Privacy Notice for Prospective Customers and Clients

In order to process your enquiry regarding our range of products and services successfully and professionally, and to ensure the successful completion of construction projects, we require personal data from our prospective customers and clients. The following privacy notice explains what personal data we process about you, how we use it, and what rights you have regarding the processing of your data.

Hanse Haus GmbH, Ludwig-Weber-Straße 18, 97789 Oberleichtersbach (hereinafter “Hanse Haus” or “we”) is responsible for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR). The authorised representatives are Marco Hammer, Christian Garke and Marcus D’Agostino; email address: info@hanse-haus.de; telephone: 09741-8080; legal notice: www.hanse-haus.de/de/impressum-agb/

Our Data Protection Officer is also available to answer any questions you may have regarding the processing of your personal data. Please address your enquiries to Ms Ann-Christin Nitz, email: datenschutz@hanse-haus.de

As a prospective customer and client, the following personal data relating to you will be stored and processed:

• Contact and identification details, e.g. surname, first name, address, date of birth, email address, telephone number and occupation
• Information regarding the building project, e.g. construction site address, planned construction budget, specific requirements of the client, house design, house specifications, work carried out by the client, reservations and any data from our online configuration tools
• Further relevant information regarding the building project, e.g. construction site address, house design, house specifications, work carried out by the client, reservations, etc.
• Surveys and questionnaires on customer satisfaction and product improvements

As a client, the following personal data will also be stored and processed:

• Order, contract and agreement details, including payment terms
• Bank and payment details of the financing banks
• Where applicable, creditworthiness data, e.g. risk category, address validation, personal information relating to adverse data from debtor lists, insolvency proceedings at local courts, debt collection data, changes of address and shareholdings in companies
• Data for carrying out compliance customer checks, including name, country of residence, results of checks against recognised sanctions and terrorist lists and, where applicable, further data where necessary for unambiguous identification

The personal data relating to you is processed for the purpose of fulfilling the contract concluded with you for the execution of a construction project or for the preparation of a relevant quotation and the implementation of corresponding pre-contractual measures, e.g. making contact to provide requested information (Art. 6 Abs. 1 lit. b) DSGVO).

In rare, specific cases, we carry out credit checks. For the processing of your data required for this purpose, we rely on the necessity of processing personal data to safeguard our legitimate interests in avoiding payment defaults (Art. 6 Abs. 1 lit. f) DSGVO). Where required in accordance with regulatory and statutory requirements for carrying out compliance customer checks, we also carry out a comparison of limited data against European and internationally recognised sanctions and terrorist lists. The processing of your data required for this purpose is carried out on the basis of our legitimate interests: ensuring compliance with and documentation of group-wide compliance requirements as well as statutory and regulatory requirements, preventing sanctioned conduct, and promoting business relationships with individuals, companies and/or organisations involved in terrorist or other unlawful activities (Art. 6 Abs. 1 lit. f) DSGVO).

In the rare event that customer satisfaction surveys or other market research activities are carried out, this serves to safeguard our legitimate interests in improving our range of services (Art. 6 Abs. 1 lit. f) DSGVO).

Where you have given us your consent to receive promotional information by email, telephone and/or post, such as newsletters and/or other promotional product information, we will also use your personal data to send you regular offers and information about our products and services via your preferred channel.

For legal reasons, a confirmation email will be sent to the email address you have provided for any email communications, using the double opt-in procedure. This confirmation email serves to verify whether the holder of the email address, as the data subject, has authorised the receipt of email communications.

Your registration to receive promotional information by email, telephone and/or post is logged so that we can document and provide evidence of the registration process in accordance with legal requirements. This recording is carried out to safeguard our legitimate interests in ensuring compliance with and documentation of the legal requirements and in guaranteeing that promotional communications are sent in a legally compliant manner (Art. 6 Abs. 1 lit. f) DSGVO).

The processing of your data for the purpose of contacting you for marketing purposes by email and/or telephone is based on your consent (Art. 6 Abs. 1 lit. f) DSGVO). You may withdraw your consent at any time. To do so, there is a link at the end of every email. You may also contact us at any time using the contact details provided in section 1.

Furthermore, we process your personal data to fulfil tax and commercial law obligations, as well as other legal obligations of Hanse Haus (Art. 6 Abs. 1 S. 1 lit. c) DSGVO), and to safeguard our legitimate interests in ensuring and documenting compliance with legal requirements, as well as in asserting, exercising and/or defending legal claims (Art. 6 Abs. 1 lit. f) DSGVO).

We generally collect your personal data directly from you. However, we obtain any creditworthiness data and any information relating to compliance customer checks through cross-referencing against sanctions lists from our respective service providers.

