Privacy Policy

1. Controller and contact details

The controller within the meaning of the GDPR is:

• BBC Best Box Containerhandel e.K.
• Petersweg 11a, 22946 Großensee, Germany
• Phone: +49 1525 9026450
• Email: kontakt@bestboxcontainer.de
• Represented by: Peer Kunz

2. Data protection officer

We have not appointed a data protection officer, as the statutory conditions for doing so (section 38 of the German Federal Data Protection Act) are not met. For any data protection questions or to exercise your rights, please use the contact details given in section 1, in particular kontakt@bestboxcontainer.de.

3. Legal bases for processing

We process personal data only on one of the following legal bases:

• Article 6(1)(a) GDPR: your consent, for example for newsletters or non-essential cookies
• Article 6(1)(b) GDPR: performance of the purchase contract or pre-contractual measures
• Article 6(1)(c) GDPR: compliance with legal obligations, in particular commercial and tax retention requirements
• Article 6(1)(f) GDPR: our legitimate interests, such as fraud prevention, IT security and improving our services

4. Server log files

When you access our pages, the server automatically collects information transmitted by your browser: IP address, date and time of access, page requested, volume of data transferred, referrer URL and browser and operating system type. This data cannot be attributed to specific individuals by us and is used to deliver the pages, ensure system security and analyse faults. The legal basis is Article 6(1)(f) GDPR. Log files are deleted or anonymised after seven days at the latest.

5. Order processing and customer accounts

To process your order we handle your form of address, first and last name, billing and delivery address, email address, telephone number where applicable, and your order and payment data. Without this information the contract cannot be concluded or performed. The legal basis is Article 6(1)(b) GDPR.

If you create a customer account, we store your access credentials and order history so that you can complete future orders more conveniently. You may have your customer account deleted at any time; statutory retention obligations remain unaffected.

6. Payment service providers

In our shop you can pay by bank transfer (advance payment) or by credit and debit card.

For payment by bank transfer we do not pass any payment data to third parties; you transfer the amount directly to the business account stated in the order confirmation.

Card payments are processed via the payment service provider Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The data required for the payment (in particular card and transaction data and your IP address) is collected directly by Stripe and processed by Stripe under its own responsibility. The legal basis for the transfer is Article 6(1)(b) GDPR. Stripe may also transfer personal data to Stripe, Inc. in the USA; this transfer is safeguarded by the European Commission's standard contractual clauses under Article 46 GDPR.

Complete card details are collected exclusively by Stripe; we do not store complete payment data.

7. No credit checks

We offer neither purchase on account nor payment in instalments. We therefore do not obtain credit reports from credit reference agencies, and we pass your data to no one for that purpose. Should we offer such a payment method in future, we will first extend this notice to name the agency, the legal basis and your right to object.

8. Shipping and installation services

For delivery purposes we pass on your name, delivery address and, for scheduling freight forwarder deliveries and connection or installation services, your telephone number or email address to the logistics or service partner engaged. The legal basis is Article 6(1)(b) GDPR.

9. Customer reviews

If you submit a product review, we process the name or pseudonym you provide, the review text, the star rating and the time of submission. Reviews are checked before publication. The legal basis is Article 6(1)(a) and (f) GDPR. You may request the deletion of your review at any time.

10. Newsletter

We use the double opt-in procedure for our newsletter: after you sign up, we send you an email containing a confirmation link. Only after you confirm do we add you to the mailing list. We store the IP address and time of registration and confirmation in order to document the process.

The legal basis is your consent under Article 6(1)(a) GDPR. You may unsubscribe at any time using the link in every email or by contacting us. Where the statutory requirements of section 7(3) of the German Act Against Unfair Competition are met, we may also send existing customers advertising for similar goods without separate consent; you may object to this at any time as well.

11. Shopping cart reminders

If you enter your email address during checkout but do not complete the order, we store your email address, the selected items, the amounts and the time you left.

