Privacy Policy

Effective Date: 5. September 2026

Beldton GmbH (“Beldton”, “we”, “us” or “our”) takes the protection of your personal data seriously. This Privacy Policy explains how we process personal data when you visit our website, contact us, use our contact forms, communicate with us by telephone, subscribe to our newsletter, or otherwise interact with our online services.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the German Federal Data Protection Act (“BDSG”), the German Telecommunications-Digital Services Data Protection Act (“TDDDG”) and other applicable data protection laws.

1. Controller

The controller responsible for the processing of personal data within the meaning of Article 4(7) GDPR is:

Beldton GmbH
Im Mediapark 8
50670 Cologne
Germany

Telephone: +49 221 82828679

For privacy-related inquiries, please use our contact form on the website.

2. Data Protection Officer

Where Beldton is legally required to appoint a Data Protection Officer (“DPO”), the contact details of the DPO are:

Philippe Pesch
Beldton GmbH
Im Mediapark 8
50670 Cologne
Germany

Telephone: +49 221 82828679

For data protection inquiries, please use our contact form.

If the appointment of a DPO is not legally required for a particular processing activity or because the statutory requirements are not met, this section should be adjusted accordingly. Under German law, a DPO may be required, among other circumstances, where a private organisation normally employs at least 20 persons continuously involved in automated processing, or where Article 37 GDPR or other statutory requirements apply.

3. What Is Personal Data?

Personal data means any information relating to an identified or identifiable natural person. This may include, for example, your name, postal address, email address, telephone number, IP address, online identifiers, communication contents, or other information associated with you.

4. Visiting Our Website

When you access our website, technical information may be processed automatically. Depending on the technical configuration of the website and your device, this may include:

  • IP address;
  • date and time of access;
  • requested pages or files;
  • referrer URL;
  • browser type and version;
  • operating system;
  • device type;
  • language and similar technical information; and
  • information necessary to ensure the security and stability of the website.

This information is processed primarily to provide the website, maintain its security and functionality, detect misuse and technical problems, and ensure reliable operation.

Where processing is necessary for these purposes, the legal basis is Article 6(1)(f) GDPR. Our legitimate interests include the secure, stable and technically functional operation of our website and IT infrastructure.

Where processing is required to comply with a legal obligation, Article 6(1)(c) GDPR applies.

5. Hosting

Our website is hosted by:

IONOS SE
Elgendorfer Straße 57
56410 Montabaur
Germany

When you visit our website, IONOS may process technical access data and server log information as necessary to provide and secure the hosting service.

The legal basis is generally Article 6(1)(f) GDPR, based on our legitimate interest in operating a secure, reliable and technically functional website.

Where IONOS processes personal data on our behalf as a processor, the processing is governed by the applicable data processing agreement and our instructions.

Further information about IONOS data processing is available in IONOS’s privacy information.

6. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Cookies are small files or other information stored on, or accessed from, your terminal device. Some cookies or technologies are technically necessary for the website or a service expressly requested by you. Other technologies may be used for analytics, marketing, personalisation or other purposes.

6.1 Necessary technologies

We may use technologies that are strictly necessary to:

  • transmit communications over an electronic communications network;
  • provide a service expressly requested by you;
  • maintain security;
  • remember technical settings necessary for the website; or
  • provide core website functionality.

Where the statutory requirements for an exemption are met, consent is not required under Section 25(2) TDDDG.

6.2 Non-essential technologies

For technologies that store information on or access information from your terminal device and are not exempt under Section 25(2) TDDDG, we obtain your prior consent where legally required.

The legal basis for the associated processing of personal data is generally Article 6(1)(a) GDPR. The legal basis for storing or accessing information on the terminal device is Section 25(1) TDDDG where applicable.

Consent must be voluntary, specific, informed and unambiguous. You may withdraw or change your consent at any time with effect for the future.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Our consent-management mechanism should provide an equally easy way to reject or withdraw consent as to grant it.

7. IONOS WebAnalytics

We use IONOS WebAnalytics to obtain statistical information about the use of our website and to technically optimise the website.

According to IONOS, WebAnalytics does not use cookies and the visitor’s IP address is anonymised after transmission. Information processed may include:

  • referrer URL;
  • requested website or file;
  • browser type and version;
  • operating system;
  • device type;
  • time of access; and
  • IP address in anonymised form for determining the location of access.

IONOS states that this information is used for statistical analysis and technical optimisation and that no personal visitor data is stored by WebAnalytics.

Where the processing is genuinely configured so that no consent-requiring terminal-device access takes place and the resulting information is sufficiently anonymised, the legal basis may be Article 6(1)(f) GDPR.

If the technical configuration of WebAnalytics changes or involves processing that requires consent, the website configuration and this Privacy Policy must be updated accordingly.

IONOS currently describes WebAnalytics as a cookie-free analytics service with immediate IP anonymisation.

8. WordPress Statistics

Where WordPress Statistics is enabled on this website, we use it to obtain statistical information about website usage.

The service may process information such as IP address, browser information, referrer information, pages viewed, interactions, downloads and other technical usage information, depending on the configuration and version of the service.

