Protecting your personal data when it is collected, processed and used in the course of your visit to our website is important to us. Your data is protected within the framework of the statutory provisions. Below, we inform you about the nature and scope of the processing of personal data via this website in accordance with Article 13 of the General Data Protection Regulation (GDPR).
I. Information about the controller
Breffka & Hehnke GmbH & Co. KG
Mörsenbroicher Weg 151
40470 Düsseldorf
Tel.: 0211 / 6 10 71 - 0
E-Mail: bh@breffka-hehnke.de
II. Information about the data protection officer
For any questions regarding data protection, our external data protection officer will be pleased to assist you:
Herr Arndt Halbach von der GINDAT GmbH
Wetterauer Str. 6, 42897 Remscheid
Mail: datenschutz@gindat.de
Tel. 02191 / 909 430
III. Data processing via the website
Your visit to our website is logged. The following data transmitted by your browser is initially collected:
This data is collected solely for the purposes of data security, improving our website and error analysis on the basis of Art. 6 (1) lit. f GDPR. Your IP address is only evaluated in anonymised form (truncated by the last 3 digits).
Apart from that, you can visit our website without providing any information about yourself.
Hosting
Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Processing takes place in data centres located in Germany. The provider processes on our behalf the data generated when you visit the website, in particular the log data listed above. The provider is engaged via the agency we have commissioned with the technical operation of our website, acting as a processor; the processing is safeguarded throughout by data processing agreements pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in the secure and efficient provision of our website (Art. 6 (1) lit. f GDPR). Further information can be found in the provider’s privacy policy at: www.hetzner.com/legal/privacy-...
The public website frontend is provided and delivered via the Vercel platform. The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Server-side execution is configured for the Frankfurt am Main region; delivery takes place via Vercel’s content delivery network. In this context, Vercel processes on our behalf, in particular, your IP address as well as technical access and log data. This processing is likewise organised via the commissioned agency and safeguarded by data processing agreements pursuant to Art. 28 GDPR. As Vercel is a US provider, a transfer of personal data to the USA cannot be ruled out; Vercel Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR), and the EU Standard Contractual Clauses additionally apply (Art. 46 (2) lit. c GDPR). The legal basis is our legitimate interest in the secure and high-performance provision of our website (Art. 6 (1) lit. f GDPR). Further information can be found in the provider’s privacy policy at: vercel.com/legal/privacy-policy.
Personal data (e.g. your name, address or contact details) that you provide to us of your own accord, for example in the context of an enquiry sent by e-mail to the contact persons named on our website, is stored by us and processed only for correspondence with you and only for the purpose for which you provided the data. This data is processed on the basis of Art. 6 (1) lit. b GDPR, insofar as your enquiry is aimed at the conclusion or performance of a contract, and otherwise on the basis of Art. 6 (1) lit. f GDPR (our legitimate interest in responding to enquiries addressed to us).
Contact form
Personal data (e.g. your name, address or contact details) that you provide to us of your own accord, for example in the context of an enquiry or in any other way, is stored by us and processed only for correspondence with you and only for the purpose for which you provided the data. This data is processed on the basis of Art. 6 (1) lit. b GDPR, insofar as your enquiry is aimed at the conclusion or performance of a contract, and otherwise on the basis of Art. 6 (1) lit. f GDPR (our legitimate interest in responding to enquiries addressed to us).
Secure data transmission
To protect the security of your data during transmission, we use state-of-the-art encryption (SSL/TLS) via HTTPS.
IV. Recipients of personal data
We may use service providers as processors to carry out and handle processing operations.
Specifically, we have engaged service providers for sending our newsletter, for hosting our website, for our marketing (HubSpot, see Section VI) and for AI-based assistance functions (see Section V).
Our contractual relationships with our service providers are governed by the provisions of Art. 28 GDPR, which contain the legally required stipulations on data protection and data security.
V. Use of AI-based assistance systems (Claude / Anthropic)
Description and scope of data processing
To support our business communication, we use the AI system Claude provided by Anthropic. Our contractual partner is Anthropic Ireland Limited, based in Ireland; the technical processing may involve Anthropic PBC, based in the USA, as well as further sub-processors.
Claude is used as a supporting assistance system within a limited scope. Upon request by our authorised employees, it can analyse and summarise business e-mail communication and calendar entries and assist in drafting texts and preparing appointments. Access is limited to e-mail and calendar data from our Microsoft 365 environment.
Processing takes place on a case-by-case basis and only upon a specific request by our employees. There is no automatic, permanent or systematic monitoring of your communication with us.
The following personal data may be processed in this context:
No automated decision-making
The results generated by Claude serve exclusively as a working aid and are reviewed by our employees before any further use. There is no automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR. All decisions, in particular in insurance and claims matters, are made by our employees.
Legal basis
The processing is based on Art. 6 (1) lit. f GDPR (legitimate interest). Our legitimate interest lies in the efficient handling of business communication and in improving our response times to your enquiries.
