Your information.
How we handle it.

BISSOLUX LLC, 30 N Gould St, Sheridan, WY 82801-6317, United States. Represented by Alban Berisha. Email: info@bissolux.com. Telephone: +49 176 34306448.

EU representative under Article 27 GDPR: Alban Berisha. Contact: info@bissolux.com.

We process email, name, business information, country, channel, verification and sign-in data, accepted terms and time, approval and support records. Payouts require billing and bank details, necessary tax information, amounts, status and payment references. Purposes are application handling, the agreement, account security and accounting.

The legal basis is Article 6(1)(b) GDPR for your agreement and pre-contract steps; Article 6(1)(f) for necessary business-contact processing and abuse prevention based on the legitimate interest in a secure, accountable relationship; and Article 6(1)(c) for statutory documentation. Acknowledging this notice is not a general marketing consent.

A referral cookie is stored only with voluntary marketing permission and used for up to 30 days. The legal bases are section 25(1) TDDDG and, for personal data, Article 6(1)(a) GDPR. Change or withdraw permission through cookie settings. Withdrawal stops future consent-dependent processing without making earlier processing retrospectively unlawful.

A partner identifier from the referral link expressly confirmed by the customer in checkout serves the attribution they request. This also applies to an identifier already expressly supplied by the customer. Its necessary functional assignment lasts no more than one hour (section 25(2)(2) TDDDG); personal attribution data for that purpose is processed under Article 6(1)(b) GDPR. This is not general marketing or analytics permission.

When the Hassolux integration is activated, the same operator can credit a voluntarily attributed first qualifying subscription payment on hassolux.com to the existing partner account. Hassolux sends frozen partner, consent and agreement versions, pseudonymous acquisition/payment references, and eligible net and refunded EUR amounts server-to-server. The billing email is used only for a private keyed self-referral check and is not retained as a customer email in the partner ledger. This does not create automatic attribution while the integration is inactive; optional consent is never required to buy.

Data necessary to account for an already attributed order and handle justified claims is processed separately on the relevant legal bases. Partners see commission amounts, type, status and references, not customer names, emails, addresses or complete browsing histories.

Access is limited to authorised account, security and accounting personnel and necessary hosting, email, banking, tax and other properly appointed providers. Authorities may receive information where required by law. The general privacy notice describes services, possible international transfers and safeguards. Selling partner or customer data is not a programme purpose.

Application and account data is retained only while necessary for review, the active relationship or justified follow-up, then erased or restricted. Agreements, invoices, payments and disputes may need to be kept after termination for applicable statutory periods or specific legal claims. Deleting optional referral information does not automatically delete necessary accounting records.

Subject to the legal requirements, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing, withdraw consent and complain to a competent supervisory authority. Contact info@bissolux.com. Exercising a valid privacy right does not require you to waive earned remuneration.

Required information is needed to assess your application and make payments; optional marketing consent is not. Admission, suspension and disputed claims are decided by a responsible person. Security checks and arithmetic do not alone decide participation solely automatically.

From 15 October 2026 we request renewed permission for optional partner attribution. The signed __Host-bissolux-partner cookie contains a partner code, assignment mode and expiry, without contact details. Remove an explicit assignment in the checkout partner-code field. Withdrawing marketing permission removes the optional 30-day assignment. Attribution already recorded with an order remains available for contractual accounting.

Necessary, protected partner login cookies bind the ten-minute email code to its requesting browser and keep a verified login for at most seven days, or until logout. No advertising or visitor analytics run in the partner portal. Bank details and commission history are encrypted at rest. Programme terms are available at /partnerprogramm/bedingungen, including an English version.

With your Marketing & analysis consent, Bissolux records a random session identifier, fixed categories and identifiers of known public pages, device class, coarse browser family, language, broad source and acquisition channel, package identifiers, booking steps and fixed error categories. We also measure time in a visible browser tab and maximum scroll depth in quarter-page increments. These measurements do not establish attention or explain why someone left. For campaign attribution, we accept bounded public campaign, ad-group, ad and advertising-account identifiers and, when supplied, a campaign label from approved tracking parameters. The first recorded attribution for a browser session stays attached through subsequent page visits and ordering. This analysis does not store full URLs, other query parameters, individual click identifiers, referrer addresses or complete user-agent strings. Optional feedback uses categories such as price, timing or scope. We do not record sessions, keystrokes or entered free text. Accepted orders and server-verified live card payments can be linked to the consenting session. Leaving a page alone does not establish why someone did not buy.

