Privacy policy

Last updated: February 2026

Thank you for visiting our website https://www.comstruct.com/ and for your interest in our services. Your personal data may be processed when you use our services. Protecting your data is always important to us. This privacy policy explains how we process personal data and what rights you have. This policy applies to all processing of personal data carried out by us, both in the provision of our services via our website and via our mobile application (hereinafter also referred to as the "app"). This privacy policy can be accessed and printed at any time on our website and in our app.

I. General information

This privacy policy informs you about how your personal data is handled when you use our website and the app. In particular, it explains what data we collect, for what purposes and on what legal basis.

Personal data ("data") means any information relating to an identified or identifiable person. "Processing" of data means any operation performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. We treat personal data confidentially and in accordance with statutory data protection provisions. The legal bases for data protection are set out in particular in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("General Data Protection Regulation", GDPR), as well as in the German Federal Data Protection Act (BDSG), the German Telemedia Act (TMG) and the German Act on the Regulation of Data Protection and Privacy in Telecommunications and Telemedia (TTDSG).

II. Controller

The controller responsible for processing your data is

comstruct ICT GmbH
Agnes-Pockels-Bogen 1
80995 Munich
Germany
+49 (0) 170 5556293
Email:kontakt@comstruct.eu

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

III. Scope of data processing

We process your data only to the extent necessary for the purpose of providing a functional and user-friendly online presence or a functional and user-friendly website and app, and for providing our content and services. Failure to provide the data may have legal disadvantages, such as making it impossible to perform a contract. In the course of data processing, we use various third-party providers in the areas of hosting, online marketing, mailing services and customer/data management (CRM), which process data on our behalf. Where these third parties act as processors, we have concluded corresponding data processing agreements with them to ensure that an adequate level of data protection is also guaranteed by our processors (Art. 28 GDPR).

We use Lovable Labs Incorporated, 1111b South Governors Avenue, Dover, DE 19904, USA (hereinafter "Lovable") to host our service. When you visit our website, Lovable records various log files, including your IP address. Details can be found in Lovable's privacy policy at https://lovable.dev/privacy.

The use of Lovable is based on Art. 6(1)(f) GDPR. We have a legitimate interest in ensuring that our website is displayed as reliably as possible. Where corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's terminal device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.

The provider is based in the USA. Data transfers to the USA are based on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914, Module 2). We have concluded a data processing agreement (DPA) with Lovable in accordance with Art. 28 GDPR.

IV. Data security

We have taken technical and organisational measures to ensure that data protection regulations are observed both by us and by external service providers. For security reasons and to protect the transmission of confidential content, such as content you send to us as the website operator, our website uses SSL or TLS encryption.

V. Processing of personal data

The following overview lists all types of data we process, the purposes of processing and the legal bases for processing.

1. Use of the website

When you use our website without otherwise transmitting data to us (e.g. by registering or using the contact form), we temporarily collect the following data in anonymised form on our web server via server log files:

  • Website from which our website was requested (the referrer URL)
  • Name and URL of the requested website
  • Date and time of access to the website
  • Description of the type, language and version of the web browser used
  • IP address of the requesting computer, which is truncated so that it can no longer be linked to an individual
  • Message indicating whether access was successful (access status/HTTP status code)
  • Internet service provider of the accessing system
  • Amount of data transferred in each case
  • Operating system used and its interface
  • GMT time zone difference

This processing is technically necessary to display our website to you. We also use the data for statistical analyses to ensure the operational security and stability of our website. The legal basis for this processing is Art. 6(1)(f) GDPR. Processing the aforementioned data is necessary to provide the website and ensure its stability and operational security, and therefore serves to safeguard a legitimate interest of our company. We also use the data to fulfil our legal obligations relating to data security. The legal basis for this processing is Art. 6(1), first sentence, point (c) GDPR.

2. Use of the app

When you use our app, we process the following data:

  • Registration data (name, username, telephone number, email address, habitual residence)
  • GPS location data
  • Content data voluntarily uploaded by the user (photos, videos, routes, etc.)
  • IP address
  • Date and time of app access
  • Time zone difference from Greenwich Mean Time (GMT)
  • Content of the request (specific page)
  • Access status/HTTP status code,
  • Amount of data transferred in each case
  • Website from which the request originates, browser, operating system and its interface
  • Language and version of the browser software
  • Your device identifier and serial number
  • Name of your mobile device, email address

The processing purposes are based on the following legal bases:

Processing purpose

  • Statistical analyses for the purpose of optimising our app, ensuring the stability and operational security of the app
  • Fulfilment of legal obligations relating to data security
  • Account creation and management; handling enquiries, use of the app's functions.
  • Voluntary sharing of content data as part of app use
  • Identification of the user account for push notifications, deactivation of the app on stolen or lost smartphones and/or terminal devices.

