NEW LAW

The Bundestag has approved the rise in the PKV income limit for 2027.

Find out if it affects you →

About us

bramex.de

Privacy Policy

At Bramex e.K. we take the protection of your personal data seriously. This Privacy Policy explains what data we collect through the website bramexplus.com, for what purpose, for how long and what your rights are, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG).

Last updated: April 2026.

1. Data controller

The controller responsible for the personal data collected through this website is:

Bramex e.K.
Owner: Ronald Seifart
Königstraße 10 C
70173 Stuttgart (Germany)
Phone: +49 171 5088078
E-mail: info@bramex.de

Bramex Plus is a brand and programme of Bramex e.K. and does not constitute a separate legal entity. All data processing carried out through bramexplus.com takes place under the responsibility of Bramex e.K.

Data Protection Officer (DPO): no Data Protection Officer has been appointed, as none of the circumstances requiring one under Article 37 GDPR and Section 38 BDSG apply. For any enquiry regarding your personal data, you may contact us directly at info@bramex.de.

2. General principles

We process your personal data in accordance with the principles set out in Article 5 GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

We do not process your data for purposes incompatible with those for which it was collected, we do not disclose it to third parties except in the cases described in this policy, and we apply reasonable technical and organisational measures to protect it.

3. Your rights as a data subject

Under the GDPR and the BDSG, you have the following rights in relation to your personal data:

  • Right of access (Art. 15 GDPR): to know what data of yours we process and to obtain a copy of it.
  • Right to rectification (Art. 16 GDPR): to have inaccurate or incomplete data corrected.
  • Right to erasure or "right to be forgotten" (Art. 17 GDPR): to request the deletion of your data when it is no longer necessary, when you withdraw your consent, or when the other legal grounds apply.
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability (Art. 20 GDPR): to receive your data in a structured, machine-readable format.
  • Right to object (Art. 21 GDPR), including objection to processing for direct marketing purposes.
  • Right to withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand (Art. 7(3) GDPR).
  • Right not to be subject to automated decisions producing legal effects (Art. 22 GDPR). We do not carry out such decisions.

To exercise any of these rights, you may write to us at info@bramex.de or by post to the address indicated in section 1. We will respond within a maximum of one month from receipt of your request, in accordance with Art. 12(3) GDPR.

Right to lodge a complaint: if you consider that the processing of your data infringes applicable law, you may lodge a complaint with the competent data protection authority. In our case, this is the data protection authority of the federal state of Baden-Württemberg:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Phone: +49 711 61 55 41-0
E-mail: poststelle@lfdi.bwl.de
Web: www.baden-wuerttemberg.datenschutz.de

4. Web hosting

The website bramexplus.com is hosted on the servers of:

Webempresa Europa, S.L.
Paseo de la Castellana 91, 6ª planta
28046 Madrid (Spain)
Web: www.webempresa.com

The servers are physically located in Spain, within the European Economic Area (EEA). We have entered into the corresponding data processing agreement with Webempresa in accordance with Article 28 GDPR.

Legal basis: legitimate interest in the secure and stable provision of the website (Art. 6(1)(f) GDPR).

5. Data collected automatically when visiting the site (log files)

When you access the website, our hosting provider automatically collects the following technical data in temporary server log files:

  • IP address of the device.
  • Date and time of the request.
  • Browser type and version.
  • Operating system.
  • Referrer URL.
  • Pages visited within the site.
  • Volume of data transmitted.
  • Successful-access indicator.

Purpose: to ensure the stability and security of the site, prevent attacks and diagnose technical errors.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Our legitimate interest lies in providing a functional website protected against unauthorised access.

Retention period: these logs are kept for a maximum of 30 days, after which they are automatically deleted, unless there are indications of an infringement that make their retention necessary for the corresponding investigation.

This data is not combined with other sources and does not allow us to identify you personally, except in the event of a legal requirement.

6. Cookies

Our website uses cookies and similar technologies. Full details of the cookies used, their purpose, duration and legal basis can be found in our Cookie Policy.

As a general rule, technical cookies that are strictly necessary for the operation of the site are installed without prior consent, on the basis of legitimate interest (Art. 6(1)(f) GDPR) and Section 25(2) TDDDG.

Any other cookie (analytical, advertising, personalisation or social media) will only be installed after we have obtained your express consent through our cookie management banner, which allows you to accept, reject or configure the categories granularly. You may withdraw your consent at any time.

7. Information request form (tariff comparator)

On bramexplus.com we provide a comparator for private health insurance (PKV) tariffs with an associated form called "Request information", which allows the user to receive personalised advice on the tariffs of the Bramex Plus programme.

