Privacy Policy

Personal data (hereinafter mostly referred to simply as “data”) is processed by us only to the extent necessary and for the purpose of providing a functional and user-friendly website, including its content and the services offered there.

In accordance with Art. 4 No. 1 of Regulation (EU) 2016/679, i.e. the General Data Protection Regulation (hereinafter referred to only as “GDPR”), “processing” means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

With the following privacy policy, we inform you in particular about the type, scope, purpose, duration, and legal basis of the processing of personal data, insofar as we determine the purposes and means of such processing alone or jointly with others. We also inform you below about the third-party components we use for optimization purposes and to improve the quality of use, insofar as third parties process data under their own responsibility as a result.

Our privacy policy is structured as follows

I. Information about us as the controller
II. Rights of users and data subjects
III. Information on data processing
IV. Cookie Manager

I. Information about us as the controller

The controller responsible for this website within the meaning of data protection law is:

BrandCrock GmbH
Max-Planck-Straße 5
85716 Unterschleißheim

Phone: +49 (0) 89 2154 7447
Email: info@brandcrock.com

Data Privacy Officer:

Data Privacy Officer BrandCrock GmbH
Phone: +49 (0) 89 2154 7447
Email: dpo@brandcrock.com

II. Rights of users and data subjects

With regard to the data processing described in more detail below, users and data subjects have the right

to confirmation of whether data concerning them is being processed, to information about the processed data, to further information about the data processing, and to copies of the data (see also Art. 15 GDPR);

to rectification or completion of inaccurate or incomplete data (see also Art. 16 GDPR);

to prompt erasure of data concerning them (see also Art. 17 GDPR), or, alternatively, if further processing is necessary pursuant to Art. 17(3) GDPR, to restriction of processing pursuant to Art. 18 GDPR;

to receive the data concerning them that they have provided, and to have this data transmitted to other providers/controllers (see also Art. 20 GDPR);

to lodge a complaint with the supervisory authority if they believe that data concerning them is being processed by the provider in violation of data protection law (see also Art. 77 GDPR).

In addition, the provider is obligated to inform all recipients to whom data has been disclosed by the provider of any rectification or erasure of data or restriction of processing carried out pursuant to Articles 16, 17(1), and 18 GDPR. However, this obligation does not apply if such notification proves impossible or involves disproportionate effort. Notwithstanding this, the user has a right to be informed of these recipients.

Users and data subjects also have the right under Art. 21 GDPR to object to the future processing of data concerning them, insofar as the data is processed by the provider pursuant to Art. 6(1)(f) GDPR. In particular, an objection to data processing for direct marketing purposes is permissible.

III. Information on data processing

Your data processed when using our website will be deleted or blocked as soon as the purpose of storage no longer applies, no statutory retention obligations preclude deletion, and no differing information is provided below regarding individual processing procedures.

Google Analytics
We use Google Analytics on our website, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter “Google.”

Google Analytics helps us analyze the use of the website and measure the effectiveness of our marketing campaigns. The legal basis for this is Art. 6(1)(a) GDPR. Users may withdraw their consent to the use of Google Analytics at any time with future effect via the “Cookie Settings” on our website, in accordance with Art. 7(3) GDPR.

Information such as the time, location, and frequency of website visits as well as interactions with the website (e.g. click paths, ads viewed/clicked, link clicks), including the user’s IP address, is transmitted to a Google server in the USA and stored there for a maximum of 2 months.

Google LLC is part of the “Data Privacy Framework,” for which the EU Commission has issued an adequacy decision pursuant to Art. 45 GDPR: https://www.dataprivacyframework.gov/list

Google also collects “demographic characteristics” and can generate statistics providing insights into the age, gender, and interests of site visitors. This is done through automated analysis of advertising and information from third-party providers.

If a user has enabled personalized ads in their Google account and consents to Google Analytics, Google can analyze usage behavior across devices — i.e. across all devices the user has linked to their Google account. Google creates models for cross-device conversions; we only receive anonymous statistics from this, not personal data.

Users who wish to disable this cross-device analysis can turn off the “Personalized Advertising” feature in their Google account settings at the following link: https://support.google.com/ads/answer/2662922

We use Google Analytics with an anonymization function. This shortens the user’s IP address by Google within EU member states or in other signatory states of the EEA Agreement.

