1. Controller
Bros Project Bau GmbH
Elsenheimerstr. 15
80687 Munich
Germany
+49 163 9438622
bros.project.bau@gmail.com
2. Scope
This privacy notice explains how personal data are processed when you visit this website or contact us. Personal data are information relating to an identified or identifiable person.
3. Hosting and server log data
This website is hosted through ChatGPT Sites. For customers based in the European Economic Area, the service is provided by OpenAI Ireland Limited. OpenAI may use technical subprocessors, including infrastructure for content delivery and security. When you access the website, the hosting systems may process your IP address, date and time, requested page or file, transferred data volume, referrer URL, browser, operating system and access status.
Processing is necessary to deliver the website reliably, prevent misuse, investigate technical problems and maintain security. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are secure, stable and efficient website operation. Log data are erased or anonymised when no longer required for these purposes, unless security incidents or legal retention duties require longer storage. Further information is available in the ChatGPT Sites Data Processing Addendum and the OpenAI privacy policy.
4. Phone, email and project inquiry
If you contact us by phone, email or the project form, we process the contact and project details you provide to respond and handle your inquiry. The project form processes the information entered only in your browser and opens your own email application with a prepared message. The website itself does not store or transmit the form content. Files selected in the form are not uploaded and must be attached in the email application before sending.
Our mailbox is operated through Gmail by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process communication and metadata on servers outside the European Economic Area. Further information is available in the Google privacy policy.
The legal basis is Art. 6(1)(b) GDPR for pre-contractual measures or contract performance and otherwise Art. 6(1)(f) GDPR for our legitimate interest in responding to business inquiries. We erase inquiry data when the matter has been completed and no contractual or statutory retention obligation applies.
5. Applications
For applications submitted through the careers form, we process contact details, desired position, qualifications, availability and uploaded documents to decide on establishing an employment relationship. The legal basis is Section 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR. The application form processes the information entered only in your browser and opens your own email application with a prepared message. The website itself does not store or transmit application content. Selected documents are not uploaded and must be attached in the email application before sending. Unless employment is established or legal claims require longer retention, application data are generally erased no later than six months after the application process ends.
6. Requirement to provide information
You are not legally required to contact us or provide personal data through this website. The contact details and project information requested are needed only to answer and assess your inquiry. Without sufficient contact or project information, we may be unable to process it.
7. Cookies, analytics and external content
We do not use analytics, advertising tracking or non-essential marketing cookies on the current website. The language selection is carried in the page address. Images, fonts and design assets are delivered locally through the website; visiting a page does not intentionally connect to image or font providers. External providers receive data only when you actively follow an external link.
8. Recipients and international transfers
Personal data are disclosed only where necessary for hosting, email communication, contract handling, legal compliance or the establishment, exercise or defence of legal claims. Recipient categories may include OpenAI and its technical subprocessors, Google as email provider, professional advisers, contractual partners involved in a project and public authorities where legally required. Providers may process data outside the European Economic Area. Where required, transfers are protected by an adequacy decision or appropriate safeguards such as EU standard contractual clauses. You may request further information about the relevant safeguards using the contact details above.
9. Your rights
Subject to the statutory requirements, you have rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on consent, you may withdraw that consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.
10. Right to object
If processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the affected data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
11. Competent supervisory authority
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de
12. Automated decisions
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place on this website.
13. Security and updates
This website uses encrypted HTTPS transmission. We also use appropriate technical and organisational measures to protect personal data. Internet communication, particularly email, can nevertheless present security risks. We update this notice when legal requirements, providers or website functions change.