Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for data processing on this website is:

Facility Masters GmbH

Ruhrallee 185

45136 Essen

Germany

Phone: 0155 65111150

Email: kontakt@facility-masters.de

Represented by: Mufid Altorok

Please send any questions about data protection and any requests to exercise your rights to the contact details stated above.

2. Overview of processing and legal bases

Personal data means any information relating to an identified or identifiable natural person. We process personal data only to the extent necessary to operate this website, to handle your enquiries and to initiate or perform contracts.

We do not use any third-party advertising or tracking technologies on this website and we do not create usage profiles. We measure reach exclusively with a self-hosted method that works without cookies and without storing any information on your device. Details can be found in the section on reach measurement. For visitors, only one technically necessary cookie is used, which stores the selected language.

Depending on the purpose, the legal bases for processing are Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures), Art. 6(1)(c) GDPR (compliance with legal obligations, for example retention obligations under commercial and tax law) and Art. 6(1)(f) GDPR (legitimate interests). Where we obtain consent in an individual case, Art. 6(1)(a) GDPR is the legal basis.

In addition, § 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG) applies to the storing of information on your device and to access to such information.

3. Hosting

This website is hosted by the following provider:

Hostinger International Ltd.

61 Lordou Vironos Street

6023 Larnaca

Cyprus

The hosting provider processes the data arising when this website is visited, in particular server log files and enquiries submitted via the website, on our behalf and in accordance with our instructions. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

The use of the hosting provider is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our online presence securely, quickly and reliably. Where enquiries aimed at concluding a contract are submitted via the website, Art. 6(1)(b) GDPR is an additional legal basis.

The provider is established in a member state of the European Union. Should data be processed by the provider or its sub-processors outside the European Union or the European Economic Area in individual cases, this takes place only in compliance with the requirements of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision or standard contractual clauses of the European Commission.

4. Server log files

Each time this website is accessed, your browser automatically transmits information to the server for technical reasons, which is stored in server log files. This includes in particular: IP address of the requesting device, date and time of access, page or file requested, volume of data transferred, status code of the request, previously visited page (referrer URL), browser type and version, and the operating system used.

Processing this data is necessary to deliver the website, to ensure the stability and security of the systems and to detect and defend against attacks or misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free and secure operation of the website.

This data is not merged with other data sources and is not evaluated for marketing purposes. The log files are deleted or anonymised after a short period, unless they are exceptionally required for longer in order to investigate a specific security incident or for evidence purposes.

5. Cookies and storage on your device

For visitors to this website, only one technically necessary cookie is used. No cookies are set for analytics, marketing or advertising purposes.

Name of the cookie: NEXT_LOCALE. Purpose: storing the language you have selected (German or English) so that the website is displayed in that language on further page views and on later visits. Storage period: up to one year. The cookie contains only a language code and no information that identifies you personally.

Storing this cookie is strictly necessary in order to provide the service you have expressly requested in the selected language. Consent is therefore not required pursuant to § 25 (2) no. 2 TDDDG. For this reason no consent banner is displayed on this website. To the extent that personal data is processed by means of the cookie, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a user-friendly presentation of the website.

A further cookie named fm_session is set only for staff who log in to the protected admin area of this website. It contains a signed session identifier, is strictly necessary for the login and is deleted after seven days at the latest or on logout. This cookie is never set for visitors to the website.

You can delete cookies or block their storage at any time in the settings of your browser. In that case the selected language may not be stored permanently.

6. Contact and quote request form

If you send us an enquiry via the contact or quote request form, we process the data you enter: name, email address, phone number, company (optional), requested service, postcode or city, and the content of your message.

The form data is transmitted to our server in encrypted form, stored there in our database and forwarded to us by email. We use the data exclusively to handle your enquiry, to clarify follow-up questions and to prepare a quote for you.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at concluding or performing a contract. Otherwise processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling the enquiries addressed to us effectively.

