Privacy Policy
1. General
1.1 Name and address of the controller
Controller responsible pursuant to Article 4 No. 7, Article 5(2) and point (a) of Article 13(1) of the General Data Protection Regulation (GDPR):
Deutsches Institut für Bautechnik (DIBt)
Dipl.-Ing. Gerhard Breitschaft, President of DIBt
Kolonnenstraße 30 B
10829 Berlin
Phone: +49 (0)30 / 78730-0
Email: dibt(at)dibt(.)de
1.2 Contact details of the data protection officer
The data controller's data protection officer can be contacted at:
Deutsches Institut für Bautechnik (DIBt)
Data Protection Officer (DPO)
Kolonnenstraße 30 B
10829 Berlin
Phone +49 (0)30/ 78730-0
Email: Datenschutzbeauftragter(at)dibt(.)de
1.3 Definitions
Following the model of Article 4 of the GDPR, this Privacy Policy is based on the following definitions:
a) 'Personal data' (Article 4 No. 1 GDPR)
'Personal data' (Article 4 No. 1 GDPR) means any information relating to an identified or identifiable natural person ('data subject'). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or by means of information relating to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Identifiability can also be provided by linking such information or other additional knowledge. The realization, form or embodiment of the information is not relevant (photos, video or audio recordings may also contain personal data).
b) 'Processing' (Article 4 No. 2 GDPR)
'Processing' (Article 4 No. 2 GDPR) means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated (i.e. technology-supported) means. This includes, in particular, the collection (i.e. acquisition), recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure or destruction of personal data, as well as the change of a purpose or intended purpose on which a data processing was originally based.
c) 'Controller' (Article 4 No. 7 GDPR)
'Controller' (Article 4 No. 7 GDPR) means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
d) 'Third party' (Article 4 No. 10 GDPR)
'Third party' (Article 4 No. 10 GDPR) means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data; this also includes other legal entities that belong to the authority.
e) 'Processor' (Article 4 No. 8 GDPR)
'Processor' (Article 4 No. 8 GDPR) means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, in particular in accordance with the controller's instructions, (e.g. IT service provider). In the sense of data protection law, a processor is in particular not a third party.
f) 'Consent' (Article 4 No. 11 GDPR)
'Consent' (Article 4 No. 11 GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
1.4 General Information on Data Processing
Regulation (EU) 2019/515 of the European Parliament and of the Council obliges Germany to operate a Product Contact Point for Construction.
This task is assigned to the controller (see numeral 1) in accordance with Article 2 No. 4 of the Administrative Agreement between the Federation and the federal states on the delegation of further responsibilities to the Deutsches Institut für Bautechnik (DIBt Administrative Agreement).
The website 'Product Contact Point for Construction – Germany' informs economic operators about applicable national legislation for construction products and their installation in Germany and the application of the principle of mutual recognition.
The Implementing Regulation (EU) 2020/1121 on the collection and sharing of user statistics and feedback by the users on the services of the single digital gateway in accordance with Regulation (EU) 2018/1724 of the European Parliament and of the Council obliges EU Member States to offer users a feedback facility with respect to the quality of all SDG-related information presented, online services provided and support services used. Feedback from users of the 'Product Contact Point for Construction – Germany' website can be given by using the feedback function, which is provided via a link to the central feedback system of the German Federal Ministry of the Interior and Community (BMI). With regard to the data processing operations associated with the use of the feedback function, reference is made to the Privacy Policy of the operator of the feedback system (https://formular.support.115.de/pcpc-germany/privacy?).
To improve the functioning of the single digital gateway in accordance with Regulation (EU) 2018/1724 of the European Parliament and of the Council, statistics covering users' visits to the gateway and the websites linked to the gateway are collected — while preserving their anonymity. We transmit the resulting statistical data to the EU on a semi-annual basis.
As a rule, we only process personal data of our users in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) insofar as this is necessary for providing and optimising a functional website as well as our content and services.
In the following, we provide information about the processing of personal data when our website is used.
1.5 Rights of the data subjects
Every data subject has the right to exercise the following data subject rights at any time by contacting us using the contact details provided under 1.1 Name and address of the controller.
a) Right of access – Article 15 GDPR
Pursuant to Article 15 GDPR you have the right to obtain from us information about your data that is being processes by us.
Where this is the case, you have the right to obtain the following information from the controller:
(1) the purposes for which the personal data are processed;
(2) the categories of personal data that are processed;
(3) recipients or categories of recipient to whom your personal data have been or will be disclosed;
(4) where possible, the envisaged period for which your personal data will be stored, or, if specific information cannot be provided, the criteria used to determine that period;
(5) the existence of a right to rectify or erase personal data concerning you, a right to have the controller restrict processing or a right to object to such processing;
(6) the existence of a right to lodge a complaint with a supervisory authority;
(7) all available information about the source of the data, if the personal data are not collected from the data subject;
(8) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject.
