Privacy Policy

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection provisions is:

Tecklenburg GmbH, Lingsforter Straße 21, 47638 Straelen, Germany
Tel: (0 28 34) 91 36 0 · Fax: (0 28 34) 91 36 91
Email: info@tecklenburg-bau.de · Web: www.tecklenburg-bau.de
Managing Director: Leonie Tillmans
Commercial Register: Amtsgericht Kleve, HRB 3633 · VAT ID: DE 119946385

We have appointed a Data Protection Officer. You can reach her at:

Jennifer Figge
Data Protection Officer of Tecklenburg GmbH
Lingsforter Straße 21, 47638 Straelen, Germany
Email: info@tecklenburg-bau.de (subject line “Data Protection Officer”)

As a general rule, we process the personal data of our users only to the extent necessary to provide a functioning website and our content and services. Any processing beyond this takes place only with your consent or on another legal basis.

Where we obtain consent, the legal basis is Art. 6(1)(a) GDPR. For processing to perform a contract or to carry out pre-contractual measures, it is Art. 6(1)(b) GDPR. Where processing is necessary to comply with a legal obligation, we rely on Art. 6(1)(c) GDPR. Where processing is based on a legitimate interest of ours or of a third party and your interests or fundamental rights do not override it, Art. 6(1)(f) GDPR is the basis. Storing information on your device and accessing it are additionally governed by section 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG).

We erase personal data as soon as the purpose of storage no longer applies. Data is retained beyond this only where statutory retention obligations exist — in particular under the German Commercial Code (Handelsgesetzbuch, HGB) and the German Fiscal Code (Abgabenordnung, AO). We state the specific periods for each individual processing activity.

This website is operated for us by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Delivery of the page and execution of the server functions for this website take place in the Frankfurt am Main, Germany region (fra1); this setting is stored in the application's configuration.

Each time you access our website, data from the accessing device's system is automatically collected and processed in log files by our hosting provider. The following information is processed:

• the IP address of the requesting device
• date and time of the request (in Coordinated Universal Time, UTC)
• the requested address (path), including any query parameters
• the requested domain or subdomain
• the HTTP method used (e.g. GET, POST)
• the HTTP status code returned
• the browser identifier (user agent), including operating system and version
• the previously visited page (referrer), where your browser transmits it
• technical identifiers and metrics of the request: request ID, processing region, cache status, execution duration and the result of the upstream attack filtering

We do not combine this data with other data sources. We do not evaluate the log data for advertising or analytics purposes.

Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical deliverability of the website, in the stability and security of the system, and in investigating and defending against attacks.

The recipient is Vercel Inc. as processor on the basis of a contract pursuant to Art. 28 GDPR. Processing for this website takes place in the Frankfurt am Main region. Access from the United States by Vercel Inc. — for example in the context of maintenance and support — cannot be ruled out; see section 16 for further details.

The runtime logs of the server functions are kept by our provider only briefly for troubleshooting purposes; the retention period depends on the plan booked and, according to the provider, ranges from one to 30 days. They are then automatically deleted. No longer-term evaluation takes place. If an incident is investigated, individual records may continue to be processed until the investigation is concluded.

When you access the publicly available pages of this website, no cookies are set. We use neither analytics nor advertising nor tracking cookies. We control the language selection via the page address (/de/, /en/, /nl/) rather than through storage on your device. The following are stored exclusively:

Name	Type	Provider	Purpose	Content	Duration
tb-consent	Local storage (localStorage)	Tecklenburg GmbH (this website)	Remembers your decision in the consent banner so that you are not asked again on every visit	Your choice regarding the external map (yes/no), a version number and the time of the decision	Remains stored until you change it or delete the website data in your browser — it does not technically expire on its own
sb-…-auth-token	Cookie (httpOnly, Secure, SameSite=Lax), may be split across several parts	Tecklenburg GmbH (own server)	Login session in the internal employee area; is set only after a login	Session token (access and refresh token)	Until logout or the session expires; the token is renewed during use

Both entries are strictly necessary to provide the service you have expressly requested: storing your consent decision and maintaining a login session. Storage and access are therefore exempt from the consent requirement under section 25(2) no. 2 TDDDG. We base the subsequent processing on Art. 6(1)(c) GDPR (evidencing consent pursuant to Art. 7(1) GDPR) or Art. 6(1)(b) and (f) GDPR (login session).

You can view local storage and cookies in your browser at any time, delete them individually or completely, and prevent their future storage. If you delete tb-consent, the consent banner will reappear the next time you visit. If the login cookies are blocked, logging in to the internal area is no longer possible; use of the public pages remains unrestricted.

