Privacy policy

Principles of data processing at Entracon Planungsgesellschaft mbH and Entracon Projektservice GmbH.

Name and address of the controller

The controller within the meaning of the General Data Protection Regulation, other national data protection laws of the member states and further data protection provisions is:

Entracon Planungsgesellschaft mbH
Dr. Philipp Schwittek
Frielinghauser Straße 5
59071 Hamm
Deutschland
E-mail: p.schwittek@entracon.de
Website: www.entracon.de

I. General information on data processing

Scope of processing personal data

As a rule, we process personal data of our users only to the extent necessary to provide a functioning website and to deliver our content and services. Personal data of our users is generally processed only with the user’s consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by law.

Legal basis for processing personal data

Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6 (1) (a) GDPR serves as the legal basis. Where processing of personal data is necessary for the performance of a contract to which the data subject is party, Art. 6 (1) (b) GDPR serves as the legal basis; this also applies to pre-contractual measures. Where processing is necessary to fulfil a legal obligation, Art. 6 (1) (c) GDPR serves as the legal basis. Where processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override it, Art. 6 (1) (f) GDPR serves as the legal basis.

Erasure and storage period

The personal data of the data subject is erased or blocked as soon as the purpose of storage no longer applies. Storage beyond that may take place where provided for by European or national legislation. Data is also blocked or erased when a prescribed storage period expires, unless further storage is necessary for the conclusion or performance of a contract.

II. Provision of the website and log files

Each time our website is accessed, our system automatically records data and information from the computer system of the accessing device. The following data is collected:

• browser type and version
• the user's operating system
• the user's internet service provider
• the user's IP address
• date and time of access
• websites from which the user's system reaches our site
• websites accessed by the user's system via our site

The legal basis for the temporary storage of the data and the log files is Art. 6 (1) (f) GDPR. Storage serves to ensure the functioning of the website and to optimise and safeguard the security of our information technology systems. The data is not evaluated for marketing purposes in this context. It is erased as soon as it is no longer required for the purpose of its collection – in the case of log files after seven days at the latest.

III. No cookies

This website does not set any cookies. For individual convenience functions your browser stores settings locally (web storage): whether you have closed an announcement or already opened the contact window (the hint pointing to it is then omitted), which language version you prefer and – only if you open the chat – an identifier that allows a started conversation to be continued. These entries serve exclusively the function you have expressly requested (Section 25 (2) no. 2 TDDDG); you can delete them at any time in your browser settings. Only the login area for our staff uses a technically necessary session cookie.

IV. Audience measurement without cookies

Scope and purpose of the processing

We would like to know which content on our website is read, how visitors find us and which content leads to an enquiry. For this we record daily totals – never information about an individual person. We do not use cookies for this, store nothing on your device and do not integrate any external service. The data does not leave our server.

What we count

• Page views per page and time of day (hour)
• the number of visitors and visits per day (see below)
• the origin of a visit: the domain of the referring page (such as a search engine) and campaign information carried by the link itself (utm parameters)
• the entry page of a visit and whether the visit ended there
• device class, browser and operating system – coarsely, from the identifier your browser sends anyway
• the country the request comes from and – only for organisations with their own network – the name of that network (see below)
• whether a contact channel was used: submitting a form, tapping the phone number, clicking the e-mail address, opening the chat, downloading a file, following an external link – only the type, never content
• search terms from this website’s search and whether they had results; terms that look like an e-mail address or phone number are discarded
• the time a page was visibly in the foreground, rounded click positions and scroll depth
• addresses that do not exist on this website and the page that linked to them

How the visitor count is created

So that the same visitor is not counted twice within one day, we form a checksum (SHA-256) from a random value generated anew each day, your IP address and your browser identification. Only this checksum is stored, never your IP address, and your IP address cannot be recovered from it. The random value changes daily at midnight, so the same person receives an entirely different checksum the next day. Recognition across several days is therefore impossible – and not something we want.

Organisations with their own network

Large organisations – such as corporations, universities or public authorities – operate their own networks. If a request comes from such a network, we record its name as a daily total together with the pages viewed, so that we can see which industries and companies are interested in our services. Networks of access providers, mobile carriers and data centres – through which private individuals and smaller companies browse – are expressly not evaluated. Your IP address is only used briefly in memory for the lookup and is not stored; we do not link the information to persons or to any other data.

We determine country and network using the freely available databases from DB-IP, which are stored on our own server; no third party is queried. Source: IP Geolocation by DB-IP (licence CC BY 4.0).

Storage period

In the night after each completed day, the checksums, the associated random value and the information assigned to the current visit (channel, entry page, network) are deleted. Only daily totals remain, which have no connection to any person.

Legal basis

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in being able to assess the reach and effect of our content and to improve our website. As no information is stored on your device, no consent under Section 25 TDDDG is required. If your browser sends the “Do Not Track” signal, clicks, reading time and use of contact channels are not measured. You may object to the processing at any time using the contact details below.

V. Contact, call-back requests and live chat

Contact by e-mail or phone

If you contact us by e-mail or telephone, we process your details exclusively to handle your enquiry. The legal basis is Art. 6 (1) (b) or (f) GDPR. The data is erased as soon as it is no longer required for the purpose of its collection and no statutory retention periods prevent this.

Call-back request via the contact window

You can request a callback via the contact panel on this website. In doing so, we process your name, telephone number, e-mail address and – where provided – your availability and your request. We use these details solely to call you back. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR.

Your callback request is created as a ticket in our own helpdesk system rapidFOX. rapidFOX is software developed by Entracon; processing takes place on servers in Germany. No transfer to third parties takes place.

Live chat

This website offers a live chat, which is likewise operated via rapidFOX. The chat window is loaded only when you actively open it – no data whatsoever is transmitted to the chat system beforehand. When you open the chat, your messages, a randomly generated session identifier and – where you provide it voluntarily – your e-mail address are processed in order to answer your enquiry. The legal basis is Art. 6 (1) (f) GDPR. The session identifier is stored locally in your browser so that a conversation you have started can be continued; you can delete it at any time via your browser settings.

VI. Rights of the data subject

If personal data concerning you is processed, you have the following rights:

• Access (Art. 15 GDPR) to the data processed about you, the purposes, the recipients, the storage period and the origin of the data.
• Rectification (Art. 16 GDPR) of inaccurate or incomplete data — without undue delay.
• Restriction of processing (Art. 18 GDPR), for instance while the accuracy of your data is being verified.
• Erasure (Art. 17 GDPR), where the data is no longer needed for its purpose, you withdraw consent, or processing was unlawful.
• Notification (Art. 19 GDPR) of all recipients about a rectification, erasure or restriction.
• Data portability (Art. 20 GDPR) in a structured, commonly used and machine-readable format.
• Objection (Art. 21 GDPR) to processing based on Art. 6 (1) (e) or (f) GDPR, and at any time to direct marketing.
• Withdrawal of consent (Art. 7 (3) GDPR) with effect for the future.
• No automated individual decision-making (Art. 22 GDPR) — we do not take decisions with legal effect by automated means alone.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority – in particular in the member state of your residence, your place of work or the place of the alleged infringement – if you consider that the processing of personal data concerning you infringes the GDPR.

For North Rhine-Westphalia this is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

To exercise your rights, an informal message to this address is sufficient: p.schwittek@entracon.de.