Data protection policy

I. Name and address of the controller

The controller as referred to by the General Data Protection Regulation and other national data protection laws of the Member States and other data protection provisions is:

STRABAG Property and Facility Services GmbH
Europa-Allee 50
60327 Frankfurt/Main
Germany
Tel. +49 69 13029-0
info@strabag-pfs.com
www.strabag-pfs.de

II. Name and address of the data protection officer

The controller’s data protection officer is:

Kathrin Ravenstein-Gramlich
CML Construction Services GmbH
A STRABAG SE Service Company
Siegburger Straße 241
50679 Cologne
Tel. +49 221 824-2913
kathrin.ravenstein@bauholding.com

III. General information on data processing

1. Extent of the processing of personal data

We process the personal data of our users only to the extent necessary to provide a functional website and our content and services. The personal data of our users is typically only processed with the user’s consent. An exception applies in cases in which it is objectively impossible to obtain prior consent and the processing of data is permitted by statutory provisions.

2. Legal basis for the processing of personal data

If we obtain the data subject’s consent for processing operations concerning their personal data, the legal basis is point (a) of Article 6(1) of the EU General Data Protection Regulation (GDPR).

When the processing of personal data is necessary for the performance of a contract to which the data subject is party, the legal basis is point (b) of Article 6(1) GDPR. This also applies to processing operations required prior to entering into a contract.

When the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, the legal basis is point (c) of Article 6(1) GDPR.

In the event that the processing of personal data is necessary to protect an interest that is essential for the life of the data subject or that of another natural person, the legal basis is point (d) of Article 6(1) GDPR.

If processing is necessary for the purposes of the legitimate interests of our company or a third party which are not overridden by the interests or rights and freedoms of the data subject, the legal basis is point (f) of Article 6(1) GDPR.

3. Data erasure and duration of storage

The personal data of the data subject will be erased or blocked as soon as the purpose of storage no longer applies. Storage is also possible if provided for by European or national legislation in EU regulations, laws or other provisions to which the controller is subject. Data will also be erased or blocked if a storage period stipulated by the above standards expires, unless further storage of the data is necessary to enter into or fulfil a contract.

IV. Provision of the website and creation of log files

1. Description and extent of data processing

Every time our website is accessed, our system automatically collects data and information from the accessing computer system.

The following data are collected:

(1) information on the type of browser and the version used;

(2) the user’s operating system;

(3) the user’s Internet service provider;

(4) the user’s IP address;

(5) the date and time of access;

(6) websites from which the user’s system accesses our website;

(7) websites that are accessed by the user’s system through our website.

Data are also stored in the log files of our system. These data are not stored with the user’s other personal data.

2. Legal basis for data processing

The legal basis for the temporary storage of data and log files is point (f) of Article 6(1) GDPR.

3. Purpose of data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. The user’s IP address must be stored for the duration of the session for this purpose.

Data are stored in log files to ensure the functionality of the website. The data are also used to optimise the website and to ensure the security of our IT systems. The data are not analysed for marketing purposes in this context.

These purposes also account for our legitimate interest in data processing as per point (f) of Article 6(1) GDPR.

4. Duration of storage

The data will be erased as soon as they are no longer necessary to achieve the purpose for which they were collected. If the data are collected to provide the website, this is the case when the respective session has ended.

If the data are stored in log files, this is the case after not more than 180 days.

5. Objecting and removing consent

The collection of data to provide the website and the storage of data in log files is essential for the website’s operation. The user therefore does not have the option to object.

V. Use of cookies

a) Description and extent of data processing

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s computer system. When a user accesses a website, a cookie might be stored in the user’s operating system. This cookie contains a string of characters that allows the browser to be uniquely identified when the website is accessed again.

We use cookies to make our website more user-friendly. Some elements of our website require the accessing browser to be identified even after moving to a different page.

The following data are stored and transmitted in cookies:

(1) Search behaviour

On our website, we also use cookies that enable analysis of users’ surfing behaviour.

The following data can be transmitted in this way:

(1) search terms entered;

(2) frequency of page views;

(3) use of website functions.

The user data collected in this way are pseudonymised using technical procedures. It is therefore no longer possible to associate the data with the accessing user. The data are not stored together with users’ other personal data.

When they access our website, users are shown an banner informing them of the use of cookies for analysis purposes and referred to this data protection policy. In this context, users are also informed how to prevent the storage of cookies in the browser settings.