We need the information in the mandatory fields in order to handle your enquiry. Without this information we will generally be unable to answer your enquiry, or able to do so only to a limited extent. There is no statutory or contractual obligation to provide the data.

We store your enquiry until it has been conclusively handled. If a contract is concluded or the correspondence qualifies as business correspondence, we store the data beyond that for the duration of the statutory retention periods. Details can be found in the section on storage periods.

7. Quote assistant, photo upload and storage of enquiries

Our quote assistant lets you request a quote in a few steps. In doing so we process the information you provide: requested service, type of property, approximate area (optional), preferred time frame and frequency, name, email address, phone number, company (optional), postcode or city, and your message.

If you wish, you can attach up to five photos to your enquiry (JPG, PNG, WebP or HEIC, no more than 10 MB each). Uploading photos is voluntary. The photos are stored in an area of our server that is not publicly accessible and can be retrieved only by logged-in staff who are responsible for handling enquiries. Please upload only photos in which no persons can be identified and which do not show confidential information of third parties.

We store enquiries from the contact form and the quote assistant in the database of this website on the server of our hosting provider, so that we can handle them in a structured way, record their status and match follow-up questions. In addition, we receive a notification by email.

After you submit the form, an automatic confirmation of receipt is sent to the email address you provided. It contains a summary of your details and serves as proof that your enquiry has reached us. Your email address is not used for advertising purposes.

The legal basis is Art. 6(1)(b) GDPR, as the processing serves to take pre-contractual steps at your request. Where processing goes beyond that, in particular the structured storage and the confirmation of receipt, it is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling the enquiries addressed to us promptly, traceably and securely.

We delete enquiries, including any uploaded photos, as soon as they have been conclusively handled and no further communication is to be expected. If a contract is concluded or the correspondence qualifies as business correspondence, we keep the necessary records for the duration of the statutory retention periods. Details can be found in the section on storage periods.

8. Job applications and careers page

If you apply using the application form on our careers page, we process the data you submit: name, email address, phone number, the position you are applying for, your message and the documents you upload, in particular your CV (PDF, JPG or PNG, no more than three files of up to 10 MB each).

Application data is transmitted in encrypted form. The documents are stored in an area of our server that is not publicly accessible and can be retrieved only by the persons involved in recruitment at our company. They are not passed on to third parties. We are notified by email when an application arrives. This notification does not contain your documents.

The legal basis is § 26 (1) of the German Federal Data Protection Act (BDSG) in conjunction with Art. 6(1)(b) GDPR, as the processing is necessary for the decision on establishing an employment relationship. Please do not include special categories of personal data within the meaning of Art. 9 GDPR in your application, for example information on health, religion or ethnic origin, unless it is required for the position.

If you are hired, we transfer your application documents to your personnel file. Otherwise we delete your application, including all uploaded files, no later than six months after the end of the application process. This period serves the defence against possible claims, in particular under the German General Equal Treatment Act (AGG), and is based on Art. 6(1)(f) GDPR.

We keep your application for longer, for example to consider you for future vacancies, only with your explicit consent under Art. 6(1)(a) GDPR. You can withdraw this consent at any time with effect for the future. You can also withdraw your application at any time. In that case we delete your data, provided that no statutory retention obligations prevent deletion.

9. Contact by email and phone

If you contact us by email or phone, we process the data you provide (for example name, contact details, content of the enquiry and, for calls, the transmitted phone number and the time of the call) in order to handle your request. Clicking the phone number on our website merely opens the phone function of your device.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the initiation or performance of a contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in handling the enquiries addressed to us.

Please note that unencrypted emails are not fully protected against access by third parties during transmission. You should therefore not send us confidential information by unencrypted email.

10. Contact via WhatsApp

Our website contains a button that allows you to contact us via WhatsApp. The button is a plain link to the address wa.me. No data is transferred to WhatsApp when you merely visit our website. Only when you click the button are you redirected to WhatsApp, and only then is data processed by WhatsApp.

