Privacy Policy – B&R Handy

1. Data controller
Responsible for data processing:
Bashar Alhabbal
Am Plärrer 19–21
90443 Nürnberg
Email: info@brhandy.de

2. General information
Protecting your personal data is very important to us.
Your data is processed in accordance with the GDPR.

3. Collection of personal data
The following data is collected automatically when you visit the website:
– IP address
– Date and time
– Browser type

4. Data processing for orders
To fulfil the contract, we process:
– Name
– Address
– Email
– Payment information

5. Legal basis
Article 6(1)(b) GDPR (performance of a contract)

6. Cookies
Our website uses cookies to improve the user experience.

7. Disclosure to third parties
Data is disclosed only to:
– Shipping service providers
– Payment providers

8. Your rights
You have the right to:
– Access
– Rectification
– Erasure
– Restriction of processing
– Data portability

9. Right to lodge a complaint
Competent supervisory authority:
Bavarian State Office for Data Protection Supervision

Last updated: January 2026

10. Privacy in the BR Handy app (Android/iOS)

This information applies to the BR Handy mobile app (package com.brhandy.app). The data controller is the provider named above. The app is a shopping app for our online shop brhandy.de.

10.1 Data processed by the app

Customer account: First name, last name, email address, username, password (stored only in encrypted form) and an optional phone number — for registration, login and account management.
Orders: Billing and delivery addresses, phone number, ordered items, cart, wishlist, coupons and order history — to process your orders.
Payment data: Card details or payment accounts are entered directly in the payment providers' forms (Stripe, PayPal, Razorpay) and processed there. We do not store full card details.
Push notifications: A device-specific Firebase Cloud Messaging (Google) token is used to send you order and offer notifications. You can disable notifications at any time in your device's system settings.
Technical data: When content is retrieved, technically necessary data (e.g. IP address, app version and language) is sent to our server.

The app uses no advertising, advertising tracking or analytics tools. Location, contacts, photos, microphone and camera are not accessed.

10.2 Recipients / data processors

Google Ireland Ltd. / Google LLC (Firebase Cloud Messaging) — delivery of push notifications.
Stripe Payments Europe Ltd., PayPal (Europe) S.à r.l. et Cie, S.C.A., Razorpay Software Pvt. Ltd. — payment processing if you choose the respective payment method.
Shipping service providers — delivery of your order.

Transfers to third countries (e.g. the USA) take place only on the basis of standard contractual clauses or the EU-U.S. Data Privacy Framework. Your data is not sold.

10.3 Legal bases

Article 6(1)(b) GDPR (contract/account), Article 6(1)(c) GDPR (statutory retention obligations), Article 6(1)(a) GDPR (consent to push notifications).

10.4 Security

All data is transmitted exclusively in encrypted form over HTTPS (TLS).

10.5 Retention period and account deletion

We store account data until you delete your account. You can delete your account at any time:

in the app under Profile → Settings → Delete account, or
without the app at https://brhandy.de/en/delete-account/, or
by email to info@brhandy.de.

This deletes the customer account, addresses, phone number, wishlist and push token. We retain invoice and order data only as legally required (section 147 AO, section 257 HGB: up to 10 years), restrict its use and delete it afterwards.