When they access our website, users are informed of the use of cookies for analysis purposes and their consent to the processing of the personal data used in this context is obtained. This data protection policy is referred to in this context.

b) Legal basis for data processing

The legal basis for the processing of personal data using technically necessary cookies is point (f) of Article 6(1) GDPR.

The legal basis for the processing of personal data using cookies for analysis purposes, if the user has consented, is point (a) of Article 6(1) GDPR.

c) Purpose of data processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some features of our website cannot be offered without the use of cookies. These require the accessing browser to be identified even after moving to a different page.

We require cookies for the following uses:

(1) Remembering search terms

The user data collected using technically essential cookies are not used to create user profiles.

The analysis cookies are used for the purpose of improving the quality of our website and its content. Through the analysis cookies, we learn how the website is used and can therefore continuously optimise our offering.

These purposes also include our legitimate interest in the processing of personal data as per point (f) of Article 6(1) GDPR.

d) Duration of storage, objecting and removing consent

Cookies are stored on the user’s computer and transmitted to our site by the user. Therefore, as the user, you have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to fully use all the features of the website.

The transmission of Flash cookies cannot be prevented by changing the browser settings, but rather by changing the Flash Player settings.

VI. Contact form and e-mail contact

1. Description and extent of data processing

The following data are also stored at the time your message is sent:

(1) the user’s IP address;

(2) the date and time of registration;

Your consent to data processing is obtained when you send a message and are referred to this data protection policy.

Alternatively, you can contact us using the e-mail address provided. In such event, the user’s personal data transmitted with the e-mail will be stored.

The data will not be shared with third parties in this context. The data are used exclusively for processing the conversation.

2. Legal basis for data processing

The legal basis for the processing of personal data when the user has consented is point (a) of Article 6(1) GDPR.

The legal basis for the processing of the data transmitted when sending an e-mail is point (f) of Article 6(1) GDPR. If the intention of making contact by e-mail is to enter into a contract, an additional legal basis for processing is point (b) of Article 6(1) GDPR.

3. Purpose of data processing

The personal data from the input screen are used solely to enable us to process your contact request. If contact is made by e-mail, this constitutes the necessary legitimate interest in processing the data.

The other personal data processed when you send your message serve to prevent the misuse of the contact form and to ensure the security of our IT systems.

4. Duration of storage

The data will be erased as soon as they are no longer necessary to achieve the purpose for which they were collected. For the personal data from the input screen of the contact form and the personal data sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation has ended when it is apparent from the circumstances that the matter concerned has been definitively resolved.

The personal data additionally collected during the sending process are erased after no more than seven days.

5. Objecting and removing consent

The user has the option to revoke their consent to the processing of personal data at any time. If the user contacts us by e-mail, they can object to the storage of their personal data at any time. In such event, the conversation cannot be continued.

If you wish to exercise your right to object, please inform us of this by sending an e-mail to kathrin.ravenstein@bauholding.com

All personal data stored in the course of the contact request will then be deleted.

VII. Disclosure to service companies

We disclose your personal data to third parties only when service companies work for us to manage our data. The legal basis for this is provided by point (a) of Article 6(1) GDPR. We have entered into contract processing agreements with our services providers in order to ensure data protection regarding your personal data as well.

VIII. Use of Matomo Analytics

We use the web analysis software Matomo (www.matomo.org) to produce access statistics and for the analysis of general user behaviour on the website and for purposes of the optimisation of our online presence. The legal basis for this is provided by point (f) of Article 6(1) GDPR.

We have configured Matomo so that:

- no cookies are stored on your device;

- the IP address is shortened by the last two bytes and thus anonymised;

- other than the pages accessed, only those data are collected that are transmitted by your browser when accessing the website/this data collection is limited to the respective duration of the session;

- when the website is accessed, the data transmitted by your browser and the anonymised IP address are irrevocably replaced by a pseudonymised ID on a session basis with the result that a personal connection cannot be made. This pseudonymised ID is also erased after not more than 24 hours.

We use a separate Matomo instance on our company’s servers within the EEA, hence no data are transmitted to Matomo or other third parties.

Also, you can activate the “do not track” option in your browser so that Matomo cannot store or process any data about your use of the website.

If you have not activated the “do not track” option and you do not consent to the storage and analysis of the above data by Matomo, you can of course object to this data processing by Matomo on our website at any time. For this purpose, we have provided you with a special inline frame that is linked to our Matomo system below. Deactivating the checkbox (opt out) sets a cookie on your device that prevents the collection and processing of any session data on our website by Matomo. Please note that completely deleting your cookies will result in the deletion of the opt-out cookie as well, and you may have to activate it again.