The provider of the service for users in the European Economic Area is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, a company of the Meta group. If you write to us via WhatsApp, we process your phone number, your WhatsApp profile name and the content of the conversation in order to handle your enquiry. According to WhatsApp, message content is end-to-end encrypted. However, WhatsApp obtains access to metadata, for example sender, recipient and time of the communication.

The legal basis for processing by us is Art. 6(1)(b) GDPR where your enquiry is aimed at a contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in offering you a fast contact channel that many customers ask for. Using WhatsApp is voluntary. You can reach us by phone, by email or via the contact form instead at any time.

WhatsApp processes data under its own responsibility and may transfer data to other companies of the Meta group, in particular to Meta Platforms, Inc. in the USA, and to further third countries outside the European Union and the European Economic Area. According to the provider, this transfer is based on the adequacy decision of the European Commission for the EU-U.S. Data Privacy Framework or on standard contractual clauses of the European Commission. We have no influence on this data processing. Details can be found in the privacy policy of WhatsApp.

Please do not send us any sensitive data via WhatsApp, for example health data, bank details or access codes. We delete conversations as soon as your request has been dealt with and no statutory retention obligations prevent deletion. Where necessary, we transfer content that is relevant to a contractual relationship to our business records.

11. Interactive map (OpenStreetMap)

On our contact page you can load an interactive map of our locations. The map is only displayed after you click the button to load it. Before that, no data is transmitted to the map service.

After the click, map tiles are retrieved from servers of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). Your IP address and technical details of your browser and device are transmitted to these servers. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give by clicking. An adequacy decision of the European Commission exists for the United Kingdom.

The button Open in Google Maps is a plain link. Only when you click it do you leave our website, and the privacy terms of Google then apply.

12. Links to social networks and to Google reviews

Our website contains links to our profiles on Instagram, Facebook, TikTok and LinkedIn and to our reviews on Google. These are plain links only. We do not embed any social media plugins, tracking pixels or other content from these providers on our website. No data is therefore transferred to these providers when you merely visit our website.

Only when you click such a link do you leave our website and are redirected to the page of the respective provider. From that moment the respective provider processes your data under its own responsibility, possibly also in third countries outside the European Union, in particular in the USA. If you are logged in to the respective service, the provider can assign the visit to your user account.

The providers are: for Instagram and Facebook, Meta Platforms Ireland Limited (Ireland); for TikTok, TikTok Technology Limited (Ireland); for LinkedIn, LinkedIn Ireland Unlimited Company (Ireland); and for Google, Google Ireland Limited (Ireland). Information on data processing can be found in the privacy notices of the respective providers.

If you get in touch with us via our social media profiles, for example through messages or comments, we process the data provided in order to handle your request on the basis of Art. 6(1)(b) or (f) GDPR.

13. Self-hosted fonts and videos

The fonts used on this website are stored locally on our server and delivered from there. No connection is made to servers of Google Fonts or other font providers.

The videos shown on this website are likewise delivered from our own server. We do not embed videos from YouTube or other video platforms. No data is therefore transferred to third parties when the videos are played. Only the data described in the section on server log files is generated.

14. Cookie-free reach measurement

To understand which pages of our website are used and to improve what we offer, we measure reach with a method we developed ourselves and run exclusively on our own server. No data is transferred to analytics services or other third parties.

The method uses no cookies and stores no information of any kind on your device. It does not access information stored there either. Consent under § 25 TDDDG is therefore not required.

For each page view we store: the page requested without parameters, the language, the host name of the previously visited website (for example a search engine), the device class (mobile, tablet or desktop), date and time, and an anonymous daily value. In addition, we count individual events without any content, for example the submission of an enquiry or a click on the phone number or the WhatsApp button.

Your IP address is not stored. Together with the browser identifier it is used only for a moment in working memory to calculate a shortened hash value with a secret additional value that changes every day. This daily value does not allow any conclusion about your IP address or your identity and changes every day, so visits on different days cannot be linked to each other. No usage profiles are created.

