Privacy Policy

General information

BFP Planung und Projekt GmbH would like to inform you about how we handle your personal data. The protection of privacy and your personal data is important to us.

We only want to collect and process personal data about you with your knowledge or consent. You will find out what information we may store and for what purposes we use it.

This privacy policy may be changed from time to time. Please use this page to inform yourself, as we will post any changes here.

The legal basis for data protection can be found in the current version of the Federal Data Protection Act (BDSG), the EU General Data Protection Regulation (GDPR) and the Telemedia Act (TMG).

When using terms such as "personal data", we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

The BFP Planung und Projekt website may contain links to websites of other providers to which this data protection declaration does not apply. We refer to the provisions on the pages of the linked pages of other providers.

We would like to point out that the use of contact details published in the imprint or comparable information such as postal addresses, telephone and fax numbers and email addresses

by third parties to send information that has not been expressly requested is not permitted. We reserve the right to take legal action in this regard.

Name and address of the responsible body

BFP Planung und Projekt GmbH

Alboinstraße 42

12103 Berlin Germany

sales@bfp-planung.com

+49 (30) 403 683 777

Data protection officer

Rodney Wiedemann
Consultant for data protection and information security

T. +49 621121847-64
rw@althammer-kill.de

Althammer & Kill GmbH & Co. KG
Kaiserring 10-16
68161 Mannheim

Data protection, information security and IT compliance
at the locations in Hanover, Düsseldorf and Mannheim
www.althammer-kill.de

Any person concerned can contact our data protection officer directly at any time with any questions or suggestions regarding data protection.

Basic categories of personal data affected by the processing

Personal data is information that can be used to identify a person or that describes their behavior, i.e. information that can be traced back to a person. This includes, among other things, the name, email address or telephone number, but also data such as the IP address or websites visited.

Customers (address data, contact details including telephone, fax and email data, contract data, support information including customer development, statistical data, billing and performance data)Employees, applicants (including application data, information on professional career, training and qualifications); contract, master and billing data (information on private and business address, field of activity, salary payments, name and age of relatives as far as relevant for social benefits, payroll tax data, bank details, assets entrusted to the employee); contact information; employee status; qualifications; employee assessments; professional career; data on personnel administration and management; Working time recording data and terminal access data; appointment management data; data for communication as well as for processing and controlling transactions and technical systems; emergency contact details.

Business partners and suppliers (address, billing and performance data), insofar as these are required to fulfil the purpose of processing.

Purpose of processing

In accordance with the principles of the GDPR, personal data is only processed for a specific purpose. These include:

Performance of consulting and development activities for or for the customers of BFP Planung und Projekt GmbH

Implementation of the storage and data processing of personal data on behalf of and in the name of business partners, customers and cooperation partners in accordance with the agreements applicable with them.

Provision of the online offer, its contents and functions.

Provision of contractual services, service and customer care.

Answering contact inquiries and communication with users.

Marketing, advertising and market research.

Security measures.

Applications (recruiting).

Employee data processing

Transfer to third countries

If BFP Planung und Projekt GmbH processes data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of the use of third-party services or disclosure or transfer of data to third parties, this only occurs if it is done to fulfill our contractual or pre-contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests.

Subject to legal or contractual permissions, we only process or have the data processed in a third country if the special requirements of Art. 44 ff. GDPR are met.

The processing is therefore carried out, for example, on the basis of an adequacy decision in accordance with Art. 45 GDPR, on the basis of suitable guarantees within the meaning of Art. 46 GDPR and insofar as enforceable rights and legal remedies arise from this. Binding Corporate Rules may be applied within the group to ensure compliance with an appropriate level of protection.

Access data/server log files

When the website is accessed, the servers automatically save various data about the accessing system. This includes the browser type used, the browser version, the operating system used, the website from which our website is accessed, the subpages of this website accessed, the date and time of access, the Internet protocol address (IP address), the Internet service provider and data comparable to this data.

This data is used to make the website accessible, to identify and resolve any technical problems that may arise and to prevent and, if necessary, prosecute misuse of our offer.

The legal basis for the processing of this data is Section 15 Paragraph 1 of the Telemedia Act (TMG)/Article 7 Letter f of Directive 95/46/EC or, from May 25, 2018: Article 6 Paragraph 1 Clause 1 Letter f of GDPR.

External hosting

This website is hosted by an external service provider (hoster). The personal data collected on this website is stored on the hoster's servers.

The hoster is used for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 Para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient

provision of our online offer by a professional provider (Art. 6 Para. 1 lit. f GDPR).

Our hoster will only process your data to the extent necessary to fulfill its performance obligations and will follow the instructions of BFP Planung und Projekt GmbH with regard to this data.