Legal basis

  • Art. 6(1), first sentence, point (f) GDPR on the basis of our legitimate interest in fraud prevention and quality assurance
  • Art. 6(1), first sentence, point (c) GDPR
  • Art. 6(1), first sentence, point (b) GDPR
  • Art. 6(1), first sentence, point (a) GDPR
  • Art. 6(1), first sentence, point (f) GDPR on the basis of our legitimate interest in fraud prevention and quality assurance

3. Contacting us

If you write to us, e.g. by sending us an email or contacting us via the contact form, we store the contact details you provide, such as your name, address, mobile number and email address, as well as the information provided in your enquiry.

If you contact us in the context of an existing contractual relationship or contact us in advance for information about our range of services or other services, the data and information you provide will be processed for the purpose of handling and responding to your enquiry on the legal basis of Art. 6(1), first sentence, point (b) GDPR. If you have consented to processing for the purpose of responding to your enquiry, the legal basis is Art. 6(1), first sentence, point (a) GDPR. Otherwise, we process your data to safeguard our legitimate interests pursuant to Art. 6(1), first sentence, point (f) GDPR in responding appropriately to customer/contact enquiries.

4. Newsletter

Our newsletter informs you about us and our offerings. Only your email address and name are required to subscribe to the newsletter. When you register for the newsletter, your email address is transmitted to us (or our email provider) and stored there. After registering, you will receive an email asking you to confirm your subscription ("double opt-in"). In this context, we (or our email provider) process the following data:

  • Contact details (email address, name)
  • Device data (device name, country code where applicable, language, operating system name and version)
  • Connection data (IP address, email provider)
  • Date and time of registration and confirmation

Our newsletter is sent on the basis of your prior express consent, Art. 6(1), first sentence, point (a) GDPR. Where we commission a service provider to send emails, this is done on the basis of our legitimate interests in efficient and secure delivery. The legal basis in this respect is Art. 6(1), first sentence, point (f) GDPR.

You may withdraw your consent to the processing of data for the purpose of sending the newsletter or analysing the associated data at any time. Consent may be withdrawn via a link included in every newsletter or by sending us a separate message. You will incur no costs other than transmission costs at the basic rates.

5. Processing of data of suppliers and construction companies

We collect data from suppliers and construction companies in various ways during registration, tendering, orders, deliveries, invoicing, payments and accounting. On the suppliers' side, data is processed for dispatch software, fleet management, customer management and accounting, as well as other systems for creating delivery tickets and invoices. On the construction companies' side, data is processed for internal construction management systems, the comstruct Field-App, the comstruct Web-App, accounting, customer and supplier management (purchasing and sales), and employee management. The legal basis for this processing is Article 6(1)(b) GDPR, as the data is required for the correct use of the app and thus for the performance of the contract.

  • General information
  • Processing of tender data
  • Orders
  • Deliveries
  • Invoices, payments and accounting

Processing of suppliers' data

Customer data:

  • General (name, owner, legal information)
  • Location
  • Contact person

Product data:

  • Current price lists
  • Availability

Warehouse/ plant data:

  • Availability and quotation lists for individual warehouses, as well as delivery lead times
  • Locations of individual warehouses/ plants
  • Contact persons

Master data:

  • Contract contents
  • Customer data (construction companies, construction sites)
  • Login details for customer portals

Quotations:

  • Contract data
  • Lists with updated product prices
  • Contact details

New contracts:

  • Contract contents regarding goods/ products
  • General data (such as contracting parties, date of contract, etc.)

