Data Protection Statement
I. Name and address of data controller
The data controller, within the meaning of the EU GDPR and other national data protection laws of the member states as well as other data protection regulations, is:
STRABAG Real Estate GmbH
Donau-City-Straße 1
1220 Wien
Österreich
Tel. +43 1 22422-7100
Website: real-estate.at@strabag.com
II. Name and address of data protection officer
The data controller’s data protection officer is:
Claus Genschow
CML Construction Services GmbH
Albstadtweg 3
70567 Stuttgart
Deutschland
Tel. +49(0)711 7883-625
claus.genschow@bauholding.com
III. General information on data processing
1. Scope of processing of the personal data
In principle, we process personal data of our users only insofar as this is necessary for the maintenance of a functional website and the provision of our content and services. The processing of our users’ personal data generally occurs only following receipt of the user’s consent. An exception is made in cases where it is not possible to obtain consent in advance for practical reasons and where the processing of the data is permitted by statutory regulations.
2. Legal basis for the processing of personal data
Insofar as we obtain consent from the data subject for the processing of personal data, Art. 6 (1) a of the EU’s General Data Protection Regulation (GDPR) shall serve as the legal basis.
Where the processing of personal data is required for the fulfilment of a contract to which the data subject is party, Art. 6 (1) b of the GDPR shall serve as the legal basis. This shall also apply to all processing operations required for the performance of pre-contractual measures.
Insofar as the processing of personal data is required for the fulfilment of a legal obligation (statutory conditions) to which our company is bound, Art. 6 (1) c of the GDPR shall serve as the legal basis.
If processing is necessary in order to protect the vital interests of the data subject or of another natural person, Art. 6 (1) d of the GDPR shall serve as the legal basis.
If processing is necessary to safeguard a legitimate interest of our company or of a third party, and the interests, basic rights and fundamental freedoms of the data subject do not outweigh the aforementioned legitimate interest, Art. 6 (1) f of the GDPR shall serve as the legal basis for processing.
3. Deletion of data and storage duration
The personal data of the data subject are deleted or blocked as soon as the purpose for their storage no longer applies. Storage beyond this point may take place if this is provided for by the European or national legislator in EU regulations, laws or other provisions to which the data controller is subject. Data will also be blocked or deleted once the storage period prescribed by the aforementioned standards expires, unless further storage of the data is necessary for the conclusion or fulfilment of a contract.
IV. Provision of the website and creation of log files
1. Description and scope of data processing
Each time this website is accessed, our system records data and information from the computer system of the calling computer by means of an automated system.
The following data are collected as part of this process:
– Information about the browser type and version used
– The user’s operating system
– The user’s Internet service provider
– The user’s IP address
– Date and time of access
– Websites from which the user’s system has come to our website
– Websites accessed by the user’s system via our website
The information stored in the log files can contain the IP address, the browser type, the date and time of the visit, and the system that the visitors use. We only store pseudonymised IP addresses of visitors to the website. At the webserver level, this is performed by default by storing an IP address 123.123.123.XXX in the log file instead of the visitor’s actual IP address, for example, 123.123.123.123. The “XXX” is a random value between 1 and 254, so it is no longer possible to establish the true identity of the visitor.
These data are also stored in our system’s log files. These data are not stored together with other personal data of the user.
2. Legal basis for data processing
The legal basis for the temporary storage of data and log files is Art. 6 (1) f of the GDPR.
3. Purpose of data processing
The system temporarily stores the user’s IP address in order to make the website available on the user’s computer. To do this, the user’s IP address must be stored for the duration of the session.
The storage in log files is carried out to ensure the functional capability of the website. The data also help us to optimise the website and ensure the security of our IT systems. No data are evaluated for marketing purposes in this context.
This is also the reasoning behind our legitimate interest in data processing under Art. 6 (1) f of the GDPR.
4. Storage duration
The data are deleted as soon as they are no longer required to achieve the purpose for which they were collected. When data are collected in order to make the website available, this is the case when the respective session ends.
When data are stored in log files, this is the case after 180 days at the latest.
Mail server log: retention time 7 days
Apache log: 6 months
Backups: stored for 14 days in encrypted format
5. Possibility of objection and elimination
The collection of data for the provision of the website and the storage of data in log files is necessary for operating the website. Therefore, there is no possibility for the user to object.
V. Use of cookies
a) Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the user’s web browser or on the user’s computer system by the web browser. When a user visits a website, a cookie is stored on the user’s operating system. This cookie contains a characteristic string, enabling the unique identification of the browser when a user revisits the website.
We use cookies to make our websites more user-friendly. Some elements of our website require the calling browser to be able to be identified even after a page change.
The cookies store and transfer the following information:
– Language settings
– Articles in a shopping cart
– Login information
– We also use cookies on our website that allow for the analysis of user browsing habits.
– The following information can be stored in this way:
– Search terms entered
– Frequency of page views
– Use of website functions
Technical measures are employed to pseudonymise user data which are collected in this manner. As a result, it is not possible to assign data to an inquirer. The data will not be stored together with other personal data of the user.
When visiting our website, a banner appears informing the user about the use of cookies for analysis purposes and the user is referred to this data protection statement. The user is also informed in this context of how to prevent the collection of cookies in the browser settings.
When visiting our website, the user is informed about the use of cookies for the purposes of analysis. The user’s consent to the processing of personal data is also obtained in this context. The user is also referred to the data protection statement at this point.
b) Legal basis for data processing
The legal basis for the processing of personal data using cookies is Art. 6 (1) f of the GDPR.
