Privacy policy

This is a translation. The German version is legally binding.

1. Controller

The controller for the processing of personal data on this website is:

BauPragma GmbH
represented by the managing directors Bernd Brengelmann and Mario Müller
Tatenberger Deich 137b
21037 Hamburg
Germany
Telephone: +49 40 52 474 089
Email: info@baupragma.de

We have not appointed a data protection officer because there is no obligation to do so: fewer than 20 people are constantly engaged in the automated processing of personal data at our company (section 38(1) BDSG, German Federal Data Protection Act), and our core activity consists neither of extensive regular and systematic monitoring of persons nor of extensive processing of special categories of personal data (Art. 37(1) GDPR). Please direct questions on data protection to info@baupragma.de or to the address given above.

2. General information and legal bases

Personal data is any information relating to an identified or identifiable natural person. We process it in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Depending on the purpose, the processing is based on the following legal bases:

Art. 6(1)(a) GDPR: consent, for example for visitor statistics; you can withdraw it at any time.
Art. 6(1)(b) GDPR: performance of pre-contractual measures and of a contract, for example answering your enquiry about our services.
Art. 6(1)(c) GDPR: compliance with legal obligations, for example statutory retention periods.
Art. 6(1)(f) GDPR: legitimate interests, for example secure operation of the website, handling general enquiries and proof of your banner choice.

For visitor statistics we obtain your consent through a banner; nothing is counted without your consent. There is no automated decision-making including profiling under Art. 22 GDPR.

3. Hosting and server log files

This website is operated by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. The servers are located in Germany (Nuremberg site). A data processing agreement under Art. 28 GDPR is in place with Hetzner.

Server log files

Each time the website is accessed, the server automatically records the following data in server log files:

IP address of the requesting device
date and time of access
page or file requested and amount of data transferred
referrer URL (previously visited page)
browser type and version, operating system used

The purpose is to deliver the website and to ensure the security and stability of operations, for example to repel and investigate attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a secure and functioning web presence. The data is not merged with other data.

The log files are deleted automatically after 15 days at the latest, unless keeping them longer is necessary to investigate a specific security incident.

4. Cookies, browser storage and embedded scripts

This website does not set cookies unless you use a function that technically requires them. We access information on your device without your consent only where this is technically strictly necessary to display the page or for a setting you have requested (section 25(2) no. 2 TDDDG); this includes storing your choice in the statistics banner. Visitor statistics run only with your consent (see below). We use no advertising networks and no third-party tracking services.

Audience measurement with consent. If you choose “Agree” in the banner, we count how often our pages are viewed and where visitors come from. This lets us check which content is needed and improve our website. We use the WordPress plugin Koko Analytics for this. The evaluation runs exclusively on our own server at Hetzner (section 3); no data is passed on to third parties. If you choose “No, thanks” or make no choice, nothing is counted.

We set no cookies in doing so. To distinguish page views, we form a short value (hash) from the IP address and browser identifier with a random value that changes daily. The random value is deleted every day; a visitor therefore cannot be recognised across several days. We do not store the IP address itself. Only aggregated counters are stored (page, date, number, referring page). We store your choice in the banner in your browser (entry “Statistik-Wahl” in local storage) so that we do not ask you again on every visit; this entry contains only “yes” or “no” and the date; after 12 months we ask you again.

The legal basis is your consent, Art. 6(1)(a) GDPR, and for access to your device section 25(1) TDDDG. Storing your choice is based on section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR (proof of your decision). You can withdraw your consent at any time with effect for the future: via the link “Statistik-Einstellungen” (statistics settings) at the bottom of every page or by email to info@baupragma.de. Withdrawal does not affect the lawfulness of the processing up to that point. We store the aggregated counters for 24 months and then delete older data; individual visitors cannot be identified from them. Visits that we attribute via addresses in flyers are likewise counted only as a counter per address, not per person, and only with consent.

Own scripts and font. All scripts and the Inter font reside on our server and are delivered from there. No content is loaded from third-party servers. We do not embed map or video services.

5. Enquiry form (Money Check)

If you write to us via the form “Request a Money Check”, we process your details in order to answer your enquiry.

Required fields: name, company, email address. Without these details we cannot answer your enquiry.
Optional fields: telephone number and message. They help us to classify your enquiry or to reach you by telephone. After sending, you receive an automatic confirmation of receipt by email from info@baupragma.de.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is directed at a contract or pre-contractual measures. In all other cases the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in answering the enquiries addressed to us.

