Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is HAGEN® GmbH Planer und Architekten BDA, Geisseestraße 39, 90439 Nuremberg, Germany, phone +49 911 58 64 9-0, e-mail info@hagen-architekten.de.

For questions relating to data protection, you may also contact our data protection contact: Henri Hagen, c/o HAGEN® GmbH Planer und Architekten BDA, Geisseestraße 39, 90439 Nuremberg, Germany, e-mail info@hagen-architekten.de.

This website is hosted by Vercel Inc. (USA) and delivered via an EU server region; technical processing therefore generally takes place within the European Union. In addition to hosting the website itself, we also use an object storage service provided by Vercel (Vercel Blob) to store files, for example in connection with job applications (see Section 9).

A data processing agreement (Data Processing Addendum) pursuant to Art. 28 GDPR is in place with Vercel, available at vercel.com/legal/dpa. Vercel states that it is certified under the EU-US Data Privacy Framework (DPF).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and performant operation of our website.

The database required to operate the website (in particular application data, job postings, and login and log data for the administration area) is operated by Neon Inc., 209 Orange Street, Wilmington, DE 19801, USA (the "Neon Serverless Postgres" service). The database is located in a data centre in Frankfurt am Main (AWS region eu-central-1). A data processing agreement pursuant to Art. 28 GDPR is in place with Neon. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the website).

When you access our website, the web server processes technically necessary data to provide the website, ensure system security and analyse technical faults, in particular IP address, date and time of access, the URL accessed, referrer URL, browser type and version, operating system used, and the amount of data transferred together with the HTTP status code.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our website. Server log files are only stored for as long as necessary for these purposes, in particular to investigate security incidents.

We additionally record, in aggregated form and without any IP address, non-existent addresses that were accessed (path, number of accesses, referring domain) in order to identify and correct faulty links; this data is deleted after 90 days.

To maintain the website, we operate a password-protected administration area. When logging in, we process your e-mail address, password (stored only as a hash), where applicable your two-factor authentication data, and session data (session identifier, IP address, browser identifier); sessions expire after 14 days at the latest. Login attempts and security-relevant actions in the administration area are logged (time, action, user account, IP address, browser identifier, and the country of origin derived from the IP address). IP address and browser identifier are removed from the log after 30 days, the country of origin is retained until the respective entry is deleted, login logs are deleted after 90 days, and all other log entries after twelve months. The legal basis is Art. 6(1)(f) GDPR (protection against unauthorised access).

Our website uses only technically necessary cookies or comparable storage technologies, for example to ensure basic functionality. Under Section 25(2) TDDDG, no consent is required for these. The only cookie we set ourselves is the web analytics objection cookie, and only if you set the objection (see Section 5).

We do not use marketing, tracking or advertising cookies and do not embed third-party content (e.g. maps, chat widgets, social-media elements) that would set cookies. The only third-party element is the Cloudflare Turnstile verification element in our forms (Section 7); it is only loaded once you start filling in a form. A cookie consent banner is therefore not required.

We use the open-source software Matomo to analyse the use of our website statistically. We operate Matomo ourselves on a server of our web host in Germany (ALL-INKL.COM, Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany), with whom a data processing agreement is in place. No data is passed on to the maker of Matomo or to any other third party; no transfer to third countries takes place as part of the web analytics.

Data is recorded on our server: when your browser requests a page, our web server transmits to Matomo the address of the page (without further parameters except campaign identifiers and the search term of our website search), the previously visited page (referrer), the time, and the information your browser sends with every request anyway (IP address, browser and operating system identification, language setting). No script is executed on your device for this, and nothing is stored on or read from it. Our server likewise records, without the content you entered, the submission of the contact or application form, the confirmation of an application, a contact request relating to a project data sheet, the download of our contact file (vCard), requests for pages that do not exist, and a change of language. Links to LinkedIn, Instagram and the directions run through a redirect on our server (address /go/…) that records the click; the target page receives no information from us about which of our pages you came from. Matomo sets no cookies, places no identifier on your device, and does not read device characteristics such as screen resolution or installed extensions.

