Privacy policy

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. For detailed information on data protection, please refer to our privacy policy set out below this text.

Data collection on this website

Data on this website is processed by the website operator. You can find the operator’s contact details in the section »Information about the controller« in this privacy policy.

On the one hand, your data is collected when you provide it to us. This may, for example, be data that you enter into a contact form. Other data is collected automatically, or after you have given your consent, by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system or time of the page visit).

What do we use your data for?

Some of the data is collected to ensure that the website is provided without errors and securely. We use other data to process your enquiries, registrations and orders. With your consent, we also analyse how our website is used and what effect our adverts have.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

Analytics tools and advertising

With your consent, we use Google Analytics. You can change or withdraw your choice at any time via »Cookie settings« in the footer. Without consent, we use SalesViewer to identify which companies visit our website. We also count visits and page views with Cloudflare Web Analytics, without setting cookies. You can find details in section 5.

Cloudflare

Our website is delivered via the network and servers of Cloudflare (Cloudflare Workers). The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (hereinafter »Cloudflare«).

When you access our website, Cloudflare processes the data that your browser transmits, in particular IP address, date and time, address accessed, referrer, browser and operating system. This serves to deliver the website, protect it against attacks and detect errors. Cloudflare stores technical logs of our server functions, such as the forms, for a few days only. To protect against attacks and automated access, Cloudflare may set technically necessary cookies (e.g. »__cf_bm« or »cf_clearance«). Your browser may also inform Cloudflare about connection errors (Network Error Logging).

Processing is based on Art. 6(1)(f) of the General Data Protection Regulation (GDPR). We have a legitimate interest in presenting our website as reliably, quickly and securely as possible. Insofar as information is stored on or read from your device in the process, this is strictly necessary for operating the website (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG)).

Cloudflare is certified under the EU-US Data Privacy Framework (DPF); in addition, we base the transfer of data to the USA on the European Commission’s standard contractual clauses. We have concluded a data processing agreement (Auftragsverarbeitungsvertrag, AVV) with Cloudflare.

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Please note that data transmission over the internet (e.g. when communicating by email) may have security gaps. Complete protection of data against access by third parties is not possible.

Information about the controller

The controller responsible for data processing on this website is:

hej.build GmbH
Mathildenstraße 15a
45130 Essen
Phone: +49 201 85892610
Email: datenschutz@hej.build

Storage period

Unless a more specific storage period has been stated in this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing your personal data.

General information on the legal bases

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR. If information is stored on or read from your device (e.g. cookies), this is done with your consent additionally on the basis of Section 25(1) TDDDG, and without consent only insofar as it is strictly necessary (Section 25(2) TDDDG). In the case of processing to perform a contract or to carry out pre-contractual measures, on the basis of Art. 6(1)(b) GDPR. In the case of processing to fulfil a legal obligation, on the basis of Art. 6(1)(c) GDPR. If processing is carried out to protect our legitimate interests, Art. 6(1)(f) GDPR is the legal basis.

Recipients of personal data

In the course of our business activities, we work with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only pass on personal data to external parties if this is necessary for the performance of a contract, if we are legally obliged to do so, if we have a legitimate interest or if another legal basis permits the disclosure of the data. We have bound service providers that process data on our behalf by means of a data processing agreement.

Data transfer to the USA

Some of the providers named in this privacy policy are based in the USA or transfer data there. For companies certified under the EU-US Data Privacy Framework (DPF), the European Commission has determined an adequate level of data protection (Art. 45 GDPR). We base these transfers on this and additionally on the European Commission’s standard contractual clauses (Art. 46 GDPR).

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time; for cookies and similar technologies via »Cookie settings« in the footer. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to object to data collection (Art. 21 GDPR)

If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation. If your personal data is processed for direct marketing purposes, you have the right to object to the processing at any time.

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a commonly used, machine-readable format.

Access, rectification and erasure

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to rectification or erasure of this data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. This applies if: you contest the accuracy of the data, the processing is unlawful, we no longer need the data (but you need it to assert legal claims) or you have objected to the processing.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of your browser changes from »http://« to »https://« and by the padlock symbol in your browser bar.

Objection to advertising emails

We hereby object to the use of contact details published as part of the obligation to provide an imprint (Impressumspflicht) for sending advertising and information materials that have not been expressly requested. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising information being sent.

Cookies

Our web pages use so-called »cookies«. Cookies are small data packets and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are deleted automatically at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically.

Cookies can come from us (first-party cookies) or from third-party companies (third-party cookies). We set technically necessary cookies on the basis of Art. 6(1)(f) GDPR and Section 25(2) no. 2 TDDDG. We only set all other cookies with your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG); section 5 lists which ones these are.

