Data protection

In brief

This statement describes which personally identifiable information we process when you visit bazuba.world, make a send an enquiry, book an appointment, or apply to us. Personally identifiable information includes all data that can be used to identify you personally.

  • We process technically necessary data (e.g. server logs) to ensure the website functions and remains secure.
  • Enquiries, appointment bookings, and applications are forwarded to the location responsible for your region.
  • Statistics and advertising services only set cookies if you have consented in the cookie banner. Without consent, Google only receives requests without cookies (section 8.3). You can change your selection at any time via the „Cookies“ link in the footer or the button below.

1. CONTROLLER

bazuba GmbH
Kammeringstraße 6b
2353 Guntramsdorf
Austria
Telephone: 02236 304397
Email: contact@bazuba.world

bazuba is a franchise system. The locations are operated partly by subsidiaries and partly by legally independent franchise partners. Where a location receives your data for processing your enquiry or application, it is independently responsible for this processing (see sections 4 and 5).

2. YOUR RIGHTS

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You may withdraw any consent you have given at any time with effect for the future (Art. 7 para. 3 GDPR); processing carried out up to that point remains lawful. For your concerns, an informal message to contact@bazuba.world.

Right to object: If we process data on the basis of legitimate interests (Art. 6 para. 1 lit. f GDPR), you may object at any time for reasons arising from your particular situation.

Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.atYou may also contact the supervisory authority at your place of residence.

3. HOSTING, SERVER LOGS AND SECURITY

The website is operated as a data processor by IP-Projects GmbH & Co. KG in a data centre in Frankfurt am Main (Germany).

Each time the site is accessed, the server automatically stores the browser type and version, operating system, referrer URL, page accessed, date and time, and the IP address. These logs are used for secure operation and troubleshooting, are not merged with other data, and are only retained for as long as necessary for these purposes. The legal basis is our legitimate interest in a functioning and secure website (Art. 6 para. 1 lit. f GDPR).

Transmission is encrypted via TLS (recognisable by „https://““ and the padlock symbol).

To protect against automated spam enquiries, we assess incoming form submissions based on technical characteristics (e.g. browser identification, time, non-reversible hash of the IP address) and limit the number of enquiries per period. Entries identified as spam are deleted after 30 days. The legal basis is Art. 6 para. 1 lit. f GDPR.

4. ENQUIRIES, CALLBACKS, PRICE CALCULATOR AND APPOINTMENT BOOKING

Which data: Name, telephone number, email address if provided, postcode or town, your enquiry and message, voluntarily uploaded photos or documents, and for the price calculator, your details about the bathroom. We also store how you reached us (entry page, referring page, campaign parameters such as „utm_source“ or click IDs from Google, Meta and Microsoft) to evaluate the success of our advertising.

Purpose and legal basis: We process your enquiry and prepare an offer (Art. 6 para. 1 lit. b GDPR, pre-contractual measures). The evaluation of the source of the enquiry is based on our legitimate interest in managing our advertising (Art. 6 para. 1 lit. f GDPR).

Forwarding to the responsible location: Based on your postcode, we automatically forward your enquiry to the bazuba location responsible for your region (subsidiary or legally independent franchise partner), by email and via a shared table in Google Sheets. If there is no responsible location, the bazuba head office will process your enquiry. The legal basis is Art. 6 para. 1 lit. b GDPR.

Confirmation by email: If you have provided an email address, you will receive an acknowledgement of receipt.

Appointment booking: If you book an appointment online in the showroom or on site, we enter the appointment in the Microsoft 365 calendar of the location and send you a confirmation, calendar file, and reminders by email. You can change or cancel the appointment via a personal link.

Retention period: Enquiries and appointment bookings are archived 12 months after receipt and pseudonymised after 3 years (name, email, and telephone are replaced by non-reversible hashes). If an order is placed, the statutory retention periods apply.

5. APPLICATIONS

Which data: The information provided in the application form (name, contact details, place of residence, details of qualifications and availability), your cover letter, CV, and any additional uploaded documents. If you use our CV assistant, we process the information you enter there.

Purpose and legal basis: Conducting the application process (Art. 6 para. 1 lit. b GDPR; in Germany, additionally § 26 BDSG). Your application is forwarded to the location where the position is to be filled.

Initial assessment with AI: To review applications more quickly, we have cover letters and CVs pre-assessed for suitability for the position by an AI service from OpenAI. Name, email address, and telephone number from the form are not provided to the service; however, information contained in the CV is transmitted. The assessment is only a support for the location. A human always decides on your application; there is no exclusively automated decision within the meaning of Art. 22 GDPR. The CV assistant also uses OpenAI to suggest wording. Provider: OpenAI, L.L.C., 1455 3rd Street, San Francisco, CA 94158, USA. Transmission to the USA is based on the EU Commission’s standard contractual clauses (Art. 46 para. 2 lit. c GDPR). According to OpenAI, data transmitted via the API is not used to train AI models. The legal basis is our legitimate interest in prompt processing of applications (Art. 6 para. 1 lit. f GDPR).