We transmit your IP address to Matomo only in shortened form (the first two bytes for IPv4, the first 48 bits for IPv6); Matomo shortens it further before storage to the first byte or the first 24 bits, so that it cannot be traced back to your connection. The approximate country of origin and the federal state or region are derived from the IP address by our hosting provider Vercel (see Section 2) when delivering the page; only the codes are transmitted to Matomo, no city. To group several page views into one visit, our server computes a check value from the full IP address, the browser identification, the language setting and the date using a secret key; this value changes every day, is not stored and cannot be reversed, and only this check value is sent to Matomo. We can therefore recognise you neither across several days nor across other websites. We do not create user profiles, do not use visitor profiles or the visits log in Matomo, and do not use heatmaps or session recordings. If your browser sends the "Do Not Track" or "Global Privacy Control" signal, we do not record your visit.

The data recorded is therefore: pages visited, with the type of page and, for project pages, the project and its building types (derived from the address), date and time, referring page and, where present, campaign identifiers in the address, search terms of our website search, browser, operating system and device type (from the browser identification), language setting, country of origin and federal state or region, and the events named in paragraph 2.

The purpose is to understand the use of our website in aggregated form, to detect errors and broken links, and to improve our content. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in this purpose. Your interests are protected by the shortening of the IP address, the absence of cookies, persistent identifiers and profiles, processing exclusively on our own servers, and the short retention period. We delete the individual visit data after 180 days; after that, only aggregated figures remain, such as views per page and day.

You may object to this analysis at any time (Art. 21 GDPR) by setting the switch below. Your objection is stored in a cookie in your browser that contains no identifier and is valid for one year; this storage is technically necessary to implement your request (Section 25(2) No. 2 TDDDG). The objection takes effect from the next page request. If you clear your browser's cookies, you will need to set the objection again. Without a cookie, you can object by having your browser send "Do Not Track" or "Global Privacy Control".

If you use our contact form, we process the data you enter (in particular name, e-mail address, phone number, message text, and optionally how you heard about us) to handle your enquiry and communicate with you. Providing how you heard about us is voluntary and is used solely for our internal evaluation of which channels enquiries come through.

Your enquiry is stored until it is delivered to our mailbox, for a maximum of 30 days.

The legal basis is Art. 6(1)(b) GDPR, insofar as your enquiry is directed at initiating or performing a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in processing and responding to your enquiry).

For technical delivery, we use the e-mail service provider Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France; an EU-based company). A data processing agreement pursuant to Art. 28 GDPR is in place with Brevo where required. The data is deleted as soon as it is no longer required to process your enquiry and no statutory retention obligations apply.

To protect our forms (contact form, data-sheet request, application form) against automated access and abuse, we use the Turnstile service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (EU contracting entity: Cloudflare Germany GmbH, Rosental 7, 80331 Munich). Turnstile checks in the background, using technical characteristics (including IP address, browser and device information, and interaction with the verification element), whether an input originates from a human. A visible confirmation (checkbox) is only requested where anomalies are detected. The verification element is only loaded once you select a form field; merely opening the page establishes no connection to Cloudflare.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure, abuse-free operation of our website, in particular protection against spam, automated bulk submissions and resource abuse). Turnstile does not set cookies for advertising or cross-site tracking purposes. Data may be transferred to the USA; Cloudflare is certified under the EU-U.S. Data Privacy Framework, and EU standard contractual clauses (Art. 46 GDPR) additionally apply.

In addition, we limit the number of requests to our forms and to the data-sheet download per sender (rate limiting). For this purpose, we store the IP address together with a counter for the duration of the respective time window; these entries are deleted automatically, generally within 24 hours.

On our project pages you can download a project data sheet. If you would like us to get in touch with you about your enquiry, you can additionally leave us your name (optional) and your e-mail address. In that case, we process these details to contact you about your enquiry (sent via Brevo, see section 6). Your details are deleted no later than 30 days after receipt.

The legal basis is Art. 6(1)(b) GDPR (steps taken at your request) or Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries from interested parties). The data is deleted as soon as it is no longer required to process your enquiry.

If you apply to us, we process the data you provide as part of your application (e.g. contact details, cover letter, CV, references) to carry out the application process and decide on the establishment of an employment relationship.

After submitting your application, you will receive an e-mail asking you to confirm your e-mail address via a confirmation link (double opt-in). Only after this confirmation will your application be forwarded to us and considered in the application process. Unconfirmed applications are automatically and completely deleted after 72 hours (including uploaded files).