Your personal data will only be disclosed to the following recipients or categories of recipients within the scope of the purposes set out in section 2:

• We pass on your data to affiliated companies within our group that provide services within the group, i.e. the technical provision of systems and applications for internal business processes, such as financial accounting, consolidation and analysis of business data, management of subcontractors, scheduling and recording of construction progress for site managers. The application used to manage business processes for our site managers is also operated on a technical infrastructure provided by third-party providers on our behalf.
• To the extent necessary for the implementation of your construction project, we will pass on your data to the sales partners, service providers, suppliers and tradespeople or subcontractors involved in the construction project, e.g. architects, ground surveyors, structural engineers, transport companies, basement builders and crane hire companies.
• In order to carry out compliance checks on customers by cross-referencing against recognised sanctions and terrorist lists, we may pass on your name and country of residence, as well as, where applicable, any further data required for unambiguous identification, such as your date of birth, to external service providers, including technical screening service providers and any solicitors engaged to handle the matter.
• Where necessary for the purpose of checking your creditworthiness, we will pass on the data required for this check, namely your name, residential address and date of birth, to credit reference agencies, in particular Creditreform and Schufa.
• In addition, we may pass on your personal data to law enforcement agencies, courts, supervisory authorities, government bodies or other third parties, insofar as this is necessary to comply with a legal or regulatory obligation or to protect our rights or the rights of third parties, for example where we are obliged to co-operate with authorities in connection with legal investigations.

Your personal data will be processed exclusively within the European Union for the purposes described in this privacy notice, with the exception of any compliance customer checks that may be carried out. With regard to any compliance customer checks involving cross-referencing against sanctions and terrorist lists, we engage service providers that are also based in the United Kingdom. In the case of the United Kingdom, the European Commission has determined, by means of an adequacy decision, that the laws in the United Kingdom ensure a level of data protection comparable to that provided by European data protection laws. Where your site manager uses our technical application for managing business processes, such as recording construction progress and schedule management, limited contact details of the clients are also stored on servers operated on our behalf by a third-party provider in Europe for planning purposes.

However, it cannot be ruled out that the third-party provider or any subcontractors may access the data from countries outside the European Union (EU) or the signatory states of the European Economic Area (EEA), including the USA, for the purposes of technical provision, maintenance and support of the systems. The laws of these countries may not, in some circumstances, guarantee a level of data protection that would be recognised by the European Commission as an adequate level of data protection comparable to the European standard. However, in order to protect your data appropriately and in accordance with legal requirements, we have entered into contracts based on the EU Standard Contractual Clauses and have also implemented additional safeguards. For further information on the recipients of your data, the countries concerned and the safeguards we have implemented, as well as how you can obtain a copy of these, you may contact us at any time using the contact details provided in section 1. There are no plans to transfer your personal data beyond this to recipients in countries outside the EU or the EEA.

Personal data relating to prospective customers is stored for the purposes set out in section 2 for as long as is necessary to fulfil those purposes. For the purposes of market research, your personal data will be stored for as long as our company has an overriding legitimate interest in processing it in accordance with the relevant legal provisions, but for no longer than three years. Your data stored for the purpose of sending promotional email communications will be deleted if you unsubscribe from receiving such communications or if we cease to send them.

Personal data relating to clients’ building contracts, in particular the associated design documents, including CAD files, is generally retained for at least ten years for warranty and service purposes. The retention periods required under tax and commercial law are observed. Once this period has expired, a review is carried out at the end of the relevant calendar year to determine whether further storage is necessary. If there is no such requirement, the data will be deleted.

In addition, your data stored to fulfil our tax and commercial law retention obligations will be retained for the duration of the statutory retention periods, which may be up to ten years. Once the above periods have expired, the data will be deleted or the documents disposed of in accordance with data protection regulations, unless further storage is necessary to fulfil legal obligations or to establish, exercise or defend legal claims.

Insofar as you are affected by our processing of data, you have the following rights in particular in accordance with data protection regulations:

• To request information about the personal data stored concerning you and to receive a copy of this data — right of access, Article 15 of the DSGVO,
• To request the rectification of inaccurate personal data and, taking into account the purposes of the processing, the completion of incomplete personal data — right to rectification, Article 16 of the DSGVO,
• To request the erasure of personal data where there are legitimate grounds — right to erasure/right to be forgotten, Article 17 of the DSGVO,
• To request the restriction of the processing of your personal data where one of the conditions set out in Article 18(1)(a) to (d) of the DSGVO applies — right to restriction of processing, Article 18 of the DSGVO,
• Where the legal conditions are met, to receive the personal data you have provided in a structured, commonly used and machine-readable format and to transmit this personal data to another controller or, where technically feasible, to have it transmitted by us — right to data portability, Article 20 of the DSGVO,
• To withdraw any consent you have given at any time, whereby such withdrawal does not affect the lawfulness of processing carried out on the basis of that consent up to that point — Article 7(3) of the DSGVO,
• To lodge a complaint with a supervisory authority — Article 77 of the DSGVO. The supervisory authority responsible for us is: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach

No automated decision-making or profiling takes place.

You also have the right, in accordance with the law, to object at any time to the processing of your data carried out on the basis of a legitimate interest within the meaning of Art. 6 Abs. 1 lit. f) DSGVO, on grounds relating to your particular situation. In the event of a justified objection, we will no longer process the personal data for the purposes in question and will erase the data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. The objection must be addressed to the body specified in section 1. Where we process your personal data for direct marketing purposes, you may object to the processing at any time without needing to provide specific reasons.

Oberleichtersbach, 15.09.2021
Hanse Haus GmbH