If your browser sends the Do Not Track or Global Privacy Control signal, no measurement takes place. The admin area and the login page are excluded from the measurement.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in designing and improving our website according to demand, using a method that is particularly sparing with data. The measurement data is deleted automatically after 400 days.

15. Security log of the admin area

The admin area of this website is accessible only to our staff and to service providers commissioned by us. To protect it against unauthorised access, we log logins, failed login attempts, lockouts after repeated failed attempts and changes to content. We store the type of event, the time, the email address of the user account used and the IP address from which access took place.

Visitors to the website who do not log in to the admin area are not affected by this logging.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in detecting, defending against and investigating attacks and misuse, and in ensuring the integrity of the data processed via the website. Log entries are deleted automatically after 180 days, unless they are exceptionally required for longer in order to investigate a specific security incident.

16. Recipients of data and transfers to third countries

Within our company, access to your data is given only to those persons who need it to handle your enquiry or to perform the contract.

Data is passed on to third parties only where this is necessary to perform the contract (for example to subcontractors engaged by us to carry out the commissioned service), where we are legally obliged to do so (for example towards tax authorities), where this is necessary for the establishment, exercise or defence of legal claims, or where you have given consent. In addition, we use processors, in particular the hosting provider named above and service providers for email and IT, who process data exclusively in accordance with our instructions.

As a rule, we do not intend to transfer personal data to countries outside the European Union or the European Economic Area. Such transfers take place only in the cases described in this privacy policy, in particular if you use WhatsApp or follow links to external platforms, and only in compliance with the requirements of Art. 44 et seq. GDPR.

17. Storage period

We store personal data only for as long as necessary for the respective purposes. Enquiries that do not lead to a contract are deleted, including any uploaded photos, as soon as they have been conclusively handled and no further communication is to be expected, provided that no statutory retention obligations prevent deletion. Job applications are deleted no later than six months after the end of the process, reach measurement data after 400 days and security log entries after 180 days.

Where statutory retention obligations exist, in particular under § 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO), we store the data concerned for the duration of those periods. These are generally six years for commercial and business letters and, depending on the type of document, generally eight to ten years for accounting vouchers and other documents relevant for tax purposes.

In addition, data may be stored for the duration of the statutory limitation periods where this is necessary for the establishment, exercise or defence of legal claims. Under §§ 195, 199 of the German Civil Code (BGB) the regular limitation period is three years from the end of the year. During this time processing is restricted to the extent necessary.

18. Your rights as a data subject

You have the following rights with regard to your personal data, provided that the respective statutory requirements are met:

Right of access to the data stored about you and to a copy of that data (Art. 15 GDPR).

Right to rectification of inaccurate data and to completion of incomplete data (Art. 16 GDPR).

Right to erasure of your data (Art. 17 GDPR).

Right to restriction of processing (Art. 18 GDPR).

Right to data portability, that is, to receive the data you have provided in a structured, commonly used and machine-readable format (Art. 20 GDPR).

Right to withdraw any consent given, with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise your rights, an informal message to the contact details stated in the section on the controller is sufficient. The restrictions under §§ 34 and 35 of the German Federal Data Protection Act (BDSG) remain unaffected. To protect your data, we may request additional information to confirm your identity where there are reasonable doubts about it.

19. Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(e) or (f) GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such marketing. In that case your data will no longer be processed for these purposes.

The objection can be made informally, for example by email to kontakt@facility-masters.de.

20. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

The supervisory authority competent for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)

Kavalleriestr. 2-4

40213 Düsseldorf

Germany

21. Data security, automated decisions and changes

For security reasons and to protect the transmission of your enquiries, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the character string https in the address line of your browser and by the lock symbol. In addition, we take appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

We update this privacy policy when the legal situation, our website or the nature of the data processing changes. The version published on this page at the relevant time applies.