Privacy Policy

Last updated: February 2026

We are glad you are visiting our website https://www.comstruct.com/ and that you are interested in what we offer. When you use our services, your personal data may be processed. Protecting your data is always an important concern for us. This privacy policy explains how we process personal data and which rights you have. It applies to all processing of personal data carried out by us, both in the course of providing our services via our website and via our mobile application (also referred to as the "App"). This privacy policy can be accessed and printed at any time on our website and in our App.

I. General information

This privacy policy informs you about how your personal data is handled when you use our website and the App. In particular, it explains which data we collect, for which purposes and on which legal basis.

Personal data ("data") means any information relating to an identified or identifiable person. "Processing" of data means any operation performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. We treat personal data confidentially and in accordance with statutory data protection provisions. The legal foundations of data protection are set out in particular in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("General Data Protection Regulation", GDPR), as well as in the German Federal Data Protection Act (BDSG), the German Telemedia Act (TMG) and the German Telecommunications-Telemedia Data Protection Act (TTDSG).

II. Controller

The controller responsible for processing your data is

comstruct ICT GmbH
Agnes-Pockels-Bogen 1
80995 Munich
Germany
+49 (0) 170 5556293
Email: kontakt@comstruct.eu

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

III. Scope of data processing

We only process your data to the extent necessary to provide a functional and user-friendly website and App, and to make our content and services available. Failure to provide the data may have legal consequences, for example that a contract cannot be performed. As part of our data processing we use various third-party providers in the areas of hosting, online marketing, mailing services and customer/data management (CRM), each of which processes data on our behalf. Where these third parties act as processors, we have concluded corresponding data processing agreements with them to ensure that an adequate level of data protection is guaranteed at our processors as well (Art. 28 GDPR).

For hosting our services we use Lovable Labs Incorporated, 1111b South Governors Avenue, Dover, DE 19904, USA ("Lovable"). When you visit our website, Lovable records various log files including your IP address. For details please see Lovable's privacy policy at https://lovable.dev/privacy.

The use of Lovable is based on Art. 6 (1) (f) GDPR. We have a legitimate interest in presenting our website as reliably as possible. Where corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6 (1) (a) GDPR and Sec. 25 (1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

The provider is based in the USA. The transfer of data to the USA is based on the EU Commission's standard contractual clauses (Implementing Decision (EU) 2021/914, Module 2). We have concluded a data processing agreement (DPA) with Lovable pursuant to Art. 28 GDPR.

IV. Data security

We have implemented technical and organisational measures to ensure that data protection provisions are complied with both by us and by external service providers. For security reasons and to protect the transmission of confidential content that you send to us as the site operator, our website uses SSL or TLS encryption.

V. Processing of personal data

The overview below lists all categories of data we process, the purposes of processing and the legal bases for such processing.

1. Use of the website

If you use our website without otherwise transmitting data to us (e.g. by registering or using the contact form), we temporarily collect the following data in anonymised form on our web server via server log files:

  • the website from which our website was requested (referrer URL)
  • name and URL of the requested website
  • date and time of access to the website
  • description of the type, language and version of the web browser used
  • IP address of the requesting computer, truncated so that it can no longer be linked to an individual
  • notification of whether access was successful (access status / HTTP status code)
  • internet service provider of the accessing system
  • volume of data transferred in each case
  • operating system used and its interface
  • the GMT time zone difference

This processing is technically necessary in order to display our website to you. We also use the data for statistical analyses in order to ensure the operational security and stability of our website. The legal basis for this processing is Art. 6 (1) (f) GDPR. Processing the data listed above is necessary to provide the website and to ensure its stability and operational security, and therefore serves to safeguard a legitimate interest of our company. We also use the data to comply with our legal obligations for reasons of data security. The legal basis for this processing is Art. 6 (1) sentence 1 (c) GDPR.

