top of page

Privacy Policy GROPYUS 

See our current openings below

GROPYUS hereby informs you about the processing of your personal data by companies of the GROPYUS Group of companies. This Privacy Policy covers processing activities by the following companies:

 

  • GROPYUS AG, Barichgasse 38/2/4, 1030 Vienna, Austria

  • GROPYUS Technologies GmbH, Hauptstraße 27, 10827 Berlin

  • GROPYUS Engineering GmbH, Pointstraße 14, 4641 Steinhaus bei Wels

  • GROPYUS Solutions GmbH, Hauptstraße 27, 10827 Berlin

  • GROPYUS Production Richen GmbH, Römerstr. 20, 75031 Eppingen

 

In individual cases, other affiliated companies of GROPYUS may be responsible for processing your data. Typically, you can find out the identity of the controller from legal notices, email signatures or letterheads. Please also consider any special area-specific privacy notices, e.g. for apps, special websites, or events.

 

Whenever the controller is not expressly named for a specific processing activity in this privacy policy (e.g., “we”), GROPYUS AG is referred to as the controller.

 

Questions regarding data protection can also be sent to privacy@gropyus.com.

​

Data protection officer of the GROPYUS Group is attorney Nikolaus Bertermann, daspro GmbH, Kurfürstendamm 21, D-10719 Berlin. You can reach the data protection officer by sending an e-mail to gropyus-dsb@daspro.de. 

​

Where the term "data" is used, only personal data within the meaning of the GDPR are meant. 

​

  1. Visitors of the GROPYUS Websites

  2. General Communication Requests

  3. Marketing Communication

  4. Customers and Contact Persons at Customers 

  5. Job Applicants 

  6. Participants in a Videoconference via Microsoft Teams 

  7. Photos and Videos

  8. Contact on LinkedIn

  9. Click Analysis

  10. Building Operating System (BOS)

  11. Surveys and Research Activities

  12. Speak Up Portal (AdvoWhistle)

  13. Data transfers to other countries

  14. Rights of Data Subjects and Further Information 

​

​

1) Visitors of GROPYUS Websites

​

1.1) Server Log Data

​

When you use the website, certain information is sent from the browser on your device to the server of our website for technical reasons. This data is stored and processed on our server.

​

  1. We process the data listed below for the purpose of providing the content of the website that you request, ensuring the security of the IT infrastructure used, correcting errors, enabling and facilitating searches on the website and managing cookies. A change of purposes is not planned.

  2. The data processed are HTTP data: HTTP data are log data which are generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure) (HTTP(S)): this includes IP address, type and version of the internet browser, operating system used, the page accessed, the page previously visited (referrer URL), language settings, date and time of access. HTTP(S) data are also generated on servers of our service providers (e.g. when third-party content is retrieved).

  3. The legal basis for the processing is our legitimate interest in the provision of the basic functions of the website, the technical protection of the website and the detection and correction of errors (Art. 6 (1) (f) GDPR and Section 25 (2) (2) TDDDG).

  4. The data are automatically provided by your browser.

  5. Recipients of the personal data are IT service providers which we use within the framework of a data processing agreement.

  6. IP addresses are anonymised after 24 hours. Pseudonymous usage data are deleted after six months at the latest.

  7. Without the disclosure of personal data, use of the website is not possible. Communication via the website is technically impossible without providing data.

 

1.2) Technically Required Cookies

​

We use cookies on the website. Cookies are small text files which can be stored on your device via the browser when you visit the website. When you revisit the website with the same device, we can read and process the information stored in cookies. For this purpose, we use processing and storage functions of the browser on your device and collect information from the browser storage of your device.

​

In this privacy notice, we distinguish between technically necessary cookies, statistics cookies and marketing cookies. Cookies that are technically necessary for the functioning of the website cannot be deactivated via the cookie management function of this website. However, cookies can be deactivated at any time in the respective browser. Different browsers offer different options to configure cookie settings in the browser. Please note that some functions of the website may not function, or may no longer function properly, if cookies are generally disabled in the respective browser.

 

a) Session Cookies

We use so-called session cookies to ensure the technical operation of the website and the technical display of images on the website. These cookies enable us to store individual settings and certain decisions or actions of visitors for the duration of the visit (e.g. login, language settings).

​

  1. The purposes of the processing of data are the technical operation of the website, enabling individual settings and the technical display of content and images on the website.

  2. The data processed are data relating to individual settings as well as HTTP data: These are log data generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure) (HTTP(S)): this includes IP address, type and version of your internet browser, operating system used, the page accessed, the page previously visited (referrer URL), date and time of access. HTTP(S) data are also generated on servers of service providers (e.g. when third-party content is retrieved).

  3. The legal basis for the processing is our legitimate interest in providing the individual sessions (Art. 6 (1) (f) GDPR and Section 25 (2) (2) TDDDG).