Retention period: Applications are automatically deleted 180 days after receipt, unless an employment relationship is established or you have consented to longer storage.

6. COOKIES AND CONSENT MANAGEMENT

We use cookies and similar technologies. Technically necessary cookies (e.g. to store your cookie selection) are set on the basis of § 165 para. 3 TKG 2021 or § 25 para. 2 TDDDG and Art. 6 para. 1 lit. f GDPR. All other cookies are only set with your consent (Art. 6 para. 1 lit. a GDPR, § 165 para. 3 TKG 2021, § 25 para. 1 TDDDG). An exception without cookies is described in section 8.3.

We manage your consents with Borlabs Cookie. The tool stores your selection in a cookie („borlabs-cookie“, 1 year) and logs it with a random identifier so that we can provide proof of consent. You can change or withdraw your selection at any time via the „Cookies“ link in the footer or the „Change data protection settings“ button at the top of this page.

The services are integrated via Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The Tag Manager itself does not evaluate usage data; when loaded, your IP address is transmitted to Google.

7. COUNTRY DETERMINATION FOR TELEPHONE NUMBER AND NOTES

In order to provide you with the correct free hotline (Germany or Austria) and relevant information, the website determines your country and federal state. To do this, our server matches your IP address with a database stored on the server; your IP address is neither transmitted to third parties nor stored. The result (country and federal state) is only stored in your browser for the duration of your visit. The legal basis is our legitimate interest in displaying a reachable telephone number to you (Art. 6 para. 1 lit. f GDPR). The database is provided by DB-IP: IP Geolocation by DB-IP (Licence CC BY 4.0).

8. STATISTICS

8.1 Google Analytics 4
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics records which pages you visit, how long you stay, the source you came from, information about your device and browser, as well as approximate location data (country, region). IP addresses are not stored by Google Analytics 4. When you make an enquiry, we transmit the event „enquiry“ with an estimated value and performance area. Cookies: „_ga“, „_ga_*“ (up to 2 years). We use the data to improve the website and our advertising.

8.2 Microsoft Clarity
Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how you use the website (mouse movements, clicks, scrolling) and creates heatmaps and session recordings so we can identify usability issues. Entries in form fields are not recorded. Cookies: „_clck“, „_clsk“ (up to 1 year).

8.3 Google Consent Mode: Measurement without consent
We use Google’s consent mode („Consent Mode“). It ensures that Google Analytics and Google Ads respect your cookie selection.

If you do not consent, Google Analytics and Google Ads do not set or read cookies. However, when you access the site and make an enquiry, your browser still sends a short message to Google, known as a request without cookies. This contains:

  • that you have not consented,
  • the page you accessed and the page you came from,
  • time, browser, and device type,
  • for an enquiry via our form, that an enquiry has taken place,
  • your IP address for technical reasons.

According to Google, the IP address is only used to roughly determine the country and is not stored. No identifier is created that would allow you to be recognised across multiple visits. Google estimates from these requests how many visits and enquiries there have been in total and only provides us with aggregated figures. We cannot identify any individual person from this.

The legal basis is our legitimate interest (Art. 6 para. 1 lit. f GDPR) in knowing how many visits and enquiries our website and advertising generate in total. You can object to this at any time, most easily with a browser add-on that blocks Google services or by sending a message to contact@bazuba.world. Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google is certified under the EU-U.S. Data Privacy Framework.

If you consent, the descriptions in 8.1 and 9.1 apply.

For Google Analytics (8.1) and Microsoft Clarity (8.2): the legal basis is your consent (Art. 6 para. 1 lit. a GDPR). For requests without consent, 8.3 applies. Google and Microsoft may transfer data to the USA; both companies are certified under the EU-U.S. Data Privacy Framework, and the transfer is based on the adequacy decision of the EU Commission (Art. 45 GDPR).

9. ADVERTISING AND PERFORMANCE MEASUREMENT (ONLY WITH CONSENT)

9.1 Google Ads and Conversion Tracking
Provider: Google Ireland Limited. If you reach us via a Google ad, Google sets cookies (e.g. “_gcl_au”, up to 90 days) to recognise that your visit led to an enquiry and to show ads again to people who have shown interest in our services (remarketing). If you make an enquiry, we additionally transmit your email address, telephone number, first and last name, as well as postcode and country (“enhanced conversions”), hashed with SHA-256 on our server. Google uses this information to attribute the enquiry to an ad and only provides us with aggregated analyses. Google is certified under the EU-U.S. Data Privacy Framework. Without your consent, Google Ads does not set any cookies; in this case, section 8.3 applies.

9.2 Meta Pixel and Meta Conversions API

We use the Meta Pixel and the Meta Conversions API on this website. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). We only use both services if you have consented to the “Meta Pixel” service in the cookie banner. Without consent, neither the Meta Pixel is loaded nor data transmitted via the Conversions API.

