Go to homepage
Wishlist
Cart

Data protection

Privacy Policy

Responsibility for Your Data

As our customer, you expect a high level of quality not only from our products and services, but also in the processing of your personal data.

As a general rule, you can use our website without providing any personal data.

To the extent that personal data is collected when you visit our websites, we process it exclusively in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679; GDPR) and the Federal Data Protection Act (BDSG), as well as the relevant national data protection regulations, in particular the Telecommunications and Digital Services Data Protection Act (TDDDG). The processing of personal data takes place exclusively in accordance with this Privacy Policy.

This Privacy Policy applies to the use of our website at https://www.kraft-baustoffe.de as well as—to the extent expressly described below—for related digital offerings, in particular the web shop, the MyKRAFT app, application forms, newsletter features, and integrated third-party services.

In addition to the mailing address listed above, you can also contact us by email at datenschutz@kraft-baustoffe.de. Our Data Protection Officer can be reached at the same mailing address and by email at info@norisk-datasecurity.com 

The following information is intended to inform you about the processing of your data on our websites.

Data Security

We implement technical and organizational security measures to protect your personal data against accidental or intentional manipulation, loss, destruction, or unauthorized access, and to ensure the protection of your rights and compliance with applicable data protection regulations in Germany and the EU.

The measures taken are intended to ensure the long-term confidentiality, integrity, availability, and resilience of the systems and services related to the processing of your data, and to restore them quickly in the event of a physical or technical incident.

For security reasons and to protect the transmission of confidential content—such as orders or inquiries you send to us as the website operator—this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock icon in your browser’s address bar.

This also includes the encryption of your data. Information that you submit online is always transmitted in encrypted form. Encrypted transmission reduces the risk of unauthorized access during transmission. Transmission is encrypted using TLS. This significantly reduces the risk of data being intercepted during transmission. The protocols authenticate the communication partner and ensure the integrity of the transmitted data.

Our data processing and security measures are continuously improved in line with technological developments.

Our employees are, of course, bound by written confidentiality agreements and are required to comply with the data protection requirements of the GDPR.

Please note that security vulnerabilities may arise during data transmission over the Internet that cannot be prevented even by the technical design of this website. It is not possible to provide complete protection of personal data when using the Internet.

Data Controller

The entity responsible for the processing of personal data in connection with the use of this website is:

KRAFT Baustoffe GmbH
Drygalski-Allee 15
D-81477 Munich
Represented by:
Managing Director: Robert Preuß
Contact:
Phone: +49 89 78591-0
Fax: +49 89 78591-1229
Email: info@kraft-baustoffe.de

Data Protection Officer

Our designated Data Protection Officer is:

Stephan Riepe
NoRisk Datasecurity GmbH
Am Windhügel 17A
59457 Werl
Contact:
Phone: +49 2922 8033707
Email: info@norisk-datasecurity.com

Personal Data

Personal data refers to any information relating to an identified or identifiable natural person (Art. 4(1) GDPR). This includes data that you provide to us when using our website, such as your address information, registration data, telecommunications data, order data, or financial data, as well as data that is automatically collected when you use our website, such as your IP address.

Required Information

If, during data collection, certain data fields are designated as mandatory information or mandatory fields and are marked with an asterisk (*), the provision of this data is required by law or contract, or is necessary for the conclusion of the contract, the provision of the requested service, or the specified purpose. The provision of voluntary information is at your discretion. To the extent that information is marked as required, failure to provide it may result in our inability to fulfill the contract, provide the requested service, or process your inquiry. Failure to provide such information may result in our inability to fulfill the contract, provide the requested service, or achieve the specified purpose.

General Inquiries and Communications

If you contact us via email, phone, mail, or the contact form, we will process the data you provide to handle your inquiry and for any follow-up questions. To the extent that your inquiry is aimed at entering into a contract or relates to an existing contractual relationship, processing is based on Article 6(1)(b) of the GDPR. In all other cases, processing is based on our legitimate interest in handling your inquiry pursuant to Article 6(1)(f) of the GDPR. The data will be deleted as soon as your inquiry has been fully processed, but no later than three months after submission, provided there are no statutory retention obligations or other legitimate reasons for longer storage. We retain commercial and business correspondence for six years in accordance with Section 257 of the German Commercial Code (HGB) and tax-related documents for ten years in accordance with Section 147 of the German Fiscal Code (AO). The data is not combined with other data collected on this website.

The contact form is sent using TLS encryption. This encryption is intended to prevent unauthorized access to your personal data by third parties.

Communication in the Context of Business Relationships

We process the data you provide in the course of our business communications (email, mail, telephone) to handle your inquiry or for the establishment, performance, and fulfillment of a contract (Art. 6(1)(b) GDPR). Any information we designate as mandatory is necessary because it is either contractually required or mandated by law. The voluntary provision of additional data facilitates the performance of the contract.

We store your data relevant to our business relationship for as long as necessary to carry out and settle the business relationship, to comply with statutory retention obligations, or to assert, exercise, or defend legal claims. Corresponding documents (e.g., business letters, invoices) are generally retained in accordance with legal requirements for six years (§ 257 HGB, Art. 6(1)(c) GDPR) or ten years (§ 147 AO, Art. 6(1)(c) GDPR) following the conclusion of the contract.

Hosting

Our website is hosted on servers provided by

maxcluster GmbH
Lise-Meitner-Str. 1b
D-33104 Paderborn

We have entered into a data processing agreement with Maxcluster GmbH.

When you access our website, data is automatically collected and stored in log files on our host’s server. This data may be personally identifiable. The data collected includes:

  • Browser type/Browser version
  • Operating system used
  • Referrer URL
  • Hostname of the accessing computer
  • Date and time of the server request
  • Amount of data transferred
  • Notification of successful retrieval
  • IP address (not anonymized)

The hosting provider uses the collected data to ensure the smooth operation of the website, to ensure IT security, and to improve our services. If there are specific indications, the log data may be analyzed retrospectively. The temporary storage of the IP address by the hosting provider is necessary to enable the website to be delivered to the user’s computer. For this purpose, your IP address must remain stored for the duration of the session.

