Privacy Policy (Datenschutzerklärung)
Last updated: 30 August 2026
1. Data Controller
The controller responsible for the processing of personal data on this website is:
BSF – Benchmarking for Sustainable Futures UG (haftungsbeschränkt)
Stubbenhof 11
21147 Hamburg
Germany
Managing Director: Farooq Fazli
Commercial Register: Amtsgericht Hamburg
Registration Number: HRB 194320
Email: info@bsf-international.com
Phone: +49 176 21456624
Website: www.bsf-international.com
We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the Telecommunications Digital Services Data Protection Act (TDDDG), and other applicable data-protection laws.
2. Accessing Our Website
When you visit our website, technical information may automatically be transmitted to and processed by our web server or hosting provider.
This may include:
- IP address
- date and time of access
- requested page or file
- browser type and version
- operating system
- referrer URL
- device and connection information
- technical error and security information
This processing is necessary to provide the website securely and reliably, prevent misuse, detect technical problems, and maintain system security.
The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in operating a secure and functional website.
3. Contact and Business Inquiries
When you contact BSF by email, telephone, contact form, or another communication channel, we process the information you provide to us.
Depending on your inquiry, this may include:
name
organization or employer
email address
telephone number
subject of the inquiry
message content
information relating to services, projects, partnerships, employment, education, or professional opportunities
Where your inquiry relates to the initiation or performance of a contractual relationship, processing is based on Article 6(1)(b) GDPR.
For general business communication and relationship management, processing may be based on our legitimate interests pursuant to Article 6(1)(f) GDPR.
Where we specifically request your consent, processing is based on Article 6(1)(a) GDPR.
4. Cookies and Similar Technologies
Our website may use cookies and similar technologies that are technically necessary for the operation, security, administration, and functionality of the website.
Technically necessary technologies are used where permitted by applicable law.
Non-essential technologies, including analytics, marketing technologies, or externally loaded services requiring consent, are activated only where the required consent has been obtained.
Where consent is required, processing is based on Article 6(1)(a) GDPR together with the applicable requirements of § 25 TDDDG.
Where available, you can withdraw or modify your consent at any time through the website's cookie or privacy settings. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
5. External Websites and Social Media
Our website may contain links to external websites and social-media platforms, including professional and social networks.
When you follow an external link, the processing of personal data on the destination website is the responsibility of the respective provider and is governed by that provider's privacy policy.
BSF is not responsible for the data-processing practices of independent third-party websites.
6. Recipients of Personal Data
BSF does not sell personal data.
Where necessary, personal data may be disclosed to carefully selected service providers or other recipients for the operation of our website, communication, delivery of services, or compliance with legal obligations.
Recipients may include:
- website hosting providers
- IT and website-maintenance providers
- email and communication providers
- contact-form or technical service providers
- professional advisers
- public authorities where disclosure is legally required
Where service providers process personal data on behalf of BSF, appropriate data-processing agreements pursuant to Article 28 GDPR are concluded where required.
7. International Data Transfers
Where a service provider processes personal data outside the European Union or European Economic Area, personal data are transferred only where the requirements of Articles 44 et seq. GDPR are satisfied.
Appropriate safeguards may include:
- an adequacy decision by the European Commission
- Standard Contractual Clauses
- other legally recognized transfer mechanisms
Additional protective measures are implemented where required.
8. Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected or for as long as required by applicable law.
The applicable retention period may depend on:
- the duration of an inquiry or communication
- an existing or prospective business relationship
- contractual requirements
- statutory commercial and tax-retention obligations
- security requirements
- the establishment, exercise, or defence of legal claims
Personal data are deleted or anonymized when they are no longer required and no legal retention obligation prevents deletion.
9. Data Security
BSF implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
These measures may include:
- encrypted HTTPS/TLS connections
- access controls
- secure authentication
- software and system updates
- backups
- organizational access restrictions
- technical security measures
Despite these measures, no internet-based transmission or electronic storage system can be guaranteed to be completely secure.
10. Your Data Protection Rights
Subject to the applicable legal requirements, you have the right to:
- Access your personal data — Article 15 GDPR
- Rectification of inaccurate personal data — Article 16 GDPR
- Erasure of personal data — Article 17 GDPR
- Restriction of processing — Article 18 GDPR
- Data portability — Article 20 GDPR
- Object to processing — Article 21 GDPR
- Withdraw consent at any time — Article 7(3) GDPR
Where processing is based on our legitimate interests pursuant to Article 6(1)(f) GDPR, you may object to such processing for reasons arising from your particular situation.
Where personal data are processed for direct-marketing purposes, you may object to such processing at any time.
To exercise your rights, contact:
11. Automated Decision-Making
BSF does not use personal data collected through this website for automated decision-making, including profiling, within the meaning of Article 22 GDPR, unless explicitly stated otherwise.
12. Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data-protection supervisory authority if you believe that the processing of your personal data violates applicable data-protection law.
For a company based in Hamburg, the competent supervisory authority is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Hamburg, Germany
13. Changes to This Privacy Policy
We may update this Privacy Policy where necessary to reflect changes in legal requirements, website technologies, services, or our data-processing activities.
The version currently published on this website applies.