You can set your browser so that you are informed about cookies being set and only allow cookies in individual cases. If cookies are deactivated, the functionality of this website may be limited.

Consent with Cloudflare Zaraz

We obtain your consent via a banner and manage it with Cloudflare Zaraz, Cloudflare’s tag manager (for the provider, see section 2). Zaraz stores your choice in a cookie on your device and only loads the services from section 5 once you have agreed to the respective purpose (»Statistics« or »Marketing«). You can change or withdraw your choice at any time via »Cookie settings« in the footer.

The legal basis is Art. 6(1)(c) GDPR, because we are required to demonstrate consent, and Section 25(2) no. 2 TDDDG.

Server log files

Our hosting provider Cloudflare automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are: browser type and browser version, operating system used, referrer URL, address accessed, time of the server request and IP address.

This data is not combined with other data sources. The basis is Art. 6(1)(f) GDPR (legitimate interest in the technically error-free presentation and optimisation of the website).

Contact form

If you write to us via the contact form, we process the details you provide (topic, message, name, company, email address, optionally your phone number and how you heard about us) as well as the page from which you sent the form. We use the data to answer your enquiry and any follow-up questions, and for this purpose we store the enquiry in our enquiry system in Notion (see »Notion«).

Processing is based on Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on our legitimate interest in answering the enquiries addressed to us (Art. 6(1)(f) GDPR).

The data you enter in the contact form remains with us until you ask us to erase it or the purpose for storing the data no longer applies (e.g. after your enquiry has been fully processed). Mandatory statutory provisions, in particular retention periods, remain unaffected.

Enquiries by email or phone

If you contact us by email or phone, your enquiry, including all resulting personal data, will be stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent. The same legal bases apply as for the contact form.

Registration for events and orders of the trade fair guide

If you register for one of our events or order the trade fair guide, we process the details from the form: company, names and email addresses of the participants or of the person placing the order, job title, phone number, billing address and, where applicable, delivery address, VAT ID number, order number and comments. We use them to perform the contract: confirmation, invoice, running the event or delivery. We store the details in our enquiry system in Notion (see »Notion«) and create the invoice with MOCO (see »MOCO«). Payment is made by invoice; we do not use a payment service provider.

For each order, we create the digital edition of the trade fair guide as a separate PDF file; the company name and the number of your order with us appear on every page and in the file properties. We store the file in a non-public area of Cloudflare R2, Cloudflare’s storage service (for the provider, see section 2). It can only be accessed via the personal download link that we send you by email (see »Notifications, confirmation of receipt and delivery«). We delete the file automatically twelve months after it was created; if you need it again after that, we will create it again on request.

The legal basis is Art. 6(1)(b) GDPR. We are generally required to retain invoices and accounting records for eight years from the end of the year in which they were issued or created; statutory extensions remain unaffected (Art. 6(1)(c) GDPR).

Notion

We store enquiries, registrations and orders from our forms in a database at Notion. The provider is Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, USA. Notion processes the data exclusively on our behalf; we have concluded a data processing agreement (AVV). Notion is certified under the EU-US Data Privacy Framework (DPF); the European Commission’s standard contractual clauses apply in addition.

MOCO

We create invoices for registrations and orders with MOCO, our software for project management and invoicing. The provider is everii Switzerland GmbH, In der Weid 15, 8122 Binz, Switzerland. For this purpose, we transfer the following details from the form to MOCO: company, name, email address, billing address, VAT ID number, your order number and the services booked or ordered. If a company based in Germany orders the trade fair guide, MOCO automatically sends the invoice by email to the address provided.

MOCO processes the data on our behalf; we use MOCO’s data processing agreement for this (data processing agreement and sub-processors). According to MOCO, the data is stored in data centres in Switzerland and the EU. The European Commission has found that Switzerland provides an adequate level of data protection (Art. 45 GDPR). For sending emails, MOCO uses the SendGrid service of Twilio, based in the USA, as a sub-processor; under the data processing agreement, MOCO ensures that such transfers are lawful.

The legal basis is Art. 6(1)(b) GDPR and, for retaining invoices, Art. 6(1)(c) GDPR (see »Registration for events and orders of the trade fair guide«).

Notifications, confirmation of receipt and delivery

So that we can deal with your enquiry, registration or order quickly, our automation service n8n forwards the details from the form to our internal communication tool Slack. We run n8n ourselves on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, located in Germany. For customers in the European Economic Area, Slack is provided by Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland. Slack processes the data on our behalf; transfers to the USA are covered by the European Commission’s standard contractual clauses.

