Data Protection Information

 

Responsible body

The body responsible for data processing on this website is:

Bulthaup GmbH & Co KG
Aich, Werkstraße 6
84155 Bodenkirchen
Germany

Tel. +49 (0)8741 80 0
Email: datenschutz@bulthaup.com

Data protection

This website uses TLS (transport layer security) encryption for security reasons and to protect the transfer of confidential information, such as orders or requests which you send to us as the site operator. An encrypted connection can be recognized when the browser’s address line changes from “http://” to “https://” and by the padlock symbol in the browser line.

We have appointed an internal data protection officer who is responsible for all data protection-related matters and concerns within our company. You can contact our data protection officer using the following contact details:

Bulthaup GmbH & Co KG
Mr. Antonino Italia
Aich, Werkstraße 6
84155 Bodenkirchen
Germany

Tel. +49 (0)8741 80 0
Email: datenschutz@bulthaup.com

Cookies

Cookies are used in some of this website. They do not harm your PC or contain any viruses. Cookies make our website easier to use and more effective and secure. They are small text files which are placed onto your computer and saved by your Internet browser.

Consent is given by clicking the appropriate selection in the cookie consent banner. Without your consent, only technically necessary cookies will be set.

Most of the cookies we use are so-called “session cookies”. They are used to optimize user-friendliness and automatically deleted after your visit. We also use temporary cookies to optimize user-friendliness, which remain on your computer until deleted. These cookies allow us to recognize your browser on your next visit.

We also use cookies to collect statistical data about the use of our website, which are then analyzed to optimize our services for you (see section 4).

All cookies we use are listed and described in detail in our cookie consent banner.

Your browser settings include options to inform you when cookies are placed on your computer, to only allow cookies on an individual basis, to accept cookies in particular cases or generally reject cookies and to turn off automatic cookie deletion when you close your browser. Deactivating cookies may restrict the functionality of this website.

The use of cookies or comparable tracking technologies, as well as the further processing of personal data collected in this manner, is based on your consent. Depending on the applicable national legal framework, the following legal bases apply:

• In the United Kingdom, the use of cookies or similar tracking technologies is governed by Regulation 6(1) of the UK Privacy and Electronic Communications Regulations (PECR). Further processing of the collected data is based on Article 6(1)(a) of the UK GDPR.
• In the United States, cookie usage is subject to applicable state privacy laws, such as the California Consumer Privacy Act (CCPA). Data processing must comply with the respective state or federal legal requirements.

Consent may be withdrawn at any time.

Where cookies or comparable tracking technologies are strictly necessary for the operation of the website (e.g., session ID, authentication, or security purposes), their use is legally permitted without consent. The applicable legal provisions depend on the respective national framework:

• In the United Kingdom, the use of such technically necessary cookies is permitted under Regulation 6(4) PECR, and further processing is based on Article 6(1)(f) UK GDPR.
• In the United States, such use may fall under “essential business operations” or “strictly necessary” exemptions in state laws such as the CCPA.

If jurisdictions outside the scope of the GDPR are involved, the applicable local data protection laws shall apply.

Server log files

The site provider automatically collects and saves information in server log files, which your browser then automatically transfers to us. This information includes:

• Browser type and version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is processed to ensure you connect to the website seamlessly, can comfortably use our website, to analyze system security and stability and for other administrative purposes. This data will not be merged with other data sources.

The IP address is anonymized immediately after collection. A personal reference can no longer be established.

This data processing is legally governed by Article 6 (1) (f) GDPR.

Contact forms

If you send us an inquiry via one of our contact forms on this website – such as “Contact Form,” “Request an Appointment with a Dealer,” or “Order Information Material” – the data you provide will be processed for the stated purpose. This includes handling your request and temporarily storing your data in our database in case of follow-up questions. The data processed may include your name, address, contact details (phone number, email address), and the reason for your inquiry (if provided). The legal basis for this data processing is Art. 6(1)(f) GDPR (UK) or, where applicable in the U.S., legitimate business interests and/or consent under applicable state laws (e.g., CCPA, CPRA).

