**APP Privacy Statement
In addition to our on-line services we also provide a mobile app you can download to your mobile device. Below please find our statement on the collection of personal data when using our app. Personal data means all data that can be related to you such as name, address, e-mail address, user behaviour.
**Name and address of controller
Controller in terms of the GDPR and other national data protection laws or Member State data protection laws and other data protection regulations:
fon +49(0)241-946 90 0
fax +49(0)241-946 90 20
statutorily represented by:
Dipl.-Ing. Arch. BDA Gerhard Wittfeld
Mag. Arch. Kilian Kada
Univ. em. Prof. DI Arch. Klaus Kada
**General notes on data processing
**Extent to which personal data are processed
We collect and use our users’ personal data only for the purpose of providing a properly working application, our contents and services.
When contacting us by e-mail or via our contact form your e-mail address, your name and your phone number (if included) will be stored by us in order to answer your questions. All data produced in this connection will be deleted as soon as a storage thereof is no longer required or the use thereof will be restricted to discharge statutory storage obligations.
**Collection of personal data when using our mobile app
(1) When downloading the mobile app required information will be transmitted to the respective app store (user name, e-mail address and customer number of your account, download time, payment information and individual device code, in particular). We cannot influence this collection of data and we are not responsible for that. We only process data that are necessary to download the mobile app to your mobile device.
(2) When using the mobile app we will collect the following personal data in order to ensure a comfortable use of all functions. If you want to use our mobile app, we will collect the following data we need technically in order to provide the functions of our mobile app and to ensure security and stability (legal basis: Art. 6, para. 1, sentence 1 f, GDPR).
We only store IP addresses to the extent needed to provide our services. Otherwise IP addresses will be deleted or anonymized. IP addresses of visitors to your sites will be anonymized within a short period time after the connection with your site is terminated.
• IP address of the device used to access the site and a service
• Accessing browser type and site previously visited
• Your system configuration
• Date and time of your request
**Deletion and storage period
Personal data of the person concerned will be deleted or blocked as soon as the purpose of storage ceases to exist. Personal data can also be stored, if this is provided for by European or national legislators, by EU directives, laws or other regulations the controller is subject to. Data will also be blocked or deleted, if the storage period provided for by such standards expires unless there is a need for further storage of data for a contract to be concluded or performed.
**Purpose of data storage
A temporary storage of an IP address by the system will be required to transfer the site and/or app to a user’s computer. For this purpose a user’s IP address must be stored for the respective session.
Data are stored in log files to ensure the site’s / app’s functionality. Data are also used to optimize the site and/or the app and to maintain security of our information systems. There is no data evaluation for marketing purposes in this connection.
These purposes constitute our legitimate interest in processing data pursuant to Art. 6, para. 1 f, GDPR.
Data will be deleted as soon as they are no longer needed to achieve the purpose of collection. In case of data needed to provide the site this means the end of the respective session.
If data are stored in log files this means after seven days at the latest. Storing beyond that date could be possible. In such case the users’ IP addresses will be deleted or scrambled in a way that they can no longer be assigned to the requesting client.
**Objection and removal
Recording data for the purpose of providing the site and/or application as well as storing data in log files is absolutely necessary to operate the site and/or app. Hence a user cannot file any objection in this respect.
**Details and extent of data processing
When using our app you may contact us by e-mail. If a user exercises this option, all data sent along with an e-mail will be transferred to us and stored. These data constitute a user’s personal data transferred along with an e-mail.
In this connection no data will be transferred to third parties. Data are solely processed for the purpose of conversation.
Legal basis for data processing
Processing of data transferred in the course of sending an e-mail is based on Art. 6, para. 1 f, GDPR. If an e-mail contact aims at the conclusion of a contract, processing is also based on Art. 6, para. 1 b, GDPR.
**Purpose of data processing
We exclusively process personal data for the purpose of dealing with a contact. If contacted by e-mail this constitutes a legitimate interest in processing data.
Data will be deleted as soon as they are no longer needed for the purpose of the collection thereof. In case of personal data transferred via e-mail this is the end of the respective conversation with a user. It is terminated if considering the circumstances it can be deduced that the situation was finally clarified.
**Objection and removal
A user may at any time revoke his/her consent to the processing of personal data. If a user contacts us by sending an e-mail, he/she may at any time object to a storage of personal data. In such case a conversation cannot be continued.
All personal data stored in the course of establishing a contact will be deleted in such case.
**Rights of person concerned
If your personal data are processed, you are a person concerned in terms of the GDPR and you can exercise the following rights towards a controller:
**Right of information
You may require the controller to confirm whether personal data concerning you are processed by us.