The form is a form of this website's own. Your details are not stored in the website's database but sent as an email to our mailbox info@baupragma.de. Microsoft 365 handles the sending: our server passes the message, encrypted, to our mailbox at Microsoft 365 (section 8), from where it is delivered. We do not use the hosting provider's mail server for this. We do not store your IP address or technical device data with the enquiry. To protect against mass submissions, our server stores a short value (hash) of your IP address for one hour and then deletes it automatically (Art. 6(1)(f) GDPR).

To protect against automated requests, the form contains a hidden field that only programs fill in, and a block against submission less than three seconds after the page has loaded. No data is transferred to third parties in the process. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in trouble-free operation of the form.

We receive your documents (for example invoices, quantity surveys or bills of quantities) only once the confidentiality agreement is signed, by email to our mailbox (Microsoft 365, section 8). We use them only to review and process your order. We delete your details and documents as soon as your enquiry has been finally dealt with, at the latest six months after completion. If the enquiry leads to an order or constitutes a business letter, the statutory retention periods apply, in particular under section 257 HGB (German Commercial Code) and section 147 AO (German Fiscal Code) (Art. 6(1)(c) GDPR).

Besides us, the recipients of your details are only our service providers for hosting (Hetzner, section 3) and for email including sending the form (Microsoft 365, section 8). They process the details on our behalf (Art. 28 GDPR). The overview in section 8 states purpose and transfer basis.

6. Contact by email or telephone

If you contact us by email or telephone, we process your details (such as name, contact details, content of the enquiry) to deal with your request. Legal bases, deletion and retention follow section 5. For email processing, the service providers used and any transfers to third countries are described in section 8.

Applications

If you apply to us by email or phone, we process your details and documents to decide on your employment (Art. 6(1)(b) GDPR). Only the managing directors see your application. If you are not hired, we delete your details and documents no later than six months after the procedure has ended.

7. Links to LinkedIn and Instagram

In the footer of our website you will find links to our company profiles on LinkedIn and Instagram. These are simple links. When you visit our website, no data is transferred to LinkedIn or Instagram, and no content from these services is loaded.

Only when you click one of the links do you move to the service concerned. From then on, the provider processes your data under its own responsibility. We have no influence on the nature and extent of this processing. Providers and information on data processing:

LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn provides information in its privacy policy at linkedin.com/legal/privacy-policy.
Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta provides information in its privacy policy at privacycenter.instagram.com/policy.

For our profiles on LinkedIn and Instagram, the providers' privacy notices also apply, and we use messages you send us there only to answer them.

8. Recipients and transfers to third countries

Except in the following case, we do not transfer your personal data to countries outside the European Union or the European Economic Area.

For our email communication we use Microsoft 365 of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. A data processing agreement under Art. 28 GDPR is in place with Microsoft. A transfer to Microsoft Corporation in the USA cannot be ruled out. It takes place on the basis of the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Microsoft Corporation is certified (Data Privacy Framework list, as of 20 October 2026), and additionally on the basis of standard contractual clauses (Art. 46(2)(c) GDPR).

Recipients in planned operation
Processing	Service provider	Purpose	Storage location and transfer basis
Website access, server log files	Hetzner Online GmbH	Delivery and secure operation of the website (section 3), audience measurement with consent (section 4)	Germany (Nuremberg); data processing under Art. 28 GDPR, no transfer to third countries
Money Check form	Hetzner Online GmbH (web server with form page), Microsoft Ireland Operations Limited (sending and mailbox)	Delivery of your enquiry to our mailbox (section 5)	no storage in the website's database; data processing under Art. 28 GDPR; for Microsoft see the row Email
Email	Microsoft Ireland Operations Limited (Microsoft 365)	Receipt and handling of your message (sections 5 and 6)	Data processing under Art. 28 GDPR; transfer to the USA not ruled out, then Art. 45 GDPR (Data Privacy Framework) and additionally Art. 46(2)(c) GDPR

9. SSL or TLS encryption

This website uses SSL or TLS encryption, for example for the transmission of form details. You can recognise an encrypted connection by “https://” in your browser's address bar.

10. Your rights

Under the GDPR you have the following rights towards us:

access to the data stored about you (Art. 15 GDPR)
rectification of inaccurate data (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
objection to processing (Art. 21 GDPR, see below)
withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to the contact details given in section 1 is sufficient.

Right to object under Art. 21 GDPR

Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22
20459 Hamburg

11. Currency of this privacy policy

We adapt this privacy policy when the website or the legal requirements change. As of: October 2026