Privacy Policy
I. What personal data is processed
GOLDBECK processes personal data that we receive from you as a contractual partner. This data is supplemented by personal data that we obtain from publicly accessible sources, which notably include the commercial register, the press and the media. If you submit an offer in response to a call for tender by GOLDBECK and/or receive or place the order for the provision of services, or if you visit our home page, customer portal or supplier portal, we will collect and store the following information:
- Title and full name
- A valid email address
- Address
- Telephone number (landline and/or mobile phone)
- IP address of the requesting computer
- Date and time of access
- Name and URL of the retrieved file
- Employer/position
- Website
- Business liability insurance
- Tax ID
- Account details
- Other information required for our cooperation
II. Why your personal data is processed
We process your personal data so that we can:
- Identify you as our contractual partner
- Inform you about new projects and give you the opportunity to actively participate in tender processes
- Send correspondence to you
- Send invoices
- Assert contractual and statutory legal claims, as well as establish a legal defence
III. Legal basis for data processing
Your personal data is processed in compliance with the regulations of the national data protection laws as well as the EU General Data Protection Regulation (EU GDPR), applying the following provisions:
- Based on your consent pursuant to Art. 6, para. 1, lit. 1 (a) of the EU GDPR
Insofar as you have expressly or implicitly given GOLDBECK consent to process personal data for specific purposes, this processing is lawful on the basis of your consent. Any consent given can be revoked at any time. This also applies to the revocation of declarations of consent that were granted to GOLDBECK before the EU General Data Protection Regulation came into force, i.e. before 25 May 2018.
- To fulfil contractual obligations pursuant to Art. 6, para. 1, lit. 1 (b) of the EU GDPR
Upon your request or after commissioning for a specific project or other delivery and service, the data agreement is made for the purposes stated under Section II and is necessary for the appropriate handling of the project and for the mutual fulfilment of obligations arising from the contract.
- To protect the legitimate interests of GOLDBECK pursuant to Art. 6, para. 1
lit. (f) of the EU GDPR
Based on the contractual relationship already established between you and GOLDBECK in the past, GOLDBECK has a legitimate interest in processing and transmitting your personal data within the GOLDBECK Group for internal administrative purposes. The processing of your personal data is necessary to be able to continue to share calls for tender with you for potential projects and to continue our cooperation in the future.
- To fulfil a legal obligation pursuant to Art. 6, para. 1, lit. 1 (c) of the EU GDPR
GOLDBECK processes your personal data for the fulfilment of legal obligations, e.g. for infection control for the purpose of implementing corresponding Covid measures.
IV. Your rights
As a data subject within the meaning of the Data Protection Act, you have the right:
- To revocation (pursuant to Art. 7, para. 3 of the EU GDPR)
Once you have given your consent, you may revoke it from GOLDBECK at any time. From this point on, GOLDBECK may no longer continue to process your data based on this consent.
- To information (in accordance with Art. 15 of the EU GDPR)
You can request information about your personal data processed by GOLDBECK. You may notably request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of complaint, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making including profilers and, if applicable, meaningful information about their details.
- To rectification (pursuant to Art. 16 of the EU GDPR)
You can request the correction of any incorrect personal data or the completion of any incomplete personal data stored by GOLDBECK with immediate effect.
- To deletion (in accordance with Art. 17 of the EU GDPR)
You may request the deletion of your personal data stored by GOLDBECK unless processing it is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the assertion, exercise or defence of legal claims.
- To restrict processing (pursuant to Art. 18 of the EU GDPR)
You may request the restriction of the processing of your personal data insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer require the data for our processing purposes, but you need it for the assertion, exercise or defence of legal claims, or you have objected to the processing pursuant to Art. 21 of the EU GDPR.
- To data portability (pursuant to Art. 20 of the EU GDPR)
You have the right to receive your personal data that you have provided to GOLDBECK in a structured, conventional and machine-readable format or to request that it be transferred to another controller.
