retention obligations remain unaffected.
12. B2B Customer Account and Registration
Authorised business customers may register in order to use certain functions of our B2B shop.
During registration, we process in particular the company name, first name, surname, e-mail address, password, and, where provided or required, the SECUMAR customer number.
The data is processed to set up and manage the user account, to verify access authorisation, to provide the agreed B2B functions, and to conduct the business relationship.
The legal basis is Art. 6(1)(b) GDPR.
Technically necessary information for login and session management may be stored on your terminal device. This takes place pursuant to Section 25(2) TDDDG, insofar as the storage is strictly necessary for the account function you have requested.
Account data is generally stored for the duration of the business relationship or until the account is deleted. Statutory retention obligations remain unaffected.
13. “Stay Logged In”
If you select the “stay logged in” function when logging in, information may be stored on your terminal device that allows your browser to be recognised on a subsequent visit and simplifies the login process.
This storage takes place at your express request, in order to provide the selected function, pursuant to Section 25(2) TDDDG.
You can remove the stored information by logging out and by deleting the corresponding browser data.
14. Online Shop and Order Processing
If you place an order through our online shop, we process the data necessary to handle and fulfil your order.
This may include, in particular, your name, billing and delivery address, contact details, ordered products, invoice data, payment information, and shipping details.
The processing is carried out to initiate and perform the purchase contract, on the basis of Art. 6(1)(b) GDPR.
Where we are required to retain invoicing, accounting, and business data under commercial or tax law, further processing is based on Art. 6(1)(c) GDPR.
To fulfil an order, the necessary data may be transferred to credit institutions, payment service providers, shipping service providers, and other recipients required for the performance of the contract.
15. Shopping Basket and Wish List
Our website provides a shopping basket as well as a wish list for selected products.
To provide these functions, technically necessary information may be stored on your terminal device. In the case of the wish list, this may also serve to retain a product list you have compiled beyond a single visit.
Insofar as this storage serves exclusively the shopping basket or wish list function you have requested, it takes place pursuant to Section 25(2) TDDDG.
For logged-in users, the corresponding information may additionally be linked to the user account. In this respect, the processing is carried out to provide the requested account functions, on the basis of Art. 6(1)(b) GDPR.
16. Payment Methods
In our online shop, you may choose to pay in advance (prepayment), by purchase on account (invoice), or via the payment service provider PayPal.
Prepayment and Purchase on Account
If you select prepayment or purchase on account as your payment method, we transfer the data necessary for payment processing, in particular invoice data and bank details, to our account-holding bank. No data is transferred to any further external payment service provider for these payment methods.
The processing is carried out to perform the purchase contract, on the basis of Art. 6(1)(b) GDPR.
PayPal
If you select PayPal as your payment method, the payment data you enter is transferred to
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal
L-2449 Luxembourg
The data transfer is carried out to process the payment method you have chosen and is therefore based on Art. 6(1)(b) GDPR.
PayPal processes personal data in connection with its payment services in part under its own data protection responsibility. We have only limited influence over the scope and duration of this processing.
If you do not select PayPal as your payment method, no payment-related data is transferred by us to PayPal.
17. Newsletter
Where we offer you the option of subscribing to a SECUMAR newsletter, we process the contact data required for this purpose in order to send the newsletter.
The newsletter is sent only where valid consent or another legally permissible basis exists. The legal basis for consent-based newsletter dispatch is Art. 6(1)(a) GDPR.
A confirmation procedure may be used to confirm a newsletter subscription. In this context, we store the data required to demonstrate that the subscription took place.
You may withdraw your consent at any time with future effect, in particular by using the unsubscribe option provided in each newsletter.
Following your unsubscription, we no longer use your e-mail address for consent-based newsletter dispatch. Insofar as this is necessary to document consent given or withdrawn, corresponding records may be retained for a reasonable period on the basis of our legitimate interest in documentation.
18. Newsletter Dispatch via Brevo
For the technical dispatch of newsletters, we use Brevo, where the newsletter service is used.
Brevo processes the data required for dispatch on our behalf. This includes, in particular, the e-mail address and other information required to manage the newsletter subscription.
The engagement of this dispatch service provider is based on a data processing agreement pursuant to Art. 28 GDPR.
Insofar as we use functions for the statistical evaluation of newsletter openings or link clicks, any personal evaluation takes place only where the necessary legal basis exists.
19. Google Analytics
Where you have given your consent via our consent management tool, we use Google Analytics for the statistical analysis of the use of our website.
For users within the European Economic Area, the provider is generally:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Analytics enables us to evaluate information about the use of our website. This may include, in particular, information about the pages visited, the time and duration of visits, technical information about the device and browser used, and interactions with our website.
Google Analytics is activated only after you have given your consent.
The storage of, or access to, information on your terminal device is based on Section 25(1) TDDDG. The subsequent processing of personal data is based on your consent pursuant to Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with future effect via our privacy settings.
According to Google, Google Analytics 4 does not permanently store IP addresses. Data available for evaluation at user and event level is stored for the retention period set in our Analytics account and is then automatically deleted. Aggregated statistical data may remain available for a longer period.
When using Google services, it cannot be ruled out that data may be processed by Google companies outside the European Economic Area, in particular in the USA. Where necessary, such transfers are based on the safeguards provided for under the GDPR or on an applicable adequacy decision.