From 14 October 2026 we request renewed consent before linking repeat visits. Only then do we store a random browser identifier and private deletion credential in localStorage under bissolux.journey-visitor.v1, for a fixed maximum of 90 days from creation. Visits use separate sessionStorage credentials; a new visit begins after 30 minutes without measured activity or at most 24 hours. This links article and product views with later bookings in the same browser. It does not identify a person or use fingerprinting. Other devices, cleared storage and refused consent cannot be linked. Historical unlinked sessions are not retroactively associated. Analysis is encrypted and separate from order records. Sessions and events expire within 90 days; expiry of a browser identifier also removes its associated analysis visits. Expired data is deleted on access and during the running service’s next six-hour retention sweep. Withdrawal in cookie settings stops collection and requests deletion of all visits and analysis order links associated with the available browser credential. Failed deletion requests retain only random access credentials for retry. Legally required order records remain unaffected. Legal bases: Article 6(1)(a) GDPR and § 25(1) TDDDG.

Separately, the unchecked Save my selection & remind me by email option allows us to save the latest email, name, company and package selection as you type for up to 30 days. It excludes addresses, project descriptions and payment details. Consent permits one personal email about this unfinished booking, not a newsletter. There is no automatic email sending. Email addresses are initially unverified. Declining does not affect ordering.

Use Withdraw & delete in the form to remove the draft, or contact info@bissolux.com if browser access is lost. Consent time and version are recorded. Accepted bookings are excluded from reminders. Drafts become inaccessible after 30 days and are removed on access or the next retention sweep. This processing and the requested email rely on your explicit consent.

Internal access requires a password and an authenticator code or one-use recovery code. Admin sessions expire after 15 minutes of inactivity or eight hours absolutely. Security state and hashed, short-lived login credentials support access control under Article 6(1)(f) GDPR. Advertising scripts do not run in the admin portal.

This notice covers personal data processed when you visit this website, contact us or use its business-order features. The GDPR applies where we offer services to people in the European Union. Depending on the purpose, processing relies on consent, pre-contractual or contractual necessity, legal obligations or legitimate interests under Article 6(1)(a), (b), (c) or (f) GDPR. Access to information on a user's device is also subject to § 25 TDDDG where applicable.

Technical requests can involve your IP address, request date/time, requested content, referrer, browser, operating system and protocol logs. We use hosting and infrastructure services in Germany/the EU, with supplementary CDN and routing services, to provide the site and maintain stability, security, troubleshooting and abuse prevention. This processing is based on our legitimate interests under Article 6(1)(f) GDPR.

We use cookies and browser storage. Non-essential device access for marketing takes place only after consent through the consent banner. You can change that choice through the cookie settings in the footer, with effect for the future.

When you choose a currency, we store only EUR, USD or GBP under bissolux.currency in your browser localStorage. This remembers your choice between pages and visits. You can change it using the currency selector or remove it by clearing this website’s browser data. It contains no contact or payment-account details.

With marketing consent, campaign and source information may be stored for the browser session under bissolux.tracking.snapshot in sessionStorage. This includes the landing page and page URL with allowlisted campaign parameters, such as UTM parameters and click identifiers. Referrers are reduced to their origin without a path. URL fragments and non-allowlisted parameters are removed, and recognisable payment-access and secret-key patterns are filtered out. This supports internal attribution of enquiries to campaigns.

The order form separately stores a random request identifier and technical fingerprint in sessionStorage to recognise a retry and reduce duplicate submissions. Entered form text is not stored in that entry. After order acceptance, a separate session entry keeps only the order reference, a protected payment-access token and acceptance/due timestamps. It lets you retrieve the original payment instructions from the server after reloading. It stores no company or form text and is no longer used after 90 days. End your browser session on shared devices. Session entries normally end with the browser session. Marketing storage relies on consent; technically necessary storage relies on the applicable necessity and legitimate-interest provisions.

With marketing consent, the Google tag for Google Ads may load from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We record successful form events and interactions such as primary contact-button or project clicks, form starts and successful enquiries or orders. Events contain the action type and a fixed page-area identifier, not the text or contact details entered in form fields.

Loading advertising scripts may involve IP address, browser/device information, time, visited URL, referrer and advertising or campaign identifiers. Campaign URLs can contain identifiers such as utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, gbraid, wbraid, msclkid, fbclid, ttclid or dclid.

With marketing consent, we separately retain available Google click identifiers (gclid, gbraid or wbraid), consent time and version for up to 90 days to attribute verified purchases. A protected server-side export may send Google a random measurement ID, verified live payment time, amount, currency, click identifier and consent status. It contains no names, contact details, bank information or order/payment access credentials. This advertising attribution is separate from our visitor-session analysis. Withdrawing consent clears local attribution and, when a network connection is available, attempts to block further exports of associated measurements; it does not delete contractual records or automatically undo processing already performed by Google. Ordering and payment do not depend on marketing consent. Campaign identifiers are transmitted with a form enquiry only after marketing consent. They are validated server-side and may appear in internal lead notifications for source attribution and campaign evaluation. Handling the actual enquiry does not depend on marketing consent and instead relies on contractual/pre-contractual necessity or another applicable basis.

