Privacy policy

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. For detailed information on data protection, please refer to our privacy policy set out below this text.

Data collection on this website

Data on this website is processed by the website operator. You can find the operator’s contact details in the section »Information about the controller« in this privacy policy.

On the one hand, your data is collected when you provide it to us. This may, for example, be data that you enter into a contact form. Other data is collected automatically, or after you have given your consent, by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system or time of the page visit).

What do we use your data for?

Some of the data is collected to ensure that the website is provided without errors and securely. We use other data to process your enquiries, registrations and orders. With your consent, we also analyse how our website is used and what effect our adverts have.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

Analytics tools and advertising

With your consent, we use Google Analytics. You can change or withdraw your choice at any time via »Cookie settings« in the footer. Without consent, we use SalesViewer to identify which companies visit our website. You can find details in section 5.

Cloudflare

Our website is delivered via the network and servers of Cloudflare (Cloudflare Workers). The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (hereinafter »Cloudflare«).

When you access our website, Cloudflare processes the data that your browser transmits, in particular IP address, date and time, address accessed, referrer, browser and operating system. This serves to deliver the website, protect it against attacks and detect errors. Cloudflare stores technical logs of our server functions, such as the forms, for a few days only. To protect against attacks and automated access, Cloudflare may set technically necessary cookies (e.g. »__cf_bm« or »cf_clearance«). Your browser may also inform Cloudflare about connection errors (Network Error Logging).

Processing is based on Art. 6(1)(f) of the General Data Protection Regulation (GDPR). We have a legitimate interest in presenting our website as reliably, quickly and securely as possible. Insofar as information is stored on or read from your device in the process, this is strictly necessary for operating the website (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG)).

Cloudflare is certified under the EU-US Data Privacy Framework (DPF); in addition, we base the transfer of data to the USA on the European Commission’s standard contractual clauses. We have concluded a data processing agreement (Auftragsverarbeitungsvertrag, AVV) with Cloudflare.

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Information about the controller

The controller responsible for data processing on this website is:

hej.build GmbH
Mathildenstraße 15a
45130 Essen
Phone: +49 201 85892610
Email: datenschutz@hej.build

Storage period

Unless a more specific storage period has been stated in this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing your personal data.

General information on the legal bases

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR. If information is stored on or read from your device (e.g. cookies), this is done with your consent additionally on the basis of Section 25(1) TDDDG, and without consent only insofar as it is strictly necessary (Section 25(2) TDDDG). In the case of processing to perform a contract or to carry out pre-contractual measures, on the basis of Art. 6(1)(b) GDPR. In the case of processing to fulfil a legal obligation, on the basis of Art. 6(1)(c) GDPR. If processing is carried out to protect our legitimate interests, Art. 6(1)(f) GDPR is the legal basis.

Recipients of personal data

In the course of our business activities, we work with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only pass on personal data to external parties if this is necessary for the performance of a contract, if we are legally obliged to do so, if we have a legitimate interest or if another legal basis permits the disclosure of the data. We have bound service providers that process data on our behalf by means of a data processing agreement.

Data transfer to the USA

Some of the providers named in this privacy policy are based in the USA or transfer data there. For companies certified under the EU-US Data Privacy Framework (DPF), the European Commission has determined an adequate level of data protection (Art. 45 GDPR). We base these transfers on this and additionally on the European Commission’s standard contractual clauses (Art. 46 GDPR).

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time; for cookies and similar technologies via »Cookie settings« in the footer. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to object to data collection (Art. 21 GDPR)

If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation. If your personal data is processed for direct marketing purposes, you have the right to object to the processing at any time.

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a commonly used, machine-readable format.

Access, rectification and erasure

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to rectification or erasure of this data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. This applies if: you contest the accuracy of the data, the processing is unlawful, we no longer need the data (but you need it to assert legal claims) or you have objected to the processing.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of your browser changes from »http://« to »https://« and by the padlock symbol in your browser bar.

Objection to advertising emails

We hereby object to the use of contact details published as part of the obligation to provide an imprint (Impressumspflicht) for sending advertising and information materials that have not been expressly requested. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising information being sent.

Cookies

Our web pages use so-called »cookies«. Cookies are small data packets and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are deleted automatically at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically.

Cookies can come from us (first-party cookies) or from third-party companies (third-party cookies). We set technically necessary cookies on the basis of Art. 6(1)(f) GDPR and Section 25(2) no. 2 TDDDG. We only set all other cookies with your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); section 5 lists which ones these are.

You can set your browser so that you are informed about cookies being set and only allow cookies in individual cases. If cookies are deactivated, the functionality of this website may be limited.