We use this data to send you up to three reminders about your shopping cart within about a day and a half, and to help you if something went wrong during checkout. The last reminder may include a discount code. The legal basis is our legitimate interest in recovering abandoned checkouts (Art. 6(1)(f) GDPR).

You may object at any time. Every message contains an unsubscribe link at the bottom. Once you unsubscribe, you will receive neither further reminders nor offers from us. The stored data is deleted automatically no later than 30 days after the checkout was abandoned, unless an order is placed.

12. Contacting us and customer service

If you contact us by email, telephone or contact form, we process your details in order to handle your enquiry. The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contract, otherwise Article 6(1)(f) GDPR. We delete enquiries once they have been dealt with conclusively and no retention obligations apply.

13. Cookies and consent management

We use cookies and comparable technologies. Technically necessary cookies, for the shopping basket, session management and security, for example, are used on the basis of section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) without consent; the associated data processing is based on Article 6(1)(f) GDPR.

We load two services only after you consent via the banner: our live chat (Smartsupp s.r.o., Czech Republic), which stores a visitor ID on your device, and the map on the contact page (Google Ireland Limited, Ireland; processing may also involve the parent company Google LLC, USA), which transmits your IP address to Google when it loads. In both cases the legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Without consent, chat and map stay disabled; the contact page then offers a plain link that opens Google Maps in a new tab without first connecting to Google. You can withdraw your consent at any time via the "Cookie settings" link in the site footer.

You can also delete or block cookies in your browser. Some shop functions may then no longer be fully available.

14. Web analytics and marketing

We currently do not use any web analytics, retargeting or conversion tracking services; no reach measurement takes place. Should we introduce such services in future, we will do so exclusively on the basis of your prior consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. We will update this privacy policy beforehand and then name the services used, their providers, the data processed, the storage period and any third-country transfers.

15. Recipients and transfers to third countries

Recipients of your data are exclusively service providers we have selected with care and who act for us as processors under Article 28 GDPR, as well as bodies to which we are legally required to transfer data (such as tax authorities). A transfer to countries outside the EU and the EEA may occur in two cases: for card payments, the payment service provider Stripe may transfer data to Stripe, Inc. in the USA; and if you consent to the map on the contact page, Google LLC, based in the USA, may receive your IP address. Both transfers are safeguarded by the European Commission's standard contractual clauses under Article 46 GDPR. Beyond this, no transfer to a third country takes place; should another one become necessary in future, it will only happen on the basis of an adequacy decision of the European Commission or appropriate safeguards within the meaning of Articles 44 et seq. GDPR.

16. Retention periods

We store personal data only for as long as is necessary for the relevant purposes. Contract and invoice data are subject to commercial and tax retention periods of six and ten years respectively (section 257 of the German Commercial Code, section 147 of the German Fiscal Code). We delete the data once these periods have expired.

17. Your rights as a data subject

You have the following rights in relation to us:

• Right of access to the data stored about you (Article 15 GDPR)
• Right to rectification of inaccurate data and completion of incomplete data (Article 16 GDPR)
• Right to erasure, provided no retention obligations apply (Article 17 GDPR)
• Right to restriction of processing (Article 18 GDPR)
• Right to data portability in a structured, commonly used and machine-readable format (Article 20 GDPR)
• Right to withdraw consent with effect for the future (Article 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

18. Right to object under Article 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

If you object to processing for direct marketing purposes, we will no longer process your data for those purposes. No particular form is required for the objection; it may be sent to kontakt@bestboxcontainer.de.

19. Competent supervisory authority

The authority responsible for us is the Independent Centre for Data Protection Schleswig-Holstein (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, ULD), Holstenstraße 98, 24103 Kiel, Germany.

20. Data security and automated decision-making

We secure the transmission of your data using TLS encryption (recognisable by the padlock symbol in your browser's address bar) and implement technical and organisational measures in accordance with Article 32 GDPR.

Automated decision-making including profiling within the meaning of Article 22 GDPR does not take place.

21. Changes to this privacy policy

We update this privacy policy when the legal situation, our services or our data processing change. The version published on this page applies. Last updated: 26 July 2026.