This data is not combined with other data sources.

The legal basis for data collection is Article 6(1)(f) of the GDPR. Our legitimate interest in collecting this data arises from the purposes stated above.

The data is deleted by the hosting provider as soon as it is no longer necessary to achieve the purpose for which it was collected. In the case of data collected for the purpose of providing the website, this occurs when the respective session ends.

If data is stored in log files, this technical information is deleted or anonymized after one week at the latest.

The collection of data for the purpose of providing the website and the storage of data in log files are strictly necessary for the operation of the website. To the extent that processing is technically necessary for the provision of the website, there is no right to object. Otherwise, you may object to processing based on Article 6(1)(f) of the GDPR in accordance with Article 21 of the GDPR.

Cookies

In addition to the data mentioned above, cookies and similar technologies are used on your device when you use and visit our website.

When you visit our website for the first time, you will be asked whether you consent to the use of cookies and, if so, which categories of cookies you consent to.

Cookies are small text files that your browser stores on your device to save certain information. Furthermore, these cookies are used to make your experience with our website more pleasant and convenient, or for analytical purposes.

Most of the cookies we use are so-called “session cookies.” They serve to technically enable you to access the services on our website. After your visit, these cookies are automatically deleted by your browser.

Other cookies remain on your computer and enable us to recognize your device the next time you visit (so-called persistent or permanent cookies).

The next time you visit our website using the same device, the information stored in the cookies will be read either by our website (“first-party cookie”) or by another website to which the cookie belongs (“third-party cookie”).

These cookies are automatically deleted from your system after a preset period of time, which varies depending on the cookie.

Based on the information stored and sent back, the respective website recognizes that you have already accessed and visited it using your device’s browser.

We use this information to optimize the design and display of the website according to your preferences. In doing so, only the cookie itself is identified on your device.

Any further storage of personal data takes place only with your express consent or if it is absolutely necessary to enable you to use the service offered and accessed by you.

To the extent that information is stored on or read from your device via cookies or similar technologies, this is done in accordance with Section 25 of the TDDDG. Section 25(2) of the TDDDG applies to cookies and similar technologies that are technically essential. For all other cookies and similar technologies, we obtain your prior consent in accordance with Section 25(1) of the TDDDG. The subsequent processing of personal data is carried out in accordance with the respective legal bases specified in the GDPR.

This website uses the following types of cookies, the scope and functionality of which are explained below:

  • Essential Cookies:
    Strictly necessary cookies ensure functions without which you cannot use our websites as intended. These cookies are used exclusively by us and serve, for example, to ensure that you, as a logged-in user, remain logged in when accessing various subpages of our website, so that you do not have to re-enter your login credentials every time you visit a new page. To the extent that these cookies are absolutely necessary for the operation of the website or the provision of an expressly requested service, the storage of or access to information on the end device is based on Section 25(2) of the TDDDG. The subsequent processing of personal data is carried out, depending on the purpose, on the basis of Article 6(1)(b) of the GDPR or Article 6(1)(f) of the GDPR.
  • Functional cookies:
    These enable our website to store information you have already provided and to offer you improved features based on that information. The storage of and access to information on your device occur only with your consent in accordance with Section 25(1) of the TDDDG. The subsequent processing of personal data is based on Article 6(1)(a) of the GDPR.
  • Marketing or tracking cookies:
    These cookies are used to collect information about the websites visited by the user, to create and enable targeted and more effective advertising for the user, and to identify the interests of website visitors in order to make our website even more interesting in the future.
    Marketing and tracking cookies, as well as comparable technologies, are used only after you have given your active consent. The storage of and access to information on your device are based on Section 25(1) of the TDDDG. The subsequent processing of personal data is based on Article 6(1)(a) of the GDPR.

Opt-out for marketing cookies

Regardless of how you manage your consent on our website, you can also manage your settings for interest-based advertising through external self-regulatory programs. However, these external settings do not replace your consent or its revocation via our consent management tool.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, e.g., third-party cookies (cookies set by a third party, i.e., not by the actual website you are currently visiting), allow cookies only in specific cases or exclude them entirely, and enable the automatic deletion of cookies when you close your browser. You can delete stored cookies at any time using your web browser.

You can disable cookies in your browser at any time.

However, disabling cookies may limit the functionality of this website.

Deleting Cookies

Cookies are stored on your device until you delete them, which you can do at any time. Furthermore, expired cookies are automatically deleted by your browser if you have configured your browser accordingly. Expired cookies are no longer sent to our servers by your browser and can therefore no longer be used by us.

Here you will find information on how to delete cookies and manage cookie settings in the most common browsers:

Desktop PC / Laptop

  • Microsoft Edge
  • Firefox
  • Google Chrome
  • Safari
  • Opera

Unless you have changed or change your settings, cookies that are intended to enable or ensure the necessary technical functions will remain on your device until you close your browser; other cookies may remain on your device for a longer period (up to 6 months).

To protect your privacy, you should regularly check the cookies on your device as well as your browser history and delete them yourself.

Local Storage and Session Storage

We also use so-called LocalStorage and Session Storage technology (also referred to as “local data,” “local storage,” and “session storage”), which means we utilize your browser’s storage capacity.

With LocalStorage, data is stored locally in your browser’s cache; this data remains even after you close the browser window or exit the program and can be read if you do not actively clear the cache.

Local Storage allows your preferences when using our websites to be stored on your computer and used by you.

The functionality of Session Storage is essentially the same as that of LocalStorage as described above, except that the corresponding data is automatically removed from your browser’s cache immediately after you close the browser (“session”).