Only on /business-start and /en/business-start, we load OpenAI’s Measurement Pixel after marketing consent. It measures campaign-page views and views of the Business Start package to attribute advertising in ChatGPT. This integration does not report purchases, payments or form submissions to OpenAI. Declining has no effect on prices, contact options or orders.

OpenAI may receive technical connection information such as IP address, browser information, time, website origin and advertising/browser identifiers. Our events contain fixed public page and package identifiers. We do not pass entered contact details, payment details or order-access credentials. The SDK does not run on our contact, order, payment or withdrawal pages; leaving the campaign pages uses a new document to keep those contexts separate.

The Pixel can store an OpenAI-provided ad identifier in __oppref for up to 30 days and a random browser identifier in __obref for up to 365 days. Capturing an ad identifier again resets its 30-day period; browsers may shorten these lifetimes. Cookie lifetimes do not describe the provider’s retention of measurement data. Withdrawing consent through cookie settings stops future measurement and removes these cookies. We also opt events out of future user-level personalisation.

Processing relies on consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. Processing outside the EU/EEA may occur. See OpenAI’s privacy policy for further information. Older marketing choices are requested again to include this additional provider.

OpenAI privacy policy ↗

When you contact us, we process the information you provide, including your name, contact details, message, project description and optional supporting information. This enables us to answer the enquiry, prepare a contract and communicate with you.

The order process additionally collects the company name, authorised contact, business address and country, and applicable tax or registration details such as VAT ID, NUI or NIPT/NUIS. It records the selected service, currency, price, package version, agreed conditions, consent and order reference. A technical delivery status helps prevent duplicate submissions. These records support contract formation, performance, correspondence and legal retention duties.

The fixed-package process can issue an automated order acceptance after a valid successful submission. The reference and payment instructions are returned in the browser and sent by email. This technical confirmation does not evaluate personal characteristics or perform credit scoring.

If you use the payment-report function, your declaration that a transfer was instructed, the associated order reference, selected bank-transfer route, stated transfer date and its processing status are recorded and communicated to our business email. This declaration is kept separate from verified bank receipt. Payment matching and related records are used for contract administration and accounting.

For directly bookable agency packages, we send Stripe the booking reference, service scope, agreed amount, currency and terms to be accepted. You enter your name, email, payment details and any required billing information directly on Stripe’s hosted payment page. No project questionnaire is required before payment. After successful payment, Stripe confirms the contact and payment information needed to match and perform the order. Existing orders may still use Stripe payment after an earlier order acceptance. Full card numbers and card security codes are not collected by our server.

We store Stripe transaction identifiers, amount, currency, confirmation time and verified payment status to match your payment to the accepted order and send a payment-confirmation email. Processing supports contract performance and statutory accounting duties under Article 6(1)(b) and (c) GDPR. Stripe also processes information for its own payment, security and fraud-prevention purposes and may process information outside the EU/EEA.

The protected payment-access entry in your browser session lets us retrieve your order and verify its status when you return from Stripe. A return to the website alone never confirms payment. The Stripe privacy notice explains the Stripe entities involved, their processing and applicable international-transfer safeguards.

Stripe privacy notice ↗

After a Stripe-verified live payment for an agency package, we email your booking number and personal project link. This space supports fulfilment of your paid order. We prefill the name, email and any available billing address from Stripe’s payment confirmation. You can add contact and company details, billing information, preferences, your existing website, example links and optional photos or logos. Only provide materials needed for the project; do not enter passwords, device PINs or other sensitive access credentials.

In this project portal, entries are saved when you choose Save, Continue or Submit; files are saved when you initiate an upload. Individual keystrokes are not automatically transmitted. You can resume a saved draft through the same personal link. Submitting notifies our responsible team using the booking reference. Photos and logos are held in private server storage and are accessible only through authorised project access or protected admin authentication. They are not published as public website files.

The personal link grants access for 30 days and should not be shared. This limits link access; it does not automatically delete necessary contract or project records. We retain those for order fulfilment and applicable legal retention duties. The legal bases are Article 6(1)(b) and (c) GDPR where applicable. Confirmation and project emails are transactional. No advertising or visitor-analysis scripts load in the project portal. Paying, saving a draft or supplying project details does not grant marketing consent.