20. Google reCAPTCHA
To protect certain forms against automated input and misuse, we use Google reCAPTCHA.
For users within the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
reCAPTCHA is not loaded automatically when the website is accessed. Only when you attempt to submit the relevant form are you asked to confirm the loading of reCAPTCHA. Without this confirmation, the form will not be submitted.
The use of reCAPTCHA may involve the processing of technical information about the device and browser used, the IP address, and other information that Google uses to distinguish human input from automated access.
The storage of, or access to, information on your terminal device, as well as the transfer of personal data to Google, take place only after your confirmation. The legal bases in this case are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
If you do not give the required confirmation, it is possible that a form protected by reCAPTCHA cannot be used. In this case, you may alternatively contact us by e-mail, telephone, or post.
When using Google services, it cannot be ruled out that data may be processed outside the European Economic Area, in particular in the USA.
21. YouTube
Videos from the YouTube platform may be embedded on our website.
For users within the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Videos are initially blocked. A connection to YouTube is established only once you release the relevant content or have consented to the corresponding service category via our consent management tool.
Once released, your IP address, information about the device and browser used, and information about the page accessed may, in particular, be transmitted to Google. If you are simultaneously logged into a Google or YouTube account, Google may be able to associate the access with your user account.
The storage of, or access to, information on your terminal device is based on your consent pursuant to Section 25(1) TDDDG. The processing of personal data is based on Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with future effect via our privacy settings.
When using Google services, it cannot be ruled out that data may be processed outside the European Economic Area, in particular in the USA.
22. Google Maps and Dealer Locator
We use Google Maps to display maps and for our search function for dealers, distributors, and service and maintenance stations.
For users within the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Maps is not loaded by default on our website. A connection to Google is established only once you activate the map or have consented to the corresponding service category via our consent management tool.
Once activated, your IP address, information about the device and browser used, and information about your use of the map function may, in particular, be transmitted to Google.
The storage of, or access to, information on your terminal device is based on your consent pursuant to Section 25(1) TDDDG. The processing of personal data is based on Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with future effect via our privacy settings.
When using Google services, it cannot be ruled out that data may be processed outside the European Economic Area, in particular in the USA.
23. Job Applications
If you apply to us for an advertised vacancy or submit a speculative application, we process the personal data you provide for the purpose of conducting the application process. This also applies where you apply by e-mail in response to a vacancy published on our website.
This may include, in particular, your name and contact details, curriculum vitae, references, information on qualifications and professional experience, and any other information you provide as part of your application.
The legal basis for the processing is Section 26(1) of the German Federal Data Protection Act (BDSG) in conjunction with Art. 6(1) GDPR.
Where you provide us with special categories of personal data as part of your application, such data is processed only within the framework of the applicable statutory requirements.
Application documents are deleted after the application process has concluded, once they are no longer required for that purpose and no statutory retention obligations or other legitimate interests justify a limited period of further storage.
If an employment relationship is established, the data required for the employment relationship is transferred to our personnel administration records.
Where we retain your application with your express consent for a possible future vacancy, such further storage is based on Art. 6(1)(a) GDPR. You may withdraw such consent at any time with future effect.
24. Transfers of Data to Third Countries
Some of the service providers used on our website may process personal data outside the European Union and the European Economic Area.
Such transfers take place only where the statutory requirements of Articles 44 to 49 GDPR are met.
This may in particular be the case where an adequacy decision of the European Commission exists for the relevant third country or recipient, or where appropriate safeguards, such as standard contractual clauses approved by the European Commission, have been agreed.
Where a service provider is certified under an applicable EU adequacy framework, the transfer may be based on that adequacy decision.
25. Obligation to Provide Data
For a purely informational visit to our website, you are generally not required to actively provide us with any personal data.
For enquiries, registrations, and orders, certain information is required so that we can provide the service you have requested or process your enquiry. Mandatory fields are marked accordingly.
Without the required information, the relevant function may not be able to be provided.
26. Automated Decision-Making
No decision based solely on automated processing that produces legal effects concerning you, or similarly significantly affects you, within the meaning of Art. 22 GDPR, takes place in connection with the processing activities described on this website.
27. Your Rights
Subject to the applicable statutory requirements, you have the right to request information about the processing of your personal data.
You may request the rectification of inaccurate personal data or the completion of incomplete personal data.
Subject to the statutory requirements, you have the right to request the erasure of your personal data and the restriction of processing.
Where the statutory requirements are met, you have a right to data portability.
You may withdraw any consent given at any time with future effect.
Where processing is based on Art. 6(1)(f) GDPR, you have the right to object to the processing on grounds relating to your particular situation. Where personal data is processed for direct marketing purposes, you may object to such processing at any time.
To exercise your rights, you may contact us or our data protection officer directly.
28. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.
The supervisory authority responsible for our company is, in particular:
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
(Independent Data Protection Centre for Schleswig-Holstein)
Holstenstraße 98
24103 Kiel
Germany
Telephone: +49 431 988-1200
E-mail: mail@datenschutzzentrum.de
Your right to lodge a complaint with any other supervisory authority competent under the GDPR remains unaffected.
29. Amendments to This Privacy Policy
We will amend this privacy policy where changes are made to the processing activities we carry out, the services we use, or the applicable legal requirements.
The version published on this website at any given time shall apply.
Last updated: August 2026