Privacy Policy

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection provisions is:

Tecklenburg GmbH, Lingsforter Straße 21, 47638 Straelen, Germany
Tel: (0 28 34) 91 36 0 · Fax: (0 28 34) 91 36 91
Email: info@tecklenburg-bau.de · Web: www.tecklenburg-bau.de
Managing Director: Leonie Tillmans
Commercial Register: Amtsgericht Kleve, HRB 3633 · VAT ID: DE 119946385

We have appointed a Data Protection Officer. You can reach her at:

Jennifer Figge
Data Protection Officer of Tecklenburg GmbH
Lingsforter Straße 21, 47638 Straelen, Germany
Email: info@tecklenburg-bau.de (subject line “Data Protection Officer”)

As a general rule, we process the personal data of our users only to the extent necessary to provide a functioning website and our content and services. Any processing beyond this takes place only with your consent or on another legal basis.

Where we obtain consent, the legal basis is Art. 6(1)(a) GDPR. For processing to perform a contract or to carry out pre-contractual measures, it is Art. 6(1)(b) GDPR. Where processing is necessary to comply with a legal obligation, we rely on Art. 6(1)(c) GDPR. Where processing is based on a legitimate interest of ours or of a third party and your interests or fundamental rights do not override it, Art. 6(1)(f) GDPR is the basis. Storing information on your device and accessing it are additionally governed by section 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG).

We erase personal data as soon as the purpose of storage no longer applies. Data is retained beyond this only where statutory retention obligations exist — in particular under the German Commercial Code (Handelsgesetzbuch, HGB) and the German Fiscal Code (Abgabenordnung, AO). We state the specific periods for each individual processing activity.

This website is operated for us by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Delivery of the page and execution of the server functions for this website take place in the Frankfurt am Main, Germany region (fra1); this setting is stored in the application's configuration.

Each time you access our website, data from the accessing device's system is automatically collected and processed in log files by our hosting provider. The following information is processed:

• the IP address of the requesting device
• date and time of the request (in Coordinated Universal Time, UTC)
• the requested address (path), including any query parameters
• the requested domain or subdomain
• the HTTP method used (e.g. GET, POST)
• the HTTP status code returned
• the browser identifier (user agent), including operating system and version
• the previously visited page (referrer), where your browser transmits it
• technical identifiers and metrics of the request: request ID, processing region, cache status, execution duration and the result of the upstream attack filtering

We do not combine this data with other data sources. We do not evaluate the log data for advertising or analytics purposes.

Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical deliverability of the website, in the stability and security of the system, and in investigating and defending against attacks.

The recipient is Vercel Inc. as processor on the basis of a contract pursuant to Art. 28 GDPR. Processing for this website takes place in the Frankfurt am Main region. Access from the United States by Vercel Inc. — for example in the context of maintenance and support — cannot be ruled out; see section 16 for further details.

The runtime logs of the server functions are kept by our provider only briefly for troubleshooting purposes; the retention period depends on the plan booked and, according to the provider, ranges from one to 30 days. They are then automatically deleted. No longer-term evaluation takes place. If an incident is investigated, individual records may continue to be processed until the investigation is concluded.

When you access the publicly available pages of this website, no cookies are set. We use neither analytics nor advertising nor tracking cookies. We control the language selection via the page address (/de/, /en/, /nl/) rather than through storage on your device. The following are stored exclusively:

Name	Type	Provider	Purpose	Content	Duration
tb-consent	Local storage (localStorage)	Tecklenburg GmbH (this website)	Remembers your decision in the consent banner so that you are not asked again on every visit	Your choice regarding the external map (yes/no), a version number and the time of the decision	Remains stored until you change it or delete the website data in your browser — it does not technically expire on its own
sb-…-auth-token	Cookie (httpOnly, Secure, SameSite=Lax), may be split across several parts	Tecklenburg GmbH (own server)	Login session in the internal employee area; is set only after a login	Session token (access and refresh token)	Until logout or the session expires; the token is renewed during use

Both entries are strictly necessary to provide the service you have expressly requested: storing your consent decision and maintaining a login session. Storage and access are therefore exempt from the consent requirement under section 25(2) no. 2 TDDDG. We base the subsequent processing on Art. 6(1)(c) GDPR (evidencing consent pursuant to Art. 7(1) GDPR) or Art. 6(1)(b) and (f) GDPR (login session).