On your first visit, we display a notice through which you decide on the only consent-requiring element embedded on this website — the external location map. Declining is designed to be just as easy and equally prominent as accepting. Without your consent, the map is not loaded and no data is transmitted to the map provider in this respect. All other content remains fully available to you regardless of your decision.

Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG.

You can withdraw your consent at any time with effect for the future; the lawfulness of processing carried out until that point remains unaffected. You can declare your withdrawal via the Cookie Settings page, permanently accessible in the footer of every page under “Legal” — or by deleting tb-consent in your browser.

On our homepage we embed an interactive map showing our company location. We source the map material from the OpenFreeMap service at tiles.openfreemap.org. According to its own information, the provider is Hyperknot Software Kft., based in Hungary. The map data is based on OpenStreetMap.

The map is loaded only after you have given your consent. Until then, you see a placeholder in its place with a “Load map” button. Only when it is loaded does your browser establish a connection to OpenFreeMap's servers. In the process, your IP address and the technically necessary connection data (including browser identifier, requested tile areas) are transmitted to the provider. The provider does not set cookies for the map delivery and does not require an access key.

Your consent pursuant to Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG.

We want to show you our location clearly and make it easier for you to find your way to us.

The recipient is Hyperknot Software Kft. (Hungary), a provider based within the European Union. According to the provider's privacy information, IP addresses are not logged by default; in the event of a detected security incident, the provider may temporarily activate logging for up to 30 days.

You can withdraw your consent at any time via the Cookie Settings page. The map will then no longer be loaded.

Our website provides a contact form. We process the information you enter there:

• type of enquiry (mandatory)
• name (mandatory)
• email address (mandatory)
• phone number (optional)
• organisation (optional)
• your message (mandatory or optional, depending on the type of enquiry)
• additional information about your enquiry, such as project volume or interest (optional)

Your information from the contact form is not stored in a database of this website. It is exclusively converted into an email and delivered to our company mailbox. For the technical delivery we use the service provider Resend. After submitting the form, you automatically receive an acknowledgement of receipt at the email address you provided; it contains only the confirmation of receipt and the type of enquiry you selected – no advertising and no offers. As with processing your enquiry, the legal basis is Art. 6(1)(f) GDPR, and delivery uses the same service provider.

To protect against automated mass submissions, the form contains an additional field that is invisible to you and is not filled in by humans, as well as a throttle that allows one request per email address per minute. No captcha service is used; accordingly, no data is transmitted to third parties in this respect.

Art. 6(1)(f) GDPR. Our legitimate interest lies in being able to process and respond to the contact you have initiated yourself. If your enquiry is aimed at concluding or initiating a contract, Art. 6(1)(b) GDPR additionally applies as the legal basis. We do not obtain separate consent to process your enquiry — so you do not need to give a declaration of consent in order to write to us.

In doing so, the provider processes the content of the message, the sender and recipient addresses, and delivery logs, and, according to its own information, stores this data in the United States; according to its own information, the provider does not offer storage within the EU. See section 16 for the safeguards applied. Within our company, only the departments responsible for handling the matter are given access. No disclosure to other third parties takes place.

Exclusively the processing and answering of your enquiry.

We erase your enquiry once it has been fully processed and no further queries are to be expected. If the matter is part of initiating a business relationship or a contract, the statutory retention periods apply (generally six or ten years under section 257 of the German Commercial Code (HGB) and section 147 of the German Fiscal Code (AO)). The delivery service provider additionally generates delivery logs; according to the provider, messages and delivery logs are retained for 30 days.

For conversations at our trade fair stand at EXPO REAL 2026 (5 and 6 October 2026, Messe München), you can book a 30-minute appointment via a dedicated booking page. We process the information you enter there:

• name (mandatory)
• email address (mandatory)
• the time slot you choose (mandatory)
• company (optional)
• phone number (optional)
• topic or message (optional)
• the language version of the page through which you book

Without the mandatory information, we cannot accept a booking. Unlike the contact form, we store your booking in a database, so that each slot is only assigned as many times as we can hold conversations. We additionally receive your booking as an email to our company mailbox, and you receive a confirmation with a calendar file at the address you provide. The confirmation contains only the appointment details and no advertising.

To protect against automated mass bookings, the form contains an additional field that is invisible to you, as well as a limit on bookings per connection and time period; for this purpose, your IP address is processed only briefly in working memory and is not stored. No captcha service is used.

