1. Data Protection at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data includes any data that can be used to identify you personally. Detailed information on data protection can be found in the privacy policy below.

Data Collection on This Website

Who is responsible for collecting data on this website?

Data processing on this website is carried out by the website operator. The operator’s contact details can be found in the website’s legal notice.

How do we collect your data?

Some data is collected when you provide it to us. This may include, for example, data that you enter in a contact form.

Other data is collected automatically or, after you have given your consent, by our IT systems when you visit the website. This primarily includes technical data, such as your internet browser, operating system and the time the page was accessed. This data is collected automatically as soon as you enter this website.

What do we use your data for?

Some of the data is collected to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour.

What rights do you have regarding your data?

You have the right to receive information free of charge at any time about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given your consent to data processing, you may withdraw this consent at any time with effect for the future. Under certain circumstances, you also have the right to request that the processing of your personal data be restricted. In addition, you have the right to lodge a complaint with the competent supervisory authority.

You may contact us at any time at the address provided in the legal notice regarding this and any other questions concerning data protection.

Analytics Tools and Third-Party Tools

When you visit this website, your browsing behaviour may be statistically evaluated. This is primarily carried out using analytics programmes.

Detailed information about these analytics programmes can be found in the following privacy policy.

2. Hosting

External Hosting

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host’s servers. This may include, in particular, IP addresses, contact requests, meta and communication data, contract data, contact details, names, website access data and other data generated through the use of a website.

The host is used to fulfil contracts with our potential and existing customers (Article 6(1)(b) GDPR) and in our legitimate interest in providing our online services securely, quickly and efficiently through a professional provider (Article 6(1)(f) GDPR).

Our host will process your data only to the extent necessary to fulfil its service obligations and will follow our instructions regarding this data.

We use the following host:

Mittwald CM Service GmbH & Co. KG
Königsberger Straße 4–6
32339 Espelkamp
Germany

Telephone: +49 5772 293-100
Fax: +49 5772 293-333

Data Processing Agreement

To ensure data processing in compliance with data protection regulations, we have concluded a data processing agreement with our host.

3. General Information and Mandatory Information

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various items of personal data are collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this occurs.

Please note that data transmission over the internet, such as communication by email, may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Information About the Data Controller

The controller responsible for data processing on this website is:

BFK GmbH + Co. KG
Adlerstraße 31
70199 Stuttgart
Germany

Telephone: +49 711 72637-0
Fax: +49 711 72637-99

Email: info@bfk-architekten.de

The controller is the natural person or legal entity that, alone or jointly with others, determines the purposes and means of processing personal data, such as names or email addresses.

Storage Period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for processing the data no longer applies. If you submit a legitimate request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible grounds for storing it, such as tax or commercial retention obligations. In the latter case, the data will be deleted once those grounds no longer apply.

Statutory Data Protection Officer

We have appointed a data protection officer for our company.

Markus Geiger
c/o MaGe Solutions GmbH
Lilienstr. 17/1
71272 Renningen
Germany

Telephone: +49 7159 4965728
Email: datenschutz@bfk-architekten.de

Information About Data Transfers to the USA

Our website includes tools provided by companies based in the USA. If these tools are active, your personal data may be transferred to the US servers of the respective companies.

Please note that the USA is not a safe third country under EU data protection law. US companies are obliged to disclose personal data to security authorities without you, as the data subject, being able to take legal action against this. It therefore cannot be ruled out that US authorities, such as intelligence services, may process, analyse and permanently store your data located on US servers for surveillance purposes. We have no influence over these processing activities.

Withdrawal of Consent to Data Processing

Many data processing operations are possible only with your express consent. You may withdraw consent that you have already given at any time. The lawfulness of data processing carried out before the withdrawal remains unaffected.

Right to Object to Data Collection in Specific Cases and to Direct Marketing

(Article 21 GDPR)

IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ARTICLE 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RELEVANT LEGAL BASIS FOR PROCESSING CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ARTICLE 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU for THE PURPOSE OF SUCH MARKETING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ARTICLE 21(2) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work or the place of the alleged infringement. This right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be carried out where technically feasible.

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the website operator, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address changing from “http://” to “https://” and by the padlock symbol in your browser’s address bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Information, Deletion and Correction

Within the framework of the applicable statutory provisions, you have the right at any time to receive information free of charge about your stored personal data, its origin and recipients, and the purpose of data processing. Where applicable, you also have the right to request the correction or deletion of this data.