Local Storage and Session Storage can be used both for technically necessary functions and—with your consent—for analytics or tracking purposes. Whether third parties have access to the stored information depends on the specific service used and is described in our consent management tool as well as in the following sections on the individual services. In particular, this technology is used to present our content to you in an appealing graphical format (e.g., pop-up windows, etc.) and to personalize our offerings and navigation on our pages for you.

The data is not combined with other data (e.g., information from tracking tools, which is also stored separately in LocalStorage).

To the extent that LocalStorage or Session Storage is used for analysis, statistical, marketing, or tracking purposes, this is done exclusively with your prior consent in accordance with Section 25(1) of the TDDDG. The specific purposes are set forth in our consent management tool and the following notes on the individual services.

To the extent that LocalStorage or Session Storage is absolutely necessary for the operation of the website or the provision of an expressly requested service— —the storage of or access to information on your device is based on Section 25(2) of the TDDDG. The subsequent processing of personal data is based on Article 6(1)(f) of the GDPR or, to the extent that the processing is necessary for the performance of a contract, on Article 6(1)(b) of the GDPR. For all other purposes, such processing is carried out only with your consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.

SSL or TLS Encryption

Our website uses TLS encryption. You can recognize an encrypted connection by “https://” and the padlock icon in the browser address bar.

CookieFirst

Our website uses CookieFirst to obtain your consent to the storage of certain cookies on your device or to the use of certain technologies, and to document this in compliance with data protection regulations. The provider of this technology is Digital Data Solutions B.V. (CookieFirst), Plantage Middenlaan 42A, 1018 DH Amsterdam, Netherlands (hereinafter “CookieFirst”).

When you visit our website, a connection is established with CookieFirst’s servers to obtain your consents and other declarations regarding cookie usage. CookieFirst then stores a cookie in your browser to associate the consents you have granted—or their revocation—with your session. In this process, the IP address (anonymized), the browser’s user agent and operating system, as well as the URL from which consent was granted, are processed and integrated into CookieFirst. The consent data is stored for the period necessary to document your consent or its revocation. The specific storage period for cookies and similar technologies set by CookieFirst is specified in the consent management tool. Mandatory legal retention requirements remain unaffected.

According to the provider, CookieFirst uses subcontractors. These may include, in particular, services for content delivery, IP geolocation, and hosting. Details regarding the subcontractors used can be found in the information provided by CookieFirst or in our consent management tool. CookieFirst is headquartered in Amsterdam, the Netherlands.

CookieFirst is used to obtain, manage, and document consent for cookies and similar technologies. To the extent that CookieFirst stores or reads information on your device for this purpose, this is necessary for the provision of consent management and is carried out pursuant to Section 25(2) of the TDDDG. The processing of personal data for the purpose of documenting consent is based on Article 6(1)(c) of the GDPR and Article 6(1)(f) of the GDPR, as we are obligated to provide evidence of consent granted and have a legitimate interest in legally compliant documentation.

We have entered into a data processing agreement (DPA) for the use of the aforementioned service. This is a contract required under data protection law that ensures that CookieFirst processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Job Applications

On our website, you have the option to apply for a posted position or submit a speculative application to our company.

We provide an application form for this purpose.

When you apply to us, we process the information we receive from you as part of the application process, e.g., through your cover letter, resume, certificates, correspondence, and information provided by phone or in person. In addition to your contact information, we are particularly interested in details regarding your education, qualifications, work experience, and skills. We will evaluate you solely based on your suitability for the respective position, so you do not need to send us a photo.

When you use the application form, we process the data you enter into the form fields (title, name, email address, desired start date, salary expectations, and any other voluntary information) as well as any documents you upload, for the purpose of processing your application.

If we enter into an employment contract with an applicant, the data provided will be stored for the purpose of administering the employment relationship in accordance with legal requirements.

If we do not enter into an employment contract with the applicant, the data will be deleted 6 months after the rejection.

If you have consented to the longer-term storage of your application data, we will transfer your data to our applicant pool (Section 26(2) BDSG in conjunction with Article 6(1)(a) GDPR). The data will be deleted from there after one year has elapsed.

The purpose of data processing is to conduct a recruitment process.

The legal basis for data processing in the application process and as part of the personnel file is Section 26(1), Sentence 1 of the BDSG and Article 6(1)(b) of the GDPR. To the extent that you voluntarily provide us with information that is not required for the application process, we process this information based on your consent pursuant to Article 6(1)(a) of the GDPR, unless another legal basis applies.

You may revoke your consent to the processing of your personal data in connection with the application process at any time by sending us an email to datenschutz@kraft-baustoffe.de.

Newsletter

This website uses Brevo to send newsletters. The provider is Brevo Germany GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

Brevo is a service that can be used, among other things, to organize and analyze the distribution of newsletters. The data you provide to subscribe to the newsletter is stored on the servers of Brevo Germany GmbH in Germany.

With the help of Brevo, we can track whether a newsletter has been opened and which links have been clicked. Tracking technologies, such as personalized links or tracking pixels, may be used for this purpose. This analysis is performed only if valid consent has been provided.

In addition, we can determine whether certain predefined actions were carried out after the newsletter was opened or a link was clicked (conversion rate). For example, we can determine whether you made a purchase after clicking a link in the newsletter.

Brevo also enables us to segment (“cluster”) newsletter recipients into different categories. Newsletter recipients can be grouped based on the data they provide and their usage behavior, provided this is legally permissible and appropriate consent has been obtained. This allows us to better tailor the newsletters to the respective target groups.

You may revoke your consent to receive the newsletter and the associated analysis at any time with future effect. To do so, you can use the unsubscribe link included in every newsletter.

For detailed information on Brevo’s features, please visit the following link: https://www.brevo.com/de/newsletter-software/.

Data processing is based on your consent (Art. 6(1)(a) GDPR). You may revoke this consent at any time. The lawfulness of data processing operations that have already taken place remains unaffected by the revocation.

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter, at which point it will be deleted from the newsletter distribution list. Data stored by us for other purposes remains unaffected by this.