Additionally, we and the relevant bulthaup partner will process your personal data from the contact forms for further purposes if you have given us your consent. These include the following processing activities, which may occur even after your initial request has been handled:

• Your data is stored in our database for these follow-up purposes.
• We may use the data to gain customer insights, develop marketing strategies, and run advertising campaigns. All such actions aim to support sales and improve customer satisfaction.
• For contact purposes, we may share your data with the bulthaup partner responsible for your region (including the national representative if the partner is located outside the UK or the U.S.). The list of bulthaup country representatives can be found here.
• We and/or the responsible bulthaup partner may contact you for marketing and advertising purposes, newsletters, or surveys (particularly by post, email, or phone).

The declaration of consent provided in the respective contact forms refers to this section 3 (“Data Collection on Our Website” – subsection “Contact Forms”). By giving consent, you agree that the data you entered into the form (mandatory and, if applicable, voluntary information) may be collected, processed, and used by bulthaup, as the responsible entity, for the aforementioned and any additional purposes indicated in the form.

Processing of the data entered into the contact form is based on your consent (Art. 6(1)(a) GDPR or applicable state/federal privacy laws). You can revoke your consent to the processing and use of your data at any time. Please send any revocation to Bulthaup GmbH & Co KG, Attn: Data Protection, 84155 Aich, Germany, or email datenschutz@bulthaup.com. If jurisdictions outside the scope of the GDPR are involved, the applicable local data protection regulations shall apply.

The data you enter in these contact forms will be stored until the purpose of the processing has been fulfilled or is no longer applicable, you request its deletion, or you revoke your consent. In any case, the data will be deleted after no more than 1,095 days (approximately 3 years).

To tailor our website to your needs and continuously improve it, and to analyze usage statistically in order to optimize our offerings for you, we use the tracking measures listed below.

The respective purpose of data processing and data categories are to be taken from the respective tracking tools.

Google Tag Manager

We use the Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The Google Tag Manager acts as a manager with regard to Google’s tracking codes and tags and allows us to integrate tracking or statistical tools and other technologies on our website. The Google Tag Manager itself does not create any user profiles, does not store cookies, and does not carry out any independent analyses. It is used solely to manage and display the tools integrated through it. However, the Google Tag Manager does collect your IP address, which may also be transferred to Google’s parent company in the United States.

The use of Google Tag Manager is based on your consent pursuant to Art. 6(1)(a) GDPR. This consent can be revoked at any time. Where legal jurisdictions outside the scope of the GDPR are affected, the applicable local data protection regulations shall apply.

Use of Google Tag

To optimize efficiency and minimize the impact on visitors to our website, we use the Google Tag (gtag.js) on our website. The Google Tag is a single snippet of code implemented on our site. It acts as a universal tag for a variety of Google services and products. It collects data about your visit to our website and sends it to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, in connection with the Google services listed below. The categories of processed data, retention periods, and purposes of processing depend on the specific Google tools deployed via the tag.

The data collected via the Google Tag may be used not only for analytical purposes but also for personalized advertising and other Google services. This processing may involve the transfer of personal data to the United States. Google processes this data on the basis of the consent you have given.

The legal basis for the use of the Google Tag is your consent in accordance with Art. 6(1)(a) GDPR or equivalent provisions under applicable U.S. or UK data protection law (such as the UK GDPR and the California Consumer Privacy Act (CCPA), where applicable). Consent may be withdrawn at any time. Where jurisdictions outside the GDPR apply, the relevant national data protection laws shall govern.

Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider of this service is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables the website operator to analyze the behavior patterns of website visitors. To that end, the website operator receives a variety of user data, such as pages accessed, time spent on the page, the utilized operating system and the user’s origin. This data is summarized in a user-ID and assigned to the respective end device of the website visitor.
Furthermore, Google Analytics allows us to record your mouse and scroll movements and clicks, among other things. Google Analytics uses various modeling approaches to augment the collected data sets and uses machine learning technologies in data analysis.

