This privacy policy covers the Bautimer app and the web application at app.bautimer.com (together the “Application”), the website bautimer.com, and the way we approach companies we would like to win as customers. The provider is TSB Tech Solution Builders UG (haftungsbeschränkt), Untere Dorfstr. 20, 84036 Kumhausen, Germany, info@bautimer.com (see Imprint). We are not required to appoint a data protection officer; the managing directors are the contacts for data protection. The German version at bautimer.com/datenschutz is the authoritative one.
When we write to or call your company
The controller is TSB Tech Solution Builders UG (haftungsbeschränkt), Untere Dorfstr. 20, 84036 Kumhausen, info@bautimer.com (see Imprint).
Where your data comes from. Public directories – the member directory of the Bavarian landscaping association (Verband Garten-, Landschafts- und Sportplatzbau Bayern, VGL), Google Maps and your own website – as well as trade-fair contacts and referrals. We do not buy address lists.
Which data. Company name, postal address, phone number, e-mail address, website; salutation and name of the contact person; short notes about the company (for example focus, size, region) and about our contacts with you (letter sent, call with its outcome; e-mail sent, delivered, opened, link clicked).
Why, and on what basis. To introduce Bautimer to you – with a letter and a short call, or with a single e-mail to your company’s business e-mail address from a public directory. The basis is our legitimate interest in direct marketing to businesses (Art. 6(1)(f) GDPR). We limit ourselves to business contact details, one letter, at most one such e-mail per address and one call; we do not build profiles. We only send further e-mails if you expressly ask for them (Art. 6(1)(a) GDPR). The e-mail we send without being asked contains a link that lets you unsubscribe with one click; your company is then kept permanently on our block list (see “Your rights”).
Who receives the data. Nobody but us. The data is stored with Amazon Web Services in the Frankfurt data centre (a processor); it is not transferred to countries outside the EU.
For how long. We delete the contact details of companies we have written to or called no later than twelve months after the last contact, unless a contract has come about. The same applies to our notes. Backups are overwritten within 35 days after that. The exception is the block list – it has to outlive the data it replaces, otherwise it would be useless (see “Your rights”).
Your rights. You can at any time request access to the data we hold about you, have it corrected or deleted, and have its processing restricted. Above all, you can object to the use of your data for marketing at any time, without giving reasons (Art. 21(2) GDPR) – a short note by phone, e-mail or post is enough. We will then stop contacting you and delete your data – the whole record including our notes, the generated letter and the visits to the info page. What remains is an entry in a block list so that we do not write to you again by mistake. It contains, in plain text: company name, town, the contact person’s salutation and surname if we knew them, plus the reason, channel and date of your objection and a short note of what you told us. Postal address, phone number, e-mail address, website and your directory number are not kept in plain text; they are stored only as pseudonymised check values (hashes) whose sole purpose is to recognise your company automatically in a later import. These check values are not anonymous – someone holding the database could test a guess against them – but nothing can be read from them. We keep this entry permanently: it is the only thing that stops us from writing to you again in a later wave. You can also complain to a data protection supervisory authority; ours is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. No automated decision-making takes place.
QR code, info page and our e-mails
The QR code in our letter leads to an info page. When it is opened we store the letter’s code and the time – that is, that your company opened the letter and visited the page, much like a reply card. We set no cookies and build no user profile. The basis is our legitimate interest in knowing whether our letter arrived and raised interest (Art. 6(1)(f) GDPR).
If we write to your company by e-mail without being asked, the e-mail contains a personal link to the same info page. When the link is opened we store its code, which version of our e-mail you received (we send it in three versions), and the time. If you stay on the info page for about ten seconds or start filling in the form, we also store the time of that visit – whether you came through the letter or the e-mail; this is how we tell a person looking at the page from a security program that only checks the link. Our e-mails also contain a small image: if your e-mail program fetches it, we learn that the e-mail was opened and store that with the code and the time. You can prevent this by setting your e-mail program not to load images automatically. Here, too, we set no cookies. The basis is our legitimate interest in knowing whether our e-mail arrived and raised interest (Art. 6(1)(f) GDPR).
If you request a call back on that page, we store your phone number and preferred time for that call only. If you order information by e-mail, we store your e-mail address and the name you give on the basis of your consent (Art. 6(1)(a) GDPR), which you give by sending the form and can withdraw at any time – a short note is enough.
The e-mail we write to your company without being asked also contains a link to unsubscribe. If you confirm there with one click – or use the unsubscribe option your e-mail program offers directly – we put your company on our block list at once and store the code and the time with it. The same applies if you report our e-mail to your e-mail provider as unwanted and the provider tells us so. The block-list entry is kept permanently so that we do not write to you again (see “Your rights” in the section above). A short reply to any of our e-mails works just as well.
These visits, unsubscribes and entries are deleted automatically after 180 days. Details from the form are added to our contact list, as is a note of whether our e-mail was delivered and opened, the link clicked or the page visited; the twelve-month period from the section above applies there.
