Privacy policy

We are pleased that you are visiting our company website and thank you for your interest. The protection of your personal data is very important to us. Below we inform you about how we handle your data.

1. Controller

The controller responsible for data processing on this website is Bauvox GmbH, Wilhelm Kabus Straße 24, 10829 Berlin, Germany, e-mail: info@bauvox.de, phone: +49 176 20726838.
(Prüfung durch den Kunden ausstehend)

2. Hosting and server log files

We run our website with the configurator and the inquiry form, and the associated database, on servers of Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg ("AWS"). The servers are in the AWS region Stockholm (Sweden) and therefore in the EU.

On these servers we store the details you send us through the contact form or the configurator (for example your name, your contact details, your configuration, your message and a photo you upload voluntarily) and the technical data that arises when the website is called up. The application logs of our programming interface (API) contain no IP addresses. Our web server and the server's operating system log accesses with the time, the address requested, the status code and your IP address; we keep these logs for 14 days and then delete them automatically. We store your IP address nowhere else. To protect against abuse, our server briefly holds a pseudonymised value (hash) of your IP address in memory and stores it with an inquiry, where we delete it after 30 days.

We use AWS to provide our website securely, quickly and reliably. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and economical operation of the website. Where you send us an inquiry, we also process your details under Art. 6(1)(b) GDPR.

AWS processes the data only on our behalf and on our instructions. We have a data processing agreement with AWS under Art. 28 GDPR (AWS GDPR Data Processing Addendum).
(Prüfung durch den Kunden ausstehend)

3. Data backup

So that no data is lost, we back up the database and the uploaded photos once a day. Every backup is encrypted before it is stored. Only Bauvox has the key to decrypt it, not AWS. The backups are kept on our server and also in a non-public storage of AWS, likewise in the region Stockholm (EU).

We keep the backups of the last 7 days, the last 4 weeks and the last 6 months; older backups are deleted automatically. If we delete your data, it is still contained in the backups made before, until these are deleted automatically after about seven months at the latest. Until then we use the backups only to restore operation after a data loss. If we have to restore a backup, we delete again the data whose deletion had already been carried out.

In addition, AWS takes a daily snapshot of our entire server so that we can restore it quickly after a failure. Only the seven most recent snapshots are kept.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security and availability of your data and ours (cf. Art. 32 GDPR).
(Prüfung durch den Kunden ausstehend)

4. Inquiries via the contact form and the configurator

Inquiries via the contact form and the configurator: we process your name, your contact details, your project details, your configuration and, if you wish, a photo in order to make you an offer (Art. 6(1)(b) GDPR). The data is seen only by authorised staff of Bauvox GmbH and by the service providers who operate the system. You can ask us at any time to delete or correct your data.

In detail:
- contact form: name, e-mail address, postcode, phone number, requested service, width and depth in centimetres and your message;
- configurator: name, e-mail address, phone number, town, country (preset to Germany), optionally street and postcode, your configuration, your answer on installation, your note, and optionally a photo and a picture of the configured patio roof;
- both: the time of your consent to this privacy notice with the version of the consent text, and the language of the page.

If we arrange an appointment with you (for example to take measurements on site), we note its date, time and a short remark with your inquiry.

To protect against abuse we store a pseudonymised value (hash) of your IP address with an inquiry and delete it after 30 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our form against automated mass submissions.

What you enter in the configurator stays in your browser until you submit (the configuration and your note in the tab's session storage, your contact details in memory only). We receive the data only when you submit.

Inquiries that do not lead to an order are deleted automatically 12 months after they were last worked on, together with photos, notes and stored e-mails. You can ask for deletion earlier at any time.
(Prüfung durch den Kunden ausstehend)

5. Photos and picture of the configuration

With a configurator inquiry you may upload a photo of your house or terrace (JPEG, PNG or WebP). We also send a picture of the patio roof you configured. Your browser converts the images to JPEG before uploading, which removes location (GPS) and camera data, and the file name is not transmitted. The images are stored on our server in a non-public area, and only logged-in staff of Bauvox GmbH can open them. We never send them by e-mail. Uploaded images that belong to no submitted inquiry are deleted after 24 hours; all others are deleted with the inquiry. The legal basis is Art. 6(1)(b) GDPR.
(Prüfung durch den Kunden ausstehend)

6. E-mail sending

When you send us an inquiry, we receive a notification by e-mail and you receive a confirmation. We send these e-mails through the service Amazon Simple Email Service (Amazon SES) of AWS (address see "Hosting"), region Stockholm (EU).

AWS processes the content of the e-mails (your details from the inquiry) and the sending data (sender and recipient address, time, message identifier and delivery status). We never send photos by e-mail; they stay on our server.

The legal basis is Art. 6(1)(b) GDPR, as the e-mails serve to handle your inquiry. The data processing agreement with AWS (see "Hosting") also applies to this service.

Your confirmation e-mail contains only your name and your configuration: no phone number, no address and no note. We send at most three confirmations to the same address within 24 hours. We keep the e-mails in our system for sending and delete them there 30 days after they were sent. The notification to us stays in the Bauvox GmbH mailbox until we delete the inquiry.
(Prüfung durch den Kunden ausstehend)

7. Cookies and storage in the browser

We use no cookies for analytics or advertising and no technologies that track you across visits, websites or devices. How we count visits without cookies is described in the section "Audience measurement without cookies".