General data:

  • Order ID
  • VAT ID
  • Dispatch planning (allocation to deliveries)
  • Time of creation
  • Time of modification

Data on problems / changes

  • Cancellations /Changes
  • Changed data
  • Time of modification
  • Responsible contact

Order contents:

  • Item number
  • Name
  • Specification (for customised products)
  • Order quantity
  • List of deliveries

Responses:

  • Acceptance
  • Proposed dates/ availability of quotations

General data:

  • Delivery ID
  • Dispatch planning (scheduled delivery time)
  • Time of creation
  • Time of modification

Problems:

  • Cancellations
  • Changes

Delivery contents:

  • Item number, name
  • Specification (for customised products)
  • Delivery quantity

Delivery vehicle:

  • Vehicle type
  • Registration number, driver
  • GPS location
  • Delivery status

Invoice data:

  • VAT ID
  • Orders (list, prices)
  • Invoice issuer
  • Bank account information
  • Planned invoice data

Payment data:

  • Payment receipt/ confirmation

Processing of construction companies' data

Customer data:

  • General (name, owner, legal information)
  • Location
  • Contact person/ employee information
  • Login details for suppliers' customer portals

Tender data:

  • Construction company contact details
  • Construction site information (start date and site location)
  • Material specifications
  • Quantities

Responses:

  • Information on acceptance/ rejection of specific quotations
  • Proposed changes

Contract data:

  • Goods lists with discounts
  • General data (such as contracting parties, etc.)

Order contents:

  • Item number
  • Name
  • Specification (for customised products)
  • Order quantity
  • List of deliveries

Data on problems / changes:

  • Cancellations /Changes
  • Changed data
  • Time of modification
  • Responsible contact

General data:

  • Delivery ticket as a PDF/ in data format (with signature)

Problems:

  • Complaints concerning individual deliveries

Changes:

  • Requests regarding changes
  • Change information

Invoice data:

  • Invoice template

Payment data:

  • Payment receipt/ confirmation
  • Outgoing payment

6. Cookies

On our website and in our app, we use cookies provided either by us or by third parties.

Cookies are small text files that are placed on the device you use and stored by the browser. Cookies help make our services more user-friendly, effective and secure. There are different types of cookies used for different purposes. Some cookies ensure that our services function correctly or that you are recognised on your device after successful registration ("necessary" cookies). By placing these necessary cookies, we make it easier for you, for example, to visit our offerings and use the services available there. We place other cookies to analyse user preferences and thus improve our services ("advanced cookies"). We use these, for example, for tracking (e.g. interest-based/behavioural profiling), remarketing, visitor action analysis, conversion measurement, reach measurement (e.g. access statistics, recognition of returning visitors), audience creation and cross-device tracking. We only use non-essential cookies with your consent. When you visit our services for the first time, a pop-up is displayed ("cookie banner") describing the individual cookies in more detail. There you can allow or reject cookies according to your preferences. You can change your settings at any time here [LINK to cookie banner]. Please note that disabling cookies may restrict the functionality of this website.

When cookies are used, the following data is processed, depending on your browser settings:

  • Usage data (e.g. websites visited, interest in content, access times),
  • Metadata/communication data (e.g. device information, IP addresses)
  • Location data (data indicating the location of an end user's device)

Where personal data is processed when "necessary" cookies are used, this is based on Article 6(1), first sentence, point (f) GDPR, on the grounds of legitimate interests in quality assurance and the technically flawless presentation of the website. The processing of personal data when so-called "advanced cookies" are used is based on your consent (Article 6(1), first sentence, point (a) GDPR).

7. Plug-ins and similar technologies

On our website, we use so-called pixel tags (invisible graphics, also known as "web beacons") and other technologies from the third-party providers listed below for marketing purposes and to provide our content. Pixel tags allow information such as visitor traffic on the pages of this website to be analysed. The pseudonymous information may also be stored in cookies on users' devices and may include, among other things, technical information about the browser and operating system, referring websites, the time of the visit and further details about the use of our online services, and may also be combined with such information from other sources.

When pixel tags are used, usage data (e.g. websites visited, interest in content, access times), metadata/communication data (e.g. device information, IP addresses) and location data are processed. We process this data for the purposes of displaying fonts, direct marketing (e.g. by email or post), tracking (e.g. interest-based/behavioural profiling, use of cookies) and interest-based and behavioural marketing. The processing of this data is based on your consent; the legal basis is Article 6(1), first sentence, point (a) GDPR.