For Pixel purchases we process your name, email, optional company details, delivery and billing address, selected device and setup, net price, VAT, shipping, contract version and order status. We calculate VAT on our server. Stripe receives the contact, address and order information needed for payment, together with the final total. Older orders already linked to Stripe Tax retain their original tax calculation association for processing. You enter card details directly in the embedded Stripe payment form; our server does not store full card numbers or security codes. A protected order-access record in your browser session supports checkout recovery.

We share the name, address and shipment details required for delivery or return collection with DHL. An electronic withdrawal is stored with your name, contract identification, confirmation email, declaration and receipt timestamp. A random request identifier prevents duplicate submissions. You receive an acknowledgement; withdrawal handling and any refund are separate. No login or proof of payment is required to submit the declaration. Our business email service sends order confirmations and withdrawal acknowledgements. Processing is based on contract performance and legal duties under Article 6(1)(b) and (c) GDPR. Records are retained for applicable legal periods or while required for their purpose, with access restricted to authorised staff.

For the separate installation service, we also process the model, confirmation that the device value is no more than EUR 2,500, acknowledgements about ownership or authorisation, OEM unlockability, backup and data erasure, and your optional early-performance declaration. The accepted contract version, declaration wording and confirmation time are documented with your order. These details support suitability checks, performance, appropriate return-shipping insurance and proof of the consumer information supplied, under Article 6(1)(b) and (c) GDPR.

If you choose EUR 350 cash in the parcel, we also record that payment method, the outstanding payment and order acceptance. This method does not initiate an online card payment. Receipt, counting and matching of cash received later are documented for contract performance and bookkeeping; order confirmation alone does not prove receipt of funds. If a refund is necessary, we process separately agreed reimbursement details, such as bank details you provide. Article 6(1)(b) and (c) GDPR and statutory retention periods also apply to these records.

Installation does not require personal device content, passwords, PINs or recovery keys, and we do not request them. Back up your data before sending the device and remove personal accounts, SIM cards and locks. Installation erases the data stored on the device; we do not create a backup or migrate personal data. Device checks and correspondence about receipt, return shipping or problems serve contract performance. The information above about Pixel payment, shipping, confirmation and retention records also applies to installation orders.

Cloudflare Turnstile, provided by Cloudflare, Inc., helps protect forms from automated or abusive submissions. It may process technical connection data, browser and interaction features and the generated verification token. Our legitimate interest in operating secure, usable forms is the relevant basis under Article 6(1)(f) GDPR.

We use appropriate technical and organisational measures such as transport encryption, access controls, role-based permissions, logging, backups and system hardening. These measures reduce risks; no internet service can promise absolute security.

Business email services, such as Microsoft 365 or Google Workspace, process message content, communication data and technical metadata as needed to answer enquiries, administer contracts or fulfil legal obligations. Relevant bases include Article 6(1)(b), (c) and (f) GDPR.

Where a separately agreed review-feedback service involves supplied existing-customer contact details, those details are processed to send the agreed requests or organise feedback under the applicable consent or other lawful basis. This is not an automatic part of website visits or package orders.

When you visit our presence on third-party platforms, the operator's own privacy notice also applies. Depending on the shared processing purposes, joint controllership under Article 26 GDPR may be relevant. Following an external link takes you to a service controlled by its respective provider.

The controller is established in the United States. Data handled by the controller can therefore be processed outside the EU/EEA. Google, OpenAI, Cloudflare and other service providers may also involve processing in third countries. Where required, appropriate safeguards, including EU Standard Contractual Clauses and supplementary measures, are used.

Service providers may support hosting/CDN, email and communications, form infrastructure, abuse protection and consent-based advertising/conversion measurement. Where they act as processors, the applicable Article 28 GDPR arrangements are required. Data is disclosed only to the extent needed for the purpose.

Campaign sessionStorage entries normally disappear at the end of the browser session. Contact, lead and business-order data is retained for the period needed to handle the request, communicate, administer the contract, follow up where appropriate or meet statutory retention obligations. Server and security logs are rotated and then deleted or anonymised according to operational retention processes.

Certain details are necessary to handle an enquiry or conclude and perform a business contract. Without the required company, contact or order information, we may be unable to process the request or may only be able to do so in a limited way.

Where the relevant conditions are met, you have rights to access, rectification, erasure, restriction of processing and data portability under Articles 15–20 GDPR. You may object to processing based on legitimate interests under Article 21 GDPR and withdraw consent at any time for the future under Article 7(3) GDPR. You may also complain to a data-protection supervisory authority in the European Union.

Contact us using the details above to exercise your rights or ask about the processing of your information. Withdrawing marketing consent does not change the lawfulness of processing that already took place, and does not cancel a separately accepted business order.

We may update this notice when processing activities, technology or legal requirements change. This English notice describes the same core website and business-order processing as our German notice, with the current online-order and payment-report workflow included. Last updated: 19 October 2026.