After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider on a blacklist, if necessary, to prevent future mailings. The data from the blacklist is used solely for this purpose and is not combined with other data. This serves both your interest and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). The data will remain on the blacklist for as long as necessary to prevent future unsolicited mailings and to provide proof of unsubscription.

You may object to this storage if your interests outweigh our legitimate interest.

For more details, please refer to Brevo’s privacy policy at: https://www.brevo.com/de/datenschutz-uebersicht/ and https://www.brevo.com/de/legal/privacypolicy/.

We have entered into a Data Processing Agreement (DPA) for the use of the aforementioned service. This is a contract required under data protection law that ensures the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Online Store

When placing an order in our online store, it is necessary to collect the personal data from you that is required to conclude the contract.

To use your customer account and place an order in our online store, you must register by providing your email address and a password of your choice.

The data you provide will be used to process your order from the online store.

Depending on the selected payment method, we process payment data and, where necessary, transmit it to payment service providers, financial institutions, or other entities involved in payment processing.

Your personal data may be disclosed to the following categories of recipients: customer service, shipping companies, direct suppliers, payment service providers, and, if applicable, debt collection agencies.

To the extent that service providers process personal data on our behalf, we enter into data processing agreements with them in accordance with Article 28 of the GDPR. To the extent that service providers act as independent controllers, the transfer is based on the applicable legal basis in each case.

The legal basis for the processing of customer data is Article 6(1)(b) of the GDPR.

We regularly store order, invoice, and payment data for six or ten years, respectively, in accordance with statutory commercial and tax retention requirements. We store other customer data for as long as necessary for contract fulfillment, customer account management, or to assert, exercise, or defend legal claims. These obligations arise, among other sources, from the German Commercial Code (HGB) and the German Fiscal Code (AO).

The order process is encrypted using TLS technology. This encryption is designed to prevent unauthorized access to your personal data by third parties.

Registration for Retailers / Private Customers

On our website, you can register for our online store and create a personal customer account.

This allows you to shop quickly, save your user data and settings, view your order and tracking information, and manage your newsletter subscription.

To verify your registration, we will send you a confirmation email. Your registration is complete once you click the confirmation link contained in that email.

If you do not confirm your registration within the timeframe specified in this email, your registration will be automatically deleted from our database. Providing the aforementioned information is required for registration.

For the purpose of registration, the following data in particular is collected:

  • Last name, first name
  • Street address, delivery address (if applicable)
  • Email address
  • Phone number/fax number
  • Business registration (retailers only)
  • Company name (retailers only)
  • IP address, date and time of registration and confirmation of registration, to the extent necessary for documentation, prevention of misuse, and the assertion, exercise, or defense of legal claims. The legal basis is Article 6(1)(f) of the GDPR.
  • Bank details, depending on the payment method
  • Additional information for business customers, if applicable, e.g., your business registration number (this can be sent by fax or provided directly during registration).

The mandatory information required for contract processing is marked separately; all other information is voluntary.

In this context, we process the aforementioned data to fulfill and execute contracts, including payment processing and, if applicable, credit checks, as well as to handle customer inquiries. Marketing communications via email are sent only if consent has been provided or if the legal requirements for marketing to existing customers are met. In addition, the data is used to fulfill our legal obligations toward state and federal authorities (e.g., tax office, customs authorities).

At a minimum, your last name, first name, and address are required to identify you. When making purchases in the online store, you must also provide your email address for the order confirmation and, for delivery, your shipping address; depending on the payment method, you may also need to provide your bank details.

We store the data processed for this purpose as part of your registration for the password-protected area until you cancel your access, provided that no other retention periods apply.

You can close your online account at any time by sending us a brief message via email or mail: onlineshop@kraft-baustoffe.de.

The legal basis for processing the data required for registration and contract fulfillment is Article 6(1)(b) of the GDPR. To the extent that we process data to fulfill legal obligations, Article 6(1)(c) of the GDPR applies. To the extent that we process data for the purposes of preventing misuse, ensuring IT security, or pursuing legal claims, this is done on the basis of Article 6(1)(f) of the GDPR.

Address Validation

On our website, we offer you the option to have certain entries in address forms in our online store for input errors in real time . This is intended to prevent problems with the delivery of the products you have ordered products due to incorrect information.

Furthermore, we want to ensure that your contact information is valid for sending information about your order or for any necessary follow-up inquiries. To provide these functions, we use the service provider Endereco, Balthasar-Neumann-Straße 4b, 97236 Randersacker.

The service provider processes the data exclusively in accordance with our instructions. The legal basis for the transfer, processing, and temporary storage of the data by the service provider is Article 6(1)(b) of the GDPR, as it is necessary for the performance of the contract or to take steps prior to entering into a contract that some of the data you enter into the input form is verified for accuracy. The following data is processed by the service provider:

  • Address (country, city, ZIP code, street, house number if applicable)

The data is processed separately by the service provider and is not merged. The requests are deleted by the service provider as soon as the status of the entered data has been determined and the transaction in the webshop has been completed, but no later than 30 days.

Payment Options

Prepayment

In our web shop, we offer, among other options, payment via “prepayment.” This payment method is provided by KRAFT Baustoffe GmbH.

With this payment option, you transfer the specified invoice amount to the account of KRAFT Baustoffe GmbH before the goods are shipped.

The processing of data required for payment in advance is based on Article 6(1)(b) of the GDPR, to the extent that it is necessary for the performance of the contract. To the extent that statutory retention obligations apply, processing is based on Article 6(1)(c) of the GDPR.

PayPal

In our online store, you have the option to complete the payment process using the online payment service PayPal. PayPal enables you to make online payments to third parties. The European operating company of PayPal is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.

A PayPal account is managed via an email address, which is why there is no traditional account number. PayPal allows you to initiate online payments to third parties or to receive payments. PayPal also acts as an escrow service and offers buyer protection services.