You can view local storage and cookies in your browser at any time, delete them individually or completely, and prevent their future storage. If you delete tb-consent, the consent banner will reappear the next time you visit. If the login cookies are blocked, logging in to the internal area is no longer possible; use of the public pages remains unrestricted.

On your first visit, we display a notice through which you decide on the only consent-requiring element embedded on this website — the external location map. Declining is designed to be just as easy and equally prominent as accepting. Without your consent, the map is not loaded and no data is transmitted to the map provider in this respect. All other content remains fully available to you regardless of your decision.

Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG.

You can withdraw your consent at any time with effect for the future; the lawfulness of processing carried out until that point remains unaffected. You can declare your withdrawal via the Cookie Settings page, permanently accessible in the footer of every page under “Legal” — or by deleting tb-consent in your browser.

On our homepage we embed an interactive map showing our company location. We source the map material from the OpenFreeMap service at tiles.openfreemap.org. According to its own information, the provider is Hyperknot Software Kft., based in Hungary. The map data is based on OpenStreetMap.

The map is loaded only after you have given your consent. Until then, you see a placeholder in its place with a “Load map” button. Only when it is loaded does your browser establish a connection to OpenFreeMap's servers. In the process, your IP address and the technically necessary connection data (including browser identifier, requested tile areas) are transmitted to the provider. The provider does not set cookies for the map delivery and does not require an access key.

Your consent pursuant to Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG.

We want to show you our location clearly and make it easier for you to find your way to us.

The recipient is Hyperknot Software Kft. (Hungary), a provider based within the European Union. According to the provider's privacy information, IP addresses are not logged by default; in the event of a detected security incident, the provider may temporarily activate logging for up to 30 days.

You can withdraw your consent at any time via the Cookie Settings page. The map will then no longer be loaded.

Our website provides a contact form. We process the information you enter there:

• type of enquiry (mandatory)
• name (mandatory)
• email address (mandatory)
• phone number (optional)
• organisation (optional)
• your message (mandatory or optional, depending on the type of enquiry)
• additional information about your enquiry, such as project volume or interest (optional)

Your information is not stored in a database of this website. It is exclusively converted into an email and delivered to our company mailbox. For the technical delivery we use the service provider Resend.

To protect against automated mass submissions, the form contains an additional field that is invisible to you and is not filled in by humans, as well as a throttle that allows one request per email address per minute. No captcha service is used; accordingly, no data is transmitted to third parties in this respect.

Art. 6(1)(f) GDPR. Our legitimate interest lies in being able to process and respond to the contact you have initiated yourself. If your enquiry is aimed at concluding or initiating a contract, Art. 6(1)(b) GDPR additionally applies as the legal basis. We do not obtain separate consent to process your enquiry — so you do not need to give a declaration of consent in order to write to us.

In doing so, the provider processes the content of the message, the sender and recipient addresses, and delivery logs, and, according to its own information, stores this data in the United States; according to its own information, the provider does not offer storage within the EU. See section 16 for the safeguards applied. Within our company, only the departments responsible for handling the matter are given access. No disclosure to other third parties takes place.

Exclusively the processing and answering of your enquiry.

We erase your enquiry once it has been fully processed and no further queries are to be expected. If the matter is part of initiating a business relationship or a contract, the statutory retention periods apply (generally six or ten years under section 257 of the German Commercial Code (HGB) and section 147 of the German Fiscal Code (AO)). The delivery service provider additionally generates delivery logs; the provider does not specify a fixed retention period and, according to its own information, stores them only for as long as is necessary for the purpose of delivery.

You can also contact us directly by email or telephone. In doing so, we process the information you provide — for emails, in particular the sender address, subject and content; for calls, the information you tell us. Please note that unencrypted emails may be read by third parties while in transit.

Art. 6(1)(f) GDPR; for contract-related matters, Art. 6(1)(b) GDPR additionally applies.

Your email is processed in our company mailbox. We erase your message once it has been fully processed, subject to statutory retention obligations.

You can apply via the email address given in the “Career” section (bewerbung@tecklenburg-bau.de). This website does not offer an application form with file upload. We process the data you send us in connection with your application — typically contact details, CV, references and other documents. Your documents are reviewed by the HR department and shared internally only with those persons involved in the decision on the respective position.

