Privacy
Privacy Policy
This translation is provided for convenience. The original German version is authoritative for legal interpretation. Open the German original
1. Controller
Muhammed Tahir Bagci
BAM Fyx² Smart Repair
Ascherslebener Weg 6c
68307 Mannheim
Phone: +49 162 91 59 063
Email: info@bamfyx.de
2. Hosting and server logs
This website is hosted by STRATO. When it is accessed, technically necessary connection data is processed. This may include the IP address, time of access, requested file, amount of data transferred, browser type, operating system and referrer. Processing serves the secure and stable provision of the website. The legal basis is Article 6(1)(f) GDPR.
3. Local preferences and browser cart
The cart, selected service type, language and colour scheme are stored in the browser’s local storage so that your selection is retained during further use. You can delete this information through your browser settings. Your name, address, phone number and email address are not stored in the local cart storage.
4. Repair orders and appointment booking
When a repair order is submitted, we process contact details, billing and return address, selected repair services, language, service and payment method, appointment details and any voluntary fault description. The data is stored in an access-protected database at the hosting provider. Processing is necessary to take steps prior to entering into a contract and to perform the repair contract. The legal basis is Article 6(1)(b) GDPR.
For on-site orders, the selected appointment is reserved. We also store the time and version of the legal confirmations given at checkout to document the ordering process. Device codes, PINs and passwords are not collected through the website.
For an estimate request, we additionally process device and damage details, voluntary insurance, claim and policy numbers, and uploaded damage photos. This information is processed to review, prepare and send the requested estimate. The legal basis is Article 6(1)(b) GDPR. Photos can only be accessed in the protected admin area.
A random status code is stored for each order so that its progress can be checked. When the code is entered, only the current processing status and the time of the last update are displayed. Names, contact details, addresses, device identifiers and internal notes are not shown.
5. Protection against misuse
Requests are rate-limited to protect the ordering, status and admin systems against automated attacks. For this purpose, the IP address may be processed together with a non-public security key as a non-reversible verification value. These values are used exclusively for system security and are regularly removed. The legal basis is Article 6(1)(f) GDPR.
6. Email notifications
Order, payment and estimate confirmations are sent through the SMTP mailbox configured at STRATO to the customer address provided and to info@bamfyx.de. The contact, order and payment-status details required for the relevant message are processed for this purpose. A failed notification does not affect storage of the transaction.
7. Contact form and custom enquiries
When the contact form is submitted, the name, email address, an optional phone number and the message are stored in the access-protected database so that the enquiry can be handled. The legal basis is the consent given pursuant to Article 6(1)(a) GDPR; consent may be withdrawn at any time with effect for the future. By contrast, the custom repair enquiry form does not store entries in the website database. Depending on the chosen contact method, a prepared message opens in WhatsApp or the email program and is only transmitted when it is sent there. The privacy terms of the relevant provider then also apply.
8. External links
The website contains links to WhatsApp, Instagram and Google. Content from these providers is not embedded in the website. A connection to the relevant provider is only established when you click a link.
9. Fonts, internal audience measurement, Google Analytics and cookies
The Manrope typeface is served locally; Google Fonts is not integrated. Independently of Google Analytics, the existing privacy-conscious internal audience measurement system is operated exclusively on our own STRATO webspace. It records requested pages, timestamps, the traffic source or referring domain, the device category and specifically defined interactions such as cart, checkout, contact and completion events. The IP address and user agent automatically transmitted by the browser are processed only temporarily to create a non-reversible value that changes every day and to determine the device category; the full IP address and full user agent are not stored in the internal analytics database. No analytics cookies or browser identifiers, form entries, screen recordings or keystrokes are collected for this purpose. Internal analytics data is not sent to an external analytics service or combined with customer data. Do Not Track and Global Privacy Control signals are respected. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is audience measurement and improving content and booking flows.
We also use Google Analytics 4 (measurement ID G-N561HB86CG), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is loaded only after you have consented to the “Statistics” category. Before consent, analytics_storage, ad_storage, ad_user_data and ad_personalization remain denied and our integration does not establish a connection to Google Analytics. After consent, the page URL and title, referrer, timestamps, device and browser information and an approximate region may in particular be processed. Google Analytics may set cookies including _ga and _ga_* for this purpose. After consent, specifically defined interaction and ecommerce events relating to repair selection, contact, estimate and booking flows are also transmitted, in particular view_item, add_to_cart, remove_from_cart, add_shipping_info, begin_checkout, add_payment_info, booking_complete, purchase, generate_lead, contact_intent, estimate_submit and cta_click. These events may include the manufacturer, device model, repair type, cart or order value, service type, payment-method category and a technical order or request number as a transaction identifier. Names, telephone numbers, email or postal addresses, IMEI or device codes, free-text entries, uploaded photos and specific card, bank-account or other payment details are not sent to Google Analytics. Google signals and personalised advertising are disabled in our integration; advertising consent remains denied. According to Google, IP addresses of users in the EU are processed only temporarily to derive coarse location data and are discarded before being logged. Processing by Google outside the European Economic Area cannot be completely ruled out.
The legal basis for Google Analytics is your consent under Article 6(1)(a) GDPR and, where information is stored on or read from your device, section 25(1) TDDDG. Your choice and its timestamp are stored in your browser’s local storage. You can change or withdraw it at any time via “Cookie settings” at the bottom of the page. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. If you reject or withdraw consent, Google Analytics is disabled for further measurement and Google Analytics cookies accessible to this website are deleted. Further information: https://policies.google.com/privacy?hl=en
Technically necessary session cookies are used for the protected admin area and the one-time setup. Secure payment components from Stripe or PayPal are loaded only when an online payment is started. These providers may use technically necessary cookies or similar storage technologies.
10. Storage period
Order, invoice and payment data is stored for as long as required for contract performance and statutory commercial and tax retention duties. Detailed audience-measurement data, including the daily-changing verification values, is deleted after no more than 90 days. Aggregated daily totals without a verification value may be retained for longer-term comparisons. Other data not subject to a statutory retention duty is deleted or anonymised once its purpose no longer applies and there are no legitimate grounds for further storage. Technical backups are overwritten according to the hosting provider’s backup cycles.
Cookies set by Google Analytics have a maximum lifetime of 13 months in this integration and are not automatically extended on every page view. User- and event-level data retention in the GA4 property used for this website is set to 14 months. Aggregated standard reports may remain available for longer independently of this setting.
11. Recipients
Access is limited to BAM Fyx² Smart Repair and service providers used to operate the website. These particularly include STRATO for hosting and email, Google Ireland Limited when statistics consent has been given and, depending on the payment method selected, Stripe or PayPal. Data is disclosed to other recipients only when necessary for contract performance, required by law, covered by consent or otherwise expressly permitted.
12. Online payments through Stripe and PayPal
For an online payment, the payment method, amount, currency, order or request number, email address, payment status and technical transaction identifiers are transmitted to Stripe or PayPal. Card and PayPal account details are entered directly in the secure area of the selected provider and are not stored on the BAM Fyx² server. The legal basis is Article 6(1)(b) GDPR. Depending on the provider, processing outside the European Economic Area may take place on the basis of the applicable data-protection safeguards.
13. Your rights
Subject to the statutory requirements, you have rights including access, rectification, erasure, restriction of processing, data portability and objection. You also have the right to lodge a complaint with a data protection supervisory authority.
14. Last updated
Last updated: September 2026