If you select PayPal as your payment method, we will transmit the data required for payment processing to PayPal. This typically includes the following information:

  • Name
  • Address
  • Company name
  • Email address
  • Phone and cell phone number
  • IP address
  • or other data necessary for payment processing

Personal data related to the respective order is also required to fulfill the purchase agreement.

The data transmitted to PayPal may be forwarded by PayPal to credit reporting agencies.

The purpose of this transfer is to verify your identity and creditworthiness. PayPal may also disclose your data to third parties to the extent necessary to fulfill contractual obligations or if the data is to be processed on its behalf.

You can view PayPal’s privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full/.

The legal basis for the transfer of data required for payment processing is Article 6(1)(b) of the GDPR. To the extent that we are complying with statutory retention obligations, processing is based on Article 6(1)(c) of the GDPR. To the extent that we pursue legitimate interests, such as fraud prevention or legal enforcement, processing is based on Article 6(1)(f) of the GDPR.

Payment by Credit Card (Visa/Mastercard/American Express)

In our online store, we offer payment via Visa/Mastercard/American Express, among other options. The provider of this payment service is PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.

If you select payment via Visa/Mastercard/American Express, the payment details you enter will be transmitted to PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.

The following data is used for the payment: card number, card sequence number, security code, card type (e.g., VISA, Mastercard, Amex), and card expiration date.

Depending on the payment process, the following data in particular may be processed: card details, payment amount, date and time of the transaction, transaction identifiers, and other data required for payment processing.

Payment processing is handled securely via an external page operated by PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, to provide the best possible protection for your payment data during the payment process.

Once the transaction is complete, the invoice amount will be conveniently and securely charged to your account.

Chargeback: If you dispute a transaction made with your card: purchase receipt and, if applicable, additional information about you that the payee intends to use to substantiate their claim, e.g., name and address.

The transmission of data required for payment processing is based on Article 6(1)(b) of the GDPR. To the extent that statutory retention obligations apply, processing is based on Article 6(1)(c) of the GDPR.

Integration of the Trusted Shops Trustbadge

The Trusted Shops Trustbadge is integrated into this website to display our Trusted Shops seal of approval and any reviews that may have been collected, as well as to offer Trusted Shops products to buyers after they place an order. The Trustbadge and the services advertised through it are provided by Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne.

To the extent that information is stored on or read from your device by the Trustbadge or associated services, this is done solely in accordance with § 25 TDDDG. If access is not strictly necessary, we will obtain your consent in advance pursuant to § 25(1) TDDDG.

The Trustbadge is made available by a CDN (Content Delivery Network) provider as part of a data processing arrangement. Trusted Shops may use service providers in third countries. To the extent that personal data is transferred to a third country, this is done in accordance with Articles 44 et seq. of the GDPR, in particular on the basis of an adequacy decision or appropriate safeguards such as standard contractual clauses.

When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which contains your IP address, the date and time of access, the amount of data transferred, and the requesting provider (access data), and documents the access. Individual access data are stored in a security database for the analysis of security incidents.

The log files are automatically deleted no later than 90 days after they are created.

Additional personal data is transferred to Trusted Shops GmbH if, after completing an order, you decide to use Trusted Shops products or have already registered to use them. The contractual agreement between you and Trusted Shops applies. For this purpose, personal data is automatically collected from the order data.

Whether you, as a buyer, are already registered to use a product is automatically verified using a neutral parameter—your email address hashed via a cryptographic one-way function. The email address is converted into this hash value, which cannot be decrypted by Trusted Shops, prior to transmission. After checking for a match, the parameter is automatically deleted.

This is done to safeguard our legitimate interests and those of Trusted Shops in providing buyer protection linked to the specific order and transactional rating services in accordance with Article 6(1)(f) of the GDPR.

Further details, including information on the right to object, can be found in the Trusted Shops Privacy Policy linked above and in the Trustbadge.

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies, or perform independent analyses. It serves solely to manage and deploy the tools integrated through it. In doing so, technical data—in particular your IP address—may be transmitted to Google. To the extent that data is transferred to third countries, this is done in accordance with Articles 44 et seq. of the GDPR.

Google Tag Manager is used to manage and deploy website tags. To the extent that Google Tag Manager itself does not access your device in a manner requiring consent and enables only technically necessary functions, the processing of personal data is based on Article 6(1)(f) of the GDPR. To the extent that services requiring consent are integrated via Google Tag Manager, these are activated only after you have given your consent in accordance with Section 25(1) of the German Telemedia Act (TDDDG) and Article 6(1)(a) of the GDPR.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link:
https://www.dataprivacyframework.gov/participant/5780.

Google Analytics

This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyze the behavior of website visitors. In doing so, the website operator receives various usage data, such as page views, time spent on the site, operating systems used, and the user’s origin. This data can be assigned to pseudonymous identifiers that enable the end device to be recognized.

Google Analytics can track interactions with our website, such as page views, click events, scroll events, or other events configured by us. Furthermore, Google Analytics uses various modeling approaches to supplement the collected data sets and employs machine learning technologies in data analysis.

Google Analytics uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting). The information collected by Google regarding the use of this website is generally transmitted to a Google server in the United States and stored there.

Use of this service is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. You may revoke your consent at any time.

To the extent that personal data is transferred to the United States, this is done—provided Google is certified under the EU-U.S. Data Privacy Framework for the respective service—on the basis of the European Commission’s Adequacy Decision. Further information on Google’s certification under the EU-U.S. Data Privacy Framework can be found in the corresponding registry of the Data Privacy Framework. For more information, see: https://www.dataprivacyframework.gov/participant/5780.

IP Anonymization

Google Analytics IP anonymization is enabled. As a result, your IP address is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before being transmitted to the U.S. Only in exceptional cases is the full IP address transmitted to a Google server in the U.S. and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide other services related to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

We have concluded or accepted the privacy policy and data processing agreements provided for Google Analytics.