Art. 6(1)(b) GDPR in conjunction with Art. 88 GDPR: the processing is necessary to carry out pre-contractual measures taken at your request — your application. If you voluntarily provide information falling within the special categories within the meaning of Art. 9 GDPR (for example regarding a severe disability), it is processed only on the basis of your express consent pursuant to Art. 9(2)(a) GDPR or pursuant to Art. 9(2)(b) GDPR. Any further retention after conclusion of the process takes place on the basis of Art. 6(1)(f) GDPR (defence against claims) or your consent.

Assessing your suitability for the advertised or desired position and carrying out the application process.

If you receive a rejection, we erase your applicant data six months after conclusion of the process. This period reflects the fact that claims may be raised under the German General Act on Equal Treatment (Allgemeines Gleichbehandlungsgesetz, AGG). If you are hired, we transfer the data to your personnel file. We retain your application for future positions only with your express consent, which you may withdraw at any time.

We display our overall rating as well as individual reviews from our Google Business Profile. This content is retrieved once a day by our server via the Google Places interface and then output as text on our page.

Your browser does not establish a connection to Google in the process. Neither your IP address nor any other data from your device is transmitted to Google, no Google script is loaded, and no images are loaded from Google's servers. Only when you click the explicitly marked link to our Google profile do you leave our website; from that point on, Google's privacy policy applies.

Art. 6(1)(f) GDPR. Our legitimate interest lies in presenting customer feedback.

The reviews displayed are contributions that the respective individuals have themselves published publicly in their Google account. We reproduce the review text, the author name shown by Google, and the time reference. If you do not want a review you wrote to appear on our website, please contact us using the details given in section 1; we will then hide your review.

The retrieved review content is cached on our server for a maximum of 24 hours and is then replaced by the next retrieval.

The following processing activities concern exclusively employees and other authorised persons with personal access. They do not take place for visitors to the public pages.

The internal area at /intern is accessible only after logging in with personal credentials and a second factor. There, we process: the email address and role of the account, characteristics of the login session, setup data for the second factor, the content stored in the media area and editorial section, including a record of who uploaded or edited it, and an audit trail of who invited, changed or blocked which user accounts.

Art. 6(1)(b) GDPR in conjunction with the employment relationship, as well as Art. 6(1)(f) GDPR (secure provision of internal work tools, traceability of permission changes, protection against unauthorised access).

Recipients and place of processing — The data is processed on a self-operated server environment commissioned by us from Pixelmeister GmbH (address geiger.db.pixelmeister.de), which is run on infrastructure of Hetzner Online GmbH at the Falkenstein data centre (Saxony, Germany). This is based on a data processing agreement pursuant to Art. 28 GDPR.

Provision of internal work tools (media library, editorial section, knowledge base, settings) as well as access and permission management.

We store credentials and roles for the duration of the access authorisation. We retain the audit trail of user management for security and evidentiary purposes for as long as the internal area is operated. We store content in the media library and editorial section for as long as it is needed to operate the website.

In the internal area, logged-in employees have access to an assistant that answers questions about stored company documents. When a question is asked, the question entered and the matching excerpts from the internal knowledge base are transmitted to the language and embedding services used and processed there to generate the answer. When a document is added to the knowledge base, its text sections are transmitted to the embedding service. The assistant is not accessible to visitors of the public website. Personal data should not be entered into the knowledge base.

Art. 6(1)(f) GDPR (efficient access to internal documents).

Recipients are:

• Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA — generation of the response texts. According to the provider, inputs and outputs of the interface are deleted within 30 days by default, unless a different agreement is in place.
• Voyage AI Innovations Inc., Palo Alto, California, USA (a company of MongoDB, Inc.) — conversion of text into vector representations for similarity search.

Both process the data in the United States. See section 16 for the safeguards applied.

We do not permanently store the assistant's questions and answers. The vector representations of the knowledge base persist for as long as the associated document is stored.

In the footer and at individual points, we link to our profiles on LinkedIn, Instagram, Facebook and YouTube, as well as to our listing on Google Maps. These are mere links — no plug-ins, data-transmitting buttons, tracking pixels or embedded content from these providers are integrated. As long as you do not click these links, no data whatsoever is transmitted to the providers named.

