Privacy Policy

Information on how your personal data is handled on bl-capital.de.

1. Privacy at a glance

General information

The following information provides a brief overview of what happens to your personal data when you visit this website. Personal data means any data that can be used to identify you personally. For detailed information on data protection, please read our Privacy Policy below.

Data collection on this website

Who is responsible for collecting data on this website?

Data on this website is processed by the website operator. You can find their contact details in the “Controller” section of this Privacy Policy.

How do we collect your data?

Some data is collected when you provide it to us, for example when you enter information in a contact form.

Other data is collected by our IT systems automatically or with your consent when you visit the website. This is primarily technical data, such as your browser, operating system or the time of your visit. This data is collected automatically as soon as you access this website.

What do we use your data for?

Some data is collected to ensure that the website operates correctly. Other data may be used to analyse your usage behaviour. Where contracts can be concluded or initiated through the website, the information provided is also processed for contract offers, orders or other order enquiries.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request its rectification or erasure. If you have consented to data processing, you may withdraw that consent at any time with effect for the future. In certain circumstances, you also have the right to request restriction of the processing of your personal data. You further have the right to lodge a complaint with the competent supervisory authority.

You may contact us at any time about these rights or any other data protection questions.

Analytics tools and third-party tools

When you visit this website, your browsing behaviour may be statistically analysed, primarily using analytics software.

Detailed information about these analytics tools can be found in the following Privacy Policy.

2. Hosting

We host our website content with the following provider:

External hosting

This website is hosted externally. Personal data collected on this website is stored on the hosting provider’s servers. This may include, in particular, IP addresses, contact enquiries, metadata and communications data, contract data, contact details, names, website visits and other data generated through a website.

External hosting is used to fulfil our contracts with prospective and existing customers (Article 6(1)(b) GDPR) and in the interest of providing our online services securely, quickly and efficiently through a professional provider (Article 6(1)(f) GDPR). Where consent has been requested, processing is based exclusively on Article 6(1)(a) GDPR and section 25(1) TDDDG, insofar as that consent covers storing cookies or accessing information on the user’s device, such as device fingerprinting, within the meaning of the TDDDG. Consent may be withdrawn at any time.

Our hosting provider will process your data only to the extent necessary to fulfil its service obligations and will follow our instructions concerning that data.

We use the following hosting provider:

TenWeb, Inc., 40 E Main St, Suite 721, Newark, DE 19711, USA.

The data centre location for this website is set to Frankfurt am Main. Engaging a US provider may nevertheless involve access from third countries, for example for support and administration. Information on processing, the subprocessors used by 10Web and transfer safeguards can be found in the 10Web Privacy Policy and the 10Web Data Processing Agreement.

Data processing on our behalf

We have concluded a data processing agreement (DPA) for the above service. This legally required agreement ensures that the provider processes our website visitors’ personal data only on our instructions and in compliance with the GDPR.

3. General information and mandatory disclosures

Privacy

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection requirements and this Privacy Policy.

Various personal data is collected when you use this website. Personal data means data that can be used to identify you personally. This Privacy Policy explains what data we collect, what we use it for, and how and for what purposes it is processed.

Please note that data transmission over the internet, for example by email, may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

Controller

The controller responsible for processing data on this website is:

B&L Capital Management GbR
Represented by Mats Brockschnieder, Janne Brockschnieder and Mika Lakämper
Ostpreußenweg 7c
33758 Schloß Holte-Stukenbrock
Germany

Phone: +49 175 1939334
Email: info@bl-capital.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data, such as names or email addresses.

Retention period

Unless a more specific retention period is stated in this Privacy Policy, we retain your personal data until the purpose of processing no longer applies. If you submit a valid erasure request or withdraw consent to processing, your data will be erased unless we have other legally permissible grounds for retaining it, such as tax or commercial-law retention periods. In that case, it will be erased once those grounds no longer apply.