Google Maps

This site uses the Google Maps mapping service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. This service allows us to embed maps on our website.

To use the features of Google Maps, it is necessary to store your IP address. This information is generally transmitted to a Google server in the United States and stored there. The provider of this site has no influence over this data transmission. When Google Maps is activated, Google may use Google Fonts to ensure consistent font display. When you access Google Maps, your browser loads the required web fonts into its cache to display text and fonts correctly.

Google Maps is loaded only if you activate the map function or have given your consent to do so. To the extent that Google Maps stores or reads information on your device, this is done on the basis of your consent pursuant to Section 25(1) of the German Telemedia Act (TDDDG). The subsequent processing of personal data is based on Article 6(1)(a) of the GDPR. If Google Maps is used without device access requiring consent and solely to provide an explicitly requested map feature, the processing may be based on Article 6(1)(f) of the GDPR.

Data transfers to the U.S. are based on the EU Commission’s Standard Contractual Clauses. Details can be found here:
https://privacy.google.com/businesses/gdprcontrollerterms/ and https://privacy.google.com/businesses/gdprcontrollerterms/sccs/.

For more information on how user data is handled, please see Google’s Privacy Policy: https://policies.google.com/privacy?hl=de.

To the extent that personal data is transferred to the United States, this is done—provided Google is certified under the EU-U.S. Data Privacy Framework for the respective service—on the basis of the European Commission’s Adequacy Decision. If this does not apply, Google bases the transfer on appropriate safeguards, in particular Standard Contractual Clauses. For more information on this, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5780.

Google reCAPTCHA

We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on this website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA is designed to verify whether data entry on this website (e.g., in a contact form) is performed by a human or by an automated program. To do this, reCAPTCHA analyzes the website visitor’s behavior based on various characteristics. The analysis takes place only when reCAPTCHA is used for a specific form or security check. For the analysis, reCAPTCHA evaluates various pieces of information (e.g., IP address, the length of time the website visitor spends on the website, or mouse movements made by the user). The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyses run entirely in the background.

Google’s role under data protection law is governed by the contractual and data protection terms applicable to reCAPTCHA. To the extent that Google processes data on our behalf, this is done on the basis of a data processing agreement in accordance with Article 28 of the GDPR. To the extent that reCAPTCHA stores or reads information on your device, this is done only in accordance with § 25 TDDDG. If consent is required for this, we obtain it in advance in accordance with § 25(1) TDDDG. The subsequent processing of personal data is carried out—depending on the specific implementation—on the basis of Article 6(1)(f) of the GDPR for the purpose of preventing abuse and spam, or, where consent is obtained, on the basis of Article 6(1)(a) of the GDPR.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5780.

Hotjar

This website uses Hotjar, operated by Hotjar Ltd., Level 2, St. Julians Business Centre, 3, Elia Zammit Street, St. Julians STJ 1000, Malta, Europe (website: https://www.hotjar.com).

Hotjar is a tool for analyzing your user behavior on this website. With Hotjar, we can—with your consent—analyze interactions with our website, such as clicks, scrolling behavior, and time spent on the site. Depending on the configuration, this data can be used to generate heatmaps or usage analyses.

Furthermore, we can determine how long you stayed on a page and when you left it. We can also determine at which point you abandoned your entries in a contact form (so-called conversion funnels).

In addition, Hotjar can be used to collect direct feedback from website visitors. This feature is used to improve the website operator’s online offerings.

Hotjar uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting).

Hotjar is used exclusively with your prior consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect.

Disabling Hotjar

If you wish to disable data collection by Hotjar, click on the following link and follow the instructions provided there:
https://www.hotjar.com/policies/do-not-track/

Please note that Hotjar must be disabled separately for each browser and each device.

For more information about Hotjar and the data it collects, please refer to Hotjar’s privacy policy at the following link:
https://www.hotjar.com/privacy

Order Tracking in the MyKRAFT App

In our MyKRAFT app, you can track your orders with us. To do so, you’ll need your customer number and the corresponding receipt number or delivery note number.

After entering the numbers, the system will cross-reference them with our inventory management system, and the app will display the processing status of your order. Your data is not stored on your mobile device and is not shared with third parties.

To the extent that order tracking serves the performance of an existing contract, processing is based on Article 6(1)(b) of the GDPR. In addition, processing may be based on our legitimate interest in ensuring smooth delivery and communication regarding the delivery status in accordance with Article 6(1)(f) of the GDPR.

To the extent that the app uses permissions on your device or stores or reads information on your device, this is done in accordance with Section 25 of the TDDDG. We provide further information on app-specific permissions, storage processes, and any third-party providers used within the app or in supplementary privacy notices.

Social Media Profiles

Our presence on the social media platforms and video platforms listed below serves to facilitate active and up-to-date communication with our customers and prospective customers. There, we provide information about our services, products, and interesting special promotions related to our company and our services:

  • https://www.facebook.com/KraftBaustoffe
  • https://www.instagram.com/kraft_baustoffe/
  • https://www.youtube.com/@kraft_baustoffe
  • https://www.xing.com/pages/kraftbaustoffegmbh

Below, we provide you with the privacy notice pursuant to Article 13 of the General Data Protection Regulation (GDPR) regarding the social media accounts we operate:

Facebook Fan Page / Facebook Page

The social network Facebook is operated by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if your company’s registered office or your place of residence is in the EU, by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”).

The legal basis for the processing of personal data that we carry out ourselves in connection with our presence on these platforms—such as when communicating with users or handling inquiries—is, depending on the purpose, either Article 6(1)(b) of the GDPR or Article 6(1)(f) of the GDPR. Meta is responsible for data processing carried out by Meta, in particular for analytical, statistical, or advertising purposes; further information can be found in Meta’s privacy policy.