If you click a link, you leave our website. From that point, sole responsibility for further processing lies with the respective provider; its privacy policy applies. We have no influence on the nature, scope and purpose of that processing.

Disclosure to other third parties takes place only with your consent, where there is a legal obligation, or to assert, exercise or defend legal claims.

Personal data is transferred to the United States when you use our contact form or when we send you a system email (delivery service provider Resend), as well as — exclusively internally — when the AI assistant is used (Anthropic, Voyage AI). For the delivery of the website itself, processing takes place in Frankfurt am Main; however, access by the hosting provider from the United States in the context of operations and support cannot be ruled out.

The United States is a third country without a general adequacy status. We base the transfer on the Standard Contractual Clauses issued by the European Commission pursuant to Art. 46(2)(c) GDPR, which form part of the respective data processing agreements. Where a provider is additionally certified under the EU-U.S. Data Privacy Framework, the transfer is, to that extent, based on the adequacy decision pursuant to Art. 45 GDPR.

Despite these safeguards, a transfer to the United States carries the risk that US authorities may access the data and that data subject rights may not be enforceable to the same extent as within the European Union.

This website uses TLS encryption (SSL) throughout. You can recognise an encrypted connection by the fact that the address in your browser begins with https:// and a padlock icon is displayed. As long as encryption is active, the data you transmit to us cannot be read by third parties. In addition, we instruct browsers via the HSTS mechanism to access our page exclusively over an encrypted connection.

We take technical and organisational measures pursuant to Art. 32 GDPR against accidental or deliberate manipulation, loss, destruction and unauthorised access. These include security-relevant response headers, a mandatory second factor for internal accounts, login cookies protected against script-based reading, and restrictive permission assignment in the database. Our measures are continuously adapted.

If personal data about you is processed, you are a data subject within the meaning of the GDPR. An informal message to the contact details given in section 1 or to our Data Protection Officer is sufficient to exercise this right.

You may request confirmation as to whether we process personal data concerning you. If so, you are entitled to information about this data as well as about the purposes of processing, categories of data, recipients, the envisaged retention period, the existence of your further rights, the origin of the data, and the existence of automated decision-making. Where data is transferred to a third country, you are entitled to be informed about the appropriate safeguards pursuant to Art. 46 GDPR.

You may request the immediate rectification of inaccurate data and the completion of incomplete data.

You may request immediate erasure, provided that one of the grounds set out in Art. 17(1) GDPR applies and the processing is not necessary under Art. 17(3) GDPR — for example, to fulfil a retention obligation or to assert legal claims.

Under the conditions set out in Art. 18 GDPR, you may request that we restrict processing, for example while the accuracy of contested data is being verified.

If you have requested rectification, erasure or restriction, we will notify all recipients accordingly, unless this proves impossible or involves disproportionate effort. You may request to be informed about these recipients.

Where processing is based on consent or a contract and is carried out by automated means, you may request to receive the data you have provided in a structured, commonly used and machine-readable format, or — where technically feasible — to have it transmitted directly to another controller.

You may withdraw any consent given at any time with effect for the future, without affecting the lawfulness of processing carried out until that point. For consent relating to the location map, use the Cookie Settings page.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority — see section 19.

You may lodge a complaint with any data protection supervisory authority, in particular the authority of your place of residence, your place of work or the place of the alleged infringement. The authority will inform you of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44, 40102 Düsseldorf, Germany
Tel: +49 211 38424-0 · Email: poststelle@ldi.nrw.de · Web: www.ldi.nrw.de

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. On this website, this concerns in particular the processing of server log data (section 4), the handling of your enquiry via the contact form or by email (sections 8 and 9), and the display of reviews (section 11).

If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

The objection is not bound to any particular form. A message to the contact details given in section 1 or to our Data Protection Officer is sufficient.

Automated decision-making in individual cases, including profiling within the meaning of Art. 22 GDPR, does not take place on this website. We do not create usage profiles, we do not carry out any reach measurement, and we do not combine the resulting technical data into personal profiles.

We reserve the right to adapt this privacy policy if the legal situation, our services or the type of data processing change. For your subsequent visits, the version currently available on this page applies. We will obtain renewed consent for material changes affecting consent already given. The version stated at the beginning applies.