You may contact us at any time at the address provided in the legal notice regarding this and any other questions concerning personal data.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data. You may contact us at any time at the address provided in the legal notice.

The right to restrict processing applies in the following cases:

• If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data was or is unlawful, you may request the restriction of data processing instead of its deletion.
• If we no longer need your personal data, but you require it to establish, exercise or defend legal claims, you have the right to request the restriction of processing instead of the deletion of your personal data.
• If you have objected to processing pursuant to Article 21(1) GDPR, a balance must be struck between your interests and ours. Until it has been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If the processing of your personal data has been restricted, this data may—apart from being stored—only be processed with your consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural person or legal entity, or for reasons of important public interest of the European Union or a Member State.

Objection to Promotional Emails

The use of contact details published as part of the legal notice for sending unsolicited advertising and informational materials is hereby prohibited. The website operators expressly reserve the right to take legal action in the event of the unsolicited sending of promotional information, such as spam emails.

4. Data Collection on This Website

Cookies

Our websites use “cookies”. Cookies are small text files that do not damage your device. They are either stored temporarily for the duration of a session (session cookies) or permanently on your device (persistent cookies). Session cookies are automatically deleted at the end of your visit. Persistent cookies remain on your device until you delete them yourself or your web browser automatically deletes them.

Third-party cookies may also be stored on your device when you visit our website. These enable us or you to use certain services provided by third parties, such as cookies used to process payment services.

Cookies have various functions. Many cookies are technically necessary because certain website functions would not work without them, such as the shopping basket function or the display of videos. Other cookies are used to analyse user behaviour or display advertising.

Cookies that are necessary for carrying out electronic communications, providing certain functions requested by you, such as the shopping basket function, or optimising the website, such as cookies used to measure website traffic, are stored on the basis of Article 6(1)(f) GDPR unless another legal basis is specified. The website operator has a legitimate interest in storing cookies to provide its services in a technically error-free and optimised manner.

If consent to the storage of cookies has been requested, the relevant cookies are stored exclusively on the basis of this consent (Article 6(1)(a) GDPR). Consent may be withdrawn at any time.

You can configure your browser to notify you when cookies are set, to allow cookies only in individual cases, to reject cookies in certain cases or generally, and to activate the automatic deletion of cookies when you close your browser. Disabling cookies may restrict the functionality of this website.

Where cookies from third-party companies or cookies used for analytics purposes are employed, we will inform you separately in this privacy policy and, where applicable, request your consent.

Server Log Files

The provider of these pages automatically collects and stores information in server log files, which your browser automatically transmits to us. This includes:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not combined with data from other sources.

This data is collected on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring that its website is displayed without technical errors and is optimised. Server log files must therefore be recorded.

Enquiries by Email, Telephone or Fax

If you contact us by email, telephone or fax, your enquiry, including all personal data arising from it, such as your name and enquiry, will be stored and processed by us for the purpose of handling your request. We will not disclose this data without your consent.

This data is processed on the basis of Article 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary to take steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling enquiries addressed to us (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR), if consent was requested.

The data you send to us in contact enquiries will remain with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies, such as after your enquiry has been fully processed. Mandatory statutory provisions, particularly statutory retention periods, remain unaffected.

5. Social Media

This privacy policy applies to the following social media profiles:

https://www.instagram.com/bfkarchitekten/
https://www.xing.com/companies/bfkarchitekten
https://www.linkedin.com/company/bfkarchitekten/

Data Processing by Social Networks

We maintain publicly accessible profiles on social networks. The social networks we use are listed below.

Social networks such as Facebook and X can generally analyse your user behaviour extensively when you visit their websites or a website containing integrated social media content, such as Like buttons or advertising banners. Visiting our social media profiles triggers numerous data processing operations relevant to data protection.

In detail: If you are logged into your social media account and visit our social media profile, the operator of the social media portal may associate this visit with your user account. However, your personal data may also be collected if you are not logged in or do not have an account with the relevant social media portal. In this case, data may be collected, for example, through cookies stored on your device or by recording your IP address.

