The protection of your personal data is very important to the Federal Office for Building and Regional Planning (BBR). We would like you to know which data we will collect, when we will collect it and how we will use it. Your personal data will be processed in accordance with the applicable data protection legislation, particularly the GDPR and the Federal Data Protection Act of 2018 (BDSG).
The term “personal data” is used to refer to any information related to an identified or identifiable natural person. A natural person is deemed to be “identifiable” if they can be directly or indirectly identified, particularly by being matched to an identifier such as a name, an identification number, location data or an online username.
The BBR website is hosted by the German Meteorological Service (DWD) at Frankfurter Straße 135, 63067 Offenbach am Main, Germany. The data transfers described below for the BBR website will be managed via the web servers operated by the DWD.
We may have to make changes to this privacy statement to reflect the further development and improvement of our website, to comply with new legal requirements or to include new pieces of technology. We would therefore advise you to read this privacy statement again from time to time.
3. Provision of our website and creation of log files
Whenever you access our website, your IP address will be logged on our web server for the duration of your stay. This will be done as part of our public relations work on the basis of point (e) of Art. 6 (1) GDPR in conjunction with Section 3 BDSG. Your IP address must be temporarily stored by the system to enable the website to be delivered to your computer. Your data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. The data collected to provide our website will be deleted at the end of each session.
Whenever you visit our website, your browser will send access data (server log files or access logs) that will be processed by our external service provider, DWD, who has been contracted in accordance with the data protection regulations, to ensure the security of our system. These server log files or access logs will include your IP address, the date and time of access, the pages you access, logs, the status code, the volume of data transferred, the referral URL (the page from which you access our website), your user agent, your username (if you sign in and access password-protected areas) and the requested host name. This data is required to ensure the security of our system (e.g. to identify and block hackers). This is necessary for us to perform our duties and reflects our overriding legitimate interest in accordance with point (e) of Art. 6 (1) GDPR in conjunction with Section 3 BDSG. The log files will be deleted after seven days.
We use a piece of web analysis software called AWStats.
AWStats is used to analyse log files created by our web servers on the basis of user requests. When carrying out such analysis, the programme works without cookie files. The statistical analysis is conducted with log files containing anonymised IP addresses. Whenever you visit the BBR website, data will be saved in a results file in AWStats for the purpose of compiling statistics and performing back-ups. The resulting reports will be published as HTML pages that can be viewed in any browser.
The following data will be saved:
Information on the type of browser and version used;
Your operating system;
Your anonymised IP address;
The date and time of access;
The name or URL of the accessed file;
The volume of data transmitted;
A message as to whether the access was successful; and
The websites from which your system has accessed our website.
When this data is added to our statistics, your IP address will be anonymised to prevent the data from being uniquely matched to you, so no personal data will be stored on your person. We will save your data in log files to optimise our website and carry out statistical analysis. Your data will not be analysed for marketing purposes. Our statistical evaluations will be kept for five years and then deleted.
We use AWStats to analyse the use of our website and make regular improvements. The statistics we obtain allow us to improve the quality of our website and make it more interesting for our users. This reflects our overriding legitimate interest in accordance with point (e) of Art. 6 (1) GDPR in conjunction with Section 3 BDSG.
General information on cookies
A “cookie” is a text file that will be saved on your computer system through or by your web browser when you visit our website. The cookie contains a string of characters that will enable your browser to be uniquely identified if you ever revisit our website.
Apple also provides support for managing cookies in Safari.
When you visit some of the pages on our website, temporary cookies (also known as “session cookies”) will be used to improve your browsing experience. These temporary cookies will not contain any personal data and will expire at the end of your session.
Some areas of our website feature technically necessary cookies; we cannot always indicate the use of such cookies in the relevant areas. Your personal data will be processed using technically necessary cookies on the basis of point (e) of Art. 6 (1) GDPR in conjunction with Section 3 BDSG. We use technically necessary cookies to make our website easier to use. We would not be able to offer some features of our website without the use of technically necessary cookies. These features will only function if your browser is recognised when changing from one page to another.
We also require cookies for the following applications: registration / login details
The following data will be stored and transmitted via these cookies: login details for password-protected areas of our website.
The user data collected by technically necessary cookies will not be used to create user profiles.