After an enquiry or an order for the trade fair guide, we send you an automatic confirmation of receipt to the email address you provided. We use Resend for this, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes your first name, your email address and, for orders, the edition, quantity and total on our behalf. Once we have accepted an order for the trade fair guide, we also use Resend to send you the email with the personal download link to the digital edition; for this, Resend processes your first name, your email address, the company and the link. The data processing agreement includes the European Commission’s standard contractual clauses; Resend is also certified under the EU-US Data Privacy Framework (DPF).

The legal basis is the same as for the respective form (Art. 6(1)(b) or (f) GDPR); our legitimate interest lies in handling requests quickly and confirming that we have received yours. Delivering the digital edition serves to perform the contract (Art. 6(1)(b) GDPR).

Spam protection with Cloudflare Turnstile

We protect our forms against spam and automated access with Cloudflare Turnstile (for the provider, see section 2). Turnstile uses technical characteristics, such as IP address and browser information, to check whether a human is using the form; a technically necessary cookie may be set in the process. On the newsletter form, Turnstile only loads once you start filling in the form.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting our forms against misuse. Insofar as information is stored on or read from your device, this is strictly necessary for sending the form, as you have requested (Section 25(2) no. 2 TDDDG).

Appointment booking

For consultation appointments, we link to the appointment booking of Notion Calendar (Notion Labs, Inc., for the address see »Notion«), and in individual posts to Calendly (Calendly LLC, 271 17th St NW, 10th Floor, Atlanta, Georgia 30363, USA). Only when you follow the link and book an appointment does the respective provider process your details (such as name, email address and requested appointment) on our behalf. The legal basis is Art. 6(1)(b) GDPR. Both providers are certified under the EU-US Data Privacy Framework (DPF).

Integration via Cloudflare Zaraz

We integrate the following services via Cloudflare Zaraz (for the provider, see section 2). Where possible, Zaraz loads them via Cloudflare’s servers instead of directly from your browser; as a result, the providers receive less data directly from your device. With the exception of SalesViewer, the services only run if you have given your consent in the banner (Art. 6(1)(a) GDPR and Section 25(1) TDDDG): Google Analytics for the purpose »Statistics«. You can withdraw your consent at any time via »Cookie settings« in the footer.

With Google Analytics, we also measure whether visitors send an enquiry, register for an event or the newsletter, order the trade fair guide or book a consultation appointment (conversions). We do not pass on the content of your form entries in the process.

Google Analytics

This website uses Google Analytics 4. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics shows us how our website is used, e.g. which pages are accessed, for how long, via which websites or search engines visitors come to us and with which devices. For this purpose, a cookie is set that recognises your browser. According to Google, Google Analytics 4 does not store IP addresses.

It is only used with your consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework (DPF). We have concluded a data processing agreement (AVV) with Google.

User and event data: 14 months, measured from the last activity for user data. Google deletes expired data monthly; aggregated standard reports are excluded.

SalesViewer

On this website, we use the technology of SalesViewer GmbH, Hueststr. 30, 44787 Bochum, to identify which companies are interested in our services. For this purpose, the IP address is matched against a database of company IP addresses when the page is accessed. Only information about identified companies is stored; IP addresses that cannot be assigned to a company are deleted immediately, and visits by private individuals are not recorded. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in identifying companies that are interested in our services. You can object to this recording at any time: https://www.salesviewer.com/de/opt-out/. We have concluded a data processing agreement (AVV) with SalesViewer.

Cloudflare Web Analytics

We measure how many visits and page views our website receives with Cloudflare Web Analytics (for the provider, see section 2). For this purpose, your browser loads a small script from Cloudflare which, when a page is accessed, transmits the address without parameters, the referrer, browser, operating system, device type and loading times to Cloudflare; Cloudflare derives the country from the connection. According to Cloudflare, Web Analytics does not set cookies, does not use storage in your browser, does not create fingerprints of your device and does not track you across other websites. We only see aggregated figures, not individual visitors.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in knowing the reach and loading times of our website, even if you do not consent to Google Analytics. You can object to this processing at any time (Art. 21 GDPR), for example by blocking the script in your browser. For the transfer to the USA and our agreement with Cloudflare, see section 2.

Subscription with double opt-in

The subscription form asks for your email address, name and company. After subscribing, you receive an email asking you to confirm your subscription (double opt-in); only then do we add you to the newsletter mailing list. As evidence, we store the submitted details, language, subscription time, IP address and browser identifier, together with the form and consent versions used. We link the confirmation to the subscription using a random identifier and record the confirmation status verified by Brevo.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every newsletter. After you unsubscribe, your email address may be stored on a block list so that you do not receive any further newsletters (Art. 6(1)(f) GDPR); you can object to this storage if your interests outweigh our legitimate interest.