  4. The data are automatically provided by your browser.

  5. Recipients of the personal data are IT service providers which we use within the framework of a data processing agreement.

  6. The cookie will be automatically deleted at the end of the session. Otherwise, the cookie automatically expires after 24 hours.

  7. Without the disclosure of personal data, use of the website is not possible. Communication via the website is technically impossible without providing data.

 

b) Cookiebot for Wix by Usercentrics

We use the Usercentrics consent manager “Cookiebot for Wix” to manage consents of website visitors, withdrawals of consent and objections to the use of cookies.

​

  1. The purpose of the processing of data is to manage cookie decisions of website visitors (consent, withdrawal, opt-out) and to ensure the security of the application. A change of purposes is not planned.

  2. The data processed are:

    • HTTP data: Log data generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure) (HTTP(S)): this includes IP address, type and version of your internet browser, operating system used, the page accessed, the page previously visited (referrer URL), date and time of access.

    • Consent data: Visitor’s decisions regarding individual cookies or groups of cookies, time of the decision and of the last visit (Consent ID, consent date and time, browser user agent and consent status).

  3. The legal basis for the processing is our legitimate interest in the simple and reliable management of cookies (Art. 6 (1) (f) GDPR, Section 25 (2) (2) TDDDG).

  4. The data are actively provided by the visitor (consent data) or automatically by the visitor’s browser (HTTP data).

  5. Recipients of the data are Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark and Wix.com Ltd., 5 Yunitsman Street, Tel Aviv, 6936025, Israel, within the framework of data processing agreements. For Israel, an adequacy decision exists pursuant to Art. 45 GDPR. Usercentrics A/S uses Microsoft Ireland Operations Ltd (“MIOL”), One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18, Ireland and Akamai Technologies, Inc., 145 Broadway, Cambridge, MA 02142, USA, as service providers. MIOL in turn uses Microsoft Corporation in the USA as a service provider. Microsoft Corporation and Akamai are both certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). In addition, Microsoft and Akamai have concluded the EU Standard Contractual Clauses (2021/914; Module 3). You may request a copy of the essential contractual provisions of the Standard Contractual Clauses at any time.

  6. Any withdrawal of consent previously given is stored for three years (accountability). The consent management cookie is deleted six months after the last visit. Log data are anonymised before storage.

  7. Without the disclosure of personal data, use of the website is not possible. Communication via the website is technically impossible without providing data.

 

1.3) Tag Management Systems

​

Piwik Pro Tag Manager

If you have given your consent, we use cookies from the tag management service “Piwik Pro Tag Manager” on our website. This tool allows us to centrally manage cookies and other features on our website and control when they are set. The Piwik Pro Tag Manager enables us to implement your consent preferences and link the setting of cookies to specific events (e.g. visiting certain sub-pages).

​

  1. The purpose of the processing is to centrally manage and control cookies and other features on our website.

  2. The data processed are:

    • HTTP data: Log data generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure) (HTTP(S)): this includes IP address, type and version of your internet browser, operating system used, the page accessed, the page previously visited (referrer URL), date and time of access and language settings.

    • Consent data: Information relating to your decision to give consent, your differentiated selection of specific consent categories or the withdrawal of consent.

    • Usage and interaction data: Depending on the specific configuration, information about your use of our website may be processed. This may include, in particular, pages accessed, clicks and other interactions, the time of the last interaction, whether a session is continuing, referrer and campaign information, and information on whether a particular function or service has already been activated.

  3. The legal basis for the processing is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG).

  4. Consent data are actively provided by you. HTTP data as well as usage and interaction data are automatically transmitted by your browser.

  5. Recipient of the data on the basis of a data processing agreement is Piwik Pro SA, ul. Św. Antoniego 2/4, 50‑073 Wrocław, Poland. Piwik PRO SA uses Microsoft Ireland Operations Ltd. (“MIOL”), One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18, Ireland as a service provider. MIOL in turn uses Microsoft Corporation in the USA as a service provider. Microsoft is certified under the EU‑U.S. Data Privacy Framework (Art. 45 GDPR). In addition, Microsoft has concluded the EU Standard Contractual Clauses (2021/914; Module 3). You may request a copy of the essential contractual provisions of the Standard Contractual Clauses at any time.

  6. The cookies will be deleted at the latest after 365 days.

  7. The provision of data is not required by law or contract. You are not obliged to provide the data.

 

1.4) Statistics cookies

​

a) Qualtrics Cookies

If you have given your consent, we use cookies from the survey service “Qualtrics” on our website. Using Qualtrics, we can display targeted feedback and satisfaction surveys to visitors to our website in the form of pop‑up windows and conduct and evaluate these surveys.

​

  1. The purpose of the processing of data is to control the display of these pop‑up windows as well as to conduct and evaluate the survey, if you participate in it.

  2. The data processed are:

    • HTTP data: Log data generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure) (HTTP(S)): this includes IP address, type and version of your internet browser, operating system used, the page accessed, the page previously visited (referrer URL), date and time of access and language settings.

