Data Protection | Heidelberg Materials Brand Hub

Responsible for data processing on these websites

Heidelberg Materials AG (in the following “we”), represented by:

Dr Dominik von Achten, Chairman
René Aldach
Dr Katharina Beumelburg
Roberto Callieri
Axel Conrads
Hakan Gurdal
Dennis Lentz
Jon Morrish
Chris Ward

Berliner Straße 6
69120 Heidelberg
Germany
Phone: +49 6221 481‑0
Fax: +49 6221 481‑13217
E‑mail: info@heidelbergmaterials.com

Data Protection Officer

Heidelberg Materials AG
Berliner Straße 6
69120 Heidelberg
Germany
E‑mail: info.dataprotection@heidelbergmaterials.com
Phone: +49 6221 481‑39603

Collection and processing of data

We collect and process personal data if you provide it to us by filling in an entry form on our website or by other means, e.g. by e‑mail. In addition, we collect and process data arising from your use of our website. All processing is carried out in accordance with the provisions of the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and the Telecommunications‑Digital Services Data Protection Act (TDDDG). Personal data is all information relating to an identified or identifiable natural person.

Processing of data via cookies and log files

Information on the use of cookies on our website can be found in our Cookie Policy. In accordance with Art. 6 para. 1 sent. 1 b) and Art. 6 para. 1 sent. 1 f) GDPR, our website also uses so‑called log files in which access data are stored each time a page is accessed. The stored record contains the following details:

IP address, date, and time of access
Status code and the request made by your browser to our server
Amount of data transmitted and the referring web page (referrer URL)
Product and version information of the browser used, your operating system, and your country of origin

The log data are deleted automatically after 30 days. The temporary storage of log data is necessary to ensure proper technical performance of the website and to protect it against attacks and misuse. We do not use these data for any other purpose.

Cookie consent management

We use the cookie‑consent technology provided by 2b Advice GmbH, Joseph‑Schumpeter‑Allee 25, 53227 Bonn, to obtain and document your consent to the storage of certain cookies and to manage cookie settings in compliance with data‑protection regulations. When you use our website, a connection is established with the provider’s servers. We then store a consent‑cookie in your browser to be able to assign your given or withdrawn consent. The data collected in this way are stored until you change your settings, remove the cookie, or the purpose for data storage no longer applies. Mandatory statutory retention obligations remain unaffected.

Legal basis: Art. 6 para. 1 sent. 1 c GDPR; § 25 para. 2 no. 2 TDDDG.

Use of etracker

We use the services of etracker GmbH, Hamburg, Germany (www.etracker.com) to analyse usage data. In principle, no information from your device is read or stored for this analysis; only browser and header information are used for statistical purposes. The legal basis for processing your personal data is Art. 6 para. 1 sent. 1 f GDPR, our legitimate interest being the optimisation of our online offer and website. You can object to such processing at any time via the cookie banner or by choosing the corresponding settings in your browser.

Where analysis or optimisation cookies are used beyond this, we request your explicit consent via the cookie banner. If you have consented, cookies enable a statistical range analysis of this website, a measurement of success of our online marketing activities, and test procedures (A/B tests). etracker cookies do not contain any information that could identify a user. Data generated by etracker are processed and stored exclusively in Germany on our behalf, thus subject to German and European data‑protection laws. etracker has been certified with the ePrivacy seal of approval.

Any data with potential personal reference such as IP address or device IDs are anonymised or pseudonymised as soon as possible. etracker does not use the data for its own purposes, does not combine them with other data and does not pass them on to third parties.

You can object to the data processing described above at any time by clicking on the slider. Objecting will not have any negative consequences. If no slider is displayed, data collection has already been prevented by other blocking measures.

External links

Our website may contain links to external websites. Social‑media plugins such as the Facebook “Like” button are not used. When activating a link, data may be transmitted to the operator of the external site. We are not responsible for the content or data‑processing practices of external websites.

Registration process for external business partners

To access our online services, external business partners need to register on the Heidelberg Materials Brand Hub.

Users will be sent a link via which they can activate their Brand Hub account and create a password. To complete the registration process, the user’s e‑mail address provided in this context must be validated and registration then confirmed by the operator.

The access details are intended solely for use by the respective authorised user and appropriate precautions must be taken to prevent them from being disclosed to third parties. If users have reason to suspect that the Brand Hub account is being misused, they must notify the operator immediately. Users shall be liable for the consequences of unauthorised use by third parties, insofar as they are responsible for such unauthorised use or for failing to prevent it.

During the registration process, the following data will be requested:

Salutation with first and last name
Email address
Password

The data provided by users during the registration process must be factually correct. Third‑party data may not be used. Should users’ details subsequently change, they must notify the operator of this without undue delay.

Legal basis: Art. 6 para. 1 lit. b GDPR (contractual relationship).

Access for Heidelberg Materials employees

When our employees and the employees of our affiliated companies access this website, we process their Single Sign-On (SSO) data exclusively for the purpose of enabling secure login and authentication. Where the user is our employee, such processing is necessary for the performance of the employment contract pursuant to Article 6 para 1 lit b GDPR. In all other cases, and insofar as the processing is not already covered by Article 6 para. 1 lit. b GDPR, the processing is based on Article 6 para. 1lit. f GDPR, as it is necessary for the purposes of our legitimate interests in ensuring the security, integrity, and functionality of our internal systems and group-wide digital infrastructure.

Processing of personal data by contacting us

If you provide us with personal data by contacting us, e.g. by e‑mail or by using a contact form, we process your data in accordance with Art. 6 para. 1 sent. 1 b GDPR for the purpose of fulfilling the contract or carrying out pre‑contractual measures at your request, or pursuant to Art. 6 para. 1 sent. 1 f GDPR on the basis of our legitimate interest in responding to your enquiry. We process your data only for processing your specific request and delete them once the purpose no longer applies.

Encryption

Data transmitted via our website are protected by TLS encryption. Our systems are secured by technical and organisational measures against loss, destruction, access, alteration, or dissemination of your data by unauthorised persons.

Categories of recipients and data transfer to third countries

Service providers and auxiliary agents engaged in connection with this website (e.g. hosting providers, agencies, IT service providers) may have access to personal data on the basis of contractual agreements and strict instructions. If these partners are located in third countries outside the EU or EEA, we ensure that transfers only take place in compliance with Chapter V GDPR, based on appropriate safeguards ensuring a level of data protection equivalent to that in the EU.

Your rights

According to Art. 15 GDPR you have the right to receive information free of charge upon request about the personal data stored about you. You also have the right to have incorrect data corrected and your personal data disabled or deleted (Art. 16 – 18 GDPR). Under Art. 20 GDPR you have the right to receive the personal data concerning you in a structured, commonly used, and machine‑readable format and to transmit that data to another controller.

You are entitled pursuant to Art. 21 para. 1 GDPR to object at any time to the processing of your personal data on the basis of Art. 6 para. 1 sent. 1 (e) or (f) GDPR from reasons arising from your particular situation. Where personal data are processed for direct‑marketing purposes, you may object at any time (Art. 21 para. 2 GDPR).

Please direct any request regarding your personal data to the contact details listed above. Every data subject has the right to lodge a complaint with a competent supervisory authority regarding any alleged infringement.

Duration of data storage and routine deletion

Unless explicitly stated otherwise, we process and store personal data only for the period required to achieve the processing purpose or as long as statutory obligations require storage. If the processing purpose no longer applies or the statutory retention period expires, the data will be erased or processing restricted.