Privacy policy

This is a translation for your convenience. Only the German version is legally binding.

1. Controller

The controller for processing personal data on this website under the General Data Protection Regulation (GDPR) is:

Kollmorgen & Orsborn UG (haftungsbeschränkt), Winfriedstr. 39, 14169 Berlin, Germany. Represented by: Cosmo Kollmorgen. Email: info@baumorgen.de.

We are not required to appoint a data protection officer, because fewer than 20 people at our company are regularly engaged in the automated processing of personal data (Section 38(1) BDSG) and none of the other conditions apply. Please send data protection questions to info@baumorgen.de.

2. Summary

• This website sets no cookies.
• We count page views anonymously on our own server, without a script in your browser and without accessing your device (section 5).
• We measure which buttons are used and how far pages are read only if you allow it in the notice. You can change your choice at any time under "Privacy settings" at the bottom of every page.
• All data stays with us and our service providers in Germany or the EU. We do not pass data to advertising or analytics companies.
• What you type into the form "Apply for a pilot place" is remembered only by your own browser tab, so nothing is lost when you reload. Nothing is sent to us until you click "Apply for a pilot place" (section 4).
• Fonts, images and program code load only from our own server.

3. Hosting and server logs

Our website is operated by Sliplane GmbH, c/o ECOSIA, Gerichtstraße 23, Innenhof 4, 13347 Berlin, Germany (hosting). The servers are located in data centres of Hetzner Online GmbH in Germany. We have concluded a data processing agreement with Sliplane under Art. 28 GDPR.

When you visit our website, your browser sends technically necessary data to the server:

• your IP address,
• date and time of the request,
• the address requested and the response code (e.g. 200 or 404),
• the browser type and operating system (user agent),
• the website you came from (referrer), if your browser sends it.

The purpose is to deliver the website, keep it secure (e.g. detect and fend off attacks) and find errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website.

The hosting provider's logs are deleted after 7 days at the latest. Our own application does not write IP addresses, names or email addresses to its logs. The connection to our website is encrypted with TLS (shown by "https://" in the address bar).

4. Applying for a pilot place (form)

Which data?

When you send the form "Apply for a pilot place", we process: your name, your company, your email address, your phone number (optional), your trade, the number of employees, your answer to the question what costs you the most time today (optional), your confirmation that you are applying as a business, the language of the page and the time of the request. Name, company, email address, trade and number of employees are required; without them we cannot process your request.

Why, and on which legal basis?

We use the data to review your request, select pilot businesses and contact you. The legal basis is Art. 6(1)(b) GDPR (steps prior to a contract) where you become the contracting party yourself, for example as a sole trader. If you apply on behalf of a company, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest is handling requests from businesses and communicating with their contact persons.

We do not send you advertising or newsletters on this basis.

How is the data transmitted and stored?

Your details are sent to our server in encrypted form, checked there and sent to our team as an email. We do not store them in a database, only as an email in our mailbox.

Sending and the mailbox are provided by our email provider IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, with data centres in the European Union. We have concluded a data processing agreement with IONOS under Art. 28 GDPR.

Draft and confirmation in your browser

So that what you typed is not lost when you reload the page, your browser keeps the draft of the form in the session storage of the open tab (entry "bm-pilot-draft-v1"). After sending, the same storage remembers the time and the company name (entry "bm-pilot-sent-v1"), so that the confirmation stays visible after a reload. Both entries stay on your device, are not transmitted to us and are deleted by the browser as soon as you close the tab. You can remove the draft at any time with "Empty the form"; after sending it is deleted automatically. This storage is strictly necessary to provide the form you are using (Section 25(2) no. 2 TDDDG).

Protection against abuse

The form also transmits how many seconds it was open; requests sent in less than three seconds are rejected as automated. We do not store this value.

So that nobody can send the form in bulk, we briefly count requests in the server's memory: per email address for 24 hours (only an irreversible checksum of the address, a so-called hash, is kept, not the address itself) and per IP address for one hour. These counters are never written to disk and expire automatically. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against spam and overload.

For how long?

If no pilot agreement is concluded, we delete your request no later than 6 months after our last message to you. We check our mailbox once a month and delete older requests. If an agreement is concluded, we keep the documents for as long as statutory retention periods require (e.g. six years for business letters under Section 257 of the German Commercial Code, HGB).

5. Reach measurement

To understand which content is read and how visitors find us, we use GoatCounter, open-source statistics software. We run it ourselves on our server at Sliplane in Germany (section 3). The data goes to no other provider, not even to the maker of GoatCounter.

a) Page views – no script, no cookies

When your browser opens one of our pages, our server reports this page view to GoatCounter. Nothing is stored on or read from your device; only data your browser sends with every page request anyway is used: the page opened, the website you came from (only its address, e.g. "google.com", not your search terms), campaign tags in the address (e.g. "utm_source=linkedin"), your IP address and the user agent.

GoatCounter uses the IP address and user agent only in memory and for at most 8 hours, to determine the country and to avoid counting repeat page views of the same visit twice. They are not stored. Only summarised figures are stored: views per page, referring websites, browser and operating system name, country. No profile is created and no visitor is followed across websites.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is analysing the use of our website in anonymous form and improving it. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, we do not count your page views. You can also object at any time without giving a reason (section 9).

b) Clicks and reading depth – only with your consent

Only if you choose "Allow" in the notice does a small program on our website also measure which of our buttons and links you use (from a fixed list, e.g. "Apply for a pilot place" or the language switch) and how far you read a page (25, 50, 75 or 100 percent). For the pilot form we only record that it was started, sent or answered with an error – never what you type. These events are sent with the page address to our own server and passed to GoatCounter as described under a). To protect against abuse, our server counts the events per IP address in memory for one hour (as described in section 4).

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Consent is voluntary. You can withdraw it at any time with effect for the future: via "Privacy settings" at the bottom of every page.

c) Storing your choice

We store your choice ("allowed" or "declined") in your browser's local storage (entry "bm-consent-v1"), so that we do not ask you again on every page view. This is strictly necessary to respect your choice (Section 25(2) no. 2 TDDDG). The entry never leaves your device and stays until you change it or delete the site data in your browser.

Retention

We delete the summarised statistics after 24 months at the latest.

6. Contact by email

If you contact us by email, we process your details to handle your request. The legal basis is Art. 6(1)(b) GDPR if it concerns a contract or steps towards one, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your request. We delete the data once your request is settled and no retention obligations apply. What section 4 says about IONOS applies to sending.

You also arrange a demonstration by email: the "Book a demo" button opens your email program with a message to us.

7. Links to other websites

We do not embed content from other providers, for example no videos, maps or "social plugins". If our pages contain a link to another website, it is a simple link: only when you click it do you leave our website, and the privacy policy of that provider applies.

8. Recipients and transfers to third countries

Your data is received only by our team and the service providers named above (Sliplane with Hetzner as data centre operator, IONOS), who work on our behalf and on our instructions. Under our agreements with these providers, the data is processed in Germany or the European Union. We do not transfer personal data to countries outside the European Union or the European Economic Area.

9. Your rights

You have the right to:

• access to your stored data (Art. 15 GDPR),
• rectification of incorrect data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent you have given, with effect for the future (Art. 7(3) GDPR).

An informal message to info@baumorgen.de is enough.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal message to info@baumorgen.de is enough.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.

10. No automated decisions

We do not make decisions based solely on automated processing (Art. 22 GDPR). People from our team decide on pilot places.

11. Changes

We update this privacy policy when our website or the law changes. The version published here applies.

Last updated: November 2026