Overall, the following data categories are collected and processed:

• Referrer URL
• Page views
• First-time visit to the website
• Start of session
• Your “click path”, interaction with the website
• Scrolls (whenever a user scrolls to the bottom of the page (90%))
• Clicks on external links
• Internal search queries
• Interaction with videos
• File downloads
• Ads viewed/clicked
• Language setting
• Approximate location (region) of the website visitor
• Date and time of visit
• IP address of the visitor (in abbreviated form)
• Operating systems used
• Browser type
• Browser language setting
• Screen resolution
• Visitor’s internet service provider

The information collected by Google is linked to other Google services, provided you have a Google Account and have consented to personalized advertising.

Google Analytics uses technologies that make the recognition of the user for the purpose of analyzing the user behavior patterns (e.g., cookies or device fingerprinting). The website use information recorded by Google is, as a rule transferred to a Google server in the United States, where it is stored.

The use of these services is based on your consent in accordance with Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications-Telemedia Data Protection Act (TTDSG).

To the extent that legal systems outside the scope of the GDPR are affected, the relevant data protection regulations there apply. In the event of data transfer to the USA, Google relies on the EU-U.S. Data Privacy Framework.

IP anonymization

On this website, we have activated the IP anonymization function. As a result, your IP address will be abbreviated by Google within the member states of the European Union or in other states that have ratified the Convention on the European Economic Area prior to its transmission to the United States. The full IP address will be transmitted to one of Google’s servers in the United States and abbreviated there only in exceptional cases. On behalf of the operator of this website, Google shall use this information to analyze your use of this website to generate reports on website activities and to render other services to the operator of this website that are related to the use of the website and the Internet. The IP address transmitted in conjunction with Google Analytics from your browser shall not be merged with other data in Google’s possession.

Browser plug-in

You can prevent the recording and processing of your data by Google by downloading and installing the browser plugin available under the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

For more information about the handling of user data by Google Analytics, please consult Google’s Data Privacy Declaration at: https://support.google.com/analytics/answer/6004245?hl=en.

Contract data processing

We have executed a contract data processing agreement with Google and are implementing the stringent provisions of the German data protection agencies to the fullest when using Google Analytics.

Google Analytics remarketing

Our websites also use the functions of Google Analytics remarketing in conjunction with the cross-device functions of Google AdWords and Google DoubleClick. These are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

This function enables advertising target groups created by Google Analytics remarketing to be linked with the cross-device functions of Google AdWords and Google DoubleClick. Accordingly, interest-related and personalized adverts are shown, which have been adapted in accordance with your previous usage behavior and surfing habits on one device (e.g. cellphone) and also shown on another of your devices (e.g. tablet or PC).

In addition to the data from your Google account, the categories of data processed include the data categories listed above in the “Google Analytics” section.

If you have provided the appropriate consent, Google will link your web and app browser histories with your Google account. This allows every device which you log in to with your Google account to have the same personalized adverts shown.

IP anonymization, browser plug-ins, and the data processing agreement with Google are governed by the principles set out above in this section a).

To support this function, Google Analytics collects Google-authenticated user IDs, which are temporarily linked to your Google Analytics data to define and create target groups for cross-device advertising.

You can permanently object to cross-device remarketing/targeting by deactivating personalized advertising in your Google account. Please visit the following to do so: https://www.google.com/settings/ads/onweb/.

Any potential consolidation of the data collected in your Google account is carried out only with your consent, which you can provide to or withdraw from Google (Article 6(1)(a) GDPR).

More information and data protection information can be found in the Google Privacy Policy and Terms at: https://policies.google.com/technologies/ads?hl=en.

Data Transfer to Third Countries

Your IP address and other personal data processed through Google tools may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google LLC is certified under the EU-U.S. Data Privacy Framework and is listed in the U.S. Department of Commerce’s Data Privacy Framework List. As such, this data transfer is covered by the adequacy decision issued by the European Commission on July 10, 2023 (Art. 45 GDPR / UK GDPR).

In the United Kingdom, this transfer is recognized under the UK Extension to the EU-U.S. Data Privacy Framework, and thus considered to have an adequate level of protection under UK GDPR, pursuant to Section 17A of the UK Data Protection Act 2018.

