Last updated: September 2026

This privacy policy informs you, in accordance with Article 13 of the General Data Protection Regulation (GDPR), which personal data we process when you visit our website gbspay.com or contact us, for which purposes and on which legal basis, and which rights you have.

1. Controller

GBS pay GmbH
Am Storrenacker 1a
76139 Karlsruhe
Germany
represented by its Managing Director, Markus Ernst
Phone: +49 69 27315671-0
Email: info@gbspay.com

We are not legally required to appoint a data protection officer and have not appointed one. For any questions regarding data protection, please use the contact details above.

2. Summary

• We do not use any analytics, tracking or advertising services and do not create user profiles.
• No cookies are set for visitors to the website; a cookie banner is therefore not required.
• Fonts and scripts are loaded from our own server. When you visit the website, no data is transmitted to third parties such as Google or content delivery networks.
• The spam protection of the contact form works without any external service.
• Hosting and email take place exclusively in data centres in Germany.

3. Visiting the website and server logs

Each time our website is accessed, the web server automatically processes data transmitted by your browser: IP address, date and time of access, requested address (URL), amount of data transferred, HTTP status code, the previously visited page (referrer) as well as browser type and operating system (user agent).

The purpose is to deliver the website, to ensure stable and secure operation and to detect and prevent attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in these purposes. The data is stored in log files of our hosting provider in Germany. The IP address is shortened after 48 hours at the latest by setting its last block to zero; the log files are deleted after seven days at the latest. It is not combined with other data or analysed for marketing purposes.

4. Hosting, operation and email

We use the following service providers as processors pursuant to Art. 28 GDPR to operate this website and our email communication:

• Green Minds Venture GmbH, Unterer Hardthof 13B, 35398 Gießen, Germany: technical operation, administration and backup of the website.
• dogado GmbH, Antonio-Segni-Straße 11, 44263 Dortmund, Germany: web hosting (servers, database, server logs); sub-processor of Green Minds Venture GmbH.
• STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany: email mailboxes and email delivery; sub-processor of Green Minds Venture GmbH.

Data processing agreements are in place with all service providers. Processing takes place in Germany. For maintenance and support, the hosting provider may in individual cases involve the manufacturers of the server software used, including CloudLinux Inc. (USA). CloudLinux is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). The legal basis for using these service providers is Art. 6(1)(f) GDPR; our legitimate interest lies in the reliable, secure and economical operation of the website.

5. Contact form and contact by email

If you write to us via the contact form, we process your name, your email address and the subject (all mandatory) as well as the content of your message. The information is sent to us by email; it is not stored in the website database. The same applies if you contact us directly by email or phone.

The purpose is to handle your enquiry, including any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in responding to your enquiry. Providing the data is neither a statutory nor a contractual requirement; without the mandatory information, however, we cannot process your enquiry.

We delete your enquiry once it has been dealt with conclusively and no further communication is expected, usually after six months. If the enquiry leads to a business relationship, the statutory retention periods for commercial correspondence apply (Section 257 German Commercial Code, Section 147 German Fiscal Code; up to six years).

Spam protection: The form contains a check field that is invisible to visitors and checks the time between loading the page and submitting the form. No additional personal data is collected, no cookies are set and no data is transmitted to third parties. The legal basis is Art. 6(1)(f) GDPR (protection against misuse).

6. Website security

To protect the website against attacks, we use the security plugin Wordfence, which runs exclusively on our server. It analyses requests to the website and logs security-relevant events such as failed login attempts or blocked requests, including IP address, time and requested address. Visitors’ IP addresses are not transmitted to the manufacturer. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the website and our visitors’ data. The logs are automatically deleted after 30 days at the latest unless they are required to investigate a specific attack.

The connection to our website is encrypted using TLS (indicated by “https://” in the address bar).

7. Cookies and browser storage

We do not set any cookies for visitors to the website. Only when editors log in to the administration area are technically necessary cookies set for login and its protection.

If you use the accessibility features of the website (e.g. to change font size or contrast), your browser stores your settings in the local storage of your device so that they are retained on your next visit. This information is not transmitted to us. The storage is strictly necessary for the function you have expressly requested (Section 25(2) No. 2 German Telecommunications Digital Services Data Protection Act, TDDDG). You can reset the settings at any time via the widget or delete the website data in your browser.

8. Fonts and external content

All fonts, scripts and graphics are delivered from our own server. No connection to third-party servers is established when you visit the website.

Our website contains links to external services, for example to Google Maps for directions. Only when you click such a link will you be redirected to the respective provider’s website; from then on, its privacy policy applies.

9. Recipients and transfers to third countries

Apart from us, the only recipients of your data are the processors listed in section 4. Transfers to countries outside the European Union or the European Economic Area only take place in the exceptional case described in section 4. Data is only disclosed to other third parties if we are legally obliged to do so.

10. Your rights

Under the GDPR, you have the right

• of access to the data stored about you (Art. 15 GDPR),
• to rectification of inaccurate data (Art. 16 GDPR),
• to erasure (Art. 17 GDPR),
• to restriction of processing (Art. 18 GDPR),
• to data portability (Art. 20 GDPR),
• to withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, simply contact us using the details given in section 1.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Heilbronner Straße 35, 70191 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de

11. Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

12. Changes to this privacy policy

We will update this privacy policy if the website, the services used or the legal situation change. The version published on this page applies.

In case of discrepancies, the German version of this privacy policy shall prevail.