Privacy policy

1. Controller

Robert Martin
Viewegstrasse 12
38165 Lehre
Germany
Email: webmaster@bs-ost.com

2. Overview

This website is used to map the business processes of car dealerships. Without signing in, only the home page, the legal notice and this privacy policy are available; all other content requires an account. We do not use any analytics, tracking or advertising services and do not embed content from third parties, so there are no external fonts, scripts, maps or videos.

3. Hosting and server log files

The website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Each time a page is requested, the server processes technically necessary data: IP address, date and time, requested address, previously visited page, browser and operating system, amount of data transferred and status code. This is required to deliver the pages and to keep the service stable and secure. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. The hosting provider keeps the log files only as long as necessary for these purposes. A data processing agreement under Art. 28 GDPR is in place with STRATO.

The connection to the website is encrypted with TLS (shown by “https” in the address bar).

4. Cookies and browser storage

We only use storage that is technically necessary:

• Session cookie “dd_session”: keeps you signed in, remembers the selected language and protects forms against misuse. It is deleted when you close your browser.
• Display mode (local storage): remembers whether the interface is shown in light or dark mode, but only if you explicitly choose this in the user menu.
• Position in the workspace (session storage): remembers the open tab and your position on the page. It is deleted when you close the browser window.

This storage is required for the use of the website you have expressly requested. Under Section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG), no consent is needed. The data never leave your browser, except for the session cookie, which is sent to our server.

5. User accounts and sign-in

User accounts are created by the administrators; there is no public registration. We store name, email address, the password only as an encrypted hash, the account status and the date and time of the last visit, so that new changes can be highlighted. Each account has a personal bookmark list. The legal basis is Art. 6(1)(b) and (f) GDPR. The data are deleted once the account is no longer needed, unless statutory retention obligations apply.

6. Password reset

If you forget your password, you can request an email with a link that is valid for a limited time only. The email is sent via the hosting provider's mail server. The legal basis is Art. 6(1)(b) GDPR.

7. Process mapping content and change log

Signed-in users record departments, journeys, steps and sub-steps, ratings, observations and attachments. For every change, we log who changed which element and when. For review and approval, the name and the date and time are recorded. This ensures traceability and approval under the four-eyes principle. The legal basis is Art. 6(1)(f) GDPR.

Process mapping describes workflows and roles. It is not intended to contain personal data of customers. The content is not analysed by third-party services.

8. Recipients and third countries

Apart from us, the only recipient of the data is STRATO as processor. Data are not transferred to countries outside the European Union.

9. Your rights

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

An informal message to the email address above is sufficient.

Last updated: October 2026. This translation is provided for convenience. The German version is legally binding.