7.1. Data collected

When you submit the form, the following personal data is collected:

  • First name and surname.
  • E-mail address.
  • Phone number.
  • Year of birth.
  • Tariff of interest selected (Basic, Smart, Pro, Max or request for a free consultation).
  • Coverage preferences indicated in the comparator (daily sickness benefit yes/no, selected deductible).
  • Date and time of submission.
  • Confirmation of acceptance of this Privacy Policy.

Additionally, for security reasons, the sender's IP address is processed transiently for a maximum of 60 seconds, for the sole purpose of preventing mass automated submissions (rate-limiting). This IP is not stored persistently together with the lead.

7.2. Purpose of the processing

  • To respond to your request for information about the tariffs and private health insurance.
  • To prepare, where applicable, a personalised offer or a free consultation for you.
  • To take pre-contractual measures requested by you.
  • To comply with legal obligations arising from our activity as an insurance intermediary under Section 34d GewO and Section 61 VVG (documentation, advisory and information duties).

7.3. Legal basis

  • Art. 6(1)(b) GDPR (performance of pre-contractual measures taken at the request of the data subject): since you contact us to receive commercial information or advice prior to the possible conclusion of an insurance policy.
  • Art. 6(1)(c) GDPR (compliance with legal obligations): for the documentation obligations applicable to insurance intermediation.
  • Art. 6(1)(a) GDPR (consent): for additional purposes requiring express consent (for example, sending commercial communications by e-mail – see section 8).

7.4. Recipients

The data is stored in the website's internal database, hosted on Webempresa's servers (see section 4), and is sent by e-mail to the internal address of Bramex e.K. via the SMTP delivery system configured with our hosting provider. Only the owner, Ronald Seifart, and strictly necessary internal staff have access to this data.

This data is not shared with insurers or third parties without your prior express consent. Should you decide to take out a policy, we will request your informed and specific consent before transmitting your data to the relevant insurance company.

7.5. Retention period

  • If the enquiry does not lead to a contractual relationship or ongoing advisory relationship, the data will be kept for a maximum of 24 months from the last contact, after which it will be deleted or anonymised.
  • If a contractual or advisory relationship is established as a client of Bramex e.K., the data will be kept for the period required by applicable law, in particular the tax and commercial retention obligations (up to 10 years under Sections 147 AO and 257 HGB), counted from the end of the relevant tax year.

7.6. Mandatory or voluntary nature of the data

Providing the form data is voluntary but necessary in order for us to handle your request. If you do not provide the data marked as mandatory, we will not be able to respond to your enquiry.

8. Sending commercial communications and newsletter (Brevo)

If you expressly consent (for example, via the corresponding checkbox in a form or by subscribing to our newsletter), we will use your e-mail address and name to send you commercial communications related to the services of Bramex e.K. and Bramex Plus: news, advice on private health insurance in Germany, tariff updates and offers.

Legal basis: express consent (Art. 6(1)(a) GDPR and Section 7(2) No. 3 UWG for e-mail communications). This consent is freely given, specific, informed and unambiguous, and may be withdrawn at any time, either via the unsubscribe link included at the end of each communication or by writing to us at info@bramex.de.

To send these communications we use the e-mail marketing platform Brevo, operated by:

Sendinblue SAS (Brevo)
106, boulevard Haussmann
75008 Paris (France)
Web: www.brevo.com
Privacy policy: www.brevo.com/legal/privacypolicy/

Brevo acts as a data processor and its servers are located within the European Union (France and Germany). We have entered into the corresponding data processing agreement with Brevo in accordance with Art. 28 GDPR.

Brevo processes subscriber data on our behalf (name, e-mail, technical delivery data, e-mail opens and clicks) for the purpose of enabling delivery and measuring campaign performance. This measurement (opens/clicks) is also based on your consent.

Retention period: your data will be kept for as long as you remain subscribed. If you withdraw your consent, it will be removed from the mailing lists immediately, being kept only on an exclusion list (blacklist) to ensure you are not contacted again by mistake, in accordance with Art. 21(3) GDPR.

9. E-mail communication and technical sending of e-mails (SMTP)

When you contact us by e-mail (for example, by writing to info@bramex.de) or receive automatic notifications from the website, the data of that communication is processed in order to handle your enquiry.

The e-mails sent by the website (confirmations, internal form notifications) are sent via the SMTP server of our hosting provider, Webempresa, located in Spain.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in efficient electronic communication), as the case may be.

Retention period: e-mails are kept for as long as necessary to handle the enquiry and, where applicable, for the applicable commercial and tax periods.