Google uses the collected data to evaluate the user’s visit to the website and to compile reports on website activity for us. The data is also used to provide further services related to website and internet usage. Google may, where necessary, pass this information on to third parties if legally required or if third parties process this data on Google’s behalf.

According to its own statements, Google will under no circumstances link the user’s IP address with other Google data. Further information and options for preventing the use of data are provided by Google here: https://policies.google.com/technologies/partner-sites

If the user does not agree with this data collection, they can also prevent it by installing the browser add-on for disabling Google Analytics once.

Google Fonts
For uniform display of fonts, we use font files (“web fonts”) that we host locally on our own server. When you visit our website, no connection is established to Google’s servers or those of any other third party; accordingly, no personal data (in particular your IP address) is transmitted to third parties in this regard. The font files are delivered together with the other content of our website from our own server.

Google reCAPTCHA
On our website, we use the “reCAPTCHA” service to verify and prevent automated access (e.g. by so-called bots), in particular in connection with form and spam protection. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”).

We are the controller for the processing of data collected via reCAPTCHA. Since April 2, 2026, Google has processed this data exclusively as a processor on our behalf, based on the Google Cloud Data Processing Addendum and the applicable Google Cloud contractual terms. Google’s previous status as an independent controller for reCAPTCHA no longer applies in this respect.

When using reCAPTCHA, various pieces of information are collected and transmitted to Google, including your IP address, information about the browser and device you use, and information about your interaction behavior on the respective page. This data is processed exclusively to detect and prevent abusive automated access.

The legal basis for this processing is your consent pursuant to § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR, which you grant via our cookie manager and may withdraw at any time with future effect.

Website translation (GTranslate / Google Website Translator)
To offer our website in additional languages, we use the WordPress plugin “GTranslate” (provider: GTranslate Inc., 4394 NW 120th Ave, Coral Springs, FL 33065, USA, https://gtranslate.io). In the free version used here, the translation is not created by us, but “on the fly” by the Google Website Translator. This service is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter “Google”).

When the translation function is triggered, your browser loads a script from Google (translate.google.com) and transmits the page content to be translated, as well as your IP address, to Google. The translation is generated on Google’s servers — including in the USA — and sent back to your browser. If plugin components are delivered via the provider’s content delivery network (cdn.gtranslate.net), your IP address is additionally transmitted to GTranslate in this case.

In connection with the translation function, cookies or comparable storage technologies are used, in particular:

“googtrans”: stores your selected source and target language (set by the Google Website Translator);

“gt_auto_switch”: duration 30 days; used if automatic language detection based on your browser language is enabled.

If automatic switching based on your browser language is enabled, the translation — and thus the transmission to Google — is triggered as early as the first page visit.

The legal basis for storing or reading information on your device is your consent pursuant to § 25(1) TDDDG; for the subsequent processing of your personal data, the legal basis is Art. 6(1)(a) GDPR. The translation function and the aforementioned cookies and external scripts are only loaded after you have given consent via our cookie manager. You can withdraw your consent at any time with future effect.

The transfer to Google in the USA is based on the EU Commission’s adequacy decision pursuant to Art. 45 GDPR (EU-US Data Privacy Framework; Google LLC is certified, https://www.dataprivacyframework.gov/list); standard contractual clauses apply additionally.

Further information: Google’s privacy policy (https://policies.google.com/privacy) and that of the plugin provider (https://gtranslate.io/privacy-policy).

IV. Cookie Manager

a) Use of cookies
We only use cookies that are not technically necessary, along with comparable technologies and the integration of third-party services requiring consent, after you have given your consent (§ 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR).These cookies and services are not loaded until you have given your consent. You can adjust or withdraw your consent at any time with future effect via the cookie manager. No consent is required for strictly necessary cookies (§ 25(2) No. 2 TDDDG).
b) Managing anddeletingcookies
Via our cookie manager, you can grant, adjust, or withdraw your consent to non-essential cookies at any time. Independently of this, you can prevent or restrict the storage of cookies through your browser settings, and delete cookies that have already been stored. The steps required for this depend on the specific browser you use; further information can be found in its help function or documentation. Restricting cookies may result in not all functions of our website being fully usable.

Registration and provisioning of BrandNube instances
Via our website, you can order free trial instances as well as paid permanent instances of our products (in particular Dolibarr instances via BrandNube). During registration, we collect and store the data you enter (in particular name, company, address, e-mail address, chosen domain/instance) as well as the IP address and time of registration. We process this data to provide and operate your instance, to manage your customer account, for invoicing, and for communication within the scope of the contractual relationship.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures for trial instances, contract performance for permanent instances). The storage of the IP address and registration time is additionally based on Art. 6(1)(f) GDPR; our legitimate interest lies in preventing misuse and being able to verify the registration.