To the extent that Meta processes personal data based on consent you have provided to Meta, Article 6(1)(a) of the GDPR applies, according to Meta. To withdraw consent granted to Meta, please contact Meta directly. You may withdraw your consent to data processing at any time with future effect; to do so, please contact Facebook directly. Withdrawal of consent does not affect the lawfulness of data processing carried out prior to the withdrawal.

For detailed information on the processing and use of data by the providers on their websites, as well as contact information, your rights in this regard, and settings to protect your privacy—in particular, options to object (so-called “opt-out”)—please refer to Facebook’s Privacy Policy: https://www.facebook.com/about/privacy/

You can find the option to object (opt-out) as follows:
https://www.facebook.com/settings?tab=ads

We are jointly responsible with the provider for the processing of personal data in connection with our Facebook page (Art. 26 GDPR). You can view the relevant agreement here:
https://www.facebook.com/legal/terms/page_controller_addendum.

Instagram Account

Instagram is a service provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

The legal basis for the processing of personal data that we carry out ourselves as part of our website operations—such as when communicating with users or handling inquiries—is, depending on the purpose, either Article 6(1)(b) of the GDPR or Article 6(1)(f) of the GDPR. Meta is responsible for data processing carried out by Meta, particularly for analytical, statistical, or advertising purposes; further information can be found in Meta’s privacy policy.

To the extent that Meta processes personal data based on consent you have provided to Meta, Article 6(1)(a) of the GDPR applies, according to Meta. To revoke consent provided to Meta, please contact Meta directly.

You may withdraw your consent to data processing at any time with future effect; to do so, please contact Meta Platforms Ireland Limited directly. Withdrawal of consent does not affect the lawfulness of data processing carried out prior to the withdrawal.

For detailed information on the processing and use of data by the providers on their sites, as well as contact information, your rights in this regard, and settings to protect your privacy—in particular, options to object (so-called “opt-out”)—please refer to the privacy policy of the Instagram service: https://help.instagram.com/519522125107875.

You can find the opt-out option in the privacy settings of your Instagram account at:
https://www.instagram.com/accounts/login/?next=/accounts/privacy_and_security/.

To the extent that personal data is transferred to the U.S., this is done—provided Meta is certified under the EU-U.S. Data Privacy Framework—on the basis of the EU Commission’s adequacy decision. Otherwise, the transfer is based on standard contractual clauses pursuant to Art. 46 of the GDPR.

YouTube with Enhanced Privacy

This website embeds videos from YouTube. The website is operated by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our webpages that embeds YouTube, a connection is established with YouTube’s servers. In the process, the YouTube server is informed which of our pages you have visited. If you are logged into your YouTube account, you allow YouTube to directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your YouTube account.

We use YouTube in enhanced privacy mode. According to YouTube, videos played in enhanced privacy mode are not used to personalize the YouTube browsing experience. Ads displayed in enhanced privacy mode are also not personalized. According to Google, even in enhanced privacy mode, local storage elements or comparable technologies may be used in the user’s browser. To the extent that information is stored on or read from your device and this is not strictly necessary, this will only occur with your consent in accordance with Section 25(1) of the TDDDG. Details on enhanced privacy mode can be found here:
https://support.google.com/youtube/answer/171780.

In some cases, activating a YouTube video may trigger additional data processing operations over which we have no control.

YouTube videos are loaded only with your consent or upon your active approval. To the extent that information is stored on or read from your device in this process, this is done on the basis of Section 25(1) of the TDDDG. The subsequent processing of personal data is based on Article 6(1)(a) of the GDPR.

For more information about data protection on YouTube, please see their Privacy Policy at: https://policies.google.com/privacy?hl=de.

The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the United States designed to ensure compliance with European data protection standards for data processing in the United States. Every company certified under the DPF commits to complying with these data protection standards. For more information, please visit the provider’s website at the following link: https://www.dataprivacyframework.gov/participant/5780.

XING / Kununu - Profile

We maintain profiles on XING and Kununu to showcase our company. The provider of XING and Kununu is New Work SE, Dammtorstraße 30, 20354 Hamburg.

Our XING profile serves to actively and effectively engage with potential employees in a professional setting. On this page, we also share information about our company, thereby presenting ourselves to the outside world . There, we provide information about our services, products, interesting special promotions, and employment opportunities within our company.

If XING asks you for consent to data processing—for example, via a checkbox—the legal basis for the data processing is Article 6(1)(a) of the GDPR.

For detailed information on how these providers process and use data on their sites, as well as contact information, your rights in this regard, and settings to protect your privacy, please refer to XING’s privacy policy: https://privacy.xing.com/de/datenschutzerklaerung

Kununu primarily offers users the opportunity to post and view reviews of employers. At the same time, we use our online presence on Kununu to provide information about our company, career opportunities, and our products and services.

When you visit our page on kununu or interact with it in other ways, kununu collects users’ personal data, for example through the use of cookies. Such data collection by kununu may also occur for users who are not logged in or registered with kununu. Information about data collection and further processing by kununu can be found in kununu’s privacy policy at
https://privacy.xing.com/de/datenschutzerklaerung/druckversion

To the extent that we jointly determine the purposes and means of individual processing operations with New Work SE, joint controllership exists in accordance with Article 26 of the GDPR. In all other respects, New Work SE processes personal data under its own responsibility.

The legal basis for the processing of your data is your consent pursuant to Article 6(1)(a) of the General Data Protection Regulation (GDPR), to the extent that you have provided it, as well as the protection of legitimate interests pursuant to Article 6(1)(f) of the GDPR. If you contact us, the legal basis may also be Article 6(1)(b) of the GDPR (necessity for the performance of pre-contractual measures).

The legitimate interest in question is that we would like to communicate with you via our kununu page and inform you about our company, career opportunities and jobs, as well as our products and services.

You can find information about how XING and Kununu process your data in XING’s Privacy Policy, which applies to all services at provided by New Work SE: https://privacy.xing.com/de/datenschutzerklaerung/allgemeine-hinweise.