Sending with Brevo

We use Brevo for subscriptions, confirmations and sending. The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. Brevo processes the necessary contact details, selected language, and subscription, delivery and unsubscribe status on our behalf. The data processing agreement forms part of Brevo’s terms of use.

Brevo’s anonymised tracking is enabled for opens and clicks. We use aggregate statistics and do not use them to create personal open or click profiles. Delivery failures, complaints and unsubscribes must, however, remain linked to an address so that we can prevent further unwanted messages.

Subscriptions and synchronisation run through our self-hosted automation service n8n. The subscription journal is stored on our server at Hetzner Online GmbH in Germany. For contacts already in our Copper CRM, we synchronise newsletter selection, language and status. A website subscription alone does not create a new CRM contact.

Transition from Mailchimp

For earlier issues, we used Mailchimp, a service provided by The Rocket Science Group LLC, 405 N Angier Ave NE, Atlanta, GA 30308, USA. Existing records and reports remain stored there during the transition. In particular, we check unsubscribes from previously sent emails so that they are also respected in Brevo. Mailchimp is certified under the EU-US Data Privacy Framework (DPF); the European Commission’s standard contractual clauses apply in addition. The existing data processing agreement continues to govern this transition.

Newsletters to existing customers

If you order goods or services, your email address may be used for newsletters advertising similar goods or services of our own, provided all requirements of Section 7(3) of the Gesetz gegen den unlauteren Wettbewerb (UWG, the German Act against Unfair Competition) are met. These include that you have not objected and that you are informed of your right to object when your address is collected and each time it is used. You can unsubscribe at any time via the newsletter link, without incurring costs other than transmission costs at the basic rates. Legal basis: Art. 6(1)(f) GDPR and Section 7(3) UWG.

Links to social networks

Our website does not integrate any social media plugins. The link to LinkedIn and the share buttons (LinkedIn, WhatsApp, email) are simple links: data only flows to the respective service when you click on a link. The privacy policy of the respective provider then applies.

Videos and YouTube

We usually deliver videos via our own hosting provider. If we embed a video from YouTube, we use the privacy-enhanced mode (youtube-nocookie.com). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you access a page with such a video, a connection to YouTube’s servers is established; in the process, YouTube learns which page you have visited and receives your IP address. Only when the video is played can further data be processed and information stored on your device. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in an appealing presentation of our projects. Google is certified under the EU-US Data Privacy Framework (DPF).

Data processing

We use online conferencing tools, among other things, to communicate with our customers. These record various data such as email address, phone number, duration of the conference, start and end of participation and technical data (IP addresses, device IDs, operating system, client version, camera/microphone/speaker type, connection type). When content such as cloud recordings, chat/voicemail messages, photos, videos and files is used, it is stored on the tool providers’ servers.

Purpose and legal bases

The conferencing tools are used for communication with contractual partners (Art. 6(1)(b) GDPR), to simplify communication in general (Art. 6(1)(f) GDPR) or on the basis of consent (Art. 6(1)(a) GDPR, which can be withdrawn at any time).

Conferencing tools used

Zoom: Zoom Communications Inc., 55 Almaden Boulevard, 6th Floor, San Jose, CA 95113, USA. DPF certified, data processing agreement (AVV) concluded.

Microsoft Teams: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. DPF certified, data processing agreement (AVV) concluded.

Google Meet: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. DPF certified, data processing agreement (AVV) concluded.

Handling of applicant data

We process personal data of applicants in order to carry out the application process. We accept applications via a form on a page at Notion (hejbuild.notion.site) or by email; Notion stores the data on our behalf (see section 4, »Notion«). Legal basis: Section 26 of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) (initiation of an employment relationship), Art. 6(1)(b) GDPR or, in the case of consent, Art. 6(1)(a) GDPR (can be withdrawn). Internally, the data is only passed on to persons involved in the application process.

Retention period

If an application is rejected or withdrawn, the data will be erased after 6 months (legal basis: Art. 6(1)(f) GDPR, legitimate interest). Data is stored for longer in the event of legal disputes, with consent or where there are statutory retention obligations. If the application is successful, the data will be stored for the purpose of carrying out the employment relationship (Section 26 BDSG, Art. 6(1)(b) GDPR).

Applicant pool

Inclusion in the applicant pool only takes place with express consent (Art. 6(1)(a) GDPR). Participation is voluntary and independent of the current application process. The data subject can withdraw their consent at any time. The data will be irrevocably erased no later than 2 years after consent was given.