Trial instances not converted into a paid contract will be deleted, including the data stored in them, no later than 30 days after the trial period ends. Paid instances will be blocked no later than 60 days after the expiration date upon contract termination or failure to pay, and deleted, including the data stored in them, no later than 120 days after the expiration date. Deletion from backups occurs as part of the regular backup cycle, no later than 30 days after deletion of the instance. We delete registration and contract data as soon as processing is no longer necessary, while observing statutory retention periods under tax and commercial law.

For technical operation, we use the following processors pursuant to Art. 28 GDPR:
OVHcloud (OVH GmbH, St. Johanner Str. 41–43, 66111 Saarbrücken, Deutschland) – server infrastructure; the servers are located in data centers within the European Union;
A data processing agreement is in place with the provider. No transfer to third countries outside the EU/EEA takes place in this regard.

Contract processing
We process the data you provide to use our services (in particular hosting, consulting, and development services as well as software modules) for the purpose of contract processing, in particular for service delivery, invoicing, and communication. Contract conclusion and processing are not possible without providing your data.

The legal basis for this processing is Art. 6(1)(b) GDPR.

We delete the data once the contract has been fully processed, while observing statutory retention periods under tax and commercial law.

As part of contract processing, we pass your data on to the financial service provider commissioned with payment processing, insofar as this disclosure is necessary for payment purposes (see the section “Payment Service Provider Novalnet”).

Contact inquiries / ways to contact us / support tickets
If you contact us via a contact form, a support ticket you create yourself, e-mail, or by telephone, the data you provide will be used to process your inquiry. Providing this data is necessary to process and respond to your inquiry — without it, we may be unable to answer your inquiry, or only to a limited extent.

The legal basis for this processing is Art. 6(1)(b) GDPR, insofar as the inquiry relates to a contractual relationship or its initiation; otherwise, Art. 6(1)(f) GDPR applies, with our legitimate interest lying in responding to your inquiry.

Your data will be deleted once your inquiry has been conclusively answered and no statutory retention obligations preclude deletion, such as in the case of any subsequent contract processing.

Payment service provider Novalnet
For processing payments for paid services, we use the payment service provider NOVALNET AG, a payment institution (ZAG), Gutenbergstraße 7, 85748 Garching bei München, Germany, hereinafter referred to only as “Novalnet”.

For this purpose, we have integrated a payment page with technical components from Novalnet, which enables secure processing in accordance with PCI guidelines by transmitting sensitive data such as credit card numbers directly to the payment service provider in encrypted form, without storing it on our own servers.

The legal basis is contract performance pursuant to Art. 6(1)(b) GDPR. In addition, we have a legitimate interest in offering effective and secure payment options, giving rise to a further legal basis under Art. 6(1)(f) GDPR.

By integrating Novalnet on the payment page, your browser loads the corresponding technical components for the secure entry of payment data from a Novalnet server when you visit the page. As with any other server request made by your browser, your operating system, the type and version of your browser, the URL of the website from which the payment was requested, the date and time of the request, and your IP address are transmitted in this case as well.

Once you complete the payment process, the data you enter into the fields on the payment page is processed by Novalnet under its own responsibility to process the payment. In addition, information provided during the ordering process, along with information about your order (name, address, invoice amount, currency, and transaction number), is passed on. Your data is disclosed exclusively for the purpose of processing the payment with Novalnet and only to the extent necessary for this purpose.

Novalnet provides further information on the processing described above, as well as its applicable data protection provisions, at https://www.novalnet.com/privacy-policy/.

LinkedIn
We maintain an online presence on LinkedIn to present our company and our services and to communicate with customers/prospective customers. LinkedIn is a service provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, a subsidiary of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

We note that user data may be processed outside the European Union, in particular in the USA. For the USA, an adequacy decision by the EU Commission exists based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR); LinkedIn Corporation is certified under the EU-U.S. Data Privacy Framework. We have no access to user data processed by LinkedIn under its own responsibility; access is available exclusively to LinkedIn.

LinkedIn’s privacy notices can be found at https://www.linkedin.com/legal/privacy-policy.

Last updated: July 27, 2026