1. Name and contact details of the controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:
John Rowan, COS
Germany Enabling Office
Bielefelder Strasse 54
33104 Paderborn
Telephone: +49 5254 982 2007
E mail:
If you have any questions about this privacy policy, please use the contact details above or the “Contact us” form on this website.
2. Contact details of the Data Protection Officer
You can contact our Data Protection Officer at:
Data Protection Officer
Germany Enabling Office
Bielefelder Strasse 54
33104 Paderborn
E mail:
3. Purposes and legal bases of processing
We process your personal data only to the extent necessary to provide, operate and improve this website and to perform our public tasks.
Unless stated otherwise below, the legal basis is:
- Art 6(1)(e) GDPR in conjunction with Section 3 BDSG, as the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority; and
- for ensuring the security and integrity of bfgnet.de (eg logging, security monitoring), Art 6(1)(f) GDPR (our legitimate interest in secure IT systems).
We use strictly necessary cookies only. Section 25(2) TDDDG exemption applies.
4. Categories of data, purposes and storage periods
4.1 Visiting the website / server log files
When you access bfgnet.de, our systems automatically collect the following data:
- IP address of the requesting device
- date and time of access
- URL and file accessed, amount of data transferred
- website from which you accessed bfgnet.de (referrer)
- browser type and version, operating system.
Purpose: technical delivery of the website, ensuring the security and stability of our IT systems (eg protection against attacks such as DDoS).
Legal basis: Art 6(1)(e) GDPR in conjunction with Section 3 BDSG; for security monitoring, additionally Art 6(1)(f) GDPR.
Storage period: log files are stored for 90 days and then deleted or anonymised, unless a security incident requires longer retention.
4.2 Forms and contact requests
If you send us an enquiry or feedback using a form or by e mail, we process:
- the information you enter in the form (eg name, e mail address, message, unit/role),
- technical metadata (date and time, IP address, browser/OS).
Purpose: processing your request and, where necessary, follow up correspondence.
Legal basis: Art 6(1)(b) GDPR where the enquiry relates to (pre-)contractual matters (eg specific service requests), otherwise Art 6(1)(e) GDPR in conjunction with Section 3 BDSG (public information and support tasks).
Storage period: your data is stored only as long as necessary to process the request and any follow up, and in line with applicable retention rules. As a rule, contact enquiries are deleted or anonymised after 2 months.
4.3 Matrix Test (including Matrix Certificate)
If you take the Matrix Test, we process:
- your login data (IP address, operating system, browser),
- your answers and score,
- your name and driving licence number (where required for the certificate),
- your e mail address if provided for correspondence.
Purpose: technical provision of the test, verification of eligibility, generation of the Matrix Certificate and, where applicable, fulfilment of internal GEO/British forces requirements concerning driving/vehicle authorisation.
Legal basis: Art 6(1)(e) GDPR in conjunction with Section 3 BDSG and the relevant legal/administrative provisions governing GEO’s responsibilities in Germany.
Storage period: a copy of your Matrix Certificate is stored for one week and may be kept for up to two months, where necessary for documentation or verification purposes. Test data and associated logs are deleted or anonymised once they are no longer required (with a maximum retention period of 3 months) for these purposes and in line with applicable retention rules.
4.4 Aral Fuelcard requests
If you submit an Aral Fuelcard request or receive a refusal, we process the personal data you provide in the form (eg name, unit, contact details, vehicle details, justification).
Purpose: processing and documenting Fuelcard requests and decisions.
Legal basis: Art 6(1)(e) GDPR in conjunction with Section 3 BDSG and the applicable administrative/legal framework for GEO’s fuelcard responsibilities.
Storage period: Data relating to Aral Fuelcard applications submitted via bfgnet.de is stored in the website environment only for as long as necessary to verify the request and to forward it to the responsible department within our organisation and is normally deleted from the website environment within a few days.
In our internal systems, data relating to Aral Fuelcard applications and decisions is stored for ten years to comply with record keeping and audit requirements for tax relevant processes, and is then deleted or anonymised.
5. Cookies and similar technologies
5.1 Use of cookies
bfgnet.de uses technically necessary cookies which are stored on your device.
Technically necessary cookies: required for the basic functions of the website (eg session cookies, security cookies). These are used without your prior consent on the basis of Section 25(2) TDDDG/TTDSG and Art 6(1)(e) and (f) GDPR.
Please refer to our Cookies page for details of cookies currently used on bfgnet.de
6. Recipients and categories of recipients
Your data is accessible only to those units within GEO and, where applicable, the British forces in Germany IT environment which need it to fulfil the purposes specified above (eg web team, administrative staff responsible for Matrix Tests and Fuelcards).