2. Use of the App

When you use our App, we process the following data:

  • registration data (name, user name, phone number, email address, habitual place of residence)
  • GPS location data
  • content data voluntarily provided by the user (photos, videos, routes, etc.)
  • IP address
  • date and time of App access
  • time zone difference to Greenwich Mean Time (GMT)
  • content of the request (specific page)
  • access status / HTTP status code
  • volume of data transferred in each case
  • website from which the request originates, browser, operating system and its interface
  • language and version of the browser software
  • your device identifier and serial number
  • name of your mobile device, email address

The purposes of processing are based on the following legal bases:

Purpose of processing

  • statistical analyses for the purpose of optimising our App, ensuring the stability and operational security of the App
  • compliance with legal obligations for reasons of data security
  • account creation and administration; handling enquiries, use of the App's functions
  • voluntary sharing of content data as part of using the App
  • identification of the user account for push notifications, deactivation of the App on stolen or lost smartphones and/or devices

Legal basis

  • Art. 6 (1) sentence 1 (f) GDPR based on our legitimate interest in fraud prevention and quality assurance
  • Art. 6 (1) sentence 1 (c) GDPR
  • Art. 6 (1) sentence 1 (b) GDPR
  • Art. 6 (1) sentence 1 (a) GDPR
  • Art. 6 (1) sentence 1 (f) GDPR based on our legitimate interest in fraud prevention and quality assurance

3. Contacting us

If you contact us, for example by sending us an email or using the contact form, we store the contact details you provide, such as your name, address, mobile number, email address and the information contained in your enquiry.

Where you contact us in the context of an existing contractual relationship, or contact us in advance for information about our services or other offerings, the data and information you provide will be processed for the purpose of handling and responding to your enquiry on the legal basis of Art. 6 (1) sentence 1 (b) GDPR. Where you have consented to processing for the purpose of responding to your enquiry, the legal basis is Art. 6 (1) sentence 1 (a) GDPR. Otherwise, we process your data to safeguard our legitimate interests pursuant to Art. 6 (1) sentence 1 (f) GDPR in properly responding to customer and contact enquiries.

4. Newsletter

With our newsletter we inform you about us and our offerings. Only your email address and your name are required to subscribe. When you register for the newsletter, your email address is transmitted to us (or our mail provider) and stored there. After registering you receive an email asking you to confirm your subscription ("double opt-in"). In this context we (or our mail provider) process the following data:

  • contact data (email address, name)
  • device data (device name, country code where applicable, language, name and version of the operating system)
  • connection data (IP address, mail provider)
  • date and time of registration and confirmation

Our newsletter is sent on the basis of your prior express consent, Art. 6 (1) sentence 1 (a) GDPR. Where we commission a service provider to send emails, this is done on the basis of our legitimate interests in efficient and secure dispatch. The legal basis in this respect is Art. 6 (1) sentence 1 (f) GDPR.

You may withdraw your consent to the processing of data for the purpose of sending the newsletter or analysing the associated data at any time. Withdrawal can be made via a link contained in every newsletter or by sending us a separate message. Apart from transmission costs at basic rates, you incur no further costs.

5. Processing of data of suppliers and construction companies

We collect data of suppliers and construction companies in various ways in the course of registration, tenders, orders, deliveries, invoices, payments and accounting. On the supplier side, data processing takes place for dispatch software, fleet management, customer administration and accounting as well as further systems for creating delivery notes and invoices. On the construction company side, data processing takes place for internal construction management systems, the comstruct field app, the comstruct web app as well as for accounting, customer and supplier administration (purchasing and sales) and employee administration. The legal basis for this processing is Art. 6 (1) (b) GDPR, as the data is required for the correct use of the App and therefore for the performance of the contract.

  • General information
  • Data processing for tenders
  • Orders
  • Deliveries
  • Invoices, payments and accounting

Processing of supplier data

Customer data:

  • general information (name, owner, legal details)
  • location
  • contact person

Product data:

  • current price lists
  • availability

Warehouse / plant data:

  • availability and offer lists of the individual warehouses as well as delivery times
  • locations of the individual warehouses / plants
  • contact persons

Master data:

  • contract contents
  • customer data (construction companies, construction sites)
  • access credentials for customer portals

Quotes:

  • contract data
  • lists with updated product prices
  • contact data

New contracts:

  • contract contents regarding goods / products
  • general data (such as contracting party, date of the contract, etc.)