Consent with Cloudflare Zaraz

We obtain your consent via a banner and manage it with Cloudflare Zaraz, Cloudflare’s tag manager (for the provider, see section 2). Zaraz stores your choice in a cookie on your device and only loads the services from section 5 once you have agreed to the respective purpose (»Statistics« or »Marketing«). You can change or withdraw your choice at any time via »Cookie settings« in the footer.

The legal basis is Art. 6(1)(c) GDPR, because we are required to demonstrate consent, and Section 25(2) no. 2 TDDDG.

Server log files

Our hosting provider Cloudflare automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are: browser type and browser version, operating system used, referrer URL, address accessed, time of the server request and IP address.

This data is not combined with other data sources. The basis is Art. 6(1)(f) GDPR (legitimate interest in the technically error-free presentation and optimisation of the website).

Contact form

If you write to us via the contact form, we process the details you provide (topic, message, name, company, email address, optionally your phone number and how you heard about us) as well as the page from which you sent the form. We use the data to answer your enquiry and any follow-up questions, and for this purpose we store the enquiry in our enquiry system in Notion (see »Notion«).

Processing is based on Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on our legitimate interest in answering the enquiries addressed to us (Art. 6(1)(f) GDPR).

The data you enter in the contact form remains with us until you ask us to erase it or the purpose for storing the data no longer applies (e.g. after your enquiry has been fully processed). Mandatory statutory provisions, in particular retention periods, remain unaffected.

Enquiries by email or phone

If you contact us by email or phone, your enquiry, including all resulting personal data, will be stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent. The same legal bases apply as for the contact form.

Registration for events and orders of the trade fair guide

If you register for one of our events or order the trade fair guide, we process the details from the form: company, names and email addresses of the participants or of the person placing the order, job title, phone number, billing address and, where applicable, delivery address, VAT ID number, order number and comments. We use them to perform the contract: confirmation, invoice, running the event or delivery. We store the details in our enquiry system in Notion (see »Notion«). Payment is made by invoice; we do not use a payment service provider.

The legal basis is Art. 6(1)(b) GDPR. We retain invoices and accounting records in accordance with the statutory periods, usually ten years (Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (Abgabenordnung, AO) and Section 257 of the German Commercial Code (Handelsgesetzbuch, HGB)).

Notion

We store enquiries, registrations and orders from our forms in a database at Notion. The provider is Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, USA. Notion processes the data exclusively on our behalf; we have concluded a data processing agreement (AVV). Notion is certified under the EU-US Data Privacy Framework (DPF); the European Commission’s standard contractual clauses apply in addition.

Spam protection with Cloudflare Turnstile

We protect our forms against spam and automated access with Cloudflare Turnstile (for the provider, see section 2). Turnstile uses technical characteristics, such as IP address and browser information, to check whether a human is using the form; a technically necessary cookie may be set in the process. On the newsletter form, Turnstile only loads once you start filling in the form.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting our forms against misuse. Insofar as information is stored on or read from your device, this is strictly necessary for sending the form, as you have requested (Section 25(2) no. 2 TDDDG).

Appointment booking

For consultation appointments, we link to the appointment booking of Notion Calendar (Notion Labs, Inc., for the address see »Notion«), and in individual posts to Calendly (Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA). Only when you follow the link and book an appointment does the respective provider process your details (such as name, email address and requested appointment) on our behalf. The legal basis is Art. 6(1)(b) GDPR. Both providers are certified under the EU-US Data Privacy Framework (DPF).

Integration via Cloudflare Zaraz

We integrate the following services via Cloudflare Zaraz (for the provider, see section 2). Where possible, Zaraz loads them via Cloudflare’s servers instead of directly from your browser; as a result, the providers receive less data directly from your device. With the exception of SalesViewer, the services only run if you have given your consent in the banner (Art. 6(1)(a) GDPR and Section 25(1) TDDDG): Google Analytics for the purpose »Statistics«. You can withdraw your consent at any time via »Cookie settings« in the footer.

With Google Analytics, we also measure whether visitors send an enquiry, register for an event or the newsletter, order the trade fair guide or book a consultation appointment (conversions). We do not pass on the content of your form entries in the process.

Google Analytics

This website uses Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics shows us how our website is used, e.g. which pages are accessed, for how long, via which websites or search engines visitors come to us and with which devices. For this purpose, a cookie is set that recognises your browser. According to Google, Google Analytics 4 does not store IP addresses.

It is only used with your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework (DPF). We have concluded a data processing agreement (AVV) with Google.