General information on the legal bases for processing data on this website

If you have consented to data processing, we process your personal data on the basis of Article 6(1)(a) GDPR or Article 9(2)(a) GDPR where special categories of data under Article 9(1) GDPR are processed. If you expressly consent to the transfer of personal data to third countries, processing is also based on Article 49(1)(a) GDPR. If you consent to storing cookies or accessing information on your device, for example through device fingerprinting, processing is additionally based on section 25(1) TDDDG. Consent may be withdrawn at any time. Where your data is necessary to perform a contract or take steps prior to entering into a contract, we process it under Article 6(1)(b) GDPR. We also process data under Article 6(1)(c) GDPR where necessary to comply with a legal obligation. Processing may further be based on our legitimate interests under Article 6(1)(f) GDPR. The following sections explain the legal bases applicable to each individual case.

Information on transfers to third countries without adequate data protection and to US companies not certified under the DPF

Among other tools, we use services from companies based in third countries without an adequate level of data protection, and US tools whose providers are not certified under the EU–US Data Privacy Framework (DPF). When these tools are active, your personal data may be transferred to and processed in those countries. Please note that a level of protection comparable to that in the EU cannot be guaranteed in such third countries.

The adequacy decision for the EU–US Data Privacy Framework (DPF) covers transfers to appropriately certified US recipients within the scope of their certification. Other transfers may require, in particular, EU standard contractual clauses and, where necessary, additional safeguards. Details of recipients and the applicable safeguards can be found in the service-specific sections. You can request copies or further details of the relevant safeguards using the contact details above.

Recipients of personal data

We work with various external organisations in the course of our business. This may require transferring personal data to them. We share personal data with external organisations only where necessary to perform a contract, where legally required, such as disclosure to tax authorities, where we have a legitimate interest in disclosure under Article 6(1)(f) GDPR, or where another legal basis permits it. When using processors, we share customers’ personal data only on the basis of a valid data processing agreement. In cases of joint processing, a joint-controller agreement is concluded.

Withdrawal of your consent to data processing

Many processing operations require your express consent. You may withdraw consent already given at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Right to object to data collection in particular circumstances and to direct marketing (Article 21 GDPR)

WHERE DATA IS PROCESSED ON THE BASIS OF ARTICLE 6(1)(e) OR (f) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA, INCLUDING PROFILING BASED ON THOSE PROVISIONS. THE APPLICABLE LEGAL BASIS IS SET OUT IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS (OBJECTION UNDER ARTICLE 21(1) GDPR).

WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING, INCLUDING PROFILING INSOFAR AS IT RELATES TO DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING (OBJECTION UNDER ARTICLE 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of a GDPR infringement, data subjects have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work or the alleged infringement. This right is without prejudice to other administrative or judicial remedies.

Right to data portability

You have the right to receive data that we process automatically on the basis of your consent or in performance of a contract, or have it provided to a third party, in a commonly used, machine-readable format. If you request direct transfer to another controller, this will be done only where technically feasible.

Access, rectification and erasure

Under the applicable legal provisions, you have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients, and the purpose of processing, and, where applicable, to have that data rectified or erased. You may contact us at any time about this or any other questions regarding personal data.

Right to restriction of processing

You have the right to request restriction of the processing of your personal data. You may contact us at any time to do so. This right applies in the following cases:

If you contest the accuracy of personal data we hold about you, we generally need time to verify it. You have the right to request restriction during that verification. If your personal data has been or is being processed unlawfully, you may request restriction instead of erasure. If we no longer need your personal data but you require it to exercise, defend or establish legal claims, you have the right to request restriction instead of erasure. If you have objected under Article 21(1) GDPR, your interests must be weighed against ours. Until it has been determined whose interests prevail, you have the right to request restriction of processing.

Once processing has been restricted, your personal data may, apart from storage, be processed only with your consent, to establish, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the website operator, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address changing from “http://” to “https://” and by the padlock symbol in your browser.

When SSL or TLS encryption is enabled, data you transmit to us cannot be read by third parties.

Objection to unsolicited promotional emails

We object to the use of contact details published as part of our legal notice obligations for sending advertising or information that has not been expressly requested. The website operators expressly reserve the right to take legal action against unsolicited advertising, including spam emails.

4. Data collection on this website

Cookies

Our website uses cookies. Cookies are small data packages that do not harm your device. They are stored either temporarily for a session (session cookies) or persistently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Persistent cookies remain on your device until you delete them or your browser deletes them automatically.

