In the following, we provide you with additional information on our general data protection information about the processing of your personal data when using our website.

Updated 10.06.2026

Who we are

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is:

BON PASTAIO GmbH
Lindenstr. 51
04895 Falkenberg
Germany
+49 (0)35365 396989
in**@********io.de
www.bonpastaio.de

Contacting the Data Protection Officer

The data protection officer of the controller is:

DataCo GmbH
Sandstr. 33
80335 München
Germany
+49 89 7400 45840
www.dataguard.de

This page informs you about the processing of your personal data on this website. How we collect and use your personal data depends on how you interact with us or which services you use. We only collect, use, or share your personal data if we have a legitimate purpose and a legal basis for doing so.

What do we mean by legal basis?

consent (Art. 6 para. 1 sentence 1 lit. a GDPR) – You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. Further information on how to withdraw your consent can be found in the subsections “Exercising your rights” in the following sections of this privacy policy.

contract (Art. 6 para. 1 sentence 1 lit. b GDPR) – We need to use your data to fulfill a contract you have with us. Alternatively, it is necessary to use your data because we have asked you to or you have taken certain steps yourself before entering into this contract.

Legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR) – We need to use your data to comply with the law.

Vital interests (Art. 6 para. 1 sentence 1 lit. d GDPR) – The processing of your data is necessary to protect your vital interests or those of another person. For example, to protect you from serious physical harm.

Public task (Art. 6 para. 1 sentence 1 lit. e GDPR) – The processing of your data is necessary for the performance of a task carried out in the public interest or because it is covered by a statutory task, e.g. for a statutory function.

Legitimate interests (Art. 6 para. 1 sentence 1 lit. f GDPR) – The processing of your data is necessary to support a legitimate interest that we or another party have, only if your own interests do not override those interests.

Please note that we may not be able to provide you with our website services if your data is being processed to fulfill a contract or legal obligation and you do not provide the requested data.

Data sharing and international transfer

As explained in this privacy policy, we use various service providers who help us provide our services and ensure the security of your data. When we use these service providers, it is necessary for us to share your personal data with them. We have agreements in place with all service providers to whom we share your data, obligating them to protect your data.

When your personal data is transferred outside the EU, we ensure that your personal data receives an equivalent level of protection, either because the country to which your data is transferred has an "adequate" level of data protection according to the European Commission, or by applying another safeguard, such as an enhanced contractual agreement, i.e., the Standard Contractual Clauses (SCCs) adopted by the European Commission. For example, when we use US service providers, we rely on either the SCCs or the EU-US Data Privacy Framework, depending on the provider. You can request a copy of the SCCs we have concluded with our service providers by sending an email to the email address provided in this Privacy Policy.

Your rights

If personal data is processed by you, you are the person concerned within the meaning of the DSGVO and you have the following rights towards the responsible person:

1. The right to information (Art. 15 GDPR)

You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to access this data and the following information:

Purposes of processing; categories of personal data; recipients or categories of recipients; planned storage period or the criteria for determining this period; the existence of the rights to rectification, erasure or restriction of processing or objection; right to lodge a complaint with the competent supervisory authority; where applicable, the source of the data (if collected from a third party); where applicable, the existence of automated decision-making, including profiling, with meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing; where applicable, the transfer of personal data to a third country or international organization.

2. Right to rectification (Art. 16 GDPR)

If your personal data is incorrect or incomplete, you have the right to request an immediate correction or completion of the personal data.

3. Right to restriction of processing (Art. 18 GDPR)

If one of the following conditions is met, you have the right to request a restriction of the processing of your personal data:

You contest the accuracy of your personal data, for a period that allows us to verify its accuracy. In the case of unlawful processing, you object to the erasure of your personal data and request instead the restriction of its use. We no longer need your personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims, or after you have objected to the processing, for the period during which we assess whether our legitimate grounds override your grounds.

4. Right to erasure (“right to be forgotten”) (Art. 17 GDPR)

If one of the following reasons applies, you have the right to request the immediate deletion of your personal data:

Your data is no longer necessary for the processing purposes for which it was originally collected. You withdraw your consent and there is no other legal basis for the processing. You object to the processing and there are no overriding legitimate grounds for the processing, or you object pursuant to Article 21(2) GDPR. Your personal data is being processed unlawfully. Erasure is necessary for compliance with a legal obligation under Union or Member State law to which we are subject. The personal data was collected in relation to the offer of information society services referred to in Article 8(1) GDPR.

Please note that the above reasons do not apply insofar as processing is necessary: ​​for exercising the right of freedom of expression and information; for compliance with a legal obligation or for the performance of a task carried out in the public interest to which we are subject; for reasons of public interest in the area of ​​public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; for the establishment, exercise or defence of legal claims.

5. Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format or to request its transmission to another controller.

6. Right to object to certain data processing (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) of the GDPR. This also applies to profiling based on those provisions. Where personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

7. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. The supervisory authority with which the complaint has been lodged will inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.

A list of the locally responsible supervisory authorities in Germany can be found on the website of the Federal Commissioner for Data Protection at the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

Provision of the website and creation of the log files

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected: information about the browser type and version used; the user's operating system; the user's internet service provider; the date and time of access; websites from which the user's system accessed our website; websites accessed by the user's system via our website.

This data is stored in our system's log files. This data is not stored together with other personal data of the user.

2. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user's computer. For this purpose, the user's IP address must be stored for the duration of the session. Storage in log files is carried out to ensure the functionality of the website. In addition, the data helps us to optimize the website and to ensure the security of our IT systems. The data is not used for marketing purposes in this context.

3. Legal basis for data processing

The legal basis for the temporary storage of the data and log files is Art. 6 para. 1 sentence 1 lit. f GDPR.

4. Duration of storage

The data is deleted as soon as it is no longer needed for the purpose for which it was collected. In the case of data collected to provide the website, this is the case when the respective session ends. In the case of data stored in log files, this is the case after a maximum of seven days. Storage beyond this period is possible. In this case, the users' IP addresses are deleted or anonymized so that it is no longer possible to identify the requesting client.

5. Exercising your rights

The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. Users may object to this. Whether the objection is successful will be determined through a balancing of interests.

Use of Cookies

1. Description and scope of data processing

When you visit our website, we use technical tools for various functions, in particular cookies, which can be stored on your device. When you access our website, and at any time later, you can choose whether to generally allow the setting of cookies or which individual additional functions you wish to select. You can make changes in your browser settings or via our consent manager. Cookies are text files or information in a database that are stored on your hard drive and assigned to the browser you are using, so that the entity setting the cookie can receive certain information.

We use technically necessary cookies that are required for the technical functioning of the website. Without these cookies, our website cannot be displayed (fully and correctly), and the support functions are not possible. The following data is stored and transmitted by the technically necessary cookies: language settings; login information; search terms entered; frequency of page views; use of website functions.

We use cookies on our website that are not technically necessary. Cookies that are not technically necessary are text files that do not solely serve the functionality of the website but also collect other data. The following data is processed by setting cookies that are not technically necessary: ​​IP address; location of internet users; date and time of website access; personalization of advertisements to the user; tracking of browsing behavior.

2. Purpose of data processing

The purpose of using technically necessary cookies is to ensure the functionality of our website. Some functions of our website cannot be offered without the use of cookies. For these functions, it is necessary that the browser is recognized even after a page change. We require technically necessary cookies for the following applications: saving language settings; remembering search terms; and ensuring the website's functionality.

The use of cookies that are not technically necessary serves the purpose of improving the quality of our website, its content, and thus our reach and efficiency. By setting these cookies, we learn how the website is used and can therefore continuously optimize our offerings. In particular, these cookies serve the following purposes: statistics, visitor behavior.

3. Legal basis for data processing

The provisions of the Telecommunications Digital Services Data Protection Act (TDDDG) apply to the storage of information on the end user's device and/or access to information already stored on the end user's device. If the setting and reading of cookies is technically necessary, this is done to ensure the functionality of our website. In this case, the storage of and access to cookies on your device is based on Section 25 Paragraph 2 No. 2 TDDDG. This storage of and access to information on your device serves to facilitate your use of our website and to enable us to offer you our services as requested. Some functions of our website do not work without the use of these cookies and therefore could not be offered. Cookies are generally deleted after the session ends (e.g., logging out or closing the browser) or after a predetermined period. Information about different storage periods for cookies can be found in the following sections of this privacy policy.

Where cookies are used that are not technically necessary, this is done on the basis of your explicit consent, which you can grant via the cookie banner. The legal basis for storing and accessing information in this case is Section 25 Paragraph 1 of the German Telemedia Act (TDDG) in conjunction with Article 6 Paragraph 1 Letter a) and Article 7 of the GDPR. You can withdraw your consent at any time with effect for the future or subsequently grant it again by configuring your cookie settings accordingly. Alternatively, you can prevent the storage of cookies by adjusting your browser settings. Please note that the browser settings you choose will only apply to the specific browser you are using.

If personal data is processed on your device following the storage of and access to the information, the provisions of the GDPR apply. You can find further information in the following sections of this privacy policy.

4. Exercising your rights

You can withdraw your consent to the use of cookies at any time and manage your consent preferences via the following link: https://www.bonpastaio.de/cookies

E-mail contact

1. Description and scope of data processing

You can contact us via the email addresses provided on our website. In this case, the personal data you transmit with your email will be stored. This data will be used solely for processing your inquiry.

2. Purpose of data processing

In the case of contact via email, this also constitutes the necessary legitimate interest in processing the data.

3. Legal basis for data processing

The legal basis for processing data transmitted when sending an email is Article 6(1)(f) GDPR. Our legitimate interest lies in optimally responding to your email inquiry. If the email contact aims at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.

4. Duration of storage

The data will be deleted as soon as it is no longer needed for the purpose for which it was collected. For personal data transmitted by email, this is the case when the respective conversation with the user has ended. A conversation is considered ended when it is clear from the circumstances that the matter in question has been resolved. The additional personal data collected during the sending process will be deleted no later than seven days after collection.

5. Exercising your rights

If the user contacts us by email, they can object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. (Email to...) in**@********io.deAll personal data stored during the contact process will be deleted in this case.

Application via email and application form

1. Description and scope of data processing

Our website features an application form that can be used for electronic applications. If an applicant uses this option, the data entered in the input fields will be transmitted to us and stored. This data includes: title; last name; first name; address; telephone/mobile number; email address; information on education and schooling; language skills; CV; certificates; residence permit; driver's license (optional).

Alternatively, you can also send us your application by email. In this case, we will collect your email address and the data you provide in the email. After you send your application, you will receive confirmation of receipt of your application documents by email. Your data will not be shared with third parties. The data will be used exclusively for processing your application.

2. Purpose of data processing

The processing of personal data from the application form serves solely to process your application. In the case of contact via email, this also constitutes the necessary legitimate interest in processing the data. The other personal data processed during the submission process serves to prevent misuse of the application form and to ensure the security of our IT systems.

3. Legal basis for data processing

The legal basis for processing your data is the initiation of a contract, which takes place at the request of the data subject, Art. 6 para. 1 sentence 1 lit. b alternative 1 GDPR and § 26 para. 1 sentence 1 BDSG.

4. Duration of storage

After the application process is complete, your data will be stored for up to six months. Your data will be deleted no later than six months after the application is completed. If legally required, data will be stored in accordance with applicable regulations. Any additional personal data collected during the submission process will be deleted no later than seven days after submission.

Use of company profiles in professional networks

1. Scope of data processing

The company profile is used for applications, information/PR, and active sourcing. We have no information regarding the processing of your personal data by the companies jointly responsible for the company profile. Further information can be found in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy

On our website, we provide information and offer users the opportunity to communicate. If you take any action on our company page (e.g., comments, posts, likes, etc.), you may be making personal data (e.g., your full name or profile picture) public.

2. Legal basis for data processing

The legal basis for processing personal data for the purpose of communicating with customers and prospective customers is Article 6(1)(f) GDPR. Our legitimate interest lies in being able to answer your inquiry optimally and/or provide the requested information. If the contact aims at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR.

3. Purpose of data processing

Our company website serves to inform users about our services. Each user is free to publish personal data through their activities.

4. Duration of storage

We store your activities and personal data published via our company website until you withdraw your consent. We also comply with statutory retention periods.

5. Exercising your rights

You can object to the processing of your personal data, which we collect in connection with your use of our company profile, at any time and assert your rights as a data subject, as set out in the "Your Rights" section of this privacy policy. To do so, please send us an informal email to the email address provided in this privacy policy. Further information on exercising your rights can be found here – LinkedIn: https://www.linkedin.com/legal/privacy-policy

Hosting

The website is hosted on servers of a service provider we have commissioned. Our service provider is:

Zahm & Zornig Werbeagentur
Breite Str 27
D- 40213 Düsseldorf

Further information can be found in the provider's privacy policy: https://www.zahmundzornig.de/datenschutz

The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The stored information includes: information about the browser type and version used; the user's operating system; the user's internet service provider; the date and time of access; websites from which the user's system accessed our website; and websites accessed by the user's system via our website.

This data will not be combined with other data sources. The collection of this data is based on Article 6(1)(f) of the GDPR. Our legitimate interest in processing this data lies in ensuring the error-free display of our website and optimizing its functions. The website's server is geographically located in Germany.