In the United States, data processing is subject to the California Consumer Privacy Act (CCPA) and, where applicable, the California Privacy Rights Act (CPRA).

Retention Period

Data we transmit, which are linked to tracking codes and other tags, will be automatically deleted either upon revocation of your consent or no later than 14 months after collection.

Our website uses the visitor action pixel from Meta Platforms Inc (formerly Facebook Inc), 1601 Willow Road, Menlo Park, CA 94025, USA (“Meta”), to measure conversations. Meta Pixel is an analytics tool implemented on our website that tracks user behavior. This is done using cookies or similar technologies.

This allows the behavior of site visitors to be tracked after they have been redirected to the provider’s website by clicking on a meta ad. This allows the effectiveness of the meta ads to be evaluated for statistical and market research purposes and future advertising measures to be optimized.

The following data categories are collected and processed:

• Page views: Recording which pages a user visits, how long they stay on these pages, and the order in which they visit them.
• Interactions with content: Recording which content a visitor views, how long they view it, and whether they interact with it (e.g., by clicking, scrolling, or sharing).
• Device information: Information about the device used, including operating system, browser type, and screen resolution.
• Location data: Approximate location of a user based on their IP address.
• Form completions: Recognition when a visitor completes a form on our website (e.g., for logins, registrations, or newsletters).

The data collected is anonymous to us as the operator of this website; we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Meta so that a connection to the respective user profile is possible and Meta can use the data for its own advertising purposes in accordance with the Meta Data Usage Policy. This enables Meta to place advertisements on Meta pages and outside Meta. This use of the data cannot be influenced by us as the site operator.

You can find further information on protecting your privacy in the data protection information: https://www.facebook.com/about/privacy.

Data policy | Instagram help section

Opt-out and deactivation options
You can also deactivate the remarketing function “Custom Audiences” in the settings for advertisements at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged in to Facebook to do this.

If you do not have a Facebook/Instagram account, you can deactivate usage-based advertising from Meta on the website of the European Interactive Digital Advertising Alliance:
https://www.youronlinechoices.com/uk/your-ad-choices

International Data Transfer

The IP address and other personal data collected through Meta tools are transferred to Meta Platforms Inc. in the United States. Meta is certified under the EU-U.S. Data Privacy Framework and is listed in the U.S. Department of Commerce’s Data Privacy Framework List. Accordingly, this transfer is subject to the adequacy decision issued by the European Commission on July 10, 2023 (Article 45 GDPR).

In the United Kingdom, the transfer is recognized under the UK Extension to the EU-U.S. Data Privacy Framework and is considered to ensure an adequate level of data protection in accordance with Section 17A of the UK Data Protection Act 2018.

Legal Basis

The use of cookies or similar technologies and the further processing of the collected data is based solely on your consent. Depending on the applicable national law, the following legal bases apply:

• In the United Kingdom, consent is required under the UK Privacy and Electronic Communications Regulations (PECR), in conjunction with the UK GDPR and the Data Protection Act 2018.
• In the United States, where applicable, processing is subject to the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

You may revoke your consent at any time with future effect. Where legal jurisdictions outside the scope of the GDPR are involved, the applicable national data protection regulations shall apply.

We use Microsoft Advertising. Microsoft Advertising is an online advertising program of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Microsoft Advertising enables us to display advertisements in the Bing search engine or on third-party websites when the user enters certain search terms into Bing (keyword targeting). Furthermore, targeted advertisements can be displayed based on the user data available at Microsoft (e.g., location data and interests) (target group targeting). As the website operator, we can evaluate this data quantitatively by analyzing, for example, which search terms led to the display of our advertisements and how many advertisements led to the corresponding clicks.

Event tracking (UET)

We use universal event tracking (UET) from Microsoft Advertising on this site. Pseudonymized data is collected to track the actions you take on our websites after you have clicked on an advertisement of Microsoft Advertising. UET collects your IP address (anonymized), device identifiers, information about device and browser settings, Microsoft Click ID (stored in cookie), time spent on the website, which areas of the website were accessed, which advertisement brought you to the website and which keyword you clicked on.