Art. 6(1)(f) GDPR. Our legitimate interest lies in organising the conversations you have requested at the trade fair, avoiding overbooking, confirming your appointment, and preparing for the conversation. If you book the appointment with a view to a contract with you, Art. 6(1)(b) GDPR additionally applies as the legal basis. We do not obtain separate consent. You may object to this processing at any time (section 20); we will then cancel your booking and delete it.

The booking data is stored in a database that Pixelmeister GmbH operates on our behalf on infrastructure of Hetzner Online GmbH in the Falkenstein data centre (Saxony, Germany) (see section 15). This is based on a data processing agreement under Art. 28 GDPR. The form itself is processed via our hosting provider in Frankfurt am Main (section 4). We send the booking email to us and the confirmation to you via Resend. According to its own information, the provider stores message content, addresses, and delivery logs in the United States; see section 16 for the safeguards. Within our company, only the employees who organise or conduct the conversations at the trade fair are given access.

Exclusively the organisation, confirmation, preparation, and conduct of the booked conversations at EXPO REAL 2026, as well as the avoidance of overbooking.

We delete the booking data in the database on 21 October 2026, two weeks after the end of the trade fair. After that, it remains in our backups until these are overwritten in the normal course of business. We delete the booking email in our company mailbox by 31 December 2026 at the latest. If further business correspondence arises from the conversation, the information on the contact form applies to it, including the statutory retention periods. At the delivery service provider, messages and delivery logs are retained for 30 days according to the provider. If you cancel your appointment or object to the processing, we delete your booking without delay.

You can also contact us directly by email or telephone. In doing so, we process the information you provide — for emails, in particular the sender address, subject and content; for calls, the information you tell us. Please note that unencrypted emails may be read by third parties while in transit. You are welcome to ask questions about open positions by phone; please submit the application itself via the careers portal (section 10).

Art. 6(1)(f) GDPR; for contract-related matters, Art. 6(1)(b) GDPR additionally applies.

Your email is processed in our company mailbox. We erase your message once it has been fully processed, subject to statutory retention obligations. Application documents that reach us by email are handled in accordance with section 10.

Applying via the careers portal. This website contains no application form and does not accept applications. On the careers page we show the open positions of Tecklenburg GmbH. Our server retrieves the list of positions from the careers portal of the Geiger Group (karriere.geigergruppe.de); no visitor data is transmitted to the portal in the process. To apply, a link opens the portal in a new tab. From the moment you open the portal, its operator processes your data; the privacy notice of the Geiger Group (section “Applications”) applies. According to that notice, the controller for applications via the central careers portal is Wilhelm Geiger GmbH & Co. KG, Wilhelm-Geiger-Straße 1, 87561 Oberstdorf, Germany; the portal is operated on its behalf by the service provider rexx systems GmbH, Hamburg. Data protection officer of the Geiger Group: datenschutzbeauftragter@geigergruppe.de.

Earlier online applications. Until 22 October 2026 you could apply via a form on this website. The form has been switched off; it no longer collects any data. For applications received until then, we processed the details you entered there:

• the position you applied for (required)
• first and last name (required)
• email address (required)
• phone number, postcode and place of residence (optional)
• earliest start date, notice period and salary expectations (optional)
• how you heard about us (optional)
• your message or cover letter (optional)
• the documents you uploaded as PDF, JPG or PNG (optional)
• the language version of the form

These details were not stored in a database of this website; they were only turned into an email to our applications mailbox, and you automatically received a confirmation of receipt. Your documents are reviewed by the staff responsible for recruitment and shared internally only with the people involved in the decision on the respective position.

Applying via the careers portal: The legal bases are stated by the portal's controller in its privacy notice.

Earlier online applications: Art. 6(1)(b) GDPR in conjunction with Art. 88 GDPR: the processing was necessary to take pre-contractual steps at your request — your application. Further retention after the procedure has ended is based on Art. 6(1)(f) GDPR (defence against claims) or your consent.

Careers portal: Where your details go within the portal is governed by the Geiger Group's privacy notice; according to it, the portal is operated with rexx systems GmbH, Hamburg, as service provider. We do not transmit any personal data there via this website.

Earlier online applications: The application email to us and the confirmation of receipt to you were sent via the service provider Resend (Plus Five Five, Inc., USA) on the basis of a data processing agreement under Art. 28 GDPR. The provider processed the content of the message including your uploaded documents, the sender and recipient addresses and delivery logs; according to its own information it stores this data in the United States and does not offer storage within the EU. To that extent, data was transferred to a third country; for the safeguards see section 16. The form itself was processed by our hosting provider in Frankfurt am Main (section 4). Within our company, only the staff responsible for recruitment have access.