10. Google Analytics

With your prior consent via the cookie banner, we use Google Analytics 4, a web analytics service provided by:

Google Ireland Limited
Gordon House, Barrow Street, Dublin 4, Ireland
(for EEA users)

And, as ultimate controller, Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Purpose: to statistically analyse the use of the website (pages visited, time spent, devices, source, etc.) in order to improve its content and the user experience.

Legal basis: consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). Google Analytics is only activated if you expressly accept it in the cookie banner. You may withdraw your consent at any time by changing your preferences in that banner, which will immediately stop the collection of data.

Data processed:

  • IP address (anonymised/truncated before being stored).
  • Cookie and client identifiers (client ID).
  • Date, time and duration of the visit.
  • Pages visited and interactions within the site.
  • Device type, browser and operating system.
  • Approximate location (at city/region level) derived from the IP.
  • Referral source.

International transfer: Google may transfer data to servers located in the United States. Google LLC is certified under the EU-US Data Privacy Framework (DPF), recognised by the European Commission as a framework that ensures an adequate level of protection (adequacy decision of 10 July 2023). This certification provides a legal basis for the transfer under Art. 45 GDPR. Additionally, we use the Standard Contractual Clauses (SCC) as a supplementary safeguard.

Retention period: the data is kept in Google Analytics for a maximum of 14 months, after which it is automatically deleted.

More information and opt-out: you can consult Google's privacy policy at policies.google.com/privacy and install the Google Analytics opt-out add-on from tools.google.com/dlpage/gaoptout.

11. Plugins and services of the WordPress site

11.1. Elementor and Elementor Pro

We use the visual page builder Elementor and Elementor Pro, by Elementor Ltd. (7 Menachem Begin Street, Ramat Gan, Israel), to build the pages visually. Elementor runs mainly on the server and does not transfer visitors' personal data to its servers during the visit to the site, except for features requiring a connection to Elementor Cloud, which we do not use.

Legal basis: legitimate interest in having an efficient content management system (Art. 6(1)(f) GDPR).

11.2. Yoast SEO

We use the Yoast SEO plugin to optimise the site's search engine ranking. Yoast SEO runs entirely on our server and does not transmit visitors' personal data to third parties.

11.3. WP Fastest Cache

We use the WP Fastest Cache plugin to cache the site's content and improve its speed. This plugin runs locally on our server and does not send data to third parties.

11.4. Google Fonts (not used)

We expressly state that we do not use Google Fonts loaded from Google's external servers. The fonts used on the site are served locally from our own server, so no transfer of your IP address to Google takes place when you visit bramexplus.com.

12. Social media

This website may include links to our social media profiles (LinkedIn, Instagram, etc.). These links are simple hyperlinks that only connect to the social networks when you click on them; no active social plugins are integrated (we do not use buttons that automatically collect data without your interaction).

When you access our social media profiles, the processing of your data is governed by the privacy policy of the relevant social network.

13. Data processors

To provide the web service, we work with the following providers, who act as data processors in accordance with Art. 28 GDPR and with whom we have entered into the corresponding agreement:

  • Webempresa Europa, S.L. (Spain): website hosting and SMTP e-mail delivery service.
  • Sendinblue SAS – Brevo (France): sending commercial communications and newsletters.
  • Google Ireland Limited / Google LLC (Ireland / USA): statistical analysis via Google Analytics (only with the user's consent).

14. International data transfers

As a general rule, we process your data within the European Economic Area (EEA). The only transfer to a third country occurs, where applicable, via Google Analytics to the United States, which is covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework and by Standard Contractual Clauses, as detailed in section 10.

15. Data security

We apply reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or manipulation, in accordance with Art. 32 GDPR. These include, among others:

  • Encryption of the connection via the TLS protocol (HTTPS) throughout the website.
  • Restricted access to the administration panel via secure credentials.
  • Keeping the site's software (WordPress, plugins, themes) up to date.
  • Regular backups.
  • Server protection by the hosting provider.

16. Minors

This website is not directed at children under 16 years of age. We do not knowingly collect personal data from children under that age. If a minor provides us with data without the consent of their legal guardians, we ask parents or guardians to notify us so that we may proceed with its immediate deletion.

17. Automated decisions and profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you (Art. 22 GDPR).

18. Changes to this Privacy Policy

We may amend this Privacy Policy to adapt it to legal or case-law changes or to changes in the services we offer. We recommend that you review this page periodically. The date of the last update appears at the beginning of the document. In the event of substantial changes affecting purposes based on consent, we will inform you by appropriate means and, where applicable, request your renewed consent.

19. Data protection contact

For any matter relating to the processing of your personal data or the exercise of your rights, you may contact us:

Bramex e.K.
Königstraße 10 C
70173 Stuttgart (Germany)
E-mail: info@bramex.de