    • Pop‑up window display data: Information on whether and which version of the pop‑up has already been displayed to you, cancelled by you or completed.

    • Usage data: Subpages visited within our web presence and click events carried out to control the display of the survey pop‑up based on predefined criteria.

    • Session identifier: Technical identifier used to link your browser to an ongoing survey so that your answers are retained while you complete it.

    • Survey data: The information you provide in the survey.

  3. The legal basis for the processing is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG).

  4. The survey data are actively provided by you. The other data are automatically provided by your browser.

  5. Recipient of the data within the framework of a data processing agreement is Qualtrics, LLC, 333 W River Park Drive, Provo, Utah 84604, USA. Qualtrics uses Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109‑5210, USA, and Akamai Technologies, Inc., 145 Broadway, Cambridge, MA 02142, USA as service providers. Qualtrics, AWS and Akamai are each certified under the EU‑U.S. Data Privacy Framework (Art. 45 GDPR). In addition, Qualtrics, AWS and Akamai have concluded the EU Standard Contractual Clauses (2021/914; Module 3). You may request a copy of the essential contractual provisions of the Standard Contractual Clauses at any time.

  6. The survey data will be deleted 5 calendar years from the end of the calendar year after the survey’s completion. The display data will be deleted after 6 months. Log data will be deleted after one year. Incidentally, any other data will be automatically deleted at the end of the session.

  7. The provision of data is not required by law or contract. You are not obliged to provide the data. If you do not provide the data, we cannot display, conduct or evaluate surveys.

 

b) Piwik PRO

If you have given your consent, we use cookies of the web analytics tool “Piwik PRO” on our website.

​

  1. The purpose of the processing of data is to analyse the use of the website in order to optimise content and user guidance, to measure the achievement of defined actions (so‑called conversions) and to ensure the technical performance of the website.

  2. The data processed are:

    • HTTP data: Log data generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure) (HTTP(S)): this includes IP address, type and version of your internet browser, operating system used, the page accessed, the page previously visited (referrer URL), date and time of access, language settings, country of access.

    • Device data: Data generated by Piwik PRO and assigned to your device: a unique, pseudonymous ID used to (re)recognise returning visitors and to count unique visitors.

    • Usage data: Device‑related raw data collected when you use our website: information on the entry page through which you access our website, on your browser and device, on the use of the website (in particular page views, time spent on pages, clicked external links and downloads, search terms entered, click and scroll behaviour, defined interactions such as submitting a contact form) and information on the fulfilment of pre‑defined goals (so‑called conversions). These include in particular contact enquiries, downloads and newsletter registrations. The data are each assigned to the pseudonymous identifier allocated to your device.

    • Technical performance data: Information on the technical performance of the website, in particular on loading time, server response time and error messages.

    • Report data: Data contained in aggregated reports created by Piwik PRO based on the analysis of device‑related raw data and consent decisions.

    • Consent data: Consent decision and time of decision.

  3. The legal basis for the processing is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG).

  4. The data are automatically provided by your browser.

  5. Recipient of the data on the basis of a data processing agreement is Piwik PRO SA, ul. Św. Antoniego 2/4, 50‑073 Wrocław, Poland. Piwik PRO SA uses Microsoft Ireland Operations Ltd. (“MIOL”), One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18, Ireland as a service provider. MIOL in turn uses Microsoft Corporation in the USA as a service provider. Microsoft is certified under the EU‑U.S. Data Privacy Framework (Art. 45 GDPR). In addition, Microsoft has concluded the EU Standard Contractual Clauses (2021/914; Module 3). You may request a copy of the essential contractual provisions of the Standard Contractual Clauses at any time.

  6. IP addresses will be masked before storage. The other data will be deleted after 13 months.

  7. The provision of data is not required by law or contract. You are not obliged to provide the data. If you do not provide the data, we cannot carry out web analytics using Piwik PRO.

 

1.5) Marketing Cookies

​

Microsoft Dynamics 365 Customer Insights

We use the service “Microsoft Dynamics 365 Customer Insights”. This allows us to embed forms on our website for project-related communication requests, to create contact profiles when these forms are used, and to organize and document our marketing communication. If you have given consent, we also use Microsoft cookies. The cookies are set when you submit such form on our website or when you access our website via a link in our marketing emails. This enables us to recognize you and to link your usage behaviour on our website with your contact profile.

​

  1. The purpose of the processing is to link your usage behaviour on our website with your contact profile in order to assess your interest in our services and to tailor our marketing communication accordingly.

  2. The data processed are:

    • HTTP data: These are log data generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure) (HTTP(S)): this includes IP address, type and version of your internet browser, operating system used, the page accessed, the page previously visited (referrer URL), date and time of access. HTTP(S) data are also generated on servers of service providers (e.g. when third-party content is retrieved).

    • Usage data: Device-related raw data collected when you use our