8. Job applications

If you apply for a position with us, we process the information and personal data you provide for the purpose of handling the application procedure. This data includes your name, email address, address and telephone number, age, professional history, qualifications, country of residence, language skills and any other personal information you provide during your interaction with us. We may also ask you for additional information to assist us in our recruitment process and, if you are offered a position, for information such as your date of birth and employment documents. Processing may also take place electronically. This is particularly the case if an applicant sends us the relevant application documents electronically, for example by email.

We process your personal data to fulfil our contractual or pre-contractual obligations (on the legal basis of Article 6(1), first sentence, point (b) GDPR) or, where applicable, to carry out the employment relationship with you (Section 26 BDSG). Where you have consented to processing for the purpose of handling your application, the legal basis is Article 6(1), first sentence, point (a) GDPR.

If we do not enter into an employment contract with the applicant, the application documents will be automatically deleted two months after notification of the rejection decision, provided that no other legitimate interests prevent deletion. Another legitimate interest in this sense is, for example, an obligation to provide evidence in proceedings under the German General Equal Treatment Act (AGG).

9. Social Media

We maintain a presence on the following social media platform and process users' data in this context in order to communicate with users active there or to provide information about us:

Please note that users' data within social networks may be processed for market research and advertising purposes. For example, usage profiles may be created based on users' usage behaviour and the interests arising from it. These usage profiles may in turn be used, for example, to display advertisements within and outside the networks that are presumed to correspond to users' interests. For these purposes, cookies are generally stored on users' computers, recording their usage behaviour and interests. Furthermore, data may also be stored in usage profiles independently of the devices used by users (particularly if users are members of the respective platforms and are logged in to them). For a detailed description of the respective forms of processing and the options for objecting (opt-out), please refer to the privacy policies and information provided by the operators of the respective social media services. In the case of requests for access and the exercise of data subject rights, we also point out that these can be pursued most effectively with the providers. Only the providers have access to users' data and can take appropriate measures and provide information directly. Should you nevertheless require assistance, you can contact us.

VI. Storage and deletion of data

The data we process will be deleted in accordance with statutory requirements as soon as the consents permitting their processing are withdrawn or other permissions cease to apply (e.g. when the purpose of processing these data no longer applies or they are not necessary for that purpose). This means that we store your personal data only for as long as they are necessary for the respective processing purpose and limit the storage period to the minimum necessary. Beyond this, we store your data only if we are entitled or obliged to do so under statutory retention periods (for example under the German Commercial Code (HGB) or the German Fiscal Code (AO)).

Our privacy notices may also contain further information on the retention and deletion of data, which takes precedence for the respective processing activities.

VII. Your rights

You have the following rights:

  • the right of access,
  • the right to rectification or erasure,
  • the right to restriction of processing,
  • the right to data portability,
  • the right to withdraw consent you have given with effect for the future.
  • the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on Article 6(1), first sentence, point (e) or (f) GDPR; this also applies to profiling based on those provisions.

To exercise your rights listed above, you can send an email to kontakt@comstruct.euYou also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

VIII. Disclosure of data / transfers to third countries

As a general rule, we only disclose your data to third parties if you have consented to this or if there is another legal basis. Where we use tools from third-party providers that process your data outside the EU/EEA, we ensure that the legal requirements of Articles 44 et seq. GDPR for such a transfer to a third country are met and that your data are processed in the third country concerned in accordance with European data protection standards. For this purpose, we generally use the EU Standard Contractual Clauses (SCC), which we conclude with the respective provider. In addition, in accordance with the requirements of the CJEU ("Schrems II"), a case-by-case risk analysis is carried out with regard to the respective transfer to a third country to ensure that your data are processed lawfully in the third country concerned and, in particular, that public authorities are prevented from accessing your data.

IX. Data processing when accessing linked content

This privacy policy applies only to this website. However, the website may also contain external links or hyperlinks to websites of other providers. These must be distinguished from our own content. This third-party content neither originates from us nor do we have any influence over the content of third-party websites. If you are redirected to other websites via links within this website, please consult the information there on how your data are handled.

X. Automated decision-making/profiling

We do not use automated decision-making or profiling (an automated analysis of your personal circumstances).

XI. Changes to this privacy policy

Further development of our website and the services offered through it, or changes to legal or regulatory requirements, may make it necessary to amend this privacy policy.

If you have any questions or suggestions regarding data protection, you can send us an email at any time to kontakt@comstruct.euSend.

Last updated: May 2024