Where you upload files as part of your application (e.g. CV, cover letter, references), these are stored in a private, non-publicly-accessible object storage service (Vercel Blob, Frankfurt am Main server region) provided by our hosting provider Vercel Inc. (USA), and are encrypted at rest (AES-256). Access to uploaded files is restricted to authorised staff via an authenticated, password-protected admin interface; the files are not publicly linked or otherwise accessible. The files are automatically deleted in accordance with the retention periods set out in this section. For information on the transfer of data to a third country in connection with this provider, see Section 11.

The application form is protected by Cloudflare Turnstile (see Section 7).

For sending the confirmation e-mail to you as well as the internal notification about the receipt of a confirmed application, we use the e-mail service Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France — address as in Section 6). This involves transmitting your name and e-mail address, and, in the internal notification, your contact details and the information you provided in the application form; uploaded files are not sent by e-mail. A data processing agreement is in place with Brevo; processing takes place on servers within the European Union.

The legal basis is Section 26 BDSG in conjunction with Art. 6(1)(b) GDPR. Your application data is generally deleted as soon as it is no longer required for the decision on your application, and at the latest six months after the conclusion of the application process, unless longer retention is required due to ongoing or threatened legal disputes (in particular under the German General Equal Treatment Act).

Should we wish to keep your application on file beyond the specific role in a talent pool for future vacancies, we will obtain your separate, active consent for this (Art. 6(1)(a) GDPR). This consent is voluntary, independent of the application itself, and may be withdrawn at any time with effect for the future. If you have given your consent, we store your application data for twelve months from your consent or from the conclusion of the application process; it is then automatically deleted. Deletion also includes any uploaded files in each case.

For the consistent display of fonts, we embed web fonts exclusively locally from our own server (self-hosting). No connection is made to third-party servers, in particular not to Google Fonts, and no data is transmitted to external font providers.

Insofar as processing outside the European Union or the European Economic Area, in particular in the USA, cannot be ruled out in connection with hosting and object storage (including for job application documents, see Section 9) at Vercel Inc., this takes place on the basis of appropriate safeguards, in particular the EU-US Data Privacy Framework or the EU Standard Contractual Clauses pursuant to Art. 46 GDPR.

The same applies to the use of Cloudflare Turnstile (see section 7) and the encrypted storage of database backups with GitHub (see section 12): both providers are certified under the EU-U.S. Data Privacy Framework; EU standard contractual clauses additionally apply.

Our database provider Neon Inc. (see Section 2) is likewise a US company; the actual data processing, however, takes place in a data centre in Frankfurt am Main, and a data processing agreement pursuant to Art. 28 GDPR is in place.

Sending e-mails via Brevo (Sendinblue SAS, see Sections 6 and 9), by contrast, is carried out by a company based in France on servers within the European Union — no transfer to a third country takes place in this respect.

We store personal data only for as long as necessary for the respective processing purposes, as long as consent exists, or as long as statutory retention obligations or legitimate interests justify further storage. Once the purpose of processing no longer applies and any retention periods have expired, the data is deleted or anonymised.

For resilience purposes, we create daily encrypted backup copies of our applications database (AES-256 encryption). These backups are stored for a maximum of 14 days with GitHub, Inc. (a Microsoft Corporation company, USA) and are then deleted automatically. The deletion of data from the live system (see section 9) therefore also takes effect for all backup copies at the latest upon expiry of this backup period. GitHub is certified under the EU-U.S. Data Privacy Framework.

The published content of the website (texts, project descriptions, images) is managed as source code at GitHub, Inc. No personal data of website visitors or applicants is stored there; publications made from the administration area are tagged with the e-mail address of the respective publishing staff member.

Right of access: You have the right to request information about the data we process about you and the further information under Art. 15 GDPR.

Right to rectification: You have the right to request the rectification of inaccurate and the completion of incomplete personal data pursuant to Art. 16 GDPR.

Right to erasure: You have the right, in accordance with Art. 17 GDPR, to request the erasure of your personal data.

Right to restriction of processing: You have the right, in accordance with Art. 18 GDPR, to request the restriction of the processing of your personal data.

Right to data portability: You have the right, in accordance with Art. 20 GDPR, to receive the data you have provided in a structured, commonly used and machine-readable format.

Right to object: You have the right, in accordance with Art. 21 GDPR, to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.

Right to withdraw consent: You may withdraw any consent given at any time with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal.

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection law. The authority generally responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, e-mail poststelle@lda.bayern.de.

We reserve the right to amend this privacy policy if the legal situation, our website, the services used or our data processing procedures change. The version published on our website at any given time shall apply.