You can register for competitions, events and other offers by providing your personal data in certain areas of our website. The data will be entered in a form, transmitted to us via a secure connection and then stored. We may sometimes have to disclose your data to external service providers for the sole and exclusive purpose of organising an event for which you have registered. If this is ever necessary, we will indicate this during the registration process. We will ensure that our service providers comply with the data protection provisions to the same extent as ourselves and handle your data responsibly and confidentially. Your data will not be disclosed to any other third parties.
The data collected during the registration process will vary in each case. However, you can be sure that we will only ever oblige you to provide the information that is absolutely necessary. This mandatory information will be marked as such. Any other information may be provided voluntarily.
During the registration process, we will request your consent to process your personal data and disclose your personal data to any third parties commissioned to organise the event for which you are registering. Please note that you will not be able to register for such events without giving your consent.
If you consent to the processing of your personal data, the legal basis will be point (a) of Art. 6 (1) GDPR.
Your registration in certain areas of our website may be necessary for the purpose of carrying out certain tasks and hosting BBR events. We will indicate the specific purpose in each case when requesting your consent required for registration.
Your data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected or if you withdraw your consent. If you withdraw your consent, however, you may no longer be able to participate in an event for which you have registered. We will conclude agreements with our service providers or third parties to ensure that they also delete your data as soon as it is no longer required for the original purpose or if you withdraw your consent.
As a user, you will be able to cancel your registration at any time and have your data deleted; you may also request the rectification of any incorrect data. The relevant contact details can be found on each registration page.
6. Contacting us
The processing of your personal data will depend on the way in which you contact us. We currently offer the following options: contact form, e-mail, letter and phone. As a general rule, your personal data will only be accessible to the BBR employees who require such information to process your enquiry.
a) Contact form
Our website contains contact forms that can be used to send us a message. If you use this feature and submit the form, the following data will be sent to us and stored:
Your e-mail address; and
The content of your message
This information is necessary for us to process your enquiry. If you do not provide all the necessary information, you will not be able to submit the form and your enquiry will not be processed.
Alternatively, you can contact us at the e-mail addresses provided. Some of our e-mail addresses are assigned to specific individuals, while others are group accounts that are accessible to multiple people. If you contact us via e-mail, we will save any personal data contained in your e-mail, such as your name, your e-mail address and the content of your enquiry.
Please note that you should use a De-Mail address for sending personal data.
If you contact us by post, we will process and store any personal data contained in your letter, such as your first and last name, your address and the content of your enquiry.
If you contact us by phone, your personal data may be requested and processed if this is necessary to process your enquiry; the personal data may include your name, your phone number and the nature of your enquiry. Your phone number will also be automatically saved in our telecommunication systems, unless you have hidden it.
The following applies to all means of communication:
We may have to forward your enquiry and data to third parties for the purpose of responding to your request. These may include ministries, public authorities or other third parties (e.g. service providers). In such cases, your data will be forwarded for the purpose of responding to your enquiry on the basis of point (e) of Art. 6 (1) GDPR in conjunction with Section 25 BDSG.
Your personal data must be processed for the purpose of dealing with your enquiry. We will store your data at least until your enquiry has been answered and the matter has been finalised. If we respond to your enquiry in writing, the retention period will be based on the applicable periods for the storage of written material, as stipulated in the Registry Directive that supplements the Joint Rules of Procedure of the Federal Ministries (GGO).
Regardless of the channel through which you submit your enquiry, your personal data will be processed on the basis of point (e) of Art. 6 (1) GDPR in conjunction with Section 3 BDSG.
7. Processing of personal data when providing information
The processing of personal data will depend on the way in which you receive information. Here, we distinguish between newsletters and similar informative e-mails, printed matter and fact-finding visits to the Federal Office for Building and Regional Planning (BBR) or to the building sites supervised by the BBR.
a) Subscribing to newsletters, informative letters and media information
If you subscribe to one of our mailing lists, we will store your e-mail address and chosen newsletter list(s) on a server hosted by the German Meteorological Service (DWD). This data will be processed on the basis of your consent in accordance with point (a) of Art. 6 (1) GDPR. We will only use this data to send you the newsletter. In certain cases, we may disclose your data to third parties (exclusively for the purpose indicated above); we will explicitly indicate this in the declaration of consent.