Only when you expressly choose a language does our website set the cookie “locale”. It is strictly necessary to remember the chosen language, is stored for 12 months (SameSite=Lax, Secure), contains only the language code, is not used for tracking and is not passed on to third parties.

The configurator keeps your current configuration and your note in the session storage of the browser tab, so that they survive a page reload. This data leaves your device only when you submit an inquiry, and it is deleted when you close the tab or reset the configuration. In the administration area we set a strictly necessary session cookie for logged-in staff, which ends when the browser is closed. Under Section 25(2) no. 2 TDDDG these strictly necessary storages need no consent.
(Prüfung durch den Kunden ausstehend)

Audience measurement without cookies

(Prüfung durch den Kunden ausstehend)

We want to know how often our website is visited and which pages people read. To find out, we count page views on our own server. We use no cookies and no other storage on your device, and we load no counting script into your browser. No data is passed to third parties.

For each page view our server evaluates what your browser sends anyway: the page requested, its language, the website you came from (its domain only), the browser type (only the device class phone, tablet or computer) and your IP address. In memory, our server derives the country and region (for example a German state) from the IP address, using a database stored on our own server; nothing is sent to a service provider. To avoid counting one visitor several times on the same day, we compute an irreversible checksum from the IP address, the browser type and a random value that is replaced every day. The checksum and the random value are deleted by the next nightly run, that is after at most about 27 hours. The IP address itself is not stored for the statistics.

Only aggregated daily figures are stored, for example "120 views of the home page from Bavaria, 80 of them visitors". Regions with fewer than three visitors are shown only in combined form. These figures cannot be traced back to you as a person. We keep them for at most 24 months.

If your browser sends the "Global Privacy Control" or "Do Not Track" signal, your page view is not counted.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to know how far our website reaches and how it is used, and to improve it. You may object at any time on grounds relating to your particular situation; a simple way is the "Global Privacy Control" setting of your browser.

Separately, our web server keeps access logs with IP addresses for 14 days.

AR view in the configurator

(Prüfung durch den Kunden ausstehend)

In the configurator you can view the planned patio roof in your surroundings through the camera of your phone or tablet (augmented reality). You grant camera access in your browser or operating system and can withdraw it at any time.

The camera image and the surfaces it detects, such as floor and wall, are processed only on your device, by the browser (Android: Chrome with "Google Play Services for AR") or by the operating system (iPhone and iPad: AR Quick Look). Your device builds the 3D model from your configuration. We receive no camera images, position data or model, and nothing is passed to third parties. We store no data for the AR view.

If you open the AR view on a computer, we show a QR code whose link contains your configuration. The part of the link that holds the configuration (after the "#" sign) is not sent to our server.

If your device does not support the AR view, you can take or choose a photo and place the patio roof in it. The photo is processed only on your device and is not sent to us. Only if you expressly attach it to your request and consent to that do we receive it, like other photos for your request (see the section "Photos and picture of the configuration").

The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request), to the extent that personal data is involved at all.

8. Links to other websites

Our contact section contains a "Route planen" (plan route) link to Google Maps. The map on our page is an image loaded from our own server. Only when you click the link does Google's website open in a new tab, where Google processes your data under its own privacy policy. No data is transmitted to Google before that.
(Prüfung durch den Kunden ausstehend)

9. Transfer to third countries

AWS is a subsidiary of Amazon.com, Inc., based in the USA. Although your data is stored exclusively in the EU, access from outside the EU (for example in the course of maintenance and support, or at the request of US authorities) cannot be ruled out. For this, AWS has committed in the data processing agreement to the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR), and Amazon.com, Inc. participates in the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR).
(Prüfung durch den Kunden ausstehend)

10. Retention periods at a glance

- Inquiries without an order (with photos, notes, appointment, e-mails): 12 months after they were last worked on
- Pseudonymised value of the IP address with an inquiry: 30 days
- Uploaded images without a submitted inquiry: 24 hours
- Sending copies of e-mails in our system: 30 days after sending
- Web server access logs (with IP address): 14 days
- Backups: up to about 7 months (see "Data backup")
- Audience measurement: checksum and daily value until the next nightly run, at most about 27 hours; aggregated figures at most 24 months
- Cookie "locale": 12 months
(Prüfung durch den Kunden ausstehend)

11. Your rights

You have the right of access to the data we hold about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21). You may withdraw a consent at any time with effect for the future. Please contact info@bauvox.de or the address above.
(Prüfung durch den Kunden ausstehend)

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
(Prüfung durch den Kunden ausstehend)

13. Obligation to provide data, no automated decision-making

You are not obliged to provide data. Without the details marked as required, however, we cannot handle your inquiry. There is no automated decision-making, including profiling (Art. 22 GDPR).
(Prüfung durch den Kunden ausstehend)

14. Contact options

You can contact us at any time by email at info@bauvox.de, through the contact form or by telephone on 0911 13069880 to clarify questions about data protection.

15. Security measures

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access.