Integrated third-party services

We use various service providers to deliver the services we offer on our website. Generally, we have a legitimate interest in sharing your data with these service providers when their services are essential for providing the basic service offered on the website. If such services are required for additional services, enhanced features, or other purposes, your personal data will only be shared with these service providers if you give your consent. You can withdraw your consent to the use of integrated third-party services and manage your consent settings at any time here: https://www.bonpastaio.de/cookies

Use of WPML

1. Extent of processing of personal data

We use WPML from OnTheGoSystems Limited, 22/F 3 Lockhart Road, Wanchai, Hong Kong (hereinafter referred to as WPML). WPML is a multilingual plugin for WordPress. We use WPML to display our website in different languages. When you visit our website, WPML stores a cookie on your device to save your chosen language setting. This may result in the storage and analysis of personal data, primarily user activity (in particular, which pages were visited and which elements were clicked) as well as device and browser information (in particular, the IP address and operating system). You can find further information on data processing by WPML here: https://wpml.org/de/documentation-3/privacy-policy-and-gdpr-compliance/

2. Purpose of processing personal data

The use of WPML allows us to present our online presence in multiple languages.

3. Legal basis for the processing of personal data

The legal basis for data processing is Article 6(1)(f) GDPR. Our legitimate interest lies in addressing visitors to our website in their native language.

4. Duration of storage

WPML stores cookies on your device. Information on how long cookies are stored can be found here: https://wpml.org/documentation/privacy-policy-and-DSGVO-compliance

5. Exercising your rights

You can prevent WPML from collecting and processing your personal data by blocking third-party cookies on your computer, using the "Do Not Track" function of a supporting browser, disabling the execution of script code in your browser, or using a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. Further information on how to object to and remove WPML can be found at: https://wpml.org/de/documentation-3/privacy-policy-and-gdpr-compliance/

Use of CleanTalk

1. Extent of processing of personal data

We use CleanTalk, a SaaS service for protection against spam and abusive form entries, provided by CleanTalk Inc., 711 S Carson Street, Suite 4, Carson City, NV 89701, USA. CleanTalk is used to automatically analyze form entries on our website and to detect and block unwanted or harmful content. In particular, the following personal data is processed: IP address, information about user behavior, technical data of the device and browser used, as well as content and parameters from completed form fields. The IP address is also compared with known databases of bot and spam IP addresses.

2. Purpose of data processing

The processing of personal data is carried out for the purpose of ensuring the functionality and security of our website, in particular to defend against spam, to prevent misuse of forms and to detect automated access (bots).

3. Legal basis for the processing of personal data

CleanTalk's processing of personal data is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. This interest lies in ensuring IT security, protecting against spam and misuse of our website, and guaranteeing the smooth operation of our online services.

4. Duration of storage

The personal data collected by CleanTalk will only be stored for as long as necessary for the stated purposes and as long as there is a legitimate interest in storing it. As soon as the purpose ceases to apply and there are no legal retention obligations to the contrary, the data will be deleted or anonymized.

5. Exercising your rights

You can prevent CleanTalk from collecting and processing your personal data by blocking third-party cookies on your computer, using the "Do Not Track" function of a supporting browser, disabling the execution of script code in your browser, or using a script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com) in your browser. Further information about how CleanTalk processes personal data can be found in CleanTalk's privacy policy: https://cleantalk.org/publicoffer#privacy

Use of GTranslate (website translation service)

1. Description and scope of data processing

We use the translation service GTranslate on our website. The provider is GTranslate Inc., 4394 NW 120th Ave, Coral Springs, FL 33065, USA. GTranslate enables the automatic translation of our website's content into various languages. In this process, the following personal data may be processed: the website visitor's IP address; language settings or browser language; and the content of the accessed web pages, insofar as this is technically necessary for the translation.

GTranslate is an independent company and not a Google product. However, in the paid versions we use, GTranslate utilizes the Google Translate engine as a technical component. Google acts as a sub-service provider in the background and can therefore also be a data recipient, even though there is no direct contact between the website visitor and Google. In the paid plans, the translations are stored on GTranslate's own cloud infrastructure and delivered via dedicated subdomains, thus reducing direct data contact with Google when the page is accessed.

2. Purpose of data processing

The processing of personal data is carried out for the following purposes: automatic translation and multilingual presentation of our website; improvement of user-friendliness for international visitors; provision of content according to the selected language setting.

3. Legal basis for data processing

The use of GTranslate is based solely on the prior consent of the website visitor. The legal bases are: Art. 6 para. 1 lit. a GDPR (consent); § 25 para. 1 TDDDG, insofar as information is stored on or read from the user's device. The transfer of personal data to the USA is based on the EU-US Data Privacy Framework and thus on an adequacy decision of the European Commission pursuant to Art. 45 GDPR.

4. Exercising your rights

Data subjects have the right at any time to: request information about the processing of their personal data; request the rectification of inaccurate or incomplete data; request erasure or restriction of processing; withdraw any consent given at any time with effect for the future; and lodge a complaint with a competent data protection supervisory authority. To exercise your rights in connection with data processing by GTranslate, you can contact us or GTranslate Inc. directly.