Some of our websites use so-called cookies. Cookies are small text files that are stored on your computer and saved by your browser. Session cookies are only stored for the duration of access and are automatically deleted when the browser is closed. These cookies do not contain any personal data, but simply identify the browser used to access the website. They are designed to make our offer more user-friendly, effective and secure. Session cookies are only stored for the duration of access and are automatically deleted when the browser is closed. These cookies do not contain any personal data, but simply identify the browser used to access the website.

Most browsers are set to accept cookies automatically. The storage of cookies can be deactivated in the browsers or set so that a notification is sent as soon as cookies are sent.

Google Analytics

On the basis of our legitimate interests (i.e. interest in the analysis, optimization and economic operation of our online offering within the meaning of Art. 6 Para. 1 lit. f. GDPR), we use Google Analytics, a web analysis service of Google LLC ("Google"). Google uses cookies. The information generated by the cookie about the use of the online offering by users is usually transferred to a Google server in the USA and stored there.

Google is certified under the Privacy Shield Agreement and thus offers a guarantee of compliance with European data protection law

(https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active).

Google will use this information on our behalf to evaluate the use of our online offering by users, to compile reports on the activities within this online offering

and to provide us with other services associated with the use of this online offering and internet usage. Pseudonymous user profiles can be created from the processed data.

We only use Google Analytics with activated IP anonymization. This means that the IP address of users is shortened by Google within member states of the European Union or in other contracting states

to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.

The IP address transmitted by the user's browser is not merged with other Google data. Users can prevent cookies from being saved by setting their

browser software accordingly; users can also prevent Google from collecting the data generated by the cookie and relating to their use of the online service and from processing this data by Google by downloading and installing the browser plug-in available under the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

You can find more information about Google's use of data, settings and objection options on Google's websites:

https://www.google.com/intl/de/policies/privacy/partners ("Use of data by Google when you use our partners' websites or apps"),

https://policies.google.com/technologies/ads ("Use of data for advertising purposes"),

https://adssettings.google.com/authenticated ("Manage information that Google uses to show you advertising").

Contact form

When you use the contact form, personal data is only collected to the extent you provide it.

All information is therefore provided voluntarily and is collected directly from you as the data subject. Your voluntarily provided personal data is stored for the purposes of processing your

request as well as any follow-up questions that may arise and any contact that may be required in this context. This personal data is not passed on to third parties.

The same applies to contacting us by email, telephone or post. Please note that this may result in additional data resulting from the communication channel selected (email address or transmitted telephone number).

The data is processed on the basis of Art. 6 I lit. a GDPR (consent) for the voluntary information and Art. 6 Para. 1 lit. f GDPR (legitimate interest) for the use of the information to process the request.

The data you enter in the contact form will remain with us until you request us to delete it, revoke your consent to storage or the purpose for storing the data no longer applies (e.g. after your request has been processed). Mandatory legal provisions - in particular retention periods - remain unaffected.

Please note that encrypted and/or signed communication may not be possible via the contact channels provided.

Deletion of personal data

We only store personal data of the data subject for the period necessary to achieve the purpose of storage. If the purpose of storage no longer applies or a storage period expires, the personal data will be deleted in accordance with the statutory provisions.

Legal basis

Art. 6 I lit. a GDPR serves as the legal basis for our company for processing operations for which we obtain consent for a specific processing purpose.

When processing personal data that is necessary to fulfill a contract to which the data subject is a party, Art. 6 I lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary to carry out pre-contractual measures.

If processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6 I lit. c GDPR serves as the legal basis.

In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 (1) lit. d GDPR serves as the legal basis.

If processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 I lit. f GDPR serves as the legal basis for processing your data.

Security

The data you submit to us is protected by suitable technical and organizational means in order to protect it from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security measures are continuously monitored and improved in line with technological developments and organizational possibilities.

Data protection updates

This data protection declaration is dated August 2019. Due to the further development of our website, our offers or due to changed legal or official requirements, it may become necessary

to change this data protection declaration. The current data protection declaration can be requested from us at any time.

Google Maps

To make it easier for you to find us, we have integrated map material from the Google Maps service from Google LLC into our website via an API. In order to display the content in your browser, Google must receive your IP address, otherwise Google would not be able to deliver this embedded content to you.

The legal basis for this data processing is Art. 6 Para. 1 b) GDPR, as the IP address is required in order to deliver the content to you. For this processing, our cooperation with Google is based on a contract for joint responsibility in accordance with Art. 26 GDPR, which can be accessed at this link: https://privacy.google.com/intl/de/businesses/mapscontrollerterms/ .

For more information on data processing by Google, please see Google's privacy policy at https://www.google.de/intl/de/policies/privacy/.

Rights of those affected

Right to information in accordance with Art. 15 GDPR: You have the right to receive information about your personal data stored and processed by us at any time.