Recipients and transfer to third countries
When Claude is used, the relevant data is transmitted to Anthropic as a processor. This may involve a transfer to the USA. The transfer is safeguarded by the EU Standard Contractual Clauses 2021 (Art. 46 (2) lit. c GDPR), which form part of the data processing agreement (Data Processing Addendum) with Anthropic, as well as by supplementary technical and organisational measures.
Anthropic uses sub-processors to provide its services, for example for cloud infrastructure and support. A current overview is available in the Anthropic Trust Center at https://trust.anthropic.com/su....
Anthropic does not use customer data processed within its commercial services to train its AI models.
Storage period
The e-mail and calendar content retrieved in the context of a request is not permanently stored as a separate copy outside the context of use. Inputs and outputs as well as technical log data may be stored by Anthropic to the extent necessary for the provision, security and traceability of the services. Upon termination of the contract, customer data is deleted or returned in accordance with the data processing agreement.
Right to object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) lit. f GDPR. We will then cease processing your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.
If you have any questions about the AI-based processing of your data, please contact our data protection officer (Section II).
VI. Use of HubSpot
For our marketing activities, in particular the provision of contact forms, the sending of our newsletter and the management of contact enquiries, we use the software platform HubSpot. The provider is HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA; the contractual partner for customers in the European Economic Area is HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland.
If you fill in a form on our website or subscribe to our newsletter, the data you provide (e.g. name, e-mail address, company, content of your enquiry) is stored in HubSpot and processed to handle your enquiry, to maintain our business contacts and to send the newsletter, respectively.
The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR, insofar as you have, for example, subscribed to the newsletter; otherwise Art. 6 (1) lit. f GDPR (our legitimate interest in the efficient handling of enquiries and the maintenance of our business contacts). You may withdraw any consent given at any time with effect for the future; you can unsubscribe from the newsletter via the unsubscribe link contained in every e-mail.
We have concluded a data processing agreement with HubSpot pursuant to Art. 28 GDPR. The data is stored in a data centre within the European Union (Germany). A transfer of personal data to the USA, for example to the parent company HubSpot, Inc., cannot be ruled out in individual cases. HubSpot, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR); in addition, the EU Standard Contractual Clauses apply (Art. 46 (2) lit. c GDPR).
Insofar as HubSpot uses cookies or similar technologies on our website (e.g. to recognise form users or to measure performance), this only takes place after you have given your consent via our cookie consent banner (see Section VII). We store the data processed in HubSpot for as long as this is necessary for the stated purposes or until you withdraw your consent; statutory retention obligations remain unaffected.
Further information can be found in HubSpot’s privacy policy at: legal.hubspot.com/privacy-policy.
VII. Cookies, web analytics and marketing tools
On our website, we use the analytics and marketing tools described below. These tools use cookies or similar technologies that are stored on your device or that access information already stored on your device. They are only used insofar as you have given us your consent via our cookie consent banner (Section 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), Art. 6 (1) lit. a GDPR). You may withdraw your consent at any time with effect for the future via the cookie settings on our website. The withdrawal does not affect the lawfulness of the processing carried out prior to the withdrawal. In addition, our website sets its own preference cookie to store your language setting (storage period: 1 year).
Consent management (Cookiebot by Usercentrics)
To obtain and manage your consents, we use the consent management tool Cookiebot. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. When you access our website, Cookiebot processes in particular your truncated IP address, the date and time of your visit, browser information, the URL of the page accessed and your consent status. Your consent status is stored in a cookie on your device so that your selection can be taken into account on future visits.
The processing is necessary in order to obtain, manage and demonstrate the consents of website visitors in a legally compliant manner (Art. 6 (1) lit. c GDPR in conjunction with Art. 7 (1) GDPR); the storage of the cookie is strictly necessary for the operation of the website (Section 25 (2) no. 2 TDDDG). We store the data for as long as this is necessary for the stated purposes. Further information can be found in the provider’s privacy policy at: www.cookiebot.com/en/privacy-p...
Google Analytics
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies and similar technologies that enable an analysis of your use of our website. The data collected includes, in particular, your truncated IP address, technical information about your browser and device, your approximate region and interactions with the website (e.g. pages viewed, time spent, links clicked). This information is usually transferred to a Google server in the USA and stored there. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); in addition, the EU Standard Contractual Clauses apply (Art. 46 (2) lit. c GDPR).
The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR. We store the data for as long as this is necessary for the stated purposes or until you withdraw your consent. Further information can be found in Google’s privacy policy at: policies.google.com/privacy.
Google Tag Manager
We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to manage and deploy the tools used on our website (e.g. Google Analytics). It does not itself create user profiles, but it processes your IP address, which may also be transmitted to Google servers in the USA. The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR. We store the data for as long as this is necessary for the stated purposes or until you withdraw your consent.