The data we collect is anonymized for us as the website operator, meaning we cannot associate it with any individual user. However, Microsoft processes this data and may associate it with an individual user account if you have a Microsoft account.

International Data Transfer

The IP address and other personal data collected through Microsoft Advertising may be transferred to Microsoft Corporation in the United States. Microsoft is certified under the EU-U.S. Data Privacy Framework and is listed in the U.S. Department of Commerce’s Data Privacy Framework List. Therefore, this data transfer is covered by the adequacy decision of the European Commission dated July 10, 2023 (Article 45 GDPR).

For users in the United Kingdom, the transfer is recognized under the UK Extension to the EU-U.S. Data Privacy Framework and falls under the adequacy provisions of the UK Data Protection Act 2018, Section 17A.

Storage Period

We delete the data as soon as it is no longer required for the purposes mentioned above.

Legal Basis

The use of cookies or similar technologies and the subsequent processing of collected data are based exclusively on your voluntary consent. Applicable laws vary by jurisdiction:

• In the United Kingdom, consent is required under the Privacy and Electronic Communications Regulations (PECR), in conjunction with the UK GDPR and the Data Protection Act 2018.
• In the United States, applicable state laws such as the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) apply, particularly for residents of California.

Right of Withdrawal

You may revoke your consent at any time with future effect. Where jurisdictions outside the scope of the GDPR are involved, the applicable national data protection regulations shall apply.

Google Maps

This website uses an API from the map service Google Maps. These are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

To use the functions of Google Maps, the following personal data must be processed and stored:

• Your IP address
• Approximate location of the IP address
• Your device information (operating system, browser type, and device hardware)
• Data on your interactions with the map and usage behavior
• Search activities
• Data from the use of embedded third-party maps

This information is typically transmitted to and stored on a server operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The provider of this website has no control over this data transfer.

The retention period for stored data relating to location and Google Maps activities depends on your personal settings in your Google Account and may be limited to 3, 18, or 36 months. Further information can be found in your Google Account privacy settings: https://myaccount.google.com/privacy.

The IP address and other personal data processed via Google tools may be transferred to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework and listed in the U.S. Department of Commerce’s Data Privacy Framework List. This means that the data transfer is covered by the European Commission’s adequacy decision of July 10, 2023 (Art. 45 GDPR).

For UK residents, the transfer is also recognized under the UK Extension to the EU-U.S. Data Privacy Framework, in accordance with the UK GDPR and the Data Protection Act 2018, Section 17A.

Processing of personal data through Google Maps occurs only with your consent, pursuant to Art. 6(1)(a) GDPR (or UK GDPR). You may withdraw your consent at any time with future effect by updating your settings in your Google Account or visiting: https://myaccount.google.com/privacy.

More information about how Google interacts with your user data can be found in Google’s Privacy Policy. https://policies.google.com/privacy?hl=en.

In accordance with the EU General Data Protection Regulation, you have a right of access (Article 15), a right to rectification and erasure (Articles 16, 17), the right to restrict processing (Article 18) and a right to data portability (Article 20), as well as the right to lodge a complaint with a supervisory authority (Article 77).

If your personal data is processed based on legitimate interests under Article 6(1)(f) GDPR, you have the right under Article 21 GDPR to object to the processing of your personal data for reasons arising from your particular situation, or if the objection concerns direct marketing. If you are objecting to advertising, you have a general right to object, which will be implemented by us without you having to provide details about your particular situation.

If you wish to exercise your right to withdraw your consent or object, it is sufficient to send an email to datenschutz@bulthaup.com.

This Privacy Policy is currently valid as of June 2025.

To ensure that our users are always informed about the current status of this privacy policy, we reserve the right to amend this privacy policy as needed. Changes may become necessary due to the ongoing development of our website and offerings, as well as due to changes in legal or regulatory requirements. We therefore recommend that you review this privacy policy regularly, especially after changes to the services or legal requirements.

© Copyright Bulthaup GmbH & Co KG, Bodenkirchen (Germany). All rights reserved.