Last updated: 29 September 2026
1. Controller
The controller responsible for processing on this website is Rittbrunnen AG, Unterdorfstrasse 9, 8507 Hörhausen, Switzerland. The company is represented by Franz Dobler. You can contact us at kontakt@bonzumo.de and use the same address for privacy enquiries. No data protection officer has been appointed. Before public launch, Rittbrunnen AG must determine whether Article 27 GDPR requires an EU representative and add that representative’s details here if required.
2. Scope and applicable law
This notice covers www.bonzumo.de and its German and English pages. It is intended in particular for people in the European Union, Germany and Switzerland. The GDPR applies where its territorial scope is met. Swiss processing is governed by the Federal Act on Data Protection (FADP); access to information on terminal equipment in Germany is also subject to section 25 TDDDG.
3. Website access and hosting
When you access a page, the hosting provider Railway processes technical connection data needed to deliver the site and protect its operation. This may include your IP address, time, requested URL, referrer, browser and device information, and security or status messages. Where the GDPR applies, the legal basis is Article 6(1)(f) GDPR: our legitimate interest in a secure and available website.
The website and its administration service use Railway as hosting platform. Enquiries are stored in a database on the service’s persistent storage volume. The Railway region and subprocessors used for the current service depend on the actual service configuration and applicable agreements. The operator must verify the precise storage location and any third-country access or transfers against the current Railway settings and data-processing documents before public launch.
4. Contact and demo enquiries
If you send a contact or demo enquiry, we process your name, email address, optional company, message, enquiry type and language, receipt time, and your confirmation of the privacy information. We use these details to handle your request and contact you about it. The form is submitted only after you activate its required confirmation.
Enquiries are stored in the Bonzumo administration service and are accessible only to authorised administrators. Saving an enquiry does not automatically send an email. Where you request a demo or discussion about a contract, the GDPR legal basis is Article 6(1)(b); for general enquiries it is Article 6(1)(f), our legitimate interest in responding. The current website service has no automatic deletion period for enquiries. The controller must regularly review completed enquiries and delete records that are no longer needed; statutory retention duties and specific legal claims remain unaffected. The operator must set a specific maximum retention period.
5. Cookies and device storage
The public website does not run Google Analytics technologies before you give voluntary consent. To remember your choice, the site uses the local storage entry bonzumo-analytics-consent-v1. It records your decision and the consent-dialog version, not analytics usage data. You can allow or reject analytics and change your choice at any time through Privacy settings in the main or mobile menu.
If you reject analytics, the Google Analytics script is not loaded and this website sends no analytics data to Google. Where German law applies, storing or accessing non-essential information on your device requires consent under section 25(1) TDDDG; processing personal data on the basis of consent relies on Article 6(1)(a) GDPR.
When an administrator signs in, the administration service uses a strictly necessary protected session cookie for authentication. It is configured as HttpOnly, Secure and SameSite=Strict and expires after eight hours. This cookie is not set for visitors to the public website.
6. Google Analytics 4
Google Analytics 4 is configured for audience measurement. The service loads only after you expressly allow analytics in the consent dialog. No Google Analytics tag runs before that choice. You can withdraw consent at any time through Privacy settings; the withdrawal applies going forward. When possible, analytics cookies accessible to this website are removed. Withdrawal does not undo data already sent.
After consent, Google may process pages viewed and usage events, session identifiers, browser and device information, and approximate location. Google Analytics may use cookies such as _ga and _ga_*. Google lists a default lifetime of up to two years for these cookies, though browsers may shorten it. The GA4 property’s configured data-retention period must also be checked by the operator.
The recipient is Google for the Analytics service, including Google Ireland Limited. Depending on the service, configuration and support, data may be transferred to other Google entities outside the EU or Switzerland, including in the United States. Before public launch, the operator must verify the actual Google terms, destination countries, transfer mechanisms and retention settings and update this notice when they change. Google states that GA4 does not log or store IP addresses; loading the Analytics tag nevertheless creates a technical connection to Google. We do not send names, email addresses, phone numbers or enquiry content as Analytics parameters. More information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/11593727.
7. Recipients and international transfers
Only people who need the information to handle an enquiry or operate the website securely, and the service providers used for those purposes, can access personal data. These include Railway for hosting and storage and, only after your analytics consent, Google for audience measurement. For transfers outside the EEA or Switzerland, we provide the destination and appropriate safeguards where required by law. The operator must confirm the current Railway region and subprocessors from the service settings and agreements.
8. Retention
Server and security logs are retained only as long as needed for delivery, troubleshooting and protection against attacks; the actual period depends on current hosting settings. The current website service has no automatic deletion period for enquiries. The controller must regularly review completed enquiries and delete records that are no longer needed; statutory retention duties and necessary legal claims remain unaffected. The operator must set a specific maximum retention period. Analytics data is retained according to the retention setting in the GA4 property.
9. Your rights
Where the GDPR applies, you may, within the scope of the law, request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent at any time for the future. You can also complain to a data protection supervisory authority; in Germany, this is the authority for your place of residence or work.
Under the Swiss FADP, you may in particular request access to your personal data and exercise other statutory rights. The supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC). For privacy enquiries, email kontakt@bonzumo.de.
10. Required information and automated decisions
Technical connection data is required to provide the website. Your name, email address and message are needed to handle a contact or demo enquiry. Google Analytics consent is voluntary; rejecting it does not affect use of the website or enquiry forms. We do not make decisions based solely on this website data that produce legal or similarly significant effects.
11. Security
We use technical and organisational measures to protect data against loss, unauthorised access and alteration. Access to enquiry management is restricted to the protected administration area. Complete security of data transmitted over the internet cannot be guaranteed.
12. Updates
We update this notice when the website, services or legal requirements change. The date above identifies the current version. Before public launch, confirm in particular any EU representative, Railway region and subprocessors, and the actual GA4 retention and international transfer arrangements.