Assessing your suitability for the advertised or desired position and carrying out the application process.

For applications via the careers portal, the Geiger Group's retention periods as set out in its privacy notice apply.

Earlier online applications: If you receive a rejection, we erase your applicant data six months after the procedure has ended. This period takes into account that claims may be asserted under the German General Equal Treatment Act (AGG). If you are hired, we transfer the data to your personnel file. We keep you on file for future positions only with your express consent, which you can withdraw at any time. According to the delivery service provider, message contents including attachments and delivery logs are retained for 30 days; for the most recently received applications this period ends at the end of November 2026. Copies remain in our backups until they are overwritten in the regular cycle. Application documents that continue to reach us by email or post are handled in the same way.

The earlier form did not ask for information on health, religion, beliefs, trade union membership or similar special categories within the meaning of Art. 9 GDPR. If you voluntarily provided such information — for example on a severe disability — we process it on the basis of your explicit consent under Art. 9(2)(a) GDPR or under Art. 9(2)(b) GDPR, insofar as this is necessary to exercise rights under employment and social security law. For applications via the careers portal, the Geiger Group's notice applies.

We display our overall rating as well as individual reviews from our Google Business Profile. This content is retrieved once a day by our server via the Google Places interface and then output as text on our page.

Your browser does not establish a connection to Google in the process. Neither your IP address nor any other data from your device is transmitted to Google, no Google script is loaded, and no images are loaded from Google's servers. Only when you click the explicitly marked link to our Google profile do you leave our website; from that point on, Google's privacy policy applies.

Art. 6(1)(f) GDPR. Our legitimate interest lies in presenting customer feedback.

The reviews displayed are contributions that the respective individuals have themselves published publicly in their Google account. We reproduce the review text, the author name shown by Google, and the time reference. If you do not want a review you wrote to appear on our website, please contact us using the details given in section 1; we will then hide your review.

The retrieved review content is cached on our server for a maximum of 24 hours and is then replaced by the next retrieval.

The following processing activities concern exclusively employees and other authorised persons with personal access. They do not take place for visitors to the public pages.

The internal area at /intern is accessible only after logging in with personal credentials and a second factor. There, we process: the email address and role of the account, characteristics of the login session, setup data for the second factor, the content stored in the media area and editorial section, including a record of who uploaded or edited it, and an audit trail of who invited, changed or blocked which user accounts.

Art. 6(1)(b) GDPR in conjunction with the employment relationship, as well as Art. 6(1)(f) GDPR (secure provision of internal work tools, traceability of permission changes, protection against unauthorised access).

Recipients and place of processing — The data is processed on a self-operated server environment commissioned by us from Pixelmeister GmbH (address geiger.db.pixelmeister.de), which is run on infrastructure of Hetzner Online GmbH at the Falkenstein data centre (Saxony, Germany). This is based on a data processing agreement pursuant to Art. 28 GDPR.

Provision of internal work tools (media library, editorial section, knowledge base, settings) as well as access and permission management.

We store credentials and roles for the duration of the access authorisation. We retain the audit trail of user management for security and evidentiary purposes for as long as the internal area is operated. We store content in the media library and editorial section for as long as it is needed to operate the website.

In the internal area, logged-in employees have access to an assistant that answers questions about stored company documents. When a question is asked, the question entered and the matching excerpts from the internal knowledge base are transmitted to the language and embedding services used and processed there to generate the answer. When a document is added to the knowledge base, its text sections are transmitted to the embedding service. The assistant is not accessible to visitors of the public website. Personal data should not be entered into the knowledge base.

Art. 6(1)(f) GDPR (efficient access to internal documents).

Recipients are:

• Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA — generation of the response texts. According to the provider, inputs and outputs of the interface are deleted within 30 days by default, unless a different agreement is in place.
• Voyage AI Innovations Inc., Palo Alto, California, USA (a company of MongoDB, Inc.) — conversion of text into vector representations for similarity search.

Both process the data in the United States. See section 16 for the safeguards applied.

We do not permanently store the assistant's questions and answers. The vector representations of the knowledge base persist for as long as the associated document is stored.

In the footer and at individual points, we link to our profiles on LinkedIn, Instagram, Facebook and YouTube, to our listing on Google Maps and to the careers portal of the Geiger Group (karriere.geigergruppe.de). These are mere links — no plug-ins, data-transmitting buttons, tracking pixels or embedded content from these providers are integrated. As long as you do not click these links, no data whatsoever is transmitted to the providers named. Our server itself retrieves the open positions shown on our careers page from the portal; no visitor data is transmitted in the process.

