Privacy Policy

We take the protection of your personal data seriously and process it exclusively on the basis of the statutory provisions (GDPR, BDSG [German Federal Data Protection Act], TDDDG [German Telecommunications Digital Services Data Protection Act]). In this privacy policy we inform you in accordance with Art. 13 and Art. 14 GDPR about the processing of personal data when you visit and use this online shop.

1. Controller

The controller within the meaning of the GDPR is:

We are not required to appoint a data protection officer (small enterprise; the threshold under Section 38 BDSG [German Federal Data Protection Act] is not reached), and we have not appointed one. For all data protection matters, please contact the address above or info@busware.de.

2. Access data / server log files

When you access our website, the browser automatically transmits information to the server, which is stored in so-called server log files. This includes in particular: the page accessed or the name of the requested file, the date and time of access, the volume of data transferred, a message indicating successful retrieval, the browser type and version, the operating system, the referrer URL and the IP address.

This processing serves to ensure trouble-free operation, the security of our information technology systems and the technical delivery of the website. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. This data is not merged with other data sources, nor is it evaluated for marketing purposes. The server log files (Apache access logs, rotated daily) are deleted after 14 days, unless they are exceptionally required for a longer period to investigate a specific security incident.

3. Cookies

We use exclusively technically necessary first-party cookies that are required to operate the shop. No tracking, analytics or advertising cookies are used. In particular, we use no Google Analytics or comparable web analytics or audience-measurement services. Fonts (Font Awesome) and the layout framework (Bootstrap) are delivered exclusively from our own server (self-hosted); no external fonts or content delivery network (CDN) are embedded, so that no IP address is transmitted to third parties during a normal page visit.

The following technically necessary cookies are used:

These cookies are strictly necessary for the provision of the telemedia service you have expressly requested; their storage is therefore permitted without consent pursuant to Section 25(2)(2) TDDDG (German Telecommunications Digital Services Data Protection Act). The processing of the data arising in this context is based on Art. 6(1)(f) GDPR (legitimate interest in the technically faultless operation of the shop). Further information can be found in our cookie notice.

4. Customer account and order processing

Placing an order in our shop requires the creation of a customer account (registration); ordering as a guest is not possible. During registration and the ordering process, we process the data you provide, in particular salutation, first and last name, date of birth, billing and delivery address, e-mail address, telephone number where applicable, as well as your order and payment details.

This processing serves to establish, perform and execute the purchase contract and to manage your customer account on the basis of Art. 6(1)(b) GDPR. Insofar as we are legally obliged to retain data, in particular under commercial and tax law, we store the relevant data for the duration of the statutory retention periods (generally up to 10 years); the legal basis for this is Art. 6(1)(c) GDPR. You can have your customer account deleted at any time; statutory retention obligations remain unaffected by this.

5. Transfer of existing customer data from the former busware online shop

If you held a customer account in our former busware online shop, your master data is transferred from the customer database of that former shop the first time you log in with the e-mail address concerned, or when you use the “forgotten password” function for that e-mail address. The data is transferred solely for the e-mail address in question; nothing is copied in advance or on a stock basis.

The following data categories are transferred to the extent they were present in the former shop: salutation, first and last name, date of birth, e-mail address, telephone and fax number, the (encrypted) password hash, the newsletter setting, and your stored address data (company, first and last name, street address, postal code, town/city, state/region and country).

The purpose of this transfer is to continue the existing business relationship and to prepare and perform a contract, while avoiding a duplicate re-entry of your data. The legal basis is Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures) and Art. 6(1)(f) GDPR (our legitimate interest in seamlessly continuing the existing customer relationship and avoiding duplicate records).

Because this data does not originate from you directly but from the database of the former shop, we provide this information in accordance with Art. 14 GDPR. Your rights as a data subject (see item 10) apply unchanged to this data.

6. Payment processing

Depending on the payment method selected, we pass on the data required for payment processing to the respective payment service provider. The legal basis is Art. 6(1)(b) GDPR (contract performance).

Prepayment / bank transfer: If you pay by bank transfer, you will receive our bank details with the order confirmation. You handle the payment yourself via your bank; no external payment service provider is involved in this case.

PayPal: If you select PayPal, you are redirected for payment to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. As the provider is established in Luxembourg (EU), no transfer of data to a third country takes place. The data transmitted during the ordering process (in particular amount, currency and order reference) is transferred to PayPal; further processing is governed by PayPal's privacy provisions.

7. Shipping

To deliver your order, we pass on the data required for this purpose (in particular name and delivery address, and where applicable your e-mail address or telephone number for delivery notification) to the shipping/transport company commissioned with the delivery (Deutsche Post). The legal basis is Art. 6(1)(b) GDPR.

8. E-mail dispatch

As part of order processing, we send transaction-related e-mails (e.g. order confirmation, password reset, shipping status). For the technical delivery of these messages we use a smarthost of Deutsche Telekom (T-Online) as our transport service provider. In doing so, the data contained in the respective message (in particular your e-mail address and the message content) is processed in the course of transport. The legal basis is Art. 6(1)(b) GDPR or our legitimate interest in reliable delivery pursuant to Art. 6(1)(f) GDPR.

9. Hosting

This website is operated on our own virtual server (vServer) rented from a hosting provider. The provider of the underlying server infrastructure is Strato AG (Strato.de), Berlin, Germany. The hosting provider processes personal data arising during the operation of the website on our behalf, on the basis of a data processing agreement pursuant to Art. 28 GDPR, which is automatically concluded as part of the Strato hosting contract. The legal basis is our legitimate interest in the secure and efficient provision of our offering pursuant to Art. 6(1)(f) GDPR.

10. Your rights as a data subject

Subject to the statutory requirements, you have the following rights:

• Right of access to the data stored about you (Art. 15 GDPR),
• Right to rectification of inaccurate data (Art. 16 GDPR),
• Right to erasure (Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• Right to data portability (Art. 20 GDPR),
• Right to object to processing (Art. 21 GDPR),
• Right to withdraw consent given at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, an informal notification to the contact details listed under item 1 is sufficient.

In addition, you have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR). The supervisory authority responsible for us is:

11. Data security

We take technical and organisational security measures to protect your data against loss, destruction, manipulation and unauthorised access. The transmission of your data between your browser and our server is encrypted using the TLS protocol (recognisable by the padlock symbol or the prefix https:// in the address bar). Access to your customer account is only possible after entering your personal password; always treat your access credentials as confidential.

Version of this privacy policy: June 2026. We reserve the right to amend this policy in order to adapt it to changes in the legal situation or to changes in our processing activities.