In this document, we explain to you which personal data we process from you when you contact us or when we are in a business relationship with your company. With this information we comply with the obligations of the EU General Data Protection Regulation and inform you transparently about our data processing.
The responsible acc. to Art. 4 No. 7 GDPR is the respective STRABAG Group company (hereinafter referred to as STRABAG) with which you are in contact. In general, the name and contact address of the responsible group company can be found in the contract documents or any correspondence. If you have any questions about the processing of your personal data through us or about data protection in general, please contact our data protection officers and/or data protection coordinators (data-protection-group@strabag.com). In any case, you can also contact Group Privacy at data-protection-group@strabag.com
Note: If you have applied to one of the STRABAG Group companies, you will find special information on data processing for applicants at. https://karriere.strabag.com/databases/internet/_public/content30.nsf/web30?Openagent&id=DE_STRABAGKARRIERE_DE_Informationen_zur_Datenverarbeitung_en.
Personal data are any information relating to an identified or identifiable natural person. This includes, for example, your name, your (business) contact information, your relationship with a company and your interaction/activities with us.
We process data within the framework of the business purposes of STRABAG as a European technology group for construction services, which we receive from you or third parties in connection with tender procedures, quotations, orders or other incipient or existing contractual relationships. In addition to your business contact data, this also includes all information exchanged, such as e-mails, order documents, requests for our (construction) services and payment data. In the case of business relationships, you must provide the personal data required for the preparation or execution of the contracts or for the processing of which we are legally obliged; otherwise we cannot fulfil the contracts.
STRABAG participates in tender procedures in the context of which the data of the tendering offices and other parties involved in the tender procedure - such as potential subcontractors / suppliers on our part - are processed.
The legal basis for data processing is Art. 6 Para. 1 S. 1 b) and/or f) GDPR.
STRABAG processes the data provided within the scope of the order placement / tender for the fulfilment of the contract and, if necessary, uses specialized (affiliated) service providers and, in particular, subcontractors and suppliers for this purpose. In addition, the data collected by STRABAG for the preparation of an offer as well as in the context of the execution of the order will be passed on to involved contractual partners or other project participants (building owners, planners, project controllers, subcontractors or suppliers). Further details on the purposes can be found in the respective contract documents.
This data processing is carried out based on Art. 6 Para. 1 S.1 b) and/or f) GDPR.
To check address and creditworthiness, STRABAG retrieves from credit agencies the address data stored in the databases for your company as well as creditworthiness data, including those determined based on mathematical-statistical procedures (scoring). This occurs if STRABAG enters into an economic risk with the conclusion of the contract and wants to secure itself through the creditworthiness query.
The information provided by the credit agencies and the internal information on payment behavior are evaluated internally by STRABAG.
The data processing referred to here is based on Art. 6 Para. 1 S. 1 f) GDPR.
STRABAG collects and processes personal data that we have received from you in the context of a business contact or that you make available to us, e.g. through information in the context of an enquiry, an order or another business contact, or that is made available to us in the context of tender procedures, for initiating business and for customer retention. By business contact we mean the collection of data within the framework of events, on presentations by STRABAG or within the framework of other events, trade fairs or networking meetings. We also collect generally accessible data, such as information from a company presence on the Internet or from other generally accessible directories (catalogues, lists of associations, etc.).
In addition to your contact data, the data collection also includes the other data that you provide us with in this context (in general in addition to the details on the business card, other wishes/inquiries, further details on the order or other details on the company for which you work). In addition, we also collect the data that is visible to us on the website of the company for which you work. We process these data for initiating business as well as within the framework of our customer loyalty measures.
STRABAG as well as commissioned service providers (printers, lettershops, etc.) use your name, address as a contact person in ongoing business relationships or as a business contact together with the data arising within the scope of the business relationship (contact data, order data, ordered services, etc.) as well as the otherwise freely accessible data for advertising purposes. STRABAG provides further information on products and services from the STRABAG Group and carries out analyses for marketing purposes.