You have the right to request information as to whether your personal data are being transferred to a third country or an international organisation. In this context, you may request to be informed about the appropriate safeguards pursuant to Article 46 GDPR relating to the transfer. Reference is also made to the right to data portability, Article 20 GDPR.
b) Right to rectification – Article 16 GDPR
Pursuant to Article 16 GDPR, you have the right to obtain from us without undue delay the rectification of inaccurate or the completion of your personal data that is stored by us.
c) Right to erasure – Article 17 GDPR
Pursuant to Article 17 GDPR, you have the right to obtain from us the erasure of your personal data stored by us without undue delay, where one of the following grounds applies:
(1) The personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
(2) You withdraw your consent on which the processing is based pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) GDPR, and there is no other legal ground for the processing.
(3) You object to the processing pursuant to Article 21(1) GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) GDPR.
(4) The personal data concerning you have been unlawfully processed.
(5) The personal data concerning you have to be erased for compliance with a legal obligation under European Union or Member State law to which the controller is subject.
(6) The personal data concerning you were collected in relation to the offer of information society services referred to in Article 8(1) GDPR.
Where the controller has made the personal data concerning you public and is obliged to erase them pursuant to Article 17(1) GDPR, the controller shall take reasonable measures, including technical measures, taking into account the available technology and the cost of implementation, to inform controllers that process the personal data that you, as the data subject, have asked them to erase all links to or copies or replications of such personal data.
There is no right to erasure where processing of personal data concerning you is necessary for the following purposes:
(1) for exercising the right of freedom of expression and information,
(2) for compliance with a legal obligation that requires processing under European Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
(3) for reasons of public interest in the area of public health pursuant to points (h) and (i) of Article 9(2) and Article 9(3) GDPR;
(4) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Article 89(1) GDPR insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the purposes of that processing, or
(5) for the establishment, exercise or defence of legal claims.
d) Right to restriction of processing – Article 18 GDPR
Pursuant to Article 18 GDPR, you have the right to obtain from us restriction of processing of your data where one of the following applies:
(1) if you contest the accuracy of your personal data for a period enabling the controller to verify the accuracy of the personal data;
(2) if the processing is unlawful, and you oppose the erasure of the personal data and request the restriction of their use instead;
(3) if the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims, or
(4) if you have objected to the processing pursuant to Article 21(1) GDPR and it is not yet clear whether the controller's legitimate interests override your interests.
Where the processing of your personal data has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.
You will be informed by the controller before the restriction is lifted if the processing has been restricted in accordance with the aforementioned conditions.
e) Right to data portability – Article 20 GDPR
Pursuant to Article 20 GDPR, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format or to request the transfer to another controller, provided that
- the processing is based on consent pursuant to point (a) of Article 6(1) GDPR or point (a) of Article 9(2) GDPR or on a contract pursuant to point (b) of Article 6(1) GDPR, and
- the processing is carried out by automated means.
In exercising your right to data portability pursuant to paragraph 1, you also have the right to have your personal data transmitted directly from us to another controller, where technically feasible.
f) Right to object – Article 21 GDPR
Pursuant to Article 21 GDPR, you have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you, insofar as such processing is carried out in accordance with point (e) or (f) of Article 6(1)(1) GDPR.
Unless your objection is in relation to direct marketing, in the event that you exercise such an objection, we ask you to please explain why you do not want us to process your data as we have done so far. In the event of a justified objection on your part, we will examine the merits of the case and either discontinue or adapt the data processing or show you our compelling legitimate grounds on the basis of which we will continue the processing.
If the aforementioned conditions are met, the processing of personal data concerning you will be discontinued, unless it can be demonstrated that there are compelling legitimate grounds for the processing that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
g) Right to withdraw consent – Article 7(3) GDPR
Pursuant to Article 7(3) GDPR, you have the right at any time to withdraw the consent that you may have given to us. This will have the consequence that, in future, we will no longer be allowed to continue the data processing that was based on this prior consent. The withdrawal of consent does not affect the lawfulness of processing carried out based on consent before its withdrawal.
h) Right to lodge a complaint with a supervisory authority – Article 77 GDPR
Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority about the processing of your personal data at our institute, such as the data protection supervisory authority competent for us:
Competent supervisory authority:
Berlin Commissioner for Data Security and Freedom of Information (Berliner Beauftragter für Datenschutz und Informationsfreiheit)
Friedrichstr. 219
10969 Berlin, Germany
Phone: +49 (0)30 13889-0
Telefax: +49 (0)30 2155050
Email: mailbox(at)datenschutz-berlin(.)de
The supervisory authority with which the complaint has been lodged must inform the complainant about the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR.