If you click a link, you leave our website. From that point, sole responsibility for further processing lies with the respective provider; its privacy policy applies. We have no influence on the nature, scope and purpose of that processing. When you open the careers portal, your IP address, among other things, is necessarily transmitted to its operator; for applications see section 10.

Disclosure to other third parties takes place only with your consent, where there is a legal obligation, or to assert, exercise or defend legal claims.

Personal data is transferred to the United States when you use our contact form or the EXPO REAL 2026 appointment booking, when we send you a system email or appointment confirmation (delivery service provider Resend), if you applied via our former application form until 22 October 2026 (retention period at the delivery service provider: 30 days, see section 10), as well as — exclusively internally — when the AI assistant is used (Anthropic, Voyage AI). For the delivery of the website itself, processing takes place in Frankfurt am Main; however, access by the hosting provider from the United States in the context of operations and support cannot be ruled out.

The United States is a third country without a general adequacy status. We base the transfer on the Standard Contractual Clauses issued by the European Commission pursuant to Art. 46(2)(c) GDPR, which form part of the respective data processing agreements. Where a provider is additionally certified under the EU-U.S. Data Privacy Framework, the transfer is, to that extent, based on the adequacy decision pursuant to Art. 45 GDPR.

Despite these safeguards, a transfer to the United States carries the risk that US authorities may access the data and that data subject rights may not be enforceable to the same extent as within the European Union.

This website uses TLS encryption (SSL) throughout. You can recognise an encrypted connection by the fact that the address in your browser begins with https:// and a padlock icon is displayed. As long as encryption is active, the data you transmit to us cannot be read by third parties. In addition, we instruct browsers via the HSTS mechanism to access our page exclusively over an encrypted connection.

We take technical and organisational measures pursuant to Art. 32 GDPR against accidental or deliberate manipulation, loss, destruction and unauthorised access. These include security-relevant response headers, a mandatory second factor for internal accounts, login cookies protected against script-based reading, and restrictive permission assignment in the database. Our measures are continuously adapted.

If personal data about you is processed, you are a data subject within the meaning of the GDPR. An informal message to the contact details given in section 1 or to our Data Protection Officer is sufficient to exercise this right.

You may request confirmation as to whether we process personal data concerning you. If so, you are entitled to information about this data as well as about the purposes of processing, categories of data, recipients, the envisaged retention period, the existence of your further rights, the origin of the data, and the existence of automated decision-making. Where data is transferred to a third country, you are entitled to be informed about the appropriate safeguards pursuant to Art. 46 GDPR.

You may request the immediate rectification of inaccurate data and the completion of incomplete data.

You may request immediate erasure, provided that one of the grounds set out in Art. 17(1) GDPR applies and the processing is not necessary under Art. 17(3) GDPR — for example, to fulfil a retention obligation or to assert legal claims.

Under the conditions set out in Art. 18 GDPR, you may request that we restrict processing, for example while the accuracy of contested data is being verified.

If you have requested rectification, erasure or restriction, we will notify all recipients accordingly, unless this proves impossible or involves disproportionate effort. You may request to be informed about these recipients.

Where processing is based on consent or a contract and is carried out by automated means, you may request to receive the data you have provided in a structured, commonly used and machine-readable format, or — where technically feasible — to have it transmitted directly to another controller.

You may withdraw any consent given at any time with effect for the future, without affecting the lawfulness of processing carried out until that point. For consent relating to the location map, use the Cookie Settings page.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority — see section 19.

You may lodge a complaint with any data protection supervisory authority, in particular the authority of your place of residence, your place of work or the place of the alleged infringement. The authority will inform you of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44, 40102 Düsseldorf, Germany
Tel: +49 211 38424-0 · Email: poststelle@ldi.nrw.de · Web: www.ldi.nrw.de

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. On this website, this concerns in particular the processing of server log data (section 4), the handling of your enquiry via the contact form or by email, as well as your EXPO REAL 2026 appointment booking (sections 8 and 9), and the display of reviews (section 11).

If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

The objection is not bound to any particular form. A message to the contact details given in section 1 or to our Data Protection Officer is sufficient.

Automated decision-making in individual cases, including profiling within the meaning of Art. 22 GDPR, does not take place on this website. We do not create usage profiles, we do not carry out any reach measurement, and we do not combine the resulting technical data into personal profiles.

We reserve the right to adapt this privacy policy if the legal situation, our services or the type of data processing change. For your subsequent visits, the version currently available on this page applies. We will obtain renewed consent for material changes affecting consent already given. The version stated at the beginning applies.