Privacy Policy
BCB website | Effective date: 10 September 2026
This Privacy Policy explains how personal data is processed when you use the BCB website, submit the contact form, or choose to load embedded YouTube content.
1. Data controller
Controller: Black Control Box GmbH
Registered office: Im Gewerbepark C25, 93059 Regensburg, Germany
Company ID / registration number: HRB 22202, Amtsgericht Regensburg
Privacy contact: privacy@blackcontrolbox.com
Website: https://www.blackcontrolbox.com
The controller determines the purposes and means of processing personal data described in this Policy.
2. Personal data we process
When you submit the contact form, we may process:
- Full name
- Email address
- Phone number
- Company name
- Message and any information you voluntarily include in it
We may also process basic technical information generated when the website is used, to the extent necessary for website delivery, security and operation, such as IP address, browser/device information, timestamps and server logs.
3. Purposes and legal bases
Responding to enquiries and communicating with you
Data: Contact-form data
Legal basis: Legitimate interests and/or steps taken at your request before entering into a contract, depending on the nature of the enquiry
Preparing or discussing potential cooperation or services
Data: Contact-form data and subsequent correspondence
Legal basis: Steps taken at your request before entering into a contract and/or legitimate interests
Website security, troubleshooting and technical operation
Data: Necessary technical/log data
Legal basis: Legitimate interests in operating, securing and protecting the website
Loading embedded YouTube content after your affirmative choice
Data: Technical and interaction data transmitted to YouTube/Google after activation
Legal basis: Consent, where required by applicable law
4. Contact form and Webflow
The website is built and operated using Webflow. When you submit the contact form, the submitted data is processed through Webflow's form functionality and is also delivered to the designated BCB email recipient so that BCB can respond to your enquiry.
For personal data collected by BCB through the BCB website, BCB acts as controller and Webflow acts as processor on BCB's behalf. Webflow states that Customer End User data may be stored and processed in the United States. Webflow currently relies on applicable international-transfer mechanisms, including its certification under the EU–U.S. Data Privacy Framework and contractual safeguards incorporated into its Data Processing Addendum, including the EU Standard Contractual Clauses where applicable.
5. Embedded YouTube videos
Embedded YouTube content is implemented using YouTube's Privacy-Enhanced Mode through the youtube-nocookie.com domain together with a click-to-load approach. The YouTube player is not loaded automatically merely because you open the page.
A connection to YouTube/Google is initiated only after you affirmatively choose to load or play the video. The interface presented before loading the player should clearly inform you that activating the video will load third-party YouTube content and may result in data being transmitted to Google/YouTube.
After activation, YouTube/Google may receive technical information such as your IP address, device/browser information and information relating to your interaction with the video. YouTube/Google may also use cookies or similar technologies according to its own privacy practices. BCB does not determine YouTube/Google's subsequent independent processing.
6. Cookies and similar technologies
The website may use technologies that are strictly necessary for technical operation and security. Non-essential third-party content or technologies should not load before the required user action or consent. In particular, embedded YouTube content uses the click-to-load mechanism described above.
If analytics, advertising, tracking, chat, marketing or other non-essential technologies are added in the future, this Policy and the website's consent mechanism must be reviewed and updated before or when those technologies are deployed.
7. Recipients of personal data
Personal data may be made available only where necessary to:
- authorised BCB personnel who handle enquiries or administer the website;
- Webflow, as the website/form technology provider and processor;
- the email service provider used by BCB for delivery and handling of form submissions;
- YouTube/Google, only after the visitor chooses to activate embedded YouTube content;
- IT, hosting, security or professional service providers where necessary and subject to appropriate safeguards;
- public authorities or other parties where disclosure is required by law.
8. International data transfers
Some service providers may process personal data outside the European Economic Area. Where GDPR restrictions on international transfers apply, transfers are made using an applicable legal transfer mechanism, such as an adequacy decision, the EU–U.S. Data Privacy Framework for eligible participating organisations, or Standard Contractual Clauses, as appropriate.
9. Retention
Contact-form submissions that do not result in an ongoing business relationship should ordinarily be deleted or anonymised no later than 12 months after the last substantive communication, unless a longer period is reasonably necessary for a specific legitimate purpose or is required by law.
Where an enquiry results in a business or contractual relationship, relevant correspondence and personal data may be retained for the duration of that relationship and afterwards for the period necessary to comply with legal obligations and establish, exercise or defend legal claims. Technical logs are retained only for the period reasonably necessary for security and operational purposes.
10. Your rights
Subject to the conditions under applicable data-protection law, you may have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete data;
- request deletion of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive data in a portable format where the right to data portability applies;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
- lodge a complaint with the competent data-protection supervisory authority.
To exercise your rights, contact BCB using the privacy contact details stated above. BCB may need to verify your identity before acting on a request.
11. Whether providing data is required
Providing information through the contact form is voluntary. However, if you do not provide information necessary to understand and respond to your enquiry, BCB may be unable to process it.
12. Automated decision-making
BCB does not use personal data collected through the website contact form for automated decision-making that produces legal effects or similarly significantly affects you.
13. Security
BCB uses reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. No internet-based service can guarantee absolute security.
14. Changes to this Privacy Policy
This Privacy Policy may be updated when the website, processing activities, service providers or legal requirements change. The current version should be published on the website together with its effective date.
15. Contact
Privacy contact: privacy@blackcontrolbox.com
Competent supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany
Email: poststelle@lda.bayern.de
Website: https://www.lda.bayern.de