The service provider may involve entities within the Automattic group, including entities located in the European Union and the United States.

We will only activate non-essential analytics technologies where the applicable legal requirements for consent have been satisfied.

Where consent is required, processing is based on Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.

Where a lawful legitimate-interest basis is used for a particular processing operation, the legal basis is Article 6(1)(f) GDPR.

The exact data processed and the applicable provider configuration may change when the service is updated. The current provider privacy information should therefore also be consulted.

9. Contact Form

If you contact us through our contact form, we process the information you provide, which may include:

  • name;
  • company;
  • address;
  • telephone number;
  • email address;
  • website address;
  • country;
  • information about how you found us;
  • inquiry category; and
  • the contents of your message.

We process this information to respond to your inquiry, communicate with you, provide requested information, and, where applicable, take steps before entering into a contract or perform an existing contract.

The legal basis is:

  • Article 6(1)(b) GDPR where processing is necessary to take steps at your request before entering into a contract or to perform a contract;
  • Article 6(1)(f) GDPR where we have a legitimate interest in efficiently handling business inquiries; or
  • Article 6(1)(a) GDPR where we have specifically requested your consent and consent is the appropriate legal basis.

We retain inquiry data only for as long as necessary for the relevant purpose and thereafter for as long as required by applicable statutory retention obligations or necessary to establish, exercise or defend legal claims.

10. Contact by Email, Telephone or Other Communication Channels

If you contact us by email, telephone or another communication channel, we may process the personal data contained in your communication.

This may include your name, contact details, company details, telephone number, email address and the content of your inquiry.

The legal basis depends on the circumstances and may be Article 6(1)(b), Article 6(1)(c), Article 6(1)(f) or Article 6(1)(a) GDPR.

We do not use your contact information for unrelated purposes unless this is legally permitted and appropriately disclosed.

11. AI-Based Telephone Assistant

We use an AI-based telephone assistant to answer, route and support telephone inquiries.

When you interact with the AI telephone assistant, the system may process:

  • your telephone number;
  • your voice;
  • information you provide during the call;
  • the content of your conversation;
  • information necessary to identify and route your inquiry; and
  • technical information necessary to operate and secure the telephone service.

The purposes include:

  • answering and routing telephone inquiries;
  • providing requested information;
  • identifying the appropriate contact person or department;
  • improving the efficiency and availability of telephone support;
  • maintaining service security; and
  • documenting inquiries where legally permissible and necessary.

11.1 AI transparency

Where you interact directly with an AI system, you will be informed that you are interacting with an AI system unless this is already obvious from the circumstances.

This disclosure is also intended to comply with the transparency requirements applicable to AI systems under Article 50 of Regulation (EU) 2024/1689 (EU AI Act), where applicable.

11.2 Recording of telephone calls

Telephone conversations are not recorded unless the applicable legal requirements for recording have been satisfied.

If a call is recorded, we will inform you before recording begins and obtain consent where required.

In Germany, unauthorised recording of non-public spoken words may constitute an offence under Section 201 of the German Criminal Code (StGB). Therefore, the mere statement that an AI assistant is being used does not by itself constitute permission to record a conversation.

Where no recording takes place, processing of the live conversation may nevertheless occur to the extent necessary to provide the telephone service.

11.3 Legal basis

Depending on the circumstances, processing may be based on:

  • Article 6(1)(b) GDPR where necessary for pre-contractual measures or contract performance;
  • Article 6(1)(f) GDPR where necessary for our legitimate interests in efficiently handling inquiries and operating an effective telephone service; or
  • Article 6(1)(a) GDPR where consent is required and has been obtained.

Where special categories of personal data under Article 9 GDPR are unintentionally disclosed by a caller, we will process them only where a valid legal basis and applicable exception under Article 9 GDPR exists.

11.4 External AI service providers

If external providers operate or support the AI telephone assistant, they may process personal data on our behalf.

Where applicable, such providers are engaged as processors under Article 28 GDPR and are contractually required to process personal data only according to our instructions and applicable data protection law.

The names of the providers, processing locations, retention periods and international-transfer mechanisms should be listed in this Privacy Policy once the exact AI telephone provider and technical architecture have been confirmed.

12. International Data Transfers

Some service providers used by us may process personal data outside the European Economic Area (“EEA”).

A transfer outside the EEA will take place only where the requirements of Chapter V GDPR are satisfied.

Depending on the destination and recipient, this may include:

  • an adequacy decision adopted by the European Commission;
  • the EU-U.S. Data Privacy Framework, where the US recipient is certified under that framework and the relevant transfer is covered by the certification;
  • Standard Contractual Clauses adopted by the European Commission;
  • appropriate supplementary measures; or
  • another lawful transfer mechanism under Chapter V GDPR.

We do not state generally that the United States is “unsafe” or that every transfer to the United States is unlawful. The legal basis for a transfer depends on the particular recipient and processing arrangement.

The European Commission has adopted an adequacy decision for participating US organisations under the EU-U.S. Data Privacy Framework.