Purpose. We want to determine whether ads on Facebook and Instagram lead to enquiries, improve our advertising based on this, and show suitable ads to people who have shown interest in a bathroom renovation.

Meta Pixel. The Meta Pixel is loaded in your browser. Cookies are set (e.g. “_fbp”, “_fbc”) and information is transmitted to Meta, such as the pages visited, date and time, your IP address, details about your browser and device, and, if applicable, the ad click identifier. If you submit an enquiry via our enquiry form, the Pixel also transmits the event “enquiry” with an estimated value as well as your email address, telephone number, first and last name, postcode, and country. The contact details are hashed with SHA-256 on our server before transmission, i.e. converted into a non-reversible string.

Meta Conversions API. Browser settings and ad blockers often prevent the Pixel from transmitting an event. Therefore, we also report an enquiry via our form directly from our server to Meta. The following are transmitted: the type of event (enquiry), time, the page on which you submitted the enquiry, an estimated value of the enquiry and the selected service area, your IP address, details about your browser (user agent), the Meta identifiers from the cookies “_fbp” and “_fbc”, as well as, each hashed with SHA-256, email address, telephone number, first and last name, postcode, and country. The content of your message, your address, and uploaded files are not transmitted. Pixel and server mark the same enquiry with the same event identifier so that Meta only counts it once. On our server, the event to be transmitted is stored for a maximum of 24 hours until transmission.

Meta matches the hashed information with user data held by Meta to attribute the enquiry to an account. We use the attribution exclusively in aggregated form for analysis and optimisation of our advertising. We do not receive any information from Meta that would allow us to personally identify you.

Joint responsibility. We and Meta are jointly responsible for the collection of data on our website and its transmission to Meta (Art. 26 GDPR). The details are governed by Meta’s agreement on joint responsibility: https://www.facebook.com/legal/controller_addendum. Meta alone is responsible for further processing after transmission. You may also exercise your data subject rights directly with Meta.

Transfer to third countries. Meta may transfer data to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the adequacy decision of the EU Commission (Art. 45 GDPR) and additionally on standard contractual clauses.

Retention period. The cookies of the Meta Pixel are stored for up to 90 days. The duration for which Meta stores the transmitted data is determined by Meta; you can find information on this in Meta’s privacy policy: https://www.facebook.com/privacy/policy/.

9.3 Taboola
Provider: Taboola Europe Limited, 2 Kingdom Street, London W2 6BD, United Kingdom. The Taboola Pixel measures whether ads in the Taboola network lead to visits and enquiries. If you make an enquiry, we transmit your email address hashed with SHA-256. For the United Kingdom, there is an adequacy decision by the EU Commission.

For all services in section 9, the legal basis is your consent (Art. 6 para. 1 lit. a GDPR, § 165 para. 3 TKG 2021, § 25 para. 1 TDDDG), which you can withdraw at any time via “Cookies” in the footer. Advertising settings: Google https://adssettings.google.com, Meta https://www.facebook.com/adpreferences/.

10. EMBEDDED CONTENT

Google Maps: On the location search and location pages, we display maps from Google Maps (Google Ireland Limited). The map is only loaded once you have consented to the ‚Google Maps‘ service in the cookie banner or clicked on ‚Load map‘ in the map field; your IP address and browser information will then be transmitted to Google and Google Fonts will be loaded. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). For postcode or location searches, our server only transmits the entered location or postcode to the Google Geocoding API, and no personal data about you.

YouTube videos: Videos are embedded in enhanced privacy mode (youtube-nocookie.com) and are only loaded when you click on the preview image. Only then will data (including your IP address) be transmitted to YouTube (Google Ireland Limited). The legal basis is your consent by clicking (Art. 6 para. 1 lit. a GDPR).

Reviews: On the website, we display public reviews of our locations from Google and Herold, including the name provided there. The texts are stored on our server; when displayed, no data is transmitted to Google or Herold. Messages sent via the feedback form are sent to anfrage@bazuba.world.

Links to social networks: The icons for Facebook, Instagram, Pinterest and YouTube are simple links. Data is only transmitted when you follow a link.

Shop: Our online shop at shop.bazuba.world has its own privacy policy.

11. EMAIL AND SERVICE PROVIDERS

We send and receive emails (enquiries, confirmations, appointment reminders, applications) via Microsoft 365 (Microsoft Ireland Operations Limited). The enquiry table for the locations is stored in Google Sheets (Google Ireland Limited). Both service providers process the data on our behalf; if data is transferred to the USA, the providers are certified under the EU-U.S. Data Privacy Framework.

12. MARKETING EMAILS

The use of the contact details published in the legal notice for sending unsolicited advertising is hereby objected to.

13. CHANGES

We update this statement if our website or the legal situation changes. The version published here applies. Last updated: 24/09/2026