Policies

Privacy policy

Last updated 29 October 2026

Version: 29 October 2026

1. Who is responsible

This privacy policy explains how we process personal data when you use bdecent.de, our demo sites and our other online services. The controller within the meaning of the General Data Protection Regulation (GDPR) is:

bdecent GmbH Franz-Obermayer-Str. 8, 83607 Holzkirchen, Germany Managing Director: Stefan-Alexander Scholz Commercial register: HRB 156862, Amtsgericht München Phone: +49 8024 64 999-21 Email: info@bdecent.de

2. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we rely on your consent, you can withdraw it at any time with effect for the future (Art. 7(3)). To exercise your rights, simply write to info@bdecent.de.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you can object at any time for reasons arising from your particular situation. You can object to direct marketing at any time without giving reasons.

You also have the right to lodge a complaint with a supervisory authority, for example the authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

3. Legal bases

Unless stated otherwise below, we process data on the basis of your consent (Art. 6(1)(a) GDPR), to perform a contract or take steps before a contract (Art. 6(1)(b)), to meet legal obligations (Art. 6(1)(c)) or on the basis of our legitimate interests (Art. 6(1)(f)).

4. Hosting and server log files

Our website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, on servers in Germany. Hostinger processes data on our behalf under a data processing agreement (Art. 28 GDPR). Each time you open a page, the server records the page or file requested, date and time, amount of data transferred, browser type and version, operating system, referrer URL, IP address and requesting provider. We need this to deliver the website and keep it secure (Art. 6(1)(f) GDPR). Log files are deleted after seven days, unless we need them as evidence of a security incident. All connections are encrypted (TLS).

We use cookies and similar technologies that are strictly necessary for the website to work – for example to keep you signed in or to remember your cart (§ 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR). Other services that set cookies or transfer data to third parties – embedded videos and the chat – only load after you consent in our consent banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change your choice at any time via “Privacy settings” at the bottom of each page.

6. Website statistics with Plausible

We use Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia) to understand how our website is used. Plausible does not use cookies and does not store personal data: page views are counted without a persistent identifier; the IP address is only used to create a daily changing, anonymous hash and is not stored. Data is processed in the EU. Legal basis: our legitimate interest in improving the website (Art. 6(1)(f) GDPR).

7. Fonts

The fonts on our website are hosted on our own server. No connection to third-party servers is made when the fonts load.

8. Videos (Vimeo)

We show product videos from Vimeo (Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA). Videos only load after you have consented (see section 5); until then you see a preview image. When a video loads, Vimeo receives your IP address and technical data about your device and may set cookies. Vimeo may process data in the USA; Vimeo is certified under the EU-US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR). Privacy policy of Vimeo: https://vimeo.com/privacy

9. Chat, support and help centre (Intercom)

For support we use Intercom (Intercom, Inc., 55 2nd Street, 4th Floor, San Francisco, CA 94105, USA). The chat widget on our website loads after your consent (see section 5); our help centre at intercom.help/bdecent is provided by Intercom as well. When you send a message, Intercom processes your message, your name and email address if you provide them, and technical data about your device. We use this to answer your request (Art. 6(1)(b) GDPR) and, for the widget, on the basis of your consent (Art. 6(1)(a) GDPR). Intercom processes data in the USA; Intercom is certified under the EU-US Data Privacy Framework, and we have concluded a data processing agreement with standard contractual clauses. Privacy policy of Intercom: https://www.intercom.com/legal/privacy

10. Buying plugins and design packages (Paddle)

Our products are sold by Paddle (Paddle.com Market Limited, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom), who acts as our reseller and merchant of record. When you check out, the purchase window is provided by Paddle; Paddle processes your name, email address, billing address, VAT number and payment data as an independent controller and handles payment, invoicing and tax. Paddle passes on to us the data we need to provide your licence and downloads (Art. 6(1)(b) GDPR). The United Kingdom has an adequacy decision of the EU Commission. Privacy policy of Paddle: https://www.paddle.com/legal/privacy

11. Customer account and downloads

You can create a customer account to access your licences, downloads and orders. We process the data you enter (name, email address, company, password as a hash) and your order history to provide the account (Art. 6(1)(b) GDPR). When you register or sign in, we store the time and IP address to protect your account against misuse (Art. 6(1)(f) GDPR). Your account data is kept until you delete your account; data that we must keep for commercial or tax reasons is then archived for the statutory period.

12. Demo sites (sandbox.bdecent.io)

Our demo sites let you try our plugins with shared demo accounts. You do not need to enter personal data. To protect the demo sites against misuse, we log each demo sign-in with a hashed (not readable) IP address and delete these entries after 30 days. Demo sites are reset regularly; anything you enter there is deleted at the next reset. Emails are not sent from demo sites. Legal basis: our legitimate interest in offering and securing the demo sites (Art. 6(1)(f) GDPR).

13. Product Hub (bdecent.io)

Our Product Hub at bdecent.io is a separate site with its own privacy policy, which applies when you use it.

14. Contacting us

When you contact us by email, phone, chat or our contact form, we process the details you provide (for example name, email address, company and your message) to answer your request (Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for general enquiries). We delete enquiries when they are no longer needed and review this every two years; statutory retention periods remain unaffected.

We maintain profiles on social networks to communicate with customers and interested parties (Art. 6(1)(f) GDPR). When you visit these profiles, the terms and privacy policies of the respective provider apply. We process your data when you communicate with us there, for example when you send us a message.

16. Transfers to third countries

Where data is processed outside the EU or EEA, we make sure that the requirements of Art. 44 ff. GDPR are met: through an adequacy decision of the EU Commission (for example for the United Kingdom, or for US companies certified under the EU-US Data Privacy Framework) or through standard contractual clauses approved by the EU Commission.

17. How long we keep data

We delete personal data as soon as it is no longer needed for its purpose, unless statutory retention obligations apply. Commercial and tax law require us to keep certain documents – such as invoices, business letters and accounting records – for six to ten years (§ 257 HGB, § 147 AO).

18. Changes to this privacy policy

We update this privacy policy when our services or the law change. The current version is always available on this page.