We also use carefully selected service providers (processors) for hosting, technical support and, where applicable, analytics or consent management. These providers are contractually bound under Art 28 GDPR to process personal data only on our documented instructions and to implement appropriate technical and organisational security measures.
Where required by law, we may transfer data to other public bodies or authorities (eg German or UK authorities) if we are legally obliged to do so or if this is necessary to assert, exercise or defend legal claims (Art 6(1)(c) and (e) GDPR).
7. International data transfers
As a rule, we process and store your personal data within the European Economic Area (EEA).
Where we use services from providers who may process personal data in third countries (in particular, the USA), we ensure that an adequate level of data protection is guaranteed in accordance with Art 44 seqq GDPR. This is done, for example, through:
- an adequacy decision by the European Commission, such as the EU/US Data Privacy Framework, and/or
- Standard Contractual Clauses (SCCs) pursuant to Art 46 GDPR, including any necessary supplementary safeguards.
7.1. Security and Spam Protection (Cloudflare & Turnstile)
Nature and Scope of Processing: On our website, we use services provided by Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare acts as a Content Delivery Network (CDN) and protects our website against cyberattacks (bot protection), as well as our forms against spam (Cloudflare Turnstile). As a result, all data traffic to and from our website is routed through Cloudflare's servers. During this process, the user's IP address is captured and processed for a short period.
Purpose and Legal Basis: The use of this service is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest consists of providing our website without technical errors, protecting it from malicious bots (DDoS attacks), and preventing spam through our contact and registration forms.
Third-Country Data Transfer: Cloudflare Inc. processes data partially in the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which ensures an adequate level of data protection in accordance with Art. 45 GDPR. In addition, we have concluded a Data Processing Addendum (DPA) with Cloudflare that includes the standard contractual clauses (SCCs).
Storage Period and Cookies: Cloudflare Turnstile and the associated security features operate cookie-free on our website. Log data (including truncated IP addresses) are generally deleted within a few days, unless a security event requires a longer retention period.
8. Security of processing
We implement appropriate technical and organisational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Art 32 GDPR.
These measures include, in particular, access controls, encryption and secure communication protocols, regular security updates, and backup concepts. Despite these measures, transmission of data over the internet may involve residual risks that cannot be completely eliminated.
We do not seek to exclude or limit our statutory responsibilities for data security; any earlier wording that suggested “any data you send is at your own risk” no longer applies.
9. Provision of data and consequences of non-provision
When you visit bfgnet.de, the collection of log data and the use of technically necessary cookies is required for technical reasons. Without this data, the website cannot be displayed or operated reliably.
When using forms (including Matrix Test or Aral Fuelcard request forms), some fields are marked as mandatory. Without this information, we may not be able to process your request or generate the Matrix Certificate.
10. Your rights as a data subject
You have the following rights under Arts 15–21 GDPR:
- Right of access (Art 15 GDPR): to obtain confirmation whether we process personal data concerning you and, if so, access to that data and further information.
- Right to rectification (Art 16 GDPR): to have inaccurate or incomplete personal data corrected.
- Right to erasure (Art 17 GDPR): to have your personal data erased in certain circumstances.
- Right to restriction of processing (Art 18 GDPR): to have processing restricted in certain circumstances.
- Right to data portability (Art 20 GDPR): where processing is based on consent or contract and carried out by automated means, to receive your data in a structured, commonly used and machine-readable format and to transmit it to another controller.
- Right to object (Art 21 GDPR): to object at any time, on grounds relating to your particular situation, to processing based on Art 6(1)(e) or (f) GDPR; we will then no longer process your data unless we can demonstrate compelling legitimate grounds.
- Right to withdraw consent (Art 7(3) GDPR): where processing is based on your consent, you may withdraw that consent at any time with effect for the future.
To exercise your rights, please contact us using the details in section 1 or via the “Contact us” form.
You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular, in the Member State of your habitual residence, your place of work or the place of the alleged infringement. For GEO activities in Germany, you may in particular, contact a German data protection supervisory authority.
11. Links to other websites
Our website contains links to external websites. This privacy policy applies only to bfgnet.de. We have no influence over whether external providers comply with data protection regulations. Please consult the privacy policies of the respective websites you visit.
12. Updates to this privacy policy
We review and, where necessary, update this privacy policy when we introduce new services or adjust our processing procedures, or when legal or regulatory requirements change. The current version is available at any time on this page and is identified by the “Last updated” date above.