Cookies may originate from us (first-party cookies) or from other companies (third-party cookies). Third-party cookies allow certain services provided by other companies to be integrated into websites, such as payment processing services.

Cookies serve different purposes. Many are technically necessary because certain website functions, such as signing in to a customer account, would not work without them. Other cookies may be used to analyse user behaviour or for advertising.

Where storage or access is strictly necessary to provide a service you have expressly requested, it is based on section 25(2)(2) TDDDG. Subsequent processing of personal data is based, depending on its purpose, on Article 6(1)(b) GDPR (performance of a contract), Article 6(1)(c) GDPR (legal obligations) or Article 6(1)(f) GDPR (secure and functional website operation).

We use optional analytics technologies on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You may change or withdraw your choices at any time via “Manage consent”. You can also delete stored cookies and website data in your browser. This may remove sign-in sessions and saved preferences.

Any other cookies and services used on this website are described in this Privacy Policy.

Consent management with Complianz

We use the Complianz WordPress plugin installed on our website to request and store your preferences for optional services. In particular, consent status, selected categories and consent version are stored in cookies on your device. This allows us to respect and demonstrate your choices. The legal basis is Article 6(1)(c) GDPR in conjunction with the consent requirements of the GDPR and TDDDG; necessary storage is based on section 25(2)(2) TDDDG.

Further details of cookies and their durations can be found in our Cookie Policy. You can access your choices at any time via “Manage consent”.

Server log files

The hosting provider automatically collects and stores information in server log files that your browser transmits automatically. This includes:

Browser type and version, operating system, referrer URL, hostname of the accessing computer, time of the server request and IP address.

This data is not combined with other data sources.

This data is collected under Article 6(1)(f) GDPR. The website operator has a legitimate interest in the technically correct presentation and optimisation of its website, which requires server log files to be recorded.

Enquiries by email, phone or through our forms

If you contact us by email, phone or through our forms, your enquiry and any resulting personal data, such as your name and enquiry details, are stored and processed to handle your request. We use the processors named in this Policy for technical processing and email delivery.

Processing is based on Article 6(1)(b) GDPR where your enquiry relates to performing a contract or is necessary for steps prior to entering into a contract. In all other cases, it is based on our legitimate interest in effectively handling enquiries addressed to us (Article 6(1)(f) GDPR), or on your consent (Article 6(1)(a) GDPR) where requested. Consent may be withdrawn at any time.

Data you send through contact enquiries remains with us until you request erasure, withdraw consent to storage, or the purpose of storage no longer applies, for example after your request has been fully handled. Mandatory legal provisions, particularly retention periods, remain unaffected.

5. Customer accounts, subscriptions and invoices

Registration and sign-in by email code

For your customer account, we process your email address, the name and profile details you provide, and technical account and sign-in data. To sign in, we send a time-limited code to your email address. The necessary information and sign-in attempts are processed to verify the code and prevent misuse. Session cookies enable signed-in use. The legal bases are Article 6(1)(b) GDPR for providing the account and Article 6(1)(f) GDPR for protection against unauthorised access; necessary cookies are covered by section 25(2)(2) TDDDG.

Membership and contract administration

We use the Paid Member Subscriptions plugin on our website to manage purchased products, contract start dates and terms, renewals, payment status, discounts and access rights. This data is necessary to fulfil your subscription and provide protected market updates. Cancellations, withdrawals and related confirmations are also processed. The legal bases are Article 6(1)(b) and (c) GDPR.

Account data is stored for as long as the account is used. After termination or deletion, data no longer required is erased. Contract and payment records may be retained longer due to statutory retention obligations and to establish or defend claims.

Invoicing and bookkeeping

For invoicing, we process the customer’s name, email address, billing address where available, purchased product, service period, price, tax amount, payment date and payment reference. Our internal invoicing application synchronises the necessary data with the website and stores it on a local device operated by us for invoicing and bookkeeping. Full card details or PayPal passwords are not required.

Processing serves contract performance and compliance with tax obligations (Article 6(1)(b) and (c) GDPR). Invoices are generally retained for eight years, subject to the applicable statutory periods and any longer retention obligations, for example during ongoing proceedings. Where necessary, appointed tax advisers or legally authorised bodies receive the relevant records.

