Contact

Privacy policy

Bay, Boesler und Sadlo GbR - 360 Vista
Website, as of 1 Apr 2026

1. Controller

Bay, Boesler und Sadlo GbR - 360 Vista
Stauffenbergstraße 8
74523 Schwäbisch Hall
Germany

Phone: +49 791 20210160
Email: info@360-vista.de
Website: https://www.360-vista.de

Authorised to represent: David Bay, Johannes Boesler and Lukas Sadlo

The company named above is the controller within the meaning of the General Data Protection Regulation (GDPR, German: DSGVO).

2. General information on data processing

We process personal data only insofar as this is necessary to provide a functioning website, to handle enquiries, to fulfil contractual or pre-contractual obligations, to protect legitimate interests or on the basis of your consent.

Personal data is any information relating to an identified or identifiable natural person, e.g. name, email address, IP address, usage data or the content of communications.

The relevant legal bases are in particular:

  • Art. 6(1)(a) GDPR for consent
  • Art. 6(1)(b) GDPR for the performance of a contract or pre-contractual measures
  • Art. 6(1)(c) GDPR for legal obligations
  • Art. 6(1)(f) GDPR for legitimate interests

3. Hosting and provision of the website with Framer

This website is built with Framer and provided via the infrastructure of Framer.

Provider:
Framer B.V.
Rozengracht 207B
1016 LZ Amsterdam
Netherlands

When the website is accessed, technically necessary data is processed so that the website can be delivered, operated stably and protected against attacks. This may include in particular:

  • IP address
  • Date and time of access
  • URL accessed and amount of data transferred
  • Browser type and browser version
  • Operating system
  • Referrer URL
  • Host name of the accessing computer

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, high-performing and reliable provision of the website.

Where Framer uses sub-processors or data is processed outside the EU or the EEA, this takes place in accordance with Art. 44 et seq. GDPR, in particular on the basis of appropriate safeguards such as EU standard contractual clauses, where required.

4. Server log files

When you visit the website, server log files are processed. This data is used for technical provision, fault analysis, detection of misuse and system security. It is only combined with other data sources where this is necessary to investigate unlawful use or to ensure security.

The legal basis is Art. 6(1)(f) GDPR. Log data is deleted as soon as it is no longer needed for the purposes stated, unless statutory retention obligations or security interests prevent this.

5. Contact by email, phone or contact form

When you contact us, we process the data you provide. This may include in particular:

  • Name
  • Email address
  • Phone number
  • Message and other voluntary information
  • Time of the enquiry

The processing serves to handle your enquiry and to communicate with you. The legal basis is Art. 6(1)(b) GDPR where the enquiry is aimed at a contract or pre-contractual measures. In other cases the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in handling enquiries properly.

The data is deleted once the enquiry has been fully dealt with, unless there are statutory retention periods or legitimate interests in further storage.

6. Cookies and similar technologies

Our website uses cookies and comparable technologies. Cookies are small text files that are stored on your device. Comparable technologies can be, for example, local storage, session storage, pixels or tags.

Technically necessary cookies and storage technologies are used to provide the website, ensure security, save settings or manage the cookie selection. The legal basis is Art. 6(1)(f) GDPR and, where required, § 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Cookies that are not necessary, in particular for analytics or marketing purposes, are only used on the basis of your consent. The legal basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw consent you have given at any time with effect for the future. A “Cookie Settings” area is provided on the website for this purpose.

Cookies and technologies identified or typically used:

Technically necessary cookies / consent storage

  • Purpose: storing your cookie selection, operating the website, security and technical delivery
  • Provider: 360 Vista / Framer
  • Legal basis: Art. 6(1)(f) GDPR, § 25(2) TDDDG
  • Storage period: depending on the cookie or browser storage, usually until changed or deleted by the user

Google Analytics cookies

  • Possible cookie names: _ga, _ga_YP2VV3P9LT and other Google Analytics cookies
  • Purpose: analysis of website usage, reach measurement, improvement of our offering
  • Provider: Google Ireland Ltd.
  • Legal basis: consent, Art. 6(1)(a) GDPR, § 25(1) TDDDG
  • Storage period: depending on the Google configuration, typically up to 2 years

HubSpot cookies and tracking technologies

  • Possible cookie names: __hstc, hubspotutk, __hssc, __hssrc, messagesUtk and other HubSpot cookies
  • Purpose: analysis of website usage, contact and form functions, CRM and marketing evaluation, recognition of visitors within the scope of consent given
  • Provider: HubSpot Ireland Limited or HubSpot, Inc.
  • Legal basis: consent, Art. 6(1)(a) GDPR, § 25(1) TDDDG; for communication relating solely to an enquiry, where applicable Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR
  • Storage period: depending on the HubSpot configuration, typically from the length of the session up to several months

You can also delete or block cookies via your browser settings. If technically necessary cookies are deactivated, the functionality of the website may be limited.