The legal basis for the processing of personal data using cookies that are technically necessary is Art. 6 (1) f of the GDPR.
The legal basis for the processing of personal data using cookies for analysis purposes, with relevant user consent, is Art. 6 (1) a of the GDPR.
c) Purpose of data processing
Cookies which are technically necessary are used to simplify website use for users. Some of our website’s functions cannot be offered without the use of cookies. These services require the browser to be recognised again following a page change.
We require cookies for the following applications:
– Shopping cart
– Transfer of language settings
– Remembering search terms
The user data collected by technically necessary cookies will not be used to create user profiles.
Analysis cookies are used to improve the quality of our website and its content. Such cookies enable us to learn how the website is used so that we can continually improve our offer.
This is also the reasoning behind our legitimate interest in data processing under Art. 6 (1) f of the GDPR.
d) Storage duration, possibility of objection and elimination
Cookies are stored on the user’s computer, which will transmit them to our website. This will grant you as the user complete control over the usage of cookies. You can deactivate or restrict the transmission of cookies by changing your web browser’s settings. Previously stored cookies can be deleted at any time. Cookies can also be deleted automatically. In the event that cookies are deactivated for our website, certain features of our website may no longer be available.
The transmission of Flash cookies cannot be restricted via the browser settings. This is done by changing the settings of the Flash player.
VI. E-mail contact
1. Description and scope of data processing
A contact form is provided on our website which may be used to make contact electronically. Should a user contact us via the contact form, the data entered in the input template are transferred to us and then stored. These data are:
Additionally, the following data are stored when the message is sent:
– The IP address of the user
– Date and time of the registration
To process the data, your consent is obtained during this process and you will be referred to this data protection statement.
As an alternative, it is also possible to contact us using the e-mail address provided. In this case, personal data of the user which is transmitted along with the e-mail will be stored.
No data will be disclosed to third parties in this context. Data will be used exclusively for the purposes of correspondence.
2. Legal basis for data processing
The legal basis for the processing of data with the user’s consent is Art. 6 (1) a of the GDPR.
The legal basis for the processing of data that are transmitted by e-mail is Art. 6 (1) f of the GDPR. If the purpose of making e-mail contact is to conclude a contract, then an additional legal basis for the processing of the data is Art. 6 (1) b of the GDPR.
3. Purpose of data processing
We only process personal data taken from the input template of the contact form for the purposes of making contact. If we are contacted by e-mail, we also have a necessary legitimate interest to process data.
Other personal data processed during this process serve to prevent misuse of the contact form and to guarantee the security of our IT systems.
4. Storage duration
The data are deleted as soon as they are no longer required to achieve the purpose for which they were collected. For personal data taken from the input template of the contact form and sent by e-mail, data are deleted when the respective correspondence with the user has ended. Correspondence concludes when it can be inferred from the circumstances that the matter in question has been conclusively resolved.
The additional personal data that are collected in this process are deleted after a period of seven days at the latest.
5. Possibility of objection and elimination
The user can withdraw his/her consent for the processing of personal data at any time. Users can contact us by e-mail at any time to withdraw their consent for storing the personal data. In this case, correspondence cannot be continued.
If you wish to make use of your right to object, please write us an e-mail at real-estate@strabag.com.
In this case, all personal data stored at the time of making contact will be deleted.
VII. Disclosure to service provides
We only disclose your personal data to third parties when service providers work for us to manage our data. The legal basis is Art. 6 (1) f of the GDPR. We have concluded processing agreements with our service providers to ensure the data protection with regard to your personal data.
VIII. Use of Matomo Analytics
We use the web analysis software Matomo (www.matomo.org) for the purpose of access statistics, to analyse the general usage behaviour of our website and to optimise our website.
The legal basis for this processing is Art. 6 (1) f) GDPR.
We configured Matomo in such a way that:
– no cookies are placed on your end-device;
– the IP address is shortened by the last two bytes and is thus anonymised;
– in addition to the pages opened, only the data transmitted by your browser when you access the website is recorded / this data recording is limited to the respective duration of the sessions;
– on opening the website, your data transmitted by the browser and the anonymized IP address are irrevocably replaced by a pseudonym ID on a session basis, so that no identifiability and thus no personal reference can be established, whereby this pseudonym ID is also deleted after a maximum of 24 hours.
We use our own Matomo instance on our company’s servers within the European Economic Area, so that no data is transmitted to Matomo or other third parties.
In addition, you have the option of activating the “Do Not Track” option in your browser. In this case Matomo does not store or process any data from your website visit.
If you have not activated the “Do Not Track” option and do not agree with the collection and analysis of the aforementioned data, you can object to this processing on our website at any time. For this purpose, we provide you below with a special inline frame that is linked to our Matomo system. By deactivating the checkbox (opt-out), a cookie is stored on your end-device that prevents the collection and processing of any session data on our website by Matomo. Please note that deleting your cookies will also delete this cookie and you may need to reactivate it.
IX. Rights of the data subject
When your personal data is processed, you become the data subject within the meaning of the GDPR and you shall have the following rights in relation to the data controller:
1. Right of access
2. Right to rectification
3. Right to restriction of processing
4. Right to erasure
5. Right to be informed
6. Right to data portability
7. Right to object
8. Right to withdraw declaration of consent
9. Automated individual decision-making, including profiling
10. Right to lodge a complaint with a supervisory authority