Privacy Policy

This is a translation for your convenience. The German version is legally authoritative.

Privacy Policy

1. Controller

The controller within the meaning of the GDPR is:
Bäste GmbH, Ardeyer Straße 100, 58730 Fröndenberg, Germany
represented by the Managing Director Philipp Michael Meliß
Phone: +49 2378 9254994 · Email: kontakt@baeste.eu

A data protection officer is not required by law and has not been appointed.

2. General, legal bases

We process personal data only within the framework of statutory provisions. The legal bases are in particular Art. 6(1)(a) GDPR (consent), (b) (performance of a contract), (c) (legal obligation) and (f) (legitimate interests).

3. Hosting

Our website is hosted by a service provider with a server location in Germany that processes the data on our behalf (processing on behalf of a controller pursuant to Art. 28 GDPR).

4. Delivery via our edge server

Our pages are delivered through an upstream server (edge) operated by us in a data centre in Frankfurt am Main, Germany; the server is provided by OVH, located in Germany. The edge accepts the connection, filters attack traffic and forwards the request to our main server over an encrypted link. In doing so it processes your IP address, the time of the request, the address requested and technical details of your browser. The legal basis is Art. 6(1)(f) GDPR (secure and undisturbed operation). Processing takes place exclusively in Germany; no transfer to a third country takes place.

Until 22 August 2026 delivery ran via Cloudflare, Inc. (USA). That service is no longer used.

5. Server log files

When the website is accessed, access data (IP address, date/time, page accessed, amount of data transferred, referrer, browser/operating system) is automatically stored in server log files. The legal basis is Art. 6(1)(f) GDPR (secure operation).

6. Cookies

We use exclusively technically necessary cookies and comparable technologies (e.g. for the shopping cart, session and login). These are required for the operation of the website; the legal basis is § 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. We do not set cookies that would require consent (in particular marketing or tracking cookies); a cookie consent banner is therefore not required. Our reach measurement is cookieless (see section 7).

7. Reach measurement with Matomo

For the statistical analysis of website use we employ the analytics software Matomo, which we operate ourselves on our own server in Germany (stats.budnuts.de). No data is transmitted to third parties. Matomo is configured so that no cookies are set and the IP address is truncated (anonymised) before storage. We process in particular the truncated IP address, pages accessed, time and duration of the visit, referrer, and technical details about your browser and device. In the shop we additionally record pseudonymous events on purchasing behaviour (products viewed and purchased, order values) for reach and shop statistics.

The legal basis is our legitimate interest in the needs-based design and statistical analysis of our offering (Art. 6(1)(f) GDPR). As the measurement is cookieless and takes place without access to your device within the meaning of § 25(1) TDDDG, no consent is required for it. You can object to the reach measurement at any time: we respect the "Do Not Track" setting of your browser; if it is enabled, no data is collected.

8. Order processing in the online shop

To process your order, we process the master and order data you provide (name, address, contact details, order and payment information). Processing takes place for the performance of the contract (Art. 6(1)(b) GDPR) and to fulfil retention obligations under tax and commercial law (Art. 6(1)(c) GDPR). For order and inventory management we process this data in our internal ERP system.

9. Customer account

You can create a customer account. The data provided is stored for contract processing and account management (Art. 6(1)(b) GDPR). You can have your account deleted at any time; statutory retention obligations remain unaffected.

10. Payment processing

Depending on the payment method chosen, we pass on the data required for processing (including name, billing/delivery address, order and payment amount) to the respective payment service provider. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

For card payment, Apple Pay, PayPal, Pay by Bank (instant bank transfer) and for invoice and instalment purchases (Klarna, Billie) we use the payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. Processing by Mollie takes place within the European Union. The privacy notices of Mollie apply in addition. When the checkout page is opened, resources (script and icons) are loaded from Mollie to embed the payment methods; your IP address is transmitted to Mollie in the process (Art. 6(1)(b) and (f) GDPR).

With Apple Pay – including the express button in the cart – Apple transmits the contact, shipping and billing details stored in your wallet and an encrypted payment token to us or Mollie; we do not receive your card details. The provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, which is independently responsible for processing within Apple Pay; Apple's privacy notices apply. Whether the express button is shown is checked locally by your browser on your device – no data is transmitted to Apple or to us before you press the button.

For payment via PayPal, Mollie redirects you to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal is independently responsible for processing your payment data; we receive confirmation of payment and the data required to process the order (name, e-mail address, delivery address) from PayPal. PayPal's privacy notices apply (Art. 6(1)(b) GDPR).