- To complaint (pursuant to Art. 77 of the EU GDPR)
You can complain to a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or the registered office of our company.
V. Right of objection according to Art. 21 of the EU GDPR
Insofar as your personal data is processed on the basis of legitimate interests pursuant to Art. 6, para. 1, item 1, lit. f) of the EU GDPR, you have the right to object to your personal data being processed pursuant to Art. 21 of the EU GDPR. This applies insofar as there are grounds for doing so that arise from your particular situation or the objection is made against direct advertising. In the latter case, you have a general right of objection, which is implemented by us without the need to specify the particular situation.
If you wish to exercise your right to object, simply send an email to:
VI. Storage and deletion
Your personal data collected by GOLDBECK will be stored by us beyond the end of our business relationship for a period of 10 calendar years and then deleted, unless GOLDBECK is obliged to store the data for a longer period pursuant to Art. 6, para. 1, item 1, lit. c) of the EU GDPR due to tax or commercial law retention and documentation obligations.
Furthermore, a longer retention period may be necessary for the preservation of evidence under national statutes of limitation.
VII. Disclosure of personal data by GOLDBECK
GOLDBECK will not disclose your personal data to third parties for purposes other than those listed below. GOLDBECK will only pass on your personal data to third parties:
- if you have previously expressly consented to a transfer to third parties in accordance with Art. 6, para. 1, item 1, lit. a) of the EU GDPR;
- insofar as this is necessary for the processing of contractual relationships with you in accordance with Art. 6, para. 1, item 1, lit. b) of the EU GDPR;
- in the event that there is a legal obligation for the disclosure pursuant to Art. 6, para. 1, item 1, lit. c) of the EU GDPR.
If we work with commissioned data processors, we ensure by means of separate contracts (known as commissioned data processing agreements) that your data is protected by the processor in the same way as it is protected by us.
VIII. Transfer to other countries
As a matter of principle, data is not transferred to bodies in countries outside the EU. Transfers may take place under the following conditions, among others:
- to certified recipients, in particular on the basis of Binding Corporate Rules (BCRS) or EU standard data protection clauses (SCCs) (Art. 45 and 47 of the EU GDPR);
- based on UK Standard Contractual Clauses
- based on the consent you have previously provided for this purpose (Art. 49 para. 1, item 1, lit. a) of the EU GDPR);
- insofar as the transfer serves to initiate or fulfil a contract (Art. 49, para. 1, item 1, lit. b) and Art. 49, para. 1, item 1, lit. c) of the EU GDPR);
- if this is necessary to assert, exercise or defend legal claims (Art. 49, para. 1, item 1, lit. e) of the EU GDPR).
IX. Protection
Communication with GOLDBECK by email is always encrypted, provided your server supports encryption.
X. Online presence in social media
GOLDBECK maintains an online presence within social networks and platforms to communicate with business partners, interested parties and users who are active in these channels and to keep them informed about our services. When launching each of these networks and platforms, the terms and conditions and data processing guidelines of their respective operators apply. Unless otherwise stated in our privacy policy, we process the data of users if they communicate with us within these social networks and platforms, e.g. write posts and send messages via our online channels.
XI. Social Media Plugins
We use plug-ins for the social networks Facebook, Instagram, Twitter, Xing, LinkedIn, YouTube and Kununu on our website on the basis of Art. 6, para. 1, item 1, lit. f) of the EU GDPR. The purpose of this is to raise the profile of our company and to enable us to analyse, optimise and improve the commercial efficiency of our website. The legal purpose behind this is to be regarded as a legitimate interest as defined in the EU GDPR.
The respective providers of these plug-ins are responsible for ensuring that they operate on data-protection-compliant basis. We integrate these plug-ins using the two-click method to ensure we can protect visitors to our website to the best possible extent.
a) Facebook social plug-ins
Our website uses social media plug-ins from the social network facebook.com, which is operated by Facebook Ireland Ltd, 4 Grand Central Square, Grand Canal Harbour, Dublin 2, Ireland (‘Facebook’). The plug-ins can display interaction elements or content (e.g. videos, graphics or text contributions) and are recognisable by one of the Facebook logos (white ‘f’ on a blue tile, the term ‘Like’, or a ‘thumbs up’ sign) or else are marked with the addition of ‘Facebook social plug-in’. The list and appearance of Facebook social plug-ins can be viewed here:
https://developers.facebook.com/docs/plugins/.
