Who is responsible
BlauWerk – Nikolaus Prasse
Pforzheimer Straße 94
76275 Ettlingen, Germany
Email for contact and privacy requests: support@blauwerk.de
This information covers blauwerk.de, the contact form, our remote diagnostics and the direct service interval function for supported Bosch smart system eBikes. Last updated: 14 October 2026.
Website and hosting
When you access the website, we process data including your IP address, access time, requested address, browser information and technical connection data. This enables us to deliver the website, operate it securely and investigate faults and misuse. The legal basis is Article 6(1)(f) GDPR; our interest is in secure and reliable operation.
The website uses hosting infrastructure provided by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp. Data submitted through forms and ordering functions is also processed on the web server. Further information: Privacy at mittwald.
Contact form and email
When you contact us, we process your name, email address, selected subject, message and, where applicable, order number. The information is forwarded to our support mailbox. We use Microsoft Outlook/Microsoft 365 for the mailbox and handling enquiries. Microsoft, in particular Microsoft Ireland Operations Limited, is a recipient for this purpose. Further information: Microsoft privacy information.
For questions about a contract or a requested service, the legal basis is Article 6(1)(b) GDPR. We handle other enquiries on the basis of Article 6(1)(f) GDPR; our interest is in answering your enquiry. Required information is needed to handle your request and reply to you. Please do not send passwords or full payment details.
The contact form does not create a separate copy of your message in the website database. To limit abuse, identifiers derived using a secret key, rather than stored in plain text, and counters are used briefly; they expire after no more than 30 minutes. The duplicate-submission record contains only a derived checksum and reference and is valid for 24 hours. Message contents remain separate in the support mailbox.
Remote diagnostics and bike data
A diagnostic session is created only after you confirm the information and select your bike in the browser. For the check and a selected service, we may process bike and component identifiers, serial numbers, software versions, configuration, error and diagnostic data, distance travelled, and available battery and usage data. The information available depends on the connected smart system.
The data is transmitted over an encrypted connection to the BlauWerk service computer. Cloudflare Tunnel, provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, is used for the internet connection. Cloudflare processes technical connection data, particularly IP addresses and connection times. The diagnostic channel also uses its own encryption. Information: Cloudflare privacy information.
As part of the service procedure, device-related data is also processed by Bosch eBike Systems, Robert Bosch GmbH. Bosch describes the manufacturer's processing and its purposes, including service handling and product improvement, in its privacy and data-use information for servicing. Our information does not replace the manufacturer's information.
We base the processing required for your order on Article 6(1)(b) GDPR. Confirmation before connecting documents that the information was provided and the service was requested. It is not blanket consent to disclosure to arbitrary third parties and does not cover advertising. Online diagnostics cannot be performed without the necessary bike and connection data.
We store the confirmed text version, confirmation wording, server-side timestamp and session identifier as evidence. Identifiers derived using a secret key are also used when associating the session with the bike. The record is retained for three months and then marked for automatic deletion; cleanup takes place during regular maintenance runs. The legal basis is Article 6(1)(f) GDPR: our interest in demonstrating the service requested and the information provided.
Service interval directly in the browser
With the service interval function , your browser reads and transfers the setting directly via USB on the eBike you select. This procedure uses neither the BlauWerk service computer nor its diagnostic tunnel and occupies no place in the remote diagnostics queue. The transmission to the workshop diagnostic system described above is not part of this direct function.
For display and checking, your browser processes the bike identifier, odometer reading, and the existing and selected date or odometer target. When creating an order, it sends the bike identifier, initial and target values, and session and order identifiers to the BlauWerk web server. The server stores the association, payment or voucher records, execution attempt and the read-back result reported by the browser so the same order can be resumed and duplicate execution prevented. The read-back result is a report from the customer's browser, not an independent check by the workshop computer. The legal basis for the processing necessary to provide the requested service is Article 6(1)(b) GDPR.
A random, essential browser identifier protects access to the respective order; no customer account is required. Briefly retained derived identifiers and counters protect against abusive requests. Order access is not associated solely by IP address. The technical browser storage is described under Cookies & browser storage . Payment, the contract and retention are governed by the following sections.
Ordering, payment and invoices
For a paid service, we process the selected function, price, association with the session and bike, and the required contact and billing details. The legal bases are Article 6(1)(b) GDPR for handling the order and Article 6(1)(c) GDPR for statutory evidence and retention obligations.
If PayPal is provided as a payment method and you use it, the order and payment information necessary for payment is sent to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal also processes data under its own responsibility. Further details are provided in the PayPal privacy statement. Simply opening the home page does not initiate a PayPal payment. When a voucher is redeemed, it is checked; no invoice is issued for it.