If you choose invoice or instalment purchase via Klarna or Billie, the respective provider acts as an independent controller and may carry out an identity and credit check to decide on the payment method, during which data is also exchanged with credit agencies. The legal basis is Art. 6(1)(b) and (f) GDPR. The specific processing operations and the applicable privacy notices are provided by the respective provider during checkout.

For prepayment/bank transfer, processing takes place via your bank. For payment by direct debit (SEPA), we process the account data you provide (IBAN, account holder) to carry out the direct debit (Art. 6(1)(b) GDPR); it is only passed on to our bank for submitting the direct debit.

11. Shipping

For delivery, we transmit your name and delivery address to the commissioned shipping company, DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. The legal basis is Art. 6(1)(b) GDPR.

Email address and phone number only with your consent. If you have expressly consented during checkout, we additionally transmit your email address to DHL so that DHL can inform you of the delivery date before delivery and coordinate the delivery with you; for shipments abroad also your phone number. The legal basis is your consent (Art. 6(1)(a) GDPR). Consent is voluntary; without it, DHL only receives your name and delivery address. You can withdraw it at any time with effect for the future, e.g. by email to kontakt@baeste.eu. The lawfulness of processing carried out before the withdrawal remains unaffected; a withdrawal no longer affects a shipping label that has already been created. After transmission, DHL processes the data under its own responsibility; see dhl.de/datenschutz.

12. BudnutsBucks rewards programme

If you take part in the loyalty programme, we process the data required to manage the points balance (assignment to your customer account, points movements). The legal basis is Art. 6(1)(b) GDPR in conjunction with the terms of participation.

13. Customer reviews

If you submit a review, we process the data provided in order to publish the review and ensure its authenticity (Art. 6(1)(a) and (f) GDPR).

14. Contact and chat

If you contact us by email, phone or via our chat/support widget, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR). The chat is handled via infrastructure operated by us.

For chats and video calls using a chat account on chat.budnuts.de or call.budnuts.de, section 20 additionally applies.

15. Sending emails

To send order and service emails we use a mail server operated by us. Processing serves the performance of the contract or our legitimate interest in reliable communication.

16. Website security

To protect against attacks and misuse, we use security software (firewall/malware protection) that processes, among other things, IP addresses and access characteristics. The legal basis is Art. 6(1)(f) GDPR.

17. Storage period

We store personal data only for as long as is necessary for the respective purposes or as prescribed by statutory retention periods (in particular 6 or 10 years under commercial and tax law).

18. Your rights

You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and a right to object (Art. 21 GDPR). You can withdraw any consent given at any time with effect for the future.

You have the right to lodge a complaint with a supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Düsseldorf.

19. SSL/TLS encryption

For security reasons, this website uses TLS encryption, recognisable by the "https://" in your browser's address bar.

20. Video calls and chat with a customer account

Via chat.budnuts.de and call.budnuts.de we offer you the option to message us directly, make voice and video calls and share your screen. We run the technology for this entirely on our own servers. No service providers are involved and no data is transferred to third countries.

What data is processed. For an account we only need a freely chosen login name and a password. An email address or your real name are not required. During a conversation we process your IP address and technical connection data, without which no connection can be established, as well as the content you send: messages, audio, video and, if you start it, your shared screen.

Message encryption. Messages in your personal customer room are end-to-end encrypted. They can only be read on your devices and by our support team, not by our server in plain text.

Nothing is recorded. Audio, video and screen content are only relayed by our media server and are not stored.

Purpose and legal basis. We process this data to conduct the conversation you started yourself and to handle your request. The legal basis is Art. 6(1)(b) GDPR where it concerns the initiation or performance of a contract, otherwise Art. 6(1)(f) GDPR based on our legitimate interest in direct and fast customer support.

Storage period. Message histories are retained until you or we delete them. Uploaded files are removed from this server after 30 days. Accounts that have not been accessed for 90 days are deactivated automatically. You can deactivate your account yourself in the settings or have us delete it at any time.

Technically necessary storage in your browser. So that you stay logged in and messages can be decrypted, the application stores data in your browser. This is strictly necessary for the service you requested (Section 25(2) no. 2 of the German TDDDG); no consent is required for this. No analytics or advertising services are included.

Delivery. The pages chat.budnuts.de and call.budnuts.de are delivered via the same edge server as the shop; section 4 applies accordingly. The conversation and media traffic does not pass through the edge but flows directly between your device and our server.

Your rights are set out in section 18.

21. Sales via the Amazon marketplace

If you order from us via the Amazon marketplace, we receive the data required to process your order (name, shipping address, anonymised Amazon email address, order data) via the Amazon Selling Partner API. How we handle this data is governed bindingly by our Data Protection and Data Handling Policy for Amazon Data (SP-API).

Last updated: September 2026