This privacy policy informs you, in accordance with Art. 13 GDPR, which personal data is processed when you visit bimdas.de or contact us, for which purposes, on which legal basis, and what rights you have.
1. Controller
Ing.-Büro Sachit Shrestha
Sachit Shrestha – Owner (Inhaber)
Am Sommerberg 20
51503 Rösrath
Germany
E-mail: info@bimdas.de
Mobile: +49 176 76 78 69 10
WhatsApp: +49 176 39 93 78 01
Phone: +49 2205 3488
Fax: +49 2205 91 25 32
2. Hosting and server log files
This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. STRATO processes the website data on our behalf on servers located in Germany.
Each time a page is requested, the web server processes the following data for technical reasons (server log files):
- IP address of the requesting device
- date and time of access
- page or file requested and amount of data transferred
- HTTP status code
- referrer URL (previously visited page), if transmitted by the browser
- browser type and version, and operating system
The purpose is to deliver the website and to ensure its stability and security, for example to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free operation of the website. Log files are deleted automatically after the retention period set by the host, unless they are needed to investigate a specific security incident.
3. Encryption
The website is delivered exclusively over an encrypted connection (HTTPS/TLS). Data you submit through the forms therefore cannot be read by third parties in transit.
4. Cookies and browser storage
On your first visit a banner asks whether you agree to optional services. Without your consent, the website only sets cookies that are technically necessary (§ 25(2) no. 2 TDDDG). Optional services, such as embedded external media like videos or maps, are only loaded after you consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We currently use no analytics, tracking or marketing services.
We store your choice in the cookie bimdas_consent for 12 months. As proof of your consent (Art. 7(1) GDPR) we log a randomly generated ID, the time, the banner version, the chosen categories, the language and the page visited. IP address and browser data are not stored. The legal basis is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. The entries are deleted automatically after three years.
You can change or withdraw your choice at any time with effect for the future, via the “Cookie settings” link in the page footer or here:
Necessary
Required for the website to work (§ 25 (2) TDDDG). This includes storing your privacy choice. Nothing is passed to third parties.
| Name | Purpose | Duration | Provider |
|---|---|---|---|
bimdas_consent | Stores your choice in this banner | 12 months | bimdas.de |
wordpress_*, wp-settings-* | Login – administrators only | Session / 1 year | bimdas.de |
External media
Content from external platforms such as videos or maps. When loaded, the provider receives your IP address. Legal basis: your consent (Art. 6 (1) (a) GDPR).
| Name | Purpose | Duration | Provider |
|---|---|---|---|
YouTube, Vimeo, Google Maps, LinkedIn | Only where embedded on a page | Depends on provider | Respective provider |
Only when logging in to the administration area (WordPress login) does WordPress set cookies that are strictly necessary for the login (§ 25(2) no. 2 TDDDG). This applies only to the operators of the website, not to visitors.
The website shows a light or dark design depending on the time on your device. Only the time in your browser is evaluated for this; it is neither stored nor transmitted to us.
5. Contact form
If you use the contact form on the “Contact” page, we process the following data: name and e-mail address (mandatory) and, optionally, company, phone number, topic and your message. The data is sent to our office by e-mail and is not stored in the website database.
The purpose is to handle and answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Where you have given consent in the form, Art. 6(1)(a) GDPR is an additional legal basis; you may withdraw your consent at any time with effect for the future.
6. Enquiry form with file upload
On the “Enquire” page you can submit a project enquiry. We process:
- mandatory data: topic of the enquiry, company, contact person, e-mail address and a description of your requirements
- optional data: e.g. website, position, country, phone, project and product details, standards, formats, project scope, budget, preferred contact method and response time
- files you upload (up to 10 files, max. 25 MB per file)
- the time and wording of your consent, the language and the page from which the enquiry was sent
The enquiry and files are stored on the web server; files are kept in a directory protected against direct access. Only the website administrators have access. We receive a notification by e-mail (files up to 10 MB are attached), and you receive a confirmation of receipt at the e-mail address you provided.
To prevent abuse, the number of enquiries per network address is limited. For this purpose, a non-reversible hash of the IP address – not the IP address itself – is stored for a maximum of one hour.
Purposes and legal bases are as described in section 5. Enquiries and files are deleted automatically 24 months after receipt, unless they must be kept longer under statutory retention obligations (e.g. § 257 HGB, § 147 AO) because they led to an order.
7. Contact by e-mail, phone or WhatsApp
If you contact us by e-mail, phone or fax, we process your data to handle your request (legal bases as in section 5).
The website contains a link to WhatsApp. WhatsApp is only opened when you click this link; no data is transferred to WhatsApp before then. When you use WhatsApp, WhatsApp Ireland Limited, Dublin, Ireland, is responsible for the processing carried out by WhatsApp; data may also be transferred to the USA. For details, see the WhatsApp privacy policy. If you do not want this, please use e-mail or phone.
8. E-mail processing and recipients
Our e-mail mailboxes are operated via Microsoft 365 (Microsoft Ireland Operations Limited, Dublin, Ireland). Messages from the forms and to our e-mail address are therefore processed on Microsoft servers. A transfer to third countries, in particular the USA, cannot be ruled out; Microsoft is certified under the EU-US Data Privacy Framework.
Beyond this, we only pass on your data if this is necessary to perform a contract, if we are legally obliged to do so, or if you have given your consent.
9. Fonts, content and third-party services
All fonts, icons and scripts (including the 3D viewer) are loaded directly from our server. No content from Google Fonts, content delivery networks, video platforms, map services or social networks is embedded.
10. Website security
To protect the administration area, login attempts are limited: after five failed attempts from the same network address, a hash of the IP address – not the address itself – is stored for 15 minutes. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the website against unauthorised access.
11. Retention
We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods (e.g. six or ten years under § 257 HGB and § 147 AO for business letters and accounting records). The specific periods are given in the individual sections.
12. Your rights
Subject to the statutory requirements, you have the following rights:
- access to your stored data (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR)
- withdrawal of consent with effect for the future (Art. 7(3) GDPR)
To exercise your rights, simply send a message to s.shrestha@bimdas.de.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
13. Obligation to provide data, no automated decision-making
You are not legally or contractually obliged to provide your data. Without the mandatory information in the forms, however, we cannot process your enquiry. No automated decision-making, including profiling, takes place.
14. Changes
We update this privacy policy when the website or the legal situation changes. The version published on this page applies.
This English version is provided for convenience. The German version is legally binding.
Last updated: October 2026