Google Ads (conversion tracking)
We use Google Ads conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Conversion tracking makes it possible to measure the effectiveness of our advertisements by recording whether users carry out certain actions on our website after clicking on an advertisement. In this context, cookies are set and, in particular, your IP address, device information and information about your interaction with our advertisements and our website are processed. This information may be transmitted to Google servers in the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and the EU Standard Contractual Clauses additionally apply. Conversion tracking is only used after you have given your consent via the cookie banner (Art. 6 (1) lit. a GDPR). We store the data for as long as this is necessary for the stated purposes or until you withdraw your consent. Further information can be found in Google’s privacy policy at: policies.google.com/privacy.
Hotjar
We use Hotjar, a service provided by Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian’s STJ 3141, Malta. Hotjar helps us to better understand how our website is used (e.g. how much time users spend on which pages and which links are clicked) in order to improve our offering. Hotjar uses cookies and similar technologies and collects, in particular, your IP address (stored in anonymised form only), screen size, device type, browser information, your approximate location (country only) and your preferred language. This information is stored in a pseudonymised usage profile and is used neither by Hotjar nor by us to identify individual users, nor is it merged with other data about individual users.
The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR. We store the data for as long as this is necessary for the stated purposes or until you withdraw your consent. Further information can be found in Hotjar’s privacy policy at: www.hotjar.com/legal/policies/...
YouTube videos
Videos from the YouTube platform are embedded on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you access a page with an embedded video, cookies are set and data is transmitted to YouTube or Google, in particular your IP address, device information and information about the videos viewed. This may involve a transfer to the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and the EU Standard Contractual Clauses additionally apply. The videos are only embedded after you have given your consent via the cookie banner (Art. 6 (1) lit. a GDPR). We store the data for as long as this is necessary for the stated purposes or until you withdraw your consent. Further information can be found in Google’s privacy policy at: policies.google.com/privacy.
Meta Pixel
We use the Meta Pixel on our website. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The Meta Pixel makes it possible to address visitors to our website as a target group for advertisements on Meta platforms (Facebook, Instagram) and to measure the success of such advertisements. In particular, your IP address, device information and information about your visit to our website are processed; the data may be transferred to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR), and the EU Standard Contractual Clauses additionally apply. The Meta Pixel is only used after you have given your consent via the cookie banner (Art. 6 (1) lit. a GDPR). We store the data for as long as this is necessary for the stated purposes or until you withdraw your consent. Further information can be found in Meta’s privacy policy at: www.facebook.com/privacy/polic...
VIII. Use of social media
We maintain a company profile on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) in order to provide information about our company and our services and to communicate with users. No LinkedIn plugins or other LinkedIn functions are technically embedded on our website; we merely link to our profile, and no data is transmitted by us to LinkedIn when you simply click the link. If you contact us via our profile, we process the data you provide in order to respond to your enquiry. The legal basis is our legitimate interest in public relations and communication (Art. 6 (1) lit. f GDPR). The operator of the network also processes your data under its own responsibility, in particular for advertising purposes; details can be found in LinkedIn’s privacy policy.
IX. Your rights
Under Art. 15 to 21 GDPR, you may, where the conditions described therein are met, assert the following rights with regard to the personal data processed by us.
Right of access
You have the right to obtain information about the personal data concerning you that is processed by us (Art. 15 GDPR).
Right to rectification
You may request the rectification of incomplete or inaccurately processed personal data (Art. 16 GDPR).
Right to erasure
You have the right to erasure of personal data concerning you (Art. 17 GDPR), in particular where one of the following grounds applies:
The right to erasure does not apply insofar as the processing is necessary, in particular, for compliance with a legal obligation or for the establishment, exercise or defence of legal claims. The further statutory exceptions are set out in Art. 17 (3) GDPR. Where data cannot be erased for these reasons, a restriction of processing (below) may apply instead.
Right to restriction of processing
You have the right to request that we restrict the processing of your personal data (Art. 18 GDPR) where
Right to data portability
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, provided that the processing is based on consent or a contract and is carried out by us using automated means (Art. 20 GDPR).
Right to object and right of withdrawal
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) lit. e or f GDPR (Art. 21 GDPR); this also applies to profiling based on those provisions. Insofar as the processing of your personal data is based on consent, you have the right to withdraw this consent at any time with effect for the future (Art. 7 (3) GDPR).
X. Standard periods for the erasure of data
Unless a statutory retention obligation applies, data is erased or destroyed once it is no longer required to achieve the purpose of the data processing. Different retention periods apply to personal data: data of relevance under tax law is generally retained for 10 years, other data under commercial law generally for 6 years. Finally, the storage period may also be determined by statutory limitation periods, which, for example, under Sections 195 et seq. of the German Civil Code (BGB), are generally three years, but in certain cases may be up to thirty years.
XI. Right to lodge a complaint with a supervisory authority
Under Art. 77 GDPR, every data subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of personal data concerning them infringes the GDPR. The competent supervisory authority for data protection matters is the state data protection commissioner of the federal state in which our company has its registered office, in our case the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.
XII. Amendments to this privacy policy
We reserve the right to amend this privacy policy with effect for the future, in particular in the event of changes to the services used or to the legal situation. The current version is available on this page at all times.