Payment processing through Stripe and PayPal

When you select a payment service, the contact, order, transaction and payment information needed for payment is transmitted to the relevant provider or collected directly by it. We receive, in particular, payment status and transaction references so that we can match the payment to your subscription. The legal basis for transmission to make payment is Article 6(1)(b) GDPR.

• Stripe: Stripe Payments Europe, Limited, Ireland, and the Stripe entities responsible for the relevant payment service. Information on data categories, processing as an independent controller, retention and international transfers: Stripe Privacy Policy.
• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Information on payment processing, fraud prevention, credit checks where applicable, and international transfers: PayPal Privacy Policy.

These providers also process certain data as independent controllers, particularly to fulfil legal obligations and prevent fraud. This may involve processing outside the European Economic Area. Depending on the provider and recipient, the transfer mechanisms described include, in particular, adequacy decisions, standard contractual clauses or binding corporate rules.

6. Email communications and newsletters

System and customer emails through Zoho

We use Zoho through a European SMTP endpoint to send technical website emails. The European provider is Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands. Recipient and sender addresses, message content and technical delivery data are processed. This includes, for example, sign-in codes and account or contract notifications. The legal bases are Article 6(1)(b) or (c) GDPR, and Article 6(1)(f) GDPR for reliable handling of other enquiries.

We have a data processing agreement with Zoho. Support services may involve access from India; Zoho describes standard contractual clauses and supplementary measures for this. Details: Zoho Privacy Policy and Information on storage locations and international access. Messages are retained according to their purpose and any statutory retention periods.

7. Usage analytics with Microsoft Clarity

With your consent, we use Microsoft Clarity, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity creates heatmaps and session recordings to help us identify usability issues and improve the website.

The data processed includes, in particular, clicks, mouse movements, scrolling behaviour, pages visited, technical browser and device information, and an approximate region derived from technical connection data. Cookies such as “_clck” (one year) and “_clsk” (one day) may be used. Processing is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You may withdraw consent with effect for the future via “Manage consent”.

According to Microsoft, normal playback data is retained for 30 days; heatmap and click data, and sessions tagged or saved as favourites, are retained for nine months. Data may be transferred to Microsoft in the USA. Microsoft uses safeguards including the EU–US Data Privacy Framework and standard contractual clauses.

Further information: Microsoft Privacy Statement, Clarity Terms and Clarity retention periods.

8. Financial quiz and sharing content

The financial quiz can be used without an account. It stores answers, progress and results locally in your browser so that you can resume and view your results. This storage does not contain an email address you have entered for this purpose and is not transmitted to us by the quiz. The data remains in local browser storage until you reset it or delete the website data. Storage necessary for the requested quiz function is based on section 25(2)(2) TDDDG and, where personal data is processed, Article 6(1)(b) GDPR.

When a quiz discount is redeemed at checkout, the discount used is associated with the order and processed to fulfil the contract. General server logs and any usage analytics you have consented to are independent of local quiz storage.

Sharing buttons and external links, particularly to YouTube, Instagram, LinkedIn, X or WhatsApp, open the relevant service only when activated. The links themselves do not embed videos or social media feeds. When you use such a link or sharing function, the provider receives the data necessary to open or share it, such as your IP address and the selected content. Its privacy information applies to subsequent processing. For YouTube, please see the Google Privacy Policy.

9. Website security with Wordfence

We use Wordfence to protect against unauthorised access, malicious requests and attacks. The provider is Defiant, Inc., USA. IP addresses, requested URLs, technical request data and security-related sign-in and event data may be processed and checked with the provider to detect threats.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to protect our website, customer accounts and the data processed on them. Where strictly necessary information is stored on or read from your device, section 25(2)(2) TDDDG applies. Security data is processed only for as long as necessary to detect, investigate and defend against threats; further statutory evidence or retention obligations may apply.

We have a data processing agreement with the provider. Transfers to the USA are based, under the Wordfence Data Processing Agreement , on standard contractual clauses. Further information is available in the Wordfence Privacy Policy.

Last updated: 12 October 2026. Based on templates from eRecht24, adapted and supplemented to cover the services used on this website.