If such data are processed, you can require the controller to furnish the following information:
(1) purposes for which personal data are processed;
(2) categories of personal data processed;
(3) recipients and/or categories of recipients to which the respective personal data were / will be disclosed;
(4) intended period of storage of personal data concerning you or, lacking specific information, storage period criteria;
(5) existing rights to correct or delete personal data concerning you, the right to restrict processing by the controller or the right to object to such processing;
(6) right of objection that can be filed with an supervisory authority;
(7) all available information about the origin of the data, if personal data are not collected from the person concerned;
(8) existing automatic individual decision-making including profiling pursuant to Art. 22, para. 1 and 4, GDPR and – at least in such cases – meaningful information about the logic involved and the consequences and intended effects of such processing for the person concerned.
You are entitled to demand information whether personal data concerning you will be transferred to a third-party country or to an international organization. In this respect you may demand information about suitable safeguards pursuant to Art. 46, GDPR in connection with a transfer.
**Right of correction
If personal data concerning you are incorrect or incomplete, you may call upon the controller to rectify and/or complete such data. The controller shall do so without delay.
**Right of restriction of processing
If the following conditions exist, you may demand a restricted processing of personal data concerning you:
(1) if you contest the correctness of the personal data concerning you for a period allowing the controller to verify the correctness of personal data;
(2) if processing is illegal and if you refuse a deletion of personal data and if in lieu thereof you demand a restriction in the use of personal data;
(3) if the controller no longer needs personal data for the purpose of processing but which you need to establish, exercise or defend legal claims, or
(4) if you have objected to processing pursuant to Art. 21, para. 1, GDPR, and if it is not yet clear whether the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
**Right of deletion
You may call upon the controller to immediately delete personal data concerning you. The controller is required to immediately delete such data on the following grounds:
(1) Personal data concerning you are no longer needed for the purposes for which they were collected or otherwise processed.
(2) You have revoked your approval on which processing pursuant to Art. 6, para. 1 a or Art. 9, para. 2 a, GDPR, was based and there is no other legal basis of processing.
(3) You have objected to processing pursuant to Art. 21, para. 1, GDPR, and there are no compelling legitimate grounds or you have objected to processing pursuant to Art. 21, para. 2, GDPR.
(4) Personal data concerning you were processed unlawfully.
(5) A deletion of personal data concerning you is required to fulfil a legal obligation according to Union law or the Member State law the controller is subject to.
(6) Personal data concerning you were collected in relation to the offer of information society services pursuant to Art. 8, para. 1, GDPR.
There will be no right of deletion, if processing is required
(1) to exercise the right to freedom of expression and information,
(2) to fulfil a legal obligation requiring processing under Union law or the Member State law the controller is subject to or to perform duties which are in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health pursuant to Art. 9, para. 2 h and i, and Art. 9, para. 3, GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89, para. 1, GDPR, insofar as the right referred to in par. a presumably makes it impossible or extremely difficult to achieve these objectives, or
(5) for the establishment, exercise or defence of legal claims.
**Right of information
If you have asserted the right of correction, deletion or restriction of processing against the controller, the controller will be required to notify all recipients to which personal data concerning you were disclosed of such correction, deletion or restriction of processing unless this proves to be impossible or involves disproportionate effort.
The controller is required to notify you of such recipients.
**Right of data transferability
You are entitled to receive personal data concerning you provided to the controller in a structured, standard and machine-readable format. Furthermore, you are entitled to transfer such data to another controller without interference by the controller which personal data were provided to, if
(1) processing is based on a consent pursuant to Art. 6, para. 1 a, GDPR, or Art. 9, para. 2 a, GDPR, or on a contract pursuant to Art. 6, para. 1 b, GDPR, and
(2) processing is based on automatic processes.
When exercising this right you are also entitled to cause personal data concerning you to be transmitted directly from one controller to another controller insofar as this technically feasible. Another person’s freedom and rights must not be impaired by that.
The right of data transferability does not apply to the processing of personal data concerning you that is required to perform duties which are in the public interest or in the exercise of official authority vested in the controller.
**Right of objection
For reasons resulting from your special situation you are entitled to object at any time to the processing of personal data concerning you carried out pursuant to Art. 6, para. 1 e or 1 f, GDPR; this also applies to a profiling based on these regulations.
The controller no longer processes personal data concerning you unless the controller can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
If personal data concerning you are processed for the purpose of direct advertising, you are entitled to object at any time to the processing of personal data concerning you for the purpose of such advertising; this also applies to profiling if related to such direct advertising.
If you object to the processing for the purpose of direct advertising, personal data concerning you will no longer be processed for these purposes.
In connection with the use of information society services and notwithstanding Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) you may exercise your right of objection using automatic procedures based on technical specifications.
**Right of revocation of declaration of consent under data protection law
You are entitled to revoke your declaration of consent under data protection law at any time. A revocation of your consent does not affect the legitimacy of the processing carried out on the basis of the consent until such revocation.
**Right of objection to supervisory authority
Notwithstanding any other administrative or judicial remedy you are entitled to complain to a supervisory authority (in Member State of your residence, your place of work and place of presumed infringement, in particular), if you are of the opinion that the processing of personal data concerning you infringes the GDPR.
The supervisory authority with which an objection was filed will notify the complainant about the status and the results of the objection including possible judicial remedy pursuant to Art. 78, GDPR.