Facebook uses standard contractual clauses approved by the European Commission and, where applicable, relies on adequacy decisions issued by the European Commission regarding specific countries for data transfers from the EEC to the US and other countries.
When you launch a function on this website that contains a plug-in like this, your device establishes a direct connection with the Facebook servers. The content of the plug-in is transmitted by Facebook directly to your device and integrated by it into the website. User profiles can be created from the processed data in the process. We therefore have no influence on the scope of the data that Facebook collects with the help of this plug-in and any information we provide to you in this regard is according to the best of our knowledge.
By integrating the plug-ins, Facebook receives the information that you have accessed the corresponding page of the website. If you are logged in to Facebook, Facebook can assign the visit to your Facebook account. If you interact with the plug-ins – for example, by clicking the Like button or posting a comment – the corresponding information is transmitted from your device directly to Facebook and stored there. If you are not a member of Facebook, there is still a possibility that Facebook will learn and store your IP address. According to Facebook, only an anonymised IP address is stored in Germany.
The purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as your rights in this regard and setting options for protecting your privacy, can be found in Facebook’s privacy policy:
https://www.facebook.com/about/privacy/.
If you are a Facebook member and do not want Facebook to collect data about you via this website and link it to your membership data stored with Facebook, you must log out of Facebook and delete its cookies before using our website. Further settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings:
https://www.facebook.com/settings?tab=ads or via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/.
The settings are platform-independent, i.e. they are applied to all devices such as desktop computers and mobile devices.
b) Instagram
Our website may use functions and content of the Instagram service, offered by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. This may include content such as images, videos, texts and buttons, which you can use to show your appreciation and subscribe to the authors of the content or our posts. You can also use the button to access the GOLDBECK Instagram account.
If you are a member of the Instagram platform and you launch any of the above-mentioned content or functions, Instagram can link this activity to your profile there. Instagram privacy policy:
https://help.instagram.com/519522125107875
c) Twitter
Our website may use functions and content of the Twitter service, offered by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. This may include content such as images, videos, texts and buttons, which you can use to show your appreciation and subscribe to the authors of the content or our posts. You can also use the button to access the GOLDBECK Twitter account.
If you are a member of the Twitter platform and you launch any of the above-mentioned content or functions, Twitter can link this activity to your profile there.
Twitter uses standard contractual clauses approved by the European Commission and, where applicable, relies on adequacy decisions issued by the European Commission regarding certain countries for data transfers from the EEC to the US and other countries.
Privacy policy: https://twitter.com/en/privacy,
Opt-out: https://twitter.com/personalization.
d) XING
Our website also uses plug-ins from XING, offered by New Work SE Dammtorstraße 30, 20354 Hamburg. This may include content such as images, videos, texts and buttons, which you can use to show your appreciation by sharing and commenting on the content via XING. You can also use the button to access the GOLDBECK XING account.
If you are a member of XING and you launch any of the above-mentioned content or functions, XING can link this activity to your profile there. You can find XING’s privacy policy at
e) YouTube
Our website also uses plug-ins from YouTube, offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This may include content such as images, videos, texts and buttons, which you can use to show your appreciation by sharing and commenting on the content via YouTube. You can also use the button to access the GOLDBECK YouTube account.
If you are a member of YouTube and you launch any of the above-mentioned content or functions, YouTube can link this activity to your profile there. You can find YouTube’s privacy policy at:
f) Kununu
Our website also uses plug-ins from Kununu, offered by kununu GmbH, Neutrogasse 4-8, Top 3.02, 1010 Vienna, Austria. New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany, is responsible for data protection. This may include content such as images, videos, texts and buttons, which you can use to show your appreciation by sharing and commenting on the content via Kununu. You can also use the button to access the GOLDBECK Kununu page.