Using the data collected in this way, the operators of the social media portals may create user profiles in which your preferences and interests are stored. This enables interest-based advertising to be displayed to you both within and outside the relevant social media profile. If you have an account with the relevant social network, interest-based advertising may be displayed on all devices on which you are or have been logged in.

Please also note that we cannot fully track all processing operations carried out on the social media portals. Depending on the provider, the operators of the social media portals may therefore carry out additional processing operations. For details, please refer to the terms of use and privacy policies of the relevant social media portals.

Legal Basis

Our social media profiles are intended to ensure as comprehensive an online presence as possible. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.

The analytics processes initiated by the social networks may be based on different legal grounds, which must be specified by the operators of the social networks, such as consent within the meaning of Article 6(1)(a) GDPR.

Controller and Exercise of Rights

When you visit one of our social media profiles, such as Facebook, we and the operator of the social media platform are jointly responsible for the data processing operations triggered by your visit.

You may generally exercise your rights, including the rights of access, correction, deletion, restriction of processing, data portability and complaint, both against us and against the operator of the relevant social media portal, such as Facebook.

Please note that, despite our joint responsibility with the operators of the social media portals, we do not have full control over their data processing operations. Our options are largely determined by the policies of the respective provider.

Storage Period

Data collected directly by us through our social media profile will be deleted from our systems as soon as you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory provisions, particularly retention periods, remain unaffected.

We have no influence over the storage period of data that the operators of social networks store for their own purposes. For details, please contact the operators of the social networks directly, for example by consulting their privacy policies listed below.

Your Rights

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to object, the right to data portability and the right to lodge a complaint with the competent supervisory authority. In addition, you may request the correction, blocking or deletion of your personal data and, under certain circumstances, the restriction of its processing.

Individual Social Networks

Instagram

We maintain a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Data transfers to the USA are based on the European Commission’s standard contractual clauses. Details can be found here:

https://www.facebook.com/legal/EU_data_transfer_addendum
https://de-de.facebook.com/help/566994660333381

For details on how Instagram handles your personal data, please refer to Instagram’s privacy policy:

https://privacycenter.instagram.com/policy/

The company is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards.

Further information is available from the provider at:

https://www.dataprivacyframework.gov/participant/4452

XING

We maintain a profile on XING. The provider is New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.

For details on how XING handles your personal data, please refer to XING’s privacy policy:

https://privacy.xing.com/de/datenschutzerklaerung

LinkedIn

We maintain a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies.

If you wish to deactivate LinkedIn advertising cookies, please use the following link:

https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Data transfers to the USA are based on the European Commission’s standard contractual clauses. Details can be found here:

https://www.linkedin.com/legal/l/dpa
https://www.linkedin.com/legal/l/eu-sccs

For details on how LinkedIn handles your personal data, please refer to LinkedIn’s privacy policy:

https://www.linkedin.com/legal/privacy-policy

The company is certified under the EU–US Data Privacy Framework (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards.

Further information is available from the provider at:

https://www.dataprivacyframework.gov/participant/5448

6. Plugins and Tools

Google Web Fonts (Local Hosting)

This website uses web fonts provided by Google to ensure a consistent presentation of fonts. Google Fonts are installed locally. No connection to Google’s servers is established.

Further information about Google Web Fonts can be found at:

https://developers.google.com/fonts/faq

Google’s privacy policy is available at:

https://policies.google.com/privacy?hl=de

Multilingual Content / Website Content Translation (WPML)

To provide our content in several languages, we use the WPML (WordPress Multilingual) plugin. The provider is OnTheGoSystems Limited, 22/F, 3 Lockhart Road, Wanchai, Hong Kong.

Our content is translated manually within our WordPress environment. Automatic or cloud-based translation functions, including the “Advanced Translation Editor” and machine translation services, are disabled. Our website content is therefore not transmitted to the provider or to third-party translation services for translation purposes.

The plugin requires technically necessary communication with the provider for its operation, for example to verify the licence, request updates and process support requests initiated by us. Technical data such as our website address, the WordPress and WPML versions used, the licence status and related log data may be processed in this context.

As the provider is based in Hong Kong, data may be transferred to a third country for which the European Commission has not issued an adequacy decision. The standard contractual clauses issued by the European Commission serve as an appropriate safeguard within the meaning of Article 46 GDPR.