7. Google Analytics

Google Analytics 4 with the measurement ID G-YP2VV3P9LT is evidently integrated on the website. The provider is:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

Google Analytics is used to analyse the use of our website. The following data in particular may be processed:

  • IP address, usually shortened or in aggregated form
  • Page views
  • Clicks and interactions
  • Referrer
  • Browser and device data
  • Approximate location
  • Time and duration of use
  • Cookie IDs or comparable identifiers

Processing only takes place on the basis of your consent. The legal basis is Art. 6(1)(a) GDPR and § 25(1) TDDDG. Consent can be withdrawn at any time via the cookie settings.

Google may also process data in the USA. Where data is transferred to a third country, Google states that it bases this on appropriate safeguards, in particular EU standard contractual clauses, and, where applicable, on the EU-U.S. Data Privacy Framework.

Further information:

8. HubSpot

HubSpot functions may be used on the website. HubSpot may be used in particular for contact forms, customer communication, CRM functions, marketing automation, and the analysis and evaluation of website interactions.

Provider:
HubSpot Ireland Limited
1 Sir John Rogerson's Quay
Dublin 2
Ireland

Parent company:
HubSpot, Inc.
25 First Street
Cambridge, MA 02141
USA

When HubSpot is used, the following data in particular may be processed:

  • IP address
  • Contact details, e.g. name, email address and phone number
  • Content of communications and form entries
  • Company details, where provided voluntarily
  • Page views, clicks and interactions
  • Browser, device and usage data
  • Cookie IDs or comparable identifiers

Depending on the function, processing serves to handle your enquiry, to carry out pre-contractual measures, for customer communication or to analyse and optimise our offering. The legal bases are Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR or, for cookies and tracking technologies that are not necessary, your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG.

HubSpot may also process data in the USA. Where data is transferred to a third country, HubSpot states that it bases this on appropriate safeguards, in particular EU standard contractual clauses, and, where applicable, on the EU-U.S. Data Privacy Framework.

Further information:

9. Google Fonts

Fonts from Google Fonts or fonts.gstatic.com are evidently integrated on the website. When the fonts are loaded, your IP address may be transmitted to Google so that the fonts can be delivered to your browser.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a consistent and high-performing presentation of the website. Where consent is technically or legally required, processing takes place on the basis of Art. 6(1)(a) GDPR.

10. Framer assets and external content delivery

The website loads images, scripts, font files and other resources via framerusercontent.com, app.framerstatic.com and possibly other Framer domains. When these resources are retrieved, technically necessary connection data, in particular the IP address, is processed.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free and fast delivery of the website.

11. External links

The website contains links to external services, in particular app.360-vista.de and my.360-vista.de. If you click on external links, you leave this website. The respective provider is responsible for the data processing there, unless stated otherwise.

12. Recipients of personal data

Personal data may be passed on to service providers who support us in operating the website, with hosting, with analytics functions or with communication. Where required, these service providers are engaged on the basis of data processing agreements under Art. 28 GDPR.

Data is only passed on to third parties if:

  • you have given your consent,
  • this is necessary for the performance of a contract,
  • there is a legal obligation,
  • or we have a legitimate interest and your interests do not override it.

13. Transfers to third countries

When individual services are used, personal data may be processed outside the European Union or the European Economic Area, in particular in the USA. Such a transfer only takes place in accordance with Art. 44 et seq. GDPR, e.g. on the basis of an adequacy decision, the EU-U.S. Data Privacy Framework, EU standard contractual clauses or your explicit consent.

14. Storage period

We only store personal data for as long as is necessary for the respective purposes. The data is then deleted unless there are statutory retention obligations, obligations to provide evidence or legitimate interests in further storage.

15. Your rights

Under the GDPR you have the following rights:

  • Access to your stored personal data, Art. 15 GDPR
  • Rectification of inaccurate data, Art. 16 GDPR
  • Erasure, Art. 17 GDPR
  • Restriction of processing, Art. 18 GDPR
  • Data portability, Art. 20 GDPR
  • Objection to processing based on Art. 6(1)(e) or (f) GDPR, Art. 21 GDPR
  • Withdrawal of consent given, with effect for the future, Art. 7(3) GDPR
  • Complaint to a data protection supervisory authority, Art. 77 GDPR

To exercise your rights, you can contact us at info@360-vista.de.

16. Right to object under Art. 21 GDPR

If we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing, or the processing serves the establishment, exercise or defence of legal claims.

17. Withdrawal of consent

If you have given consent, you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

18. Data security

We take technical and organisational measures to protect personal data against loss, destruction, manipulation, unauthorised access and unauthorised disclosure. The website is delivered encrypted via HTTPS.

19. Currency and changes

This privacy policy may be adapted if the website, the services used or legal requirements change. The current version published on the website applies.

20. Practical compliance note for the website operator

As a Google Analytics script is visible in the source code of the website and HubSpot was subsequently added to this privacy policy, it should be technically ensured that Google Analytics, HubSpot tracking and the associated non-essential cookies are only loaded after active consent. If loading already takes place before consent, the implementation of the cookie consent mechanism should be checked and adjusted.