Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Where this policy refers to BAUF, we, us, or our, it means the entity identified above. Certain data processing operations — such as order fulfilment, regional logistics, and local partner coordination — may be carried out by our affiliated entity, BAUF HOME, UNIPESSOAL LDA (Portugal), acting as a data processor on our behalf and under our instruction.

2. What Data We Collect

2.1 Data You Provide Directly

• Contact and enquiry forms: name, email address, company name, phone number, message content.
• Job applications: name, email address, LinkedIn profile URL, CV/resume.
• Partner registration: company details and contact information.
• Newsletter subscription: email address.

2.2 Data Collected Automatically via Cookies and Similar Technologies

Technical values may be used to enrich form submissions with neutral context:

• referrer_url — entry referrer, stored in browser session storage only after your consent for form-visit context.
• landing_url — first page in the current session after consent for form-visit context.
• NEXT_LOCALE — language preference selected in the language switcher.
• app_mode — selected application/UI mode.

For cookies, similar technologies, and analytics (where enabled), see our separate Cookie Policy.

2.3 Server Log Data

• IP address (anonymised), browser type/version, OS, referrer URL where available, pages visited, date and time of access (retained 30 days).

3. Legal Basis for Processing

Where we rely on legitimate interests, you have the right to object at any time.

4. Data Sharing and Processors

We may share your personal data with:

• BAUF HOME, UNIPESSOAL LDA (Portugal), our operational affiliate, acting as a data processor for logistics, regional fulfilment, and partner support on our behalf and under appropriate agreements.
• Hosting and IT providers — for website hosting, email services, and IT infrastructure, predominantly within the EU/EEA where possible.
• Analytics providers — such as Google Analytics with IP anonymisation enabled, subject to your cookie consent.

We do not sell your personal data to third parties. We do not transfer personal data outside the EU/EEA unless adequate safeguards (e.g., Standard Contractual Clauses under Art. 46 GDPR) are in place.

5. International Transfers

Where data is processed outside the EU/EEA, we rely on safeguards such as SCCs under Art. 46 GDPR.

6. Retention Periods

• Enquiry data and CRM records: up to 24 months after last substantive contact unless a lasting business relationship requires longer retention or legal obligations apply.
• Application data: 6 months after the recruitment process concludes unless you consent to longer storage.
• Newsletter subscriptions: retained until you unsubscribe.
• Server logs: deleted after 30 days.

7. Your Rights

Under the GDPR, you have the right to:

• Access your personal data (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data (“right to be forgotten”) where conditions are met (Art. 17).
• Restrict processing in certain circumstances (Art. 18).
• Data portability, where applicable (Art. 20).
• Object to processing based on legitimate interests, where applicable (Art. 21).
• Withdraw consent at any time without affecting processing prior to withdrawal (Art. 7(3)).

To exercise these rights in relation to this website, please contact us at the email address shown under the Controller section above.

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The supervisory authority competent for Bauf Home GmbH is:

You may alternatively lodge a complaint with the supervisory authority in your country of residence or place of work.

If your concern relates to processing carried out solely by BAUF HOME, UNIPESSOAL LDA in Portugal as processor or as an independent controller, you may contact the Portuguese data protection authority, CNPD (Comissão Nacional de Proteção de Dados), Av. D. Carlos I, 134, 1200-651 Lisbon, Portugal (www.cnpd.pt).

9. Security

We use industry-standard technical and organisational measures to protect personal data, including TLS encryption, role-based access controls, and periodic security reviews. However, no electronic transmission or storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security and shall not be liable for unauthorised access despite reasonable safeguards. Transmission over public networks may involve delays or loss.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be published on this page. We encourage you to review this page periodically.