Since only New Work SE has information about the data actually collected and its use on the respective platforms, requests for information and the exercise of other data subject rights should be directed there. Of course, you can also send such requests to us; we will forward them to the operator for further processing.

Via the XING and Kununu platforms, we process only the data that you provide to us directly. This includes comments, inquiries, your user profile, reviews, and similar information. This data generally remains visible on the platform as long as the respective post, comment, message, or our profile exists, unless it is deleted beforehand or statutory retention requirements prevent this.

The data we use is processed exclusively within the EU or the EEA. We do not transfer data to third countries.

Ordering Service via WhatsApp through MessengerPeople by Sinch

We use the services of MessengerPeople GmbH, Herzog-Heinrich-Str. 9, 80336 Munich, to send you the content you have requested via various messaging services. The privacy policy of our service provider, MessengerPeople GmbH, applies to this use: https://www.messengerpeople.com/de/datenschutzerklaerung/.

WhatsApp is a service provided by WhatsApp Ireland Limited or its affiliated companies within the Meta Group. The applicable provider and privacy information can be found in WhatsApp’s Privacy Policy.

The use of WhatsApp is governed by WhatsApp’s Terms of Service and Privacy Policy, over which we have no control. Depending on the settings of your device and the WhatsApp app, WhatsApp may access certain information on your device, such as your phone number, device information, or—if you have shared them—your contacts.

The use of WhatsApp is voluntary. You may also submit orders and inquiries to us via our other contact channels, in particular by email, phone, or through the web store.

MessengerPeople processes personal data on our behalf. We have therefore entered into a data processing agreement with MessengerPeople in accordance with Article 28(3) of the GDPR, in which MessengerPeople undertakes to protect your personal data and not to disclose it to third parties for purposes other than those mentioned above.

If you contact us via WhatsApp, we process the data you provide to handle your inquiry or order. To the extent that the communication serves the purpose of entering into or performing a contract, the legal basis is Article 6(1)(b) of the GDPR. In all other cases, processing is based on our legitimate interest in simple and user-friendly communication pursuant to Article 6(1)(f) of the GDPR. Transfers to third countries via WhatsApp are additionally governed by Article 44 et seq. of the GDPR. An existing WhatsApp user account is required to use this service.

According to the current WhatsApp Terms of Service, the data controller for users in the European Economic Area is generally WhatsApp Ireland Limited. Details can be found in WhatsApp’s privacy policy.

Please read WhatsApp’s Privacy Policy (https://www.whatsapp.com/legal/) carefully before using WhatsApp.

Please note, however, that we have no influence over WhatsApp’s Terms of Service.

When using WhatsApp, personal data—in particular communication metadata—may be processed by WhatsApp or companies within the Meta Group. To the extent that personal data is transferred to third countries in this context, such transfers are carried out in accordance with Articles 44 et seq. of the GDPR, in particular on the basis of an adequacy decision or appropriate safeguards such as standard contractual clauses.

When you place an order with us via WhatsApp, you are providing us with your phone number. We use this number solely for WhatsApp communication with you and the chat content solely to process your order.

In order for us to process your order, the following information is required:

  • First name, last name
  • Customer number
  • Construction site
  • Item description / Item number
  • Delivery + Time Frame OR Pickup + Branch

The legal basis for data processing is therefore Article 6(1)(b) of the GDPR (pre-contractual measures or performance of a contract).

We have no influence over the processing of personal data by WhatsApp or companies within the Meta Group acting on their own behalf. We remain responsible for the processing of data that we carry out ourselves in connection with your inquiry or order.

Your Rights and Exercising Your Rights

You are entitled to the following rights in accordance with the statutory requirements. To exercise your rights, you may contact us at any time, in particular by email at: datenschutz@kraft-baustoffe.de.

Right of Access:

Pursuant to Article 15 of the GDPR, you have the right to request information about your personal data processed by us. In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned retention period, the existence of a right to rectification, erasure, restriction of processing, or objection; the existence of a right to lodge a complaint; the origin of your data, if it was not collected by us; and the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details.

Rectification:

Pursuant to Article 16 of the GDPR, you have the right to request, without undue delay, the rectification of inaccurate personal data or the completion of your personal data stored by us.

Erasure:

Pursuant to Article 17 of the GDPR, you have the right to request the erasure of your personal data stored by us, unless processing is necessary for the exercise of the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims.

Restriction of processing:

Pursuant to Art. 18 of the GDPR, you have the right to request the restriction of the processing of your personal data if you contest the accuracy of the data, if the processing is unlawful but you oppose its erasure, and if we no longer need the data but you require it to assert, exercise, or defend legal claims, or you have objected to the processing pursuant to Article 21 of the GDPR.

Data Portability:

Pursuant to Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller;

Withdrawal of Your Consent:

Pursuant to Article 7(3) of the GDPR, you have the right to withdraw your consent at any time. As a result, we may no longer continue processing data based on that consent in the future.

Please send your withdrawal to the contact information provided above or via email to: datenschutz@kraft-baustoffe.de.

Complaint to a supervisory authority:

Pursuant to Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority at your usual place of residence, your place of work, or the location of our company headquarters.

The Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, is generally responsible for our company.

Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions.

The controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

In connection with the use of information society services—notwithstanding Directive 2002/58/EC—you have the option to exercise your right to object using automated procedures that employ technical specifications.

If you wish to exercise your right of withdrawal or objection, simply send an email to: datenschutz@kraft-baustoffe.de.

Changes

From time to time, it is necessary to adapt the content of this Privacy Policy for data collected in the future. We therefore reserve the right to change this Privacy Policy at any time. We will also publish the updated version of the Privacy Policy here. If you visit us again, you should therefore review the Privacy Policy once more.

Status of the Privacy Policy

The constant evolution of the Internet makes it necessary to update our privacy policy from time to time. We reserve the right to make such changes at any time.

Effective: June 2026