Privacy policy
1. Controller
The controller responsible for data processing on this website is:
BFF Business Services GmbH
Günther-Wagner-Allee 13-17
30177 Hannover, Germany
Email: mbe0051@mbe.de
No data protection officer has been appointed, as the legal requirements for this do not apply.
2. In short
This website uses no cookies, no cross-site tracking and no social media plugins. We measure traffic with a cookie-free method that does not identify users (see section 4). Fonts, scripts and images are served from our own web space; when you open the site, no data is sent to Google, Cloudflare or any other third party. We process personal data only when you contact us by email or phone, and only to the extent needed to handle your request and carry out an order.
3. Hosting and server log files
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open the website, Vercel automatically processes technical access data (server log files): IP address, date and time of access, page requested, amount of data transferred, browser type and operating system and the previously visited page (referrer). This data is technically necessary to deliver the website and to ensure its security and stability. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the secure operation of the website). Log files are deleted automatically after a short period and are not combined with other data.
A data processing agreement under Art. 28 GDPR is in place with Vercel. Where data is transferred to the USA, the transfer is based on Vercel's certification under the EU-US Data Privacy Framework and on the EU Commission's standard contractual clauses. Further information: vercel.com/legal/privacy-policy.
4. Traffic measurement (Vercel Web Analytics)
To learn how many visitors open our pages, where they come from and which pages they view, we use Vercel Web Analytics provided by our hosting provider Vercel Inc. The method works without cookies and without storing anything on your device. A short-lived hash is derived from the IP address and browser string solely to distinguish page views within one visit and is discarded after a short time; the IP address is not stored and no user profile is created. We also count how often the contact buttons and links (email, phone) are clicked, again without any personal reference. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in evaluating and improving our website). As no information is stored on or read from your device, no consent under § 25 TDDDG is required. You may object to this processing at any time (section 9).
5. Contact by email or phone
When you contact us by email, via an email link on this website or by phone, we process the data you provide (name, contact details, shipment details such as item, dimensions, collection and delivery address, auction house and lot number) to handle your request, prepare a quote and carry out the order. The legal basis is Art. 6 (1) (b) GDPR (contract and pre-contractual measures); for general enquiries Art. 6 (1) (f) GDPR (legitimate interest in answering you).
Our mailboxes are provided within the Mail Boxes Etc. franchise system. Processing takes place in professional, encrypted email systems within the EU or on the basis of appropriate safeguards under Art. 44 et seq. GDPR.
Enquiries that do not lead to an order are deleted once the matter is settled, at the latest after twelve months. Data on orders placed is retained for the periods required by German commercial and tax law (six or ten years, §§ 257 HGB, 147 AO).
Request form: When you write to us via the form on this website, your details (name, email, optional phone, delivery location, description of the shipment, optional item value) and the page you wrote from are not stored in a database but forwarded immediately as an email to our mailbox. The email is sent via the mail server of our host STRATO AG, Berlin; a data processing agreement under Art. 28 GDPR is in place with STRATO. The data does not leave the EU in the process. We use the details only to answer your request and prepare a quote (Art. 6(1)(b) GDPR) and delete them when they are no longer needed for this and no statutory retention obligations apply.
Contact via Telegram: If you message us on Telegram, you use a service of Telegram FZ-LLC, Dubai, United Arab Emirates. Telegram processes your messages, your Telegram name and connection data under its own terms, including outside the EU. We store your messages and details to handle your request and prepare a quote (Art. 6(1)(b) GDPR) and delete them when they are no longer needed for this and no statutory retention obligations apply. The Telegram button on this website is a plain link: no data is sent to Telegram until you click it.
6. Sharing data to carry out an order
To carry out a transport order we pass the necessary data (name, address, phone number and email of the recipient, contents and value of the shipment) to the carriers we commission (e.g. DHL Express, UPS, TNT, FedEx Express, Kühne + Nagel), to customs authorities and, if you request transport insurance, to the insurer. The legal basis is Art. 6 (1) (b) GDPR and, for customs declarations, Art. 6 (1) (c) GDPR. For shipments to countries outside the EU, transferring recipient data to the carrier and the authorities of the destination country is necessary for the performance of the contract (Art. 49 (1) (b) GDPR).
When collecting auction purchases, we pass your collection authorisation and contact details to the auction house concerned, as far as this is required for the release of the goods.
7. Payment
Payments are made by card via SumUp or via PayPal. The respective payment provider processes your payment data under its own responsibility; we only receive confirmation of payment. The privacy notices of SumUp Limited and PayPal (Europe) S.à r.l. et Cie, S.C.A. apply.
8. External links
This website contains links to external websites (e.g. mbe.de, Google Maps). When you click a link you leave our website; the respective provider is responsible for data processing on the linked pages. No content from these providers is embedded on our site.
9. Your rights
You have the following rights regarding your personal data: access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing (Art. 21 GDPR). Where processing is based on your consent, you may withdraw it at any time with effect for the future.
To exercise your rights, an email to mbe0051@mbe.de is sufficient.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, lfd.niedersachsen.de.
10. Data security
This website is delivered exclusively over an encrypted HTTPS connection. We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.
11. Changes
We update this privacy policy when the legal situation or our processing changes. The version published on this page applies.
Last updated: October 2026