Contract declarations and withdrawals
To process orders, we store the selected service, price, consent given to an immediate start together with its text version and timestamp, and the contract confirmation. Withdrawals are stored with the name, email address, contract details and receipt time and sent to our support mailbox for processing. An acknowledgement is sent to the email address you provide. Sending attempts and the email service's acceptance status are recorded to handle errors. The legal basis is Article 6(1)(b) and (c) GDPR. These contract documents are not subject to the short retention period for technical logs.
Cookies and browser storage
To resume an order already started, your browser stores under bwc-order-recovery-v1 an order number and a signed record limited to that order, valid for 24 hours. Expired entries are removed on the next visit. This allows the same order to be associated after the same bike's data is read again. The storage does not authorise work on a different bike; it contains no full payment or diagnostic data.
The direct service interval function uses its own essential storage: an access cookie limited to seven days, short-lived protection against third-party requests, and the selected draft and an order receipt in local browser storage. After 24 hours without an update, the draft is no longer valid for automatic resumption. The order receipt is removed after confirmed completion and a subsequent click on “Start a new operation”; closing the tab alone does not delete it. Details and the consequences of manually deleting it are in the storage overview.
We use technically necessary storage for requested functions and their secure operation. WooCommerce order attribution analysis is disabled. Advertising tracking is disabled. Optional Matomo visitor analytics starts only after you select “Allow analytics”. Fonts and the logo are loaded from our own web server. Details of individual storage uses and the cookie notice are available under Cookies & browser storage.
Where access to your device is strictly necessary for a service you have explicitly requested, it is based on Section 25(2), point 2 TDDDG. Any additional processing of personal data is governed by the GDPR legal bases specified for the respective purpose. Optional analytics is based on your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. The free check and our services can also be used without consenting to analytics.
Optional visitor analytics with Matomo
Optional visitor analytics starts only after you voluntarily select “Allow analytics”. Without this consent, the analytics tracker is not loaded.
If you select “Allow analytics”, we record page views, date and time, the referring website, general device/browser information and selected navigation and function clicks. Matomo runs on our own web hosting; analytics data is not sent to an external analytics service. IP addresses are truncated before storage. Analytics contains no names, email addresses, form entries, order keys, diagnostic sessions or bike data. Address parameters and URL fragments are not included; the pages and events recorded are predefined.
We do not use Matomo visitor cookies for analytics or link it to your customer account. Logged-in users are not tracked. Regular deletion of individual visit records after 90 days is configured; aggregated reports contain no individual visit histories. Your choice remains valid for 180 days; expired entries are removed from local browser storage on the next visit. You can change it or turn analytics off for the future at any time through “Cookie settings” in the footer. Before you consent, neither the analytics tracker is loaded nor analytics events transmitted.
Processing outside the EU/EEA
Cloudflare, Microsoft and PayPal may also process data outside the EU or EEA, particularly in the USA. These providers explain their transfer mechanisms and safeguards in the notices linked above. Depending on the recipient involved, an adequacy decision, in particular the EU–US Data Privacy Framework for appropriately certified recipients, or standard contractual clauses and supplementary safeguards may apply. Our privacy contact can provide information about the recipients and safeguards used for your transaction.
Retention and deletion
Technical diagnostic logs and additional report copies are retained for 90 days from completion of the operation. Where documents are needed for unresolved complaints, claims or statutory evidence obligations, they remain retained with access restricted for that purpose. Contract documents and invoices are not subject to this technical 90-day period. Local cleanup is performed separately from ending the session.
The duration depends on the purpose: support enquiries are needed for handling the request and any necessary follow-up; order-related correspondence and invoice data are also subject to statutory retention obligations. Diagnostic logs and reports may remain on the service computer to handle orders, investigate errors and prove a service was performed. Ending the browser session does not automatically delete these files or messages already sent.
Necessity is assessed according to the processing status, unresolved complaints or claims, and legal obligations. Data must be deleted when processing is no longer necessary and no retention obligation prevents deletion. You can contact support@blauwerk.de at any time about the data relating to your particular operation.
Your rights
Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on your consent, you may withdraw it with effect for the future. This does not affect the lawfulness of processing before withdrawal.
For processing based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may also lodge a complaint with a data protection supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.
You can end the diagnostic connection using “Disconnect” or by closing the diagnostic page. During an ongoing transfer, follow the instructions shown so that a change already started is not interrupted. For privacy enquiries, please use our contact form or support@blauwerk.de.