Consent given outside the info page
If you ask us elsewhere – at a trade fair, on the phone or in writing – to send you information by e-mail, we record it: your e-mail address, the name you give us, the date of your consent, the channel it came through, who on our side received it, and a short note of what you asked for. The legal basis is that consent (Art. 6(1)(a) GDPR); the note serves as proof that and for what you gave it. You can withdraw this consent at any time – a short note is enough. The same twelve-month period as for the rest of the contact list applies.
Bautimer app and web application
The Application is used by companies that have a contract with us. We create the accounts for the company; there is no self-registration.
Who is responsible. The company that records data in Bautimer – about its construction sites, customers, employees, machines and material – is the controller of that data. We process it on the company’s behalf (Art. 28 GDPR), on the basis of our contract with the company and only on its instructions. If you are an employee of such a company and have questions about your data, your company is your first point of contact; we support it in answering. We are the controller for the account data, the technical data and the error reports that arise from operating the Application itself.
Which data the Application processes.
- Account data: name, e-mail address, password (stored only as a hash), permissions, language setting and login times. The basis is the contract with the company (Art. 6(1)(b) GDPR).
- Business data recorded by the company: construction sites with address, period and remarks; customers with name, address and contact details; employees with name, grade and – where the company enters them – hourly rates; working hours per employee and day; absences (holiday or sickness, each only as an absence type without any details of an illness); machine usage and material; work items, quotes and invoices; photos and documents attached to sites and daily reports. Photos are stored as the device delivers them. The Application does not request your location.
- Technical data: IP address and time of every request to our server, device type, operating system and app version. The basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).
Why. For the functions of the Application: the company’s daily reports, time recording, billing, quotes and post-calculation. Account data serves login and the attribution of entries to people. Technical data and error reports serve to run the Application securely and fix defects. We do not use data from the Application for marketing, and we do not analyse it across companies.
On the device. So that the app works without a network connection, it stores the company data your account can access locally on the device and synchronises it with the server when connected. Signing out deletes this local data. It is excluded from device backups and cloud backups.
Where the data is kept. On Amazon Web Services (AWS) servers in the Frankfurt data centre (region eu-central-1) – login service, database and file storage. AWS is our processor under a data processing agreement that includes the EU standard contractual clauses. Database backups are overwritten within 35 days. Server logs are deleted after 90 days.
Error reports. If the Application crashes or hits an error, we send an error report to Sentry (Functional Software, Inc., San Francisco, USA). It contains device type, operating system, app version, the error with its technical trace and a pseudonymous identifier of your account so that we can attribute recurring errors to one account. Business data such as customer or employee names is removed before sending. The basis is our legitimate interest in finding and fixing defects (Art. 6(1)(f) GDPR). The transfer to the USA relies on the adequacy decision for the EU-US Data Privacy Framework, under which Sentry is certified, and additionally on the EU standard contractual clauses in our contract with Sentry. Sentry deletes error reports after 90 days. Sentry’s own privacy policy: sentry.io/privacy.
App stores. If you install the app through Google Play, Google processes installation and crash statistics under its own rules (Google privacy policy); we have no influence on that.
For how long. We keep business data for as long as the contract with the company runs. When it ends, we hand the company its data as an export on request and delete it no later than three months after the end of the contract, unless statutory retention duties require otherwise. What the company deletes itself during the contract is deleted; backups are overwritten within 35 days. Account data is deleted when the company revokes the account or the contract ends.
Your rights. You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on our legitimate interest (Art. 15–21 GDPR). For data your company has recorded in Bautimer, please contact your company; for everything else, contact us at info@bautimer.com. How to request deletion of your account is described at bautimer.com/en/data-deletion. You can also complain to a data protection supervisory authority; ours is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. No automated decision-making takes place.
Website bautimer.com
When you open the website, your browser sends the technically necessary connection data (IP address, time, requested page, browser type) to our hosting provider AWS, which serves the pages from the Frankfurt data centre through its delivery network. This data is processed only to deliver the pages and to fend off attacks; we keep no access logs of our own. We set no cookies, use no analytics or tracking services, and serve fonts from our own server. The basis is our legitimate interest in providing the website securely (Art. 6(1)(f) GDPR).
If you e-mail us via the contact page, we process what you send to answer your enquiry (Art. 6(1)(b) or (f) GDPR) and delete it once the matter is settled and no retention duty applies. For the info page from our letter, the section above applies.
Children
The Application and the website are aimed at businesses, not at persons under 16. We do not knowingly collect data from them; should we learn of it, we delete it.
Security
All connections are encrypted. Access to data is limited to the respective company and the permissions granted there; our own access is limited to the people who operate the Application and is logged. Loss of a device exposes at most what the account on that device was allowed to see.
Changes
If the processing changes, we update this policy and the date at the top. For material changes we additionally inform the companies we have a contract with directly.
Contact
Questions about data protection: info@bautimer.com, or by post to the address in the Imprint.