Where a specific service provider is located outside the EEA, the relevant provider and transfer mechanism should be identified in the applicable section of this Privacy Policy.

13. YouTube

Our website may embed or link to videos provided by YouTube, a service of Google.

Where YouTube content is embedded in a way that causes information to be transmitted to Google when the page loads, the applicable consent requirements will be respected.

Where technically available, we may use privacy-enhanced embedding or another configuration designed to minimise unnecessary data transmission.

If YouTube content requires consent, it will not be activated until the required consent has been obtained.

The processing associated with optional YouTube content is generally based on Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.

If a YouTube service is strictly necessary for a service expressly requested by the user, the applicable legal basis may differ.

Google’s current privacy information should also be consulted.

14. Newsletter

If you subscribe to our newsletter, we process your email address and any other information necessary to administer the subscription.

Newsletter processing is based on your consent under Article 6(1)(a) GDPR where consent is required.

You may withdraw your consent at any time by using the unsubscribe link contained in the newsletter or by contacting us.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Where applicable, we use a confirmation procedure (such as double opt-in) to verify that the person submitting the email address controls that address and to document the subscription.

In addition, German unfair-competition law restricts advertising by electronic mail without the required prior consent, subject to the statutory exception for existing customer relationships and similar products or services under Section 7 UWG.

Newsletter suppression or blacklist information may be retained where necessary to ensure that a person who has withdrawn consent is not inadvertently contacted again. Such information is used only for this purpose.

The legal basis for maintaining such suppression information is Article 6(1)(f) GDPR, based on our legitimate interest in documenting and respecting withdrawal of consent and complying with applicable advertising law.

15. Legal Retention Periods

Personal data is generally deleted when the purpose for which it was collected no longer applies.

Data may nevertheless need to be retained for longer where:

  • statutory retention obligations apply;
  • retention is necessary to establish, exercise or defend legal claims;
  • we have another lawful basis for continued storage; or
  • deletion is technically or legally restricted.

Statutory retention periods may arise, in particular, from German commercial and tax law.

Once the applicable retention period expires and there is no other lawful reason for continued storage, the data will be deleted or securely anonymised.

16. Your Rights

Subject to the statutory requirements and limitations, you have the following rights under the GDPR:

Right of access

Under Article 15 GDPR, you may request confirmation as to whether personal data concerning you is being processed and, where applicable, obtain access to that data and additional information required by law.

Right to rectification

Under Article 16 GDPR, you may request correction of inaccurate personal data and completion of incomplete personal data.

Right to erasure

Under Article 17 GDPR, you may request deletion of personal data where the legal requirements are satisfied.

Right to restriction of processing

Under Article 18 GDPR, you may request restriction of processing where the statutory requirements are met.

This may apply, for example, where:

  • you contest the accuracy of the personal data;
  • processing is unlawful and you request restriction instead of deletion;
  • we no longer need the data but you require it for legal claims; or
  • you have objected under Article 21(1) GDPR and the applicable balancing assessment is still pending.

Right to data portability

Under Article 20 GDPR, you may have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format, or request transmission to another controller where the statutory requirements are satisfied.

Right to object

Where processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR, you may object to processing on grounds relating to your particular situation.

Where personal data is processed for direct marketing, you have the right to object at any time to processing for such marketing purposes, including related profiling.

After an objection to direct marketing, the relevant personal data will no longer be processed for those purposes.

Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time with effect for the future.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

17. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

You may generally lodge a complaint with a supervisory authority in the Member State of your habitual residence, place of work or the place of the alleged infringement.

For Beldton GmbH, the competent German state supervisory authority is generally:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Telephone: +49 (0) 211 38424-0
Email: poststelle@ldi.nrw.de

The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

18. Recipients of Personal Data

Depending on the services and circumstances involved, personal data may be disclosed to or accessed by:

  • hosting and IT service providers;
  • telecommunications and telephone-service providers;
  • AI service providers;
  • email and newsletter service providers;
  • analytics providers;
  • website and software providers;
  • professional advisers;
  • payment or logistics providers where necessary;
  • public authorities where legally required; and
  • other processors acting on our behalf.

Where a service provider processes personal data on our behalf, we enter into an appropriate data processing agreement where required by Article 28 GDPR.

19. Automated Decision-Making and Profiling

We do not use your personal data for automated decision-making producing legal effects or similarly significant effects within the meaning of Article 22 GDPR unless this Privacy Policy is specifically updated to explain such processing and the applicable safeguards.

The use of analytics or similar technologies for statistical purposes does not by itself mean that automated decision-making under Article 22 GDPR takes place.

20. Security

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

However, no transmission or storage system can guarantee absolute security.

21. Data Minimisation

We seek to process only personal data that is adequate, relevant and limited to what is necessary for the purposes for which it is processed.

We do not intentionally request special categories of personal data through general contact forms unless such processing is specifically necessary and legally permitted.

22. Changes to This Privacy Policy

We may update this Privacy Policy where necessary to reflect changes to our website, services, processing activities, service providers, technology or applicable legal requirements.

The current version published on this website is authoritative.