STRABAG will use your telephone number for advertising purposes, if you have given your consent or if the prerequisites for presumed consent have been met, for example within the framework of an existing business relationship or after prior contact. In addition, STRABAG uses the e-mail address collected from the contact persons as part of the conclusion of contracts to advertise its own similar offers. Of course, you have the right to object to these advertising addresses. We point out the right to object to advertising separately in each case.
The legal basis for this advertising use is Art. 6 Para. 1 Sentence 1 f) GDPR or, if you have given your consent, Art. 6 Para. 1 Sentence 1 a) GDPR.
STRABAG also processes personal data for public relations and investor relations purposes. In this context, personal data may be passed on to stakeholders and the media. On the other hand, the contact data of media representatives/journalists and stakeholders are also processed.
The legal basis for these processing activities is Art. 6 para. 1, sentence 1 b) and/or f) GDPR.
STRABAG - like every company - is subject to various legal obligations to check the data of our customers and business partners. In these cases, we process your personal data only to the extent necessary for these legal requirements. To fulfil legal obligations, it may be necessary to process your data partially automatically with the aim of evaluating personal aspects (profiling). Unless you are expressly informed of this, no automated individual case decisions will be made.
These legal requirements refer to:
The legal basis is Art. 6 para. 1 sentence 1 c) GDPR in connection with the relevant statutory provisions.
STRABAG can forward your master data (name of the company, contact person, address and contact data such as telephone number and e-mail address) to other companies of the STRABAG Group and, if necessary, update it to ensure that all STRABAG companies involved in a transaction with you (e.g. processing of a contract) have uniform master data on you. This serves to simplify our processes and can free you from having to enter the master data again when you contact another group company. This data processing takes place on the legal basis of Art. 6 Para. 1 Sentence 1 b) and/or f) GDPR. Your rights are safeguarded by internal contractual regulations that guarantee a high standard of data protection.
In addition to master data, contract data can also be passed on to other STRABAG companies if this is necessary due to the execution of the contract or within the framework of award procedures. For example, different STRABAG services are provided by different STRABAG companies, so that a transfer can take place to simplify contract processing. The legal basis is Art. 6 para. 1 sentence 1 b) and/or f) GDPR.
Where required for the fulfilment of our legal obligations, data on orders can be passed on to the responsible offices together with information on the clients and, if necessary, also on the contact person. This concerns, for example, the transfer of data to tax authorities, auditors, insurance companies, shareholders or chambers of commerce.
In individual cases, data may also be passed on to lawyers commissioned by STRABAG to evaluate and/or enforce legal claims. In these cases, the information may also be passed on to public tender chambers, (arbitration) courts and/or bailiffs.
The legal basis for the processing is Art. 6 Para. 1, Sentence 1 b), c) and/or f) GDPR.
We only store your data for as long as it is necessary to fulfil the purpose for which it was collected (e.g. within the framework of a contractual relationship) or if this is provided for by law. In the context of a contractual relationship, we store your data at least until the complete termination of the contract. The data will then be stored for the duration of the statutory retention periods.
For the exercise of your rights and if you wish to complain in connection with the processing of personal data by STRABAG, you are welcome to contact our data protection officers and/or data protection coordinators. You can also contact the Group Privacy Department at data-protection-group@strabag.com
Every affected (natural) person has the following rights:
You can object the processing of personal data for advertising purposes including the analysis of customer data or the transfer to third parties for advertising purposes at any time without giving reasons.
In addition, every data subject has a general right of objection (cf. Art. 21 para. 1 GDPR). In this case, the objection against data processing must be justified. If the data processing is based on a consent, your consent can be revoked at any time with effect for the future. The revocation of your consent does not affect the legality of the processing carried out based on your consent until you revoke it.
We adapt the data protection notice to changed functionalities or changed legal situations. We therefore recommend that you read the data protection notice at regular intervals. If your consent is required, the changes will only be made with your consent.
Status: May 2020