Right to rectification, erasure, restriction, information in accordance with Art. 16-19 GDPR: You have the right to have incorrect data rectified and to have personal data erased or restricted (provided your request does not conflict with a legal obligation to retain data). If you have asserted your right to rectification, erasure or restriction to the person responsible, the person responsible is obliged to inform all recipients to whom your data has been disclosed of your request.

Right to data portability in accordance with Art. 20 GDPR: You have the right to receive your personal data stored by us in a structured, common and machine-readable format.

Right to revoke consent granted in accordance with Art. 7 Para. 3 GDPR: You have the right to revoke a consent granted (Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR) at any time with effect for the future, without affecting the legality of the processing carried out on the basis of the consent until the revocation. Right to complain in accordance with Art. 77 GDPR: If you believe that the processing of personal data concerning you violates the provisions of the GDPR, you have - without prejudice to any other administrative or judicial remedy - the right to complain to a supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged violation.

To exercise these rights, please contact our data protection officer directly, for example an email to rw@althammer-kill.de is sufficient.

You also have the option of submitting a complaint directly to the responsible data protection supervisory authority (Art. 77 GDPR).

For BFP Planung und Projekt GmbH, this is the Berlin Commissioner for Data Protection and Freedom of Information

Friedrichstr. 219

10969 Berlin

Tel.: +49 30 13889-0

Fax: +49 30 2155050

E-mail: mailbox@datenschutz-berlin.de

Information for applicants (m, f, d)

[according to Art. 13 GDPR - obligation to provide information when collecting personal data from the data subject]

We attach great importance to protecting your data and safeguarding your privacy. To ensure that you are fully informed about the collection, processing and use of personal data as part of our application process, please read the information below.

When submitting the applicant data, you as the applicant give your consent to the processing of personal data for the purpose set out in this data protection declaration.

We collect various personal data through the application process. Personal data is all information from which conclusions can be drawn about your personal or factual circumstances or which makes you identifiable. The following data is collected and processed for the automated processing of your application:

First name, last name, address, email, date of birth, title, telephone number, country of residence and citizenship

Additional questions depending on the respective advertisement (e.g. driving license)

CV, in particular information on professional experience and training

Skills and knowledge for the advertised position

Application photo

Qualifications, awards and language skills

Cover letter

No information is required to process your application that may not be processed under the General Equal Treatment Act (this includes race, ethnic origin, gender, disability, religion and belief or age). We ask you not to submit any information that is irrelevant to the processing of your application under the Equal Treatment Act (including illnesses, pregnancy, membership of a union and sex life).

Please do not submit any content that could, for example, infringe the copyright or press rights of third parties.

The data you submit will only be collected, processed and used for purposes related to processing your application.

Your personal data will only be collected or processed by people who are responsible for processing the application. All employees involved have been obliged to treat your data confidentially. In particular, they may not pass on any data to unauthorized persons.

If you, as an applicant, send your application documents electronically, you must ensure that they are encrypted yourself.

If we are unable to offer you a job, we will keep your data for a maximum of six months after rejection in order to be able to answer any questions that may arise in connection with the rejection.

Right to information according to Art. 15 GDPR: You have the right to receive information about your personal data stored and processed by us at any time.

Right to rectification, erasure, restriction, information in accordance with Art. 16-19 GDPR: You have the right to rectification of incorrect data and to erasure or restriction of the processing of personal data (provided your request does not conflict with a legal obligation to retain data).

Right to data portability in accordance with Art. 20 GDPR: You have the right to receive your personal data stored by us in a structured, common and machine-readable format.

Right to revoke consent granted in accordance with Art. 7 Para. 3 GDPR: You have the right to revoke consent granted (Art. 6 Para. 1 lit. a GDPR or Art. 9 Para. 2 lit. a GDPR) at any time with effect for the future, without affecting the legality of the processing carried out on the basis of the consent until the revocation.

Right to complain in accordance with Art. 77 GDPR: If you believe that the processing of personal data concerning you violates the provisions of the GDPR, you have - without prejudice to

any other administrative or judicial remedy - the right to complain to a supervisory authority, in particular in the Member State of your residence, place of work or place of the alleged violation.

To exercise these rights, please contact the person responsible directly.

In addition, you have the option of contacting the responsible data protection supervisory authority directly with a complaint (Art. 77 GDPR).

We are aware that applications contain sensitive personal data. We therefore ask you not to send applications to our general postal or email address, but always to the contact person named in each case or to our email address set up specifically for applications.

Right of objection

You have the right to object to the processing of personal data concerning you at any time in accordance with Art. 21 GDPR.

If you object, your personal data will no longer be processed unless compelling legitimate grounds for the processing are proven which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.