General data:

  • order ID
  • VAT ID
  • scheduling (allocation to deliveries)
  • time of creation
  • time of change

Data on issues / changes

  • cancellations / changes
  • changed data
  • time of change
  • responsible contact

Order contents:

  • item number
  • name
  • specification (for customised products)
  • order quantity
  • list of deliveries

Responses:

  • acceptance
  • proposed dates / availability of the offers

General data:

  • delivery ID
  • scheduling (planned delivery time)
  • time of creation
  • time of change

Issues:

  • cancellations
  • changes

Delivery contents:

  • item number, name
  • specification (for customised products)
  • delivery quantity

Delivery vehicle:

  • vehicle type
  • licence plate, driver
  • GPS location
  • delivery status

Invoice data:

  • VAT ID
  • orders (list, prices)
  • invoice issuer
  • account information
  • planned invoice data

Payment data:

  • incoming payment / payment confirmation

Processing of construction company data

Customer data:

  • general information (name, owner, legal details)
  • location
  • contact person / employee information
  • access credentials for supplier customer portals

Tender data:

  • contact data of the construction company
  • site information (start and location of the construction site)
  • material specifications
  • quantities

Responses:

  • information on acceptance / rejection of specific offers
  • proposed changes

Contract data:

  • goods lists with discounts
  • general data (such as contracting party, etc.)

Order contents:

  • item number
  • name
  • specification (for customised products)
  • order quantity
  • list of deliveries

Data on issues / changes:

  • cancellations / changes
  • changed data
  • time of change
  • responsible contact

General data:

  • delivery note as PDF / in data format (with signature)

Issues:

  • complaints regarding individual deliveries

Changes:

  • requests regarding changes
  • change information

Invoice data:

  • invoice template

Payment data:

  • incoming payment / payment confirmation
  • outgoing payment

6. Cookies

On our website and in our App we use cookies, which are provided either by us or by third parties.

Cookies are small text files that are placed on the device you use and stored by the browser. Cookies serve to make our offering more user-friendly, more effective and more secure. There are different types of cookies used for different purposes. Some cookies ensure that our services function correctly or that you are recognised on your device after successful registration ("necessary" cookies). By placing these necessary cookies we make it easier for you to visit our services and use the features available there. We place other cookies in order to analyse user preferences and thereby improve our services ("extended cookies"). We use these, for example, for tracking (e.g. interest- and behaviour-based profiling), remarketing, visit action analysis, conversion measurement, reach measurement (e.g. access statistics, recognition of returning visitors), audience building and cross-device tracking. We only set non-necessary cookies with your consent. When you visit our services for the first time, a pop-up is displayed (the "cookie banner") describing the individual cookies in more detail. There you have the option to allow or reject cookies according to your preferences. You can change your settings at any time here [LINK to the cookie banner]. Please note that disabling cookies may limit the functionality of this website.

When cookies are used, the following data is processed - depending on your browser settings:

  • usage data (e.g. websites visited, interest in content, access times)
  • meta / communication data (e.g. device information, IP addresses)
  • location data (data indicating the location of an end user's device)

Where personal data is processed when using "necessary" cookies, this is based on Art. 6 (1) sentence 1 (f) GDPR due to legitimate interests in quality assurance and a technically flawless presentation of the website. The processing of personal data when using so-called "extended cookies" is based on your consent (Art. 6 (1) sentence 1 (a) GDPR).

7. Plug-ins and similar technologies

On our website we use so-called pixel tags (invisible graphics, also referred to as "web beacons") and other technologies of the third-party providers listed below for marketing purposes and to deliver our content. Pixel tags allow information such as visitor traffic on the pages of this website to be analysed. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and further details about the use of our online offering, and may also be combined with such information from other sources.

When pixel tags are used, usage data (e.g. websites visited, interest in content, access times), meta / communication data (e.g. device information, IP addresses) and location data are processed. We process this data for the purpose of displaying fonts, direct marketing (e.g. by email or post), tracking (e.g. interest- and behaviour-based profiling, use of cookies) and interest- and behaviour-based marketing. The processing of this data is based on your consent; the legal basis is Art. 6 (1) sentence 1 (a) GDPR.

