Eurova logoEUROVA

Privacy Policy

Last updated: 26 July 2026

This Privacy Policy explains how Bambeo GmbH (“we”, “us”) processes personal data when you use EUROVA at eurova.eu (the “Site”). EUROVA is an informational directory of brands and European alternatives. We do not operate a store, process payments, or sell products on the Site.

1. Controller

The controller under the GDPR is:

Bambeo GmbH
Törringstraße 23
84359 Simbach am Inn
Germany
Email:contact@bambeo.de

Further company details are in ourImprint.

2. What data we process

a) Browsing the Site

When you visit the Site, our hosting and security infrastructure (Cloudflare) may process technical connection data such as IP address, request timestamps, and basic device/browser information. This is necessary to deliver the Site securely (Art. 6(1)(f) GDPR).

Your browser may also store a local preference for dark mode (darkMode in local storage). That preference stays on your device and is not sent to us as account data.

b) Cookie consent (c15t, self-hosted)

  • We use c15t (open-source consent management) with a self-hosted backendat consent.eurova.eu (Node API with SQLite on our infrastructure) to show a cookie banner, store your choices, and load non-essential scripts only when allowed.
  • Data: consent preferences, timestamps, technical details needed to remember and apply those choices, and a durable consent/audit record on our servers (subject id, jurisdiction, categories, masked IP where applicable).
  • Legal basis: Art. 6(1)(c) GDPR (legal obligation under ePrivacy / TDDDG) and, where applicable, Art. 6(1)(f) GDPR.
  • Change preferences anytime viaor the floating preferences control on the Site.

c) Analytics — Google Analytics 4

  • We use Google Analytics 4 (measurement ID G-GRBFML1Z1G), provided by Google Ireland Limited / Google LLC, to measure traffic and usage.
  • GA4 is loaded through c15t with Google Consent Mode v2. Defaults are denied until you grant themeasurement category; c15t then updates Google’s consent state.
  • Data: may include online identifiers (e.g. cookie IDs), IP-derived location, device/browser data, and pages visited. Google may process this data in the United States or other countries outside the EEA.
  • Legal basis: Art. 6(1)(a) GDPR (consent). Withdraw anytime via.
  • Google’s privacy information:policies.google.com/privacy.

d) Accounts and reviews (Supabase)

  • Optional accounts let you leave shopper reviews on brand pages. Authentication and review storage are provided by Supabase on our behalf.
  • Account data: email address; optional display name; password (if you choose email/password signup — stored hashed by Supabase, not in readable form by us); session tokens in your browser.
  • Review data: rating, title, review text, company slug, timestamps. Yourdisplay name is shown publicly with published reviews. Your email is not shown on reviews.
  • Sign-in options: magic link (one-time email) or email/password.
  • Legal basis: Art. 6(1)(b) GDPR (contract / requested service) to create and operate your account and publish reviews you submit; Art. 6(1)(f) GDPR to display and moderate public review content.

e) Email contact (claim / suggestions)

  • There is no on-site contact form. Brand claims and suggestions are sent by email tocontact@bambeo.de(e.g. via mailto links on the Site).
  • We process the content of your message and your email address to respond and, where relevant, update catalog information.
  • Legal basis: Art. 6(1)(b) or (f) GDPR, depending on the request.

3. What we do not do

  • We do not sell your personal data.
  • We do not run an on-site newsletter signup or payment checkout.
  • Outbound links go to third-party brand websites. Those sites have their own privacy practices; we are not responsible for them.

4. Recipients and processors

We use service providers who process data on our instructions or as independent controllers where applicable:

  • c15t (self-hosted) — consent management API and audit records at consent.eurova.eu
  • Google — Google Analytics 4
  • Supabase — authentication, profiles, and reviews
  • Cloudflare — hosting, CDN, and security
  • Email providers — delivery of messages you send to contact@bambeo.de

We may also disclose data if required by law or to establish, exercise, or defend legal claims.

5. International transfers

Some providers (notably Google and, depending on configuration, Supabase or Cloudflare) may process data outside the European Economic Area. Where required, transfers rely on adequacy decisions or standard contractual clauses / equivalent safeguards under Chapter V GDPR. Our consent database (Cloudflare D1) is configured in the EEUR region.

6. Retention

  • Consent records: stored in your browser and in our self-hosted consent database for as long as needed to honour your choice and demonstrate consent; then deleted or anonymized according to our retention practice.
  • Analytics: according to Google Analytics’ configured retention period.
  • Accounts and reviews: until you delete your account / ask us to erase data, or we remove content that violates ourTerms of Use, unless longer retention is required by law.
  • Email correspondence: as long as needed to handle your request and for ordinary business records.

7. Your rights

Under the GDPR you may have the right to access, rectify, erase, restrict, object to processing, and data portability, and to withdraw consent at any time (without affecting prior lawful processing).

To exercise these rights, emailcontact@bambeo.de. You can also sign out of your account on the Site. For account or review deletion, contact us at the same address. For cookie preferences, use.

You may lodge a complaint with a supervisory authority. In Germany, a common contact is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), or the authority of your habitual residence.

8. Cookies and similar technologies

The Site uses essential technologies to operate (including hosting and session handling for accounts), c15t consent storage, and Google Analytics when you grant measurement consent. Manage non-essential cookies viaor your browser settings.

9. Children

The Site is not directed at children under 16. Account features (sign-in and reviews) are intended for users 16 or older. If you believe we have collected a child’s data, contact us and we will delete it.

10. Changes

We may update this policy when our practices or the law change. The “Last updated” date at the top will change when we do. Continued use of the Site after an update means you have been informed of the revised policy; material changes may also be highlighted on the Site where appropriate.