Privacy notice
This is a translation. The German version is legally binding: Datenschutzerklärung.
1. Controller
BCA Unternehmensberatung UG (haftungsbeschränkt)
Königstraße 35, 70173 Stuttgart, Germany
E-mail: [email protected] · Phone: +49 151 61471603
This notice applies to sanctions.bcaun.com. The main site bcaun.com has its own privacy policy.
2. Hosting and server logs (Cloudflare)
The website is delivered through Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit, Cloudflare processes technically necessary data: IP address, date and time, requested address, referrer, browser and system information, amount of data and status code. This serves delivery, protection against attacks and stability (Art. 6(1)(f) GDPR). A data processing addendum is in place with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework, on which any transfer to the US is based (Art. 45 GDPR). Cloudflare sets no analytics cookies.
3. Fonts
The IBM Plex typeface is loaded from our own server. There is no connection to Google Fonts or any other font provider.
4. Google Analytics 4 — only with consent
With your consent we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure how the site is used: pages viewed, time on page, approximate location (country/region), device type, browser and traffic source. For this, cookies are set or information is stored on and read from your device. Google Analytics 4 does not store IP addresses. Data are deleted after the retention period set in Google Analytics (14 months at most).
Google Analytics loads only after you click “Accept” in the notice. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google may transfer data to Google LLC in the US; Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). You can withdraw consent at any time with effect for the future: open cookie settings and choose “Decline”. Google's privacy policy: policies.google.com/privacy.
We store your choice in your browser's local storage (key bca_consent) so that the notice does not reappear on every visit. This is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG) and is not transmitted to us.
5. Request form “Written opinion”
When you submit the form at /opinion/ or /de/einschaetzung/, we process the details you enter (name and organisation, e-mail address, description of the operation, card number and party type if given) and the address of the page the request comes from. The purpose is to handle your request and prepare a fee quote; the legal basis is Art. 6(1)(b) GDPR (pre-contractual steps taken at your request).
The request is received by a server function of this website (Cloudflare Worker) and delivered as an e-mail through Cloudflare Email to our mailbox [email protected]. Cloudflare acts as our processor (see section 2); no other provider is involved. The server function adds the country derived from the IP address and the time of the request. To prevent abuse, a hash of your IP address is kept in Cloudflare's cache for no more than ten minutes to limit the number of requests; the IP address itself is not stored (Art. 6(1)(f) GDPR).
If the server function is unavailable, your e-mail client opens with a pre-filled message to [email protected].
Requests that do not lead to an engagement are deleted no later than six months after the last correspondence; for engagements, the statutory retention periods apply (§ 257 HGB, § 147 AO).
6. Contact by e-mail
If you e-mail us, we process your details to handle the request (Art. 6(1)(b) or (f) GDPR).
7. Copy protection and external links
A script on this site limits copying of longer passages. It collects or transmits no personal data. Links to external sites (e.g. pravo.gov.ru, cbr.ru, bcaun.com) connect you to that provider only when clicked.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on Art. 6(1)(f) GDPR (Art. 21) and withdrawal of consent (Art. 7(3)). Write to [email protected].
You may lodge a complaint with a supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.
9. Retention and changes
Personal data are deleted once the purpose ceases and no statutory retention duty applies. We update this notice when the site or the law changes.
Last updated: October 2026