If you no longer agree to your data being stored for this purpose and you no longer wish to use our service, you may unsubscribe at any time. The data you have provided will then be deleted. To do this, you will have to enter the e-mail address you provided during registration.
b) Ordering printed matter
If you order brochures, leaflets or other printed matter on our website and/or via e-mail, your personal data will have to be processed to perform pre-contractual and contractual measures (delivery of products) in accordance with point (b) of Art. 6 (1) GDPR. You must provide the following personal data for us to process your order:
First and last name;
Postcode and town
This data will be processed within the scope of the order. If your order cannot be finally processed by us, the data you provide will be forwarded to third parties (the shipping company or any other authorities or institutions that will be sending the ordered goods).
If you do not provide the required data, we will not be able to process your order.
The additional information (such as institution, department, country and e-mail address) is optional and not absolutely necessary for us to process your order; however, this information will help us to deliver your order.
The data you provide will be deleted once your order has been delivered.
8. Links to third-party websites
Our website contains links to third-party websites. We have no control over their compliance with data protection provisions.
9. Integration of external web content
Our website also features content from external online services. This includes embedded videos from online platforms (such as Vimeo). Whenever you visit our website, your anonymised IP address will be registered on our servers alongside other technical information for your specific device, such as the browser and operating system you are using (see section 3 of this privacy statement). This data will also be received by the external online service providers if you watch any of the embedded videos. The online service providers will not be able to draw any conclusions about your person on the basis of such data, but they will know certain information such as where you are (geographically) located. The online service providers may also save cookies on your device, enabling them to log your surfing habits and recognise your device used for visiting our website.
In order to protect your data, we will inform you about the transfer of your data to the relevant network and request your consent before showing content from external online service providers. A connection will only be established with the servers of the online service provider – and your data will only be transferred – when you have authorised the data transfer by clicking on “Allow” or “Always allow” (two-click solution).
If you select “Allow”, you will only give your consent on a one-off basis. You will then have to give your consent again before viewing any other embedded content from the same online service provider. If you select “Always allow”, your selection will be saved in your browser’s local storage. Depending on your browser security settings, your consent will then remain valid for at least the duration of your browser session. The “Always allow” function is supported by most current browser versions. If this function is not supported by your browser, you will only be able to play the video by clicking on “Allow”.
We would like to explicitly point out that the online services used by the BBR (such as Vimeo) process their users’ data (such as personal information and IP address) according to their own data protection guidelines. The BBR has no control over the collection and use of data by external online service providers, nor does it have any control over the storage location, retention period or linking of such data. You are therefore free to use such services and their features at your own risk.
We currently use the following online services:
BSCW server: During some projects, we offer the possibility of exchanging information via a service known as “Basic Support for Cooperative Work” (BSCW). This service is provided by the Federal Centre for Information Technology (ITZBund). More information is available on the BSCW website (only in German).
10. Your rights
If personal data is processed concerning you as a data subject, you may exercise various data protection rights against us. In accordance with Art. 15 GDPR in conjunction with Section 34 BDSG, you have the right to access the data we hold on your person and request information as to the source of such data, the recipients or categories of recipients of your data, and the purpose for which your data is stored.
You may also be entitled to request the rectification and/or erasure of your personal data and/or the restriction of processing in accordance with Art. 16 to 18 GDPR in conjunction with Section 35 BDSG. In addition, you may ask us to transfer your personal data to another controller in accordance with Art. 20 GDPR.
If we are processing your data on the basis of our legitimate interest (point (f) of Art. 6 (1) GDPR) or on the basis of a public duty incumbent upon us (point (e) of Art. 6 (1) GDPR), you may object to the further processing of your data. If you file an objection, we will stop processing your personal data from the moment of receipt and then during the subsequent evaluation and, if we find your objection to be justified, we will erase your personal data (Art. 21 GDPR in conjunction with Section 36 BDSG).
If you consent to data processing, you may withdraw your consent at any time in accordance with point (a) of Art. 6 (1) GDPR. If you withdraw your consent, we will stop processing your personal data unless we are legally authorised to continue doing so.
If you file an objection or withdraw your consent, this will have no bearing on the lawfulness of any data processing performed in the past.
We will immediately honour your rights free of charge. If you wish to exercise your rights, please contact us or our data protection officer. Our contact details can be found at the top of this privacy statement.
If you believe the processing of your personal data constitutes a violation of data protection law, you have the right to lodge a complaint with a data protection supervisory authority in accordance with Art. 77 GDPR in conjunction with Section 19 BDSG. This also includes our competent data protection supervisory authority, which can be contacted as follows:
Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit