Privacy Policy

BMG Solar — Privacy Notice (GDPR / BDSG-Conform)

Last updated: 10 July 2025

1. Who we are

Controller: Ambit Spot GmbH (t/a BMG Solar)

Leopoldstraße 31, 80802 München, Germany

Email: privacy@bmg.solar Tel.: +49 1522 347 2031

2. What personal data we collect

• Business identity & contact
• Name, job title, company, VAT ID, business address, email, phone
• Contract & billing
• Quotes, purchase orders, invoices, payment references, delivery / collection notes (CMR)
• Communications
• Emails, CRM notes, call logs, marketing preferences, opt-out records
• Website & usage
• IP address, device / browser details, pages viewed, interaction timestamps (via GoDaddy cookies & Google Analytics)
• Marketing & analytics
• Cookie IDs, Meta / Facebook Pixel IDs, email-campaign engagement (via Woodpecker & Zoho CRM)
• Whistle-blowing
• Any personal data voluntarily included in a report
  
  

3. Purposes & legal bases

• Quotation, order fulfilment, invoicing, logistics
• Legal basis: Performance of a contract (Art. 6 (1)(b))
• Statutory record-keeping, tax / VAT compliance
• Legal basis: Legal obligation (Art. 6 (1)(c))
• B2B marketing, customer relationship management, site analytics, fraud prevention
• Legal basis: Legitimate interests (Art. 6 (1)(f)) — you may object at any time (see § 9)
• Optional cookies / tracking beyond what is strictly necessary
• Legal basis: Consent (Art. 6 (1)(a) GDPR + § 25 TTDSG)

4. Who receives the data

• IT & hosting: GoDaddy (EU/US), Microsoft 365 (EU/US)
• CRM & email marketing: Zoho CRM (EU/US), Woodpecker.co (US)
• Analytics & advertising: Google Analytics (US), Meta Platforms (Ireland/US)
• Logistics & insurers: Freight forwarders, couriers, transit-insurers (EU)
• Professional advisers & authorities: Tax consultants, auditors, customs, courts, regulators where legally required

All providers are bound by data-processing agreements and (for non-EEA transfers) Standard Contractual Clauses or equivalent safeguards.

5. International transfers

Some vendors (e.g., Microsoft 365, Zoho, Google, Meta, Woodpecker) host or process data in the US or other third countries. Transfers rely on EU Standard Contractual Clauses and additional technical/organisational measures.

6. Retention

• Commercial correspondence: 6 years (§ 257 HGB)
• Invoices & VAT records: 10 years (§ 147 AO)
• CRM & marketing leads: deleted 3 years after last meaningful contact or immediately upon objection
• Cookie/analytics data: see § 10
• We retain data longer only where statutory retention or ongoing legal claims apply.

7. Security

We employ ISO-27001-aligned controls, TLS encryption, role-based access, and regular penetration tests. Transit shipments are insured; proof-of-delivery files are stored securely.

8. No children’s data

Our services target professionals aged 18+. We do not knowingly collect children’s data.

9. Your rights

You may request access, rectification, erasure, restriction, portability, or object to processing (including marketing/legitimate-interest analytics). Send requests to privacy@bmg.solar.

If you believe we breach data-protection law, you can lodge a complaint with your local authority or with:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

10. Cookies & tracking

Our site uses:

• Essential cookies (GoDaddy ecommerce platform) — required for security & checkout.
• Analytics cookies (Google Analytics) — help us improve site performance.
• Marketing cookies (Meta Pixel) — measure campaign success.

On first visit you’ll see a banner to accept or manage non-essential cookies. You can withdraw consent anytime via the “Cookie Settings” link in the footer or by clearing your browser cookies.

11. Whistle-blowing channel

Suspect misconduct or bribery? Email whistle@bmg.solar (encrypted). Reports are handled confidentially by senior management; anonymous tips welcome.

12. Set-off & marketing opt-out

Marketing emails always include an unsubscribe link. We will honour opt-outs immediately and keep a suppression list to ensure compliance.

13. Changes to this notice

We may update this Notice to reflect legal or operational changes. The latest version is always available at www.bmg.solar/privacy.

Questions?  Contact our privacy team at privacy@bmg.solar.