8. Applications

If you apply for a position with us, we process the information and personal data you provide for the purpose of conducting the application procedure. This data includes your name, email address, address and phone number, age, professional background, qualifications, country of residence, language skills and any other personal information you provide in the course of your interaction with us. We may also ask you for additional information that helps us in our recruitment process and if you are offered a position, such as your date of birth and employment records. Processing may also take place electronically. This is in particular the case where an applicant submits the relevant application documents to us electronically, for example by email.

We process your personal data in order to fulfil our contractual or pre-contractual obligations (on the legal basis of Art. 6 (1) sentence 1 (b) GDPR) or, where applicable, for the performance of the employment relationship with you (Sec. 26 BDSG). Where you have consented to processing for the purpose of handling your application, the legal basis is Art. 6 (1) sentence 1 (a) GDPR.

In the event that we do not conclude an employment contract with the applicant, the application documents are automatically deleted two months after the rejection decision has been communicated, provided that no other legitimate interests prevent deletion. Another legitimate interest in this sense is, for example, a burden of proof in proceedings under the German General Equal Treatment Act (AGG).

9. Social media

We are present on the following social media platform and process user data in this context in order to communicate with users active there or to provide information about us:

Please note that user data within social networks may be processed for market research and advertising purposes. For example, usage profiles may be created based on users' usage behaviour and the interests derived from it. These usage profiles may in turn be used to display advertisements inside and outside the networks that presumably match users' interests. For these purposes, cookies are generally stored on users' computers in which usage behaviour and interests are stored. Furthermore, data may be stored in the usage profiles irrespective of the devices used by users (in particular if users are members of the respective platforms and are logged in there). For a detailed description of the respective forms of processing and the options to object (opt-out), we refer you to the privacy policies and information of the operators of the respective social media providers. In the case of requests for information and the assertion of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the providers have access to users' data and can take appropriate measures and provide information directly. If you still need help, you can contact us.

VI. Storage and deletion of data

The data we process is deleted in accordance with statutory requirements as soon as the consents permitting processing are withdrawn or other permissions cease to apply (e.g. if the purpose of processing this data no longer applies or the data is not necessary for the purpose). This means we store your personal data only for as long as it is necessary for the respective purpose of processing and we limit the storage period to the necessary minimum. Beyond this, we only store your data where we are entitled or obliged to do so under statutory retention periods (for example under the German Commercial Code (HGB) or the German Fiscal Code (AO)).

Our data protection notices may also contain further information on the retention and deletion of data which takes precedence for the respective processing operations.

VII. Your rights

You have the following rights:

  • the right of access,
  • the right to rectification or erasure,
  • the right to restriction of processing,
  • the right to data portability,
  • the right to withdraw consent you have given with effect for the future,
  • the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is carried out on the basis of Art. 6 (1) sentence 1 (e) or (f) GDPR; this also applies to profiling based on these provisions.

To exercise the rights listed above, you can send an email to kontakt@comstruct.eu. You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

VIII. Disclosure of data / transfers to third countries

As a rule, we only disclose your data to third parties if you have consented or if another legal basis applies. Insofar as we use third-party tools that process your data outside the EU/EEA, we ensure that the legal requirements of Art. 44 et seq. GDPR for such a third-country transfer are complied with and that your data is processed in the relevant third country in accordance with the European data protection standard. For this purpose we regularly use the EU standard contractual clauses (SCC), which we conclude with the respective provider. In addition, in line with the requirements of the CJEU ("Schrems II"), a case-by-case risk assessment is carried out with regard to the respective third-country transfer in order to ensure that your data is processed lawfully in the relevant third country and, in particular, that access to your data by government authorities is prevented.

IX. Data processing when accessing linked content

This privacy policy relates only to this website. However, the website may also contain external links or hyperlinks to websites of other providers. These must be distinguished from our own content. This third-party content does not originate from us, nor are we able to influence the content of third-party pages. If you are forwarded to other pages via links within the website, please inform yourself there about how your data is handled.

X. Automated decision-making / profiling

We do not use automated decision-making or profiling (an automated analysis of your personal circumstances).

XI. Changes to this privacy policy

As our website and the offerings provided through it develop further, or due to changed statutory or regulatory requirements, it may become necessary to amend this privacy policy.

If you have any questions or suggestions regarding data protection, you can send us an email at any time to kontakt@comstruct.eu.

Status: May 2024