The legal basis is our legitimate interest in providing a multilingual and fully functional website (Article 6(1)(f) GDPR).

Further information about data processing by the provider can be found in its privacy notice:

https://wpml.org/documentation/privacy-policy-and-gdpr-compliance

7. Audio and Video Conferencing

Data Processing

We use, among other services, online conferencing tools to communicate with our customers. If you communicate with us by video or audio conference over the internet, your personal data will be collected and processed by us and by the provider of the relevant conferencing tool.

The conferencing tools collect all data that you provide or use to access the tools, such as your email address and/or telephone number. The conferencing tools also process the duration of the conference, the start and end times of your participation, the number of participants and other contextual information related to the communication process (metadata).

In addition, the provider of the tool processes all technical data required to conduct online communication. This includes, in particular, IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker, and connection type.

If content is exchanged, uploaded or otherwise provided through the tool, this content is also stored on the tool provider’s servers. This includes, in particular, cloud recordings, chats or instant messages, voicemails, uploaded photos and videos, files, whiteboards and other information shared while using the service.

Please note that we do not have full control over the data processing operations of the tools used. Our options are largely determined by the policies of the respective provider. Further information about data processing by the conferencing tools can be found in the privacy policies of the tools used, which are listed below this text.

Purpose and Legal Basis

The conferencing tools are used to communicate with prospective or existing contractual partners or to provide certain services to our customers (Article 6(1), first sentence, point (b) GDPR).

The tools are also used to generally simplify and accelerate communication with us and our company. This constitutes a legitimate interest within the meaning of Article 6(1)(f) GDPR.

Where consent has been requested, the relevant tools are used on the basis of that consent. Consent may be withdrawn at any time with effect for the future.

Storage Period

Data collected directly by us through the video and conferencing tools will be deleted from our systems as soon as you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory statutory retention periods remain unaffected.

We have no influence over the storage period of data that the operators of the conferencing tools store for their own purposes. For details, please contact the operators of the conferencing tools directly.

8. Our Own Services

Handling Applicant Data

We offer you the opportunity to apply for a position with us, for example by email, post or through an online application form. Below, we inform you about the scope, purpose and use of the personal data collected during the application process.

We assure you that your data will be collected, processed and used in compliance with applicable data protection law and all other statutory provisions, and that your data will be treated in strict confidence.

Scope and Purpose of Data Collection

When you submit an application to us, we process the associated personal data, such as contact and communication data, application documents and notes made during interviews, insofar as this is necessary to decide whether to establish an employment relationship.

The legal basis for this is Section 26 of the German Federal Data Protection Act (BDSG), as amended, under German law, concerning the initiation of an employment relationship; Article 6(1)(b) GDPR, concerning general steps prior to entering into a contract; and, where you have given consent, Article 6(1)(a) GDPR. Consent may be withdrawn at any time.

Within our company, your personal data is disclosed only to persons involved in processing your application.

If your application is successful, the data you submit will be stored in our data processing systems on the basis of Section 26 BDSG and Article 6(1)(b) GDPR for the purpose of carrying out the employment relationship.

Data Retention Period

If we are unable to offer you a position, if you reject a job offer or if you withdraw your application, we reserve the right to retain the data you have submitted for up to six months after the end of the application process, such as the rejection or withdrawal of the application, on the basis of our legitimate interests (Article 6(1)(f) GDPR).

The data will then be deleted and physical application documents destroyed. Retention serves, in particular, as evidence in the event of legal disputes.

If it is apparent that the data will be required after the expiry of the six-month period, for example because of an impending or pending legal dispute, the data will only be deleted once the purpose for continued retention no longer applies.

Data may also be retained for a longer period if you have given corresponding consent (Article 6(1)(a) GDPR) or if statutory retention obligations prevent deletion.

Inclusion in the Applicant Pool

If we do not offer you a position, you may possibly be included in our applicant pool. If you are included, all documents and information from your application will be transferred to the applicant pool so that we can contact you if suitable vacancies arise.

Inclusion in the applicant pool is based exclusively on your express consent (Article 6(1)(a) GDPR). Giving consent is voluntary and is not connected to the ongoing application process. You may withdraw your consent at any time. In this case, the data will be permanently deleted from the applicant pool unless statutory retention obligations apply.

Data from the applicant pool will be permanently deleted no later than two years after consent has been granted.