SalesViewer

On this website, we use the technology of SalesViewer GmbH, Hueststr. 30, 44787 Bochum, to identify which companies are interested in our services. For this purpose, the IP address is matched against a database of company IP addresses when the page is accessed. Only information about identified companies is stored; IP addresses that cannot be assigned to a company are deleted immediately, and visits by private individuals are not recorded. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in identifying companies that are interested in our services. You can object to this recording at any time: https://www.salesviewer.com/de/opt-out/. We have concluded a data processing agreement (AVV) with SalesViewer.

Subscription with double opt-in

For the newsletter, we need your email address, your name and your company. After subscribing, you will receive an email in which you confirm your subscription (double opt-in); only then will you receive the newsletter. The time and IP address of the confirmation are stored so that we can demonstrate your consent.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every newsletter. After you unsubscribe, your email address may be stored on a block list so that you do not receive any further newsletters (Art. 6(1)(f) GDPR); you can object to this storage if your interests outweigh our legitimate interest.

Mailchimp

We use Mailchimp for subscriptions and sending. The provider is The Rocket Science Group LLC, 405 N Angier Ave NE, Atlanta, GA 30308, USA. We transfer your details from the subscription form directly to Mailchimp, where they are stored on our behalf. Mailchimp recognises whether a newsletter has been opened and which links have been clicked, and in doing so records technical information (e.g. time of retrieval, IP address, browser type and operating system).

Mailchimp is certified under the EU-US Data Privacy Framework (DPF); the European Commission’s standard contractual clauses apply in addition. We have concluded a data processing agreement (AVV) with Mailchimp.

Newsletters to existing customers

If you order goods or services, your email address may be used to send newsletters with direct advertising for similar goods or services of our own, provided you have been informed of this in advance. You can unsubscribe at any time via the link in the newsletter. Legal basis: Art. 6(1)(f) GDPR, Section 7(3) of the Gesetz gegen den unlauteren Wettbewerb (UWG, the German Act against Unfair Competition).

Links to social networks

Our website does not integrate any social media plugins. The link to LinkedIn and the share buttons (LinkedIn, WhatsApp, email) are simple links: data only flows to the respective service when you click on a link. The privacy policy of the respective provider then applies.

Videos and YouTube

We usually deliver videos via our own hosting provider. If we embed a video from YouTube, we use the privacy-enhanced mode (youtube-nocookie.com). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you access a page with such a video, a connection to YouTube’s servers is established; in the process, YouTube learns which page you have visited and receives your IP address. Only when the video is played can further data be processed and information stored on your device. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in an appealing presentation of our projects. Google is certified under the EU-US Data Privacy Framework (DPF).

Data processing

We use online conferencing tools, among other things, to communicate with our customers. These record various data such as email address, phone number, duration of the conference, start and end of participation and technical data (IP addresses, device IDs, operating system, client version, camera/microphone/speaker type, connection type). When content such as cloud recordings, chat/voicemail messages, photos, videos and files is used, it is stored on the tool providers’ servers.

Purpose and legal bases

The conferencing tools are used for communication with contractual partners (Art. 6(1)(b) GDPR), to simplify communication in general (Art. 6(1)(f) GDPR) or on the basis of consent (Art. 6(1)(a) GDPR, which can be withdrawn at any time).

Conferencing tools used

Zoom: Zoom Communications Inc., 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA. DPF certified, data processing agreement (AVV) concluded.

Microsoft Teams: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. DPF certified, data processing agreement (AVV) concluded.

Google Meet: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. DPF certified, data processing agreement (AVV) concluded.

Handling of applicant data

We process personal data of applicants in order to carry out the application process. We accept applications via a form on a page at Notion (hejbuild.notion.site) or by email; Notion stores the data on our behalf (see section 4, »Notion«). Legal basis: Section 26 of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) (initiation of an employment relationship), Art. 6(1)(b) GDPR or, in the case of consent, Art. 6(1)(a) GDPR (can be withdrawn). Internally, the data is only passed on to persons involved in the application process.

Retention period

If an application is rejected or withdrawn, the data will be erased after 6 months (legal basis: Art. 6(1)(f) GDPR, legitimate interest). Data is stored for longer in the event of legal disputes, with consent or where there are statutory retention obligations. If the application is successful, the data will be stored for the purpose of carrying out the employment relationship (Section 26 BDSG, Art. 6(1)(b) GDPR).

Applicant pool

Inclusion in the applicant pool only takes place with express consent (Art. 6(1)(a) GDPR). Participation is voluntary and independent of the current application process. The data subject can withdraw their consent at any time. The data will be irrevocably erased no later than 2 years after consent was given.