1.6 Legal basis for the processing of personal data
By law, any processing of personal data is in principle only permitted if one of the following applies to such data processing:
- point (a) of Article 6(1)(1) GDPR ('Consent'): If the data subject has freely given their consent, in an informed and unambiguous manner, by means of a declaration or other unambiguous affirmative act, to the processing of personal data relating to them for one or more specified purposes;
- point (b) of Article 6(1)(1) GDPR: Where processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
- point (c) of Article 6(1)(1) GDPR: Where processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. a legal obligation to retain records);
- point (d) of Article 6(1)(1) GDPR: Where processing is necessary in order to protect the vital interests of the data subject or of another natural person;
- point (e) of Article 6(1)(1) GDPR: Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- point (f) of Article 6(1)(1) GDPR: ('Legitimate Interests'): Where processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
The following is a statement of the applicable legal basis and the purpose of the data processing as well as the storage period for each of the personal data processing operations carried out by us. Such processing of personal data may also be based on several legal bases.
2. Processing of personal data when the website is used for informative purposes
2.1 Legal basis for data processing
Points (e) and (f) of Article 6 (1)(1) GDPR are the legal bases for the temporary storage of the data and the log files.
2.2 Description and scope of data processing
When the website is used for information purposes, i.e. when you simply view the website without registering and without providing us with any other information, we process the personal data that your browser transmits to our server. The following data are processed within this context:
- information about the browser type and version used
- the user's operating system
- the user's IP address
- date and time of access
- internet pages from which the user's system accesses our website as the referrer URL
2.3 Purpose of data processing
The personal data specified above are processed by us in compliance with the provisions of the GDPR, the other relevant data protection regulations and only to the extent necessary. Thus, for example, the user's IP address is stored on the delivery servers to ensure operation and to protect against attacks (e.g. DDOS).
The temporary storage of the IP address by the system is necessary to facilitate delivery of the website to the user's computer. While there is a legitimate interest in making the access and use of the website technically possible, without the above-named data, such access and use of the website cannot be provided.
2.4 Duration of storage
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage ceases to apply. In addition, data may be stored if this has been provided for by European or national legislation in regulations of the European Union, laws or other provisions to which the controller is subject.
For example, under the conditions of Article 5(1) of Implementing Regulation (EU) 2020/1121, user statistics and user feedback will be automatically deleted no later than after three years.
3. Processing of personal data by the use of cookies
3.1 Description and scope of data processing
Our website uses 'cookies'. Cookies are small text files that are assigned to the browser you are using and stored on your hard drive with a characteristic character string and through which certain information flows to the body that sets the cookie. Cookies cannot execute programs or transmit viruses to your computer and therefore cannot cause any damage. Overall, they serve to make the website offering a more user-friendly and effective experience, i.e. more pleasant for you to use. Cookies may contain data that facilitate recognition of the device being used. In some cases, however, cookies only contain information about certain settings that cannot be related to a specific person. However, cookies cannot identify a user directly.
A distinction is made between session cookies, which are deleted as soon as you close your browser, and permanent cookies, which are stored beyond the individual session.
We only use cookies that are required technically and are necessary for making certain website functions work. A banner is displayed asking you to agree to the use of these cookies.
3.2 Legal basis for data processing
Points (e) and (f) of Article 6(1) GDPR provide the legal basis for processing personal data using cookies, and point (a) of Article 6(1) GDPR provides the legal basis for consent-related cookies.
3.3 Purpose of data processing
The purpose of using technically necessary cookies is to ensure that our website is free of technical errors and is provided in an optimised condition.
The user data collected through technically necessary cookies are not used to create user profiles.
3.4 Duration of storage, right to object and erase
Cookies are stored on the user's computer, which transmits them to our website. As a user, you have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been saved, can be deleted at any time. This can also be handled automatically.
4. Processing of personal data when you use the contact form and when you contact us by email
4.1 Description and scope of data processing
When you contact us by email or by using a contact form, the data you provide will be stored by us for the purpose of answering your questions. The following personal data are collected:
- Salutation, first name and surname
The following data are also stored during the submission process:
- User's IP address
- Time and date of registration
To be able to process this data, during the submission process you are asked for your consent and reference is made to this Privacy Policy.
Alternatively, it is possible to contact us via the email address provided. In this case, the user's personal data that is transmitted with the email will be stored.
In this context, no data is shared with third parties. The data are used exclusively for processing the conversation.
4.2 Legal basis for data processing
The legal basis for processing data transmitted during the course of registration or sending an email is based on our legitimate interest in being able to effectively process requests addressed to us (points (e) and (f) of Article 6(1) GDPR) or on your consent (point (a) of Article 6(1) GDPR).
4.3 Purpose of data processing
The personal data obtained from the registration process are processed for the purpose of fulfilling our task as Product Contact Point for Construction – Germany (cf. Regulation (EU) 2018/1724). The other data processed during the submission procedure is used to prevent the contact form from being misused and to ensure the security of our information technology systems.
4.4 Duration of storage
The data acquired in this context are deleted by us as soon as the purpose for storage ceases to apply and storage is no longer necessary, or we restrict the processing of such data in the event that there are statutory storage obligations.
We also delete the additional data collected during the submission process as soon as the purpose for their storage no longer applies and storage is no longer necessary. This data is deleted upon or before a period of seven days, unless mandatory statutory provisions – in particular statutory retention periods – conflict with this regulation.