If you are a member of Kununu and you launch any of the above-mentioned content or functions, Kununu can link this activity to your profile there. You can find Kununu’s privacy policy at:
g) LinkedIn
Our website also uses plug-ins from LinkedIn on a regular basis, offered by LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland. This may include content such as images, videos, texts and buttons, which you can use to show your appreciation by sharing and commenting on the content via LinkedIn. You can also use the button to access the GOLDBECK LinkedIn page.
If you are a member of LinkedIn and you launch any of the above-mentioned content or functions, LinkedIn can link this activity to your profile there. You can find LinkedIn’s privacy policy at:
https://www.linkedin.com/psettings/
e) LinkedIn Insight Tag
This website uses the Insight tag from LinkedIn. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Data processing by LinkedIn Insight Tag
With the help of the LinkedIn Insight Tag, we receive information about visitors to our website. If a website visitor is registered with LinkedIn, we can, among other things, analyse the key professional data (e.g. career level, company size, country, location, industry and job title) of our website visitors and thus better tailor our site to the respective target groups. Furthermore, we can use LinkedIn Insight Tags to measure whether visitors to our websites make a purchase or take any other action (conversion measurement). Conversion measurement can also be done across devices (e.g. from PC to tablet). LinkedIn Insight Tag also offers a retargeting function that allows us to display targeted advertising to visitors to our website outside of the website, whereby, according to LinkedIn, no identification of the advertising addressee takes place.
LinkedIn itself also collects so-called log files (URL, referrer URL, IP address, device and browser properties and time of access). The IP addresses are shortened or (if they are used to reach LinkedIn members across devices) hashed (pseudonymised). The direct identifiers of LinkedIn members are deleted by LinkedIn after seven days. The remaining pseudonymised data is then deleted within 180 days.
The data collected by LinkedIn cannot be assigned to specific individuals by us as the website operator. LinkedIn will store the collected personal data of website visitors on its servers in the USA and use it in the context of its own advertising measures. For details, please refer to LinkedIn's privacy policy at www.linkedin.com.
Legal basis
Insofar as consent has been obtained, the above-mentioned service is used exclusively on the basis of Art. 6 Para. 1 lit. a DSGVO and § 25 TTDSG. The consent can be revoked at any time. If no consent has been obtained, the use of this service is based on Art. 6 para. 1 lit. f DSGVO; the website operator has a legitimate interest in effective advertising measures including social media.
Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: www.linkedin.com and www.linkedin.com.
Objection to the use of LinkedIn Insight Tag
You can object to the analysis of usage behaviour and targeted advertising by LinkedIn at the following link: www.linkedin.com.
Furthermore, LinkedIn members can control the use of their personal data for advertising purposes in their account settings. To avoid a link between data collected on our website by LinkedIn and your LinkedIn account, you must log out of your LinkedIn account before visiting our website.
Order processing
We have concluded an order processing agreement (AVV) with the above-mentioned provider. This is a contract required by data protection law, which ensures that the provider only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.
XII. Google Analytics
Our website uses Google Analytics, a web analytics service provided by Google, Inc. (‘Google’). Google Analytics allows us to record statistics based on the use of our website and optimise the user experience.
You can agree to the use of Google Analytics at the beginning of your session via the pop-up window for querying the data protection settings (‘cookie opt-in’) or reject it accordingly. Please be aware that, if you choose to reject it, you may not be able to benefit from the full functionality of our website, such as the display of Google Maps functions, the interactive location map or the route guidance to the respective Goldbeck location.
Google Analytics uses ‘cookies’, which are text files placed on your computer by your web browser to help the website analyse how users interact with the site. The information generated by the cookies about your use of this website (including the anonymised IP address), such as the user’s language settings, time spent on the website and individual pages visited, is transmitted to a Google server in the USA and stored there. The analysis of your surfing behaviour is usually anonymous, which means that your surfing behaviour cannot be traced back to you. Google will use this data for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to our website and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf (‘Google affiliates’).
By using our website, you consent to Google processing data about you in the manner and for the purposes set out above.
Please be aware that Google Analytics has been extended by the code ‘gat._anonymizeIp();’ on this website to ensure anonymised collection of IP addresses.
For more information on the use of data by Google Inc., see:
https://support.google.com/analytics/answer/6004245?hl=en
XIII. Hotjar
Hotjar is a web analytics service. It is used to collects data on users’ behavior. Hotjar can also process provided information from you within surveys and feedback functions incorporated into our website.
Processing Company: Hotjar Limited, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta
Data Protection Officer of Processing Company: dpo@hotjar.com
Data Purposes of the data collection and processing: Analytics and Feedback. All technologies this service uses to collect data: Cookies.
This list represents all (personal) data that is collected by or through the use of this service:
- Date and time of visit
- Device type
- Geographic location
- IP address
- Mouse movements
- Pages visited
- Referrer URL
- Screen resolution
- Unique device identifier
- Language information
- Device operating system
- Browser type
- Clicks
- Domain name
- Unique user ID
- Answers given to surveys
Legal Basis
In the following the required legal basis for the processing of data is listed:
- Art. 6 para. 1 s. 1 lit. a GDPR
Location of Processing
This is the primary location where the collected data is being processed. If the data is also processed in other countries, you are informed separately.
- European Union
Retention Period
The retention period is the time span the collected data is saved for the processing purposes. The data needs to be deleted as soon as it is no longer needed for the stated processing purposes.
- Data about your visit and your activities on the website are generally stored for 365 days and then automatically deleted. This does not apply to information gathered within surveys and incoming feedback. However, data will be deleted in any case as soon as they are no longer needed for the processing purposes.
Transfer to Third Countries
This service may forward the collected data to a different country. Please note that this service might transfer the data to a country without the required data protection standards. If the data is transferred to the USA, there is a risk that your data can be processed by US authorities, for control and surveillance measures, possibly without legal remedies. Below you can find a list of countries to which the data is being transferred. For more information regarding safeguards please refer to the website provider’s privacy policy or contact the website provider directly.
- United States of America
Data Recipients
In the following the recipients of the data collected are listed.
- Hotjar Ltd., Amazon Web Services EMEA SARL, Datadog Inc., Functional Software Inc.
Click here to read the privacy policy of the data processor
https://www.hotjar.com/legal/policies/privacy
Click here to read the cookie policy of the data processor
https://help.hotjar.com/hc/en-us/articles/115011789248-Hotjar-Cookies
Click here to opt out from this processor across all domains
https://www.hotjar.com/legal/compliance/opt-out
Storage Information
Below you can see the longest potential duration for storage on a device, as set when using the cookie method of storage and if there are any other methods used.
- Maximum age of cookie storage: 1 year
XIV. ePrivacy Regulation
When accessing our website for the first time, visitors have the option of either rejecting or consenting to the use of cookies. This is an active and autonomous decision. The setting can be adjusted at any time if the user wishes to change their decision in the future. This can be actioned by selecting ‘Data Protection’ in the black header on our website and editing the data protection settings again in the menu shown.
XV. Amendment of this Privacy Policy
This Privacy Policy was last updated on 28 September 2022 and is currently valid. It may become necessary to amend the Privacy Policy in the course of further developments to our website and the information it includes or to reflect changes in legal or official requirements.
The current Privacy Policy can be accessed and printed from our website at:
XVI. Contact/Responsible body
This data protection information applies to data processing by GOLDBECK. The responsible body is:
GOLDBECK GmbH, Ummelner Straße 4-6, 33649 Bielefeld, Germany
You can contact our Group Data Protection Officer at:
GOLDBECK GmbH
Group Data Protection Officer
Ummelner Straße 4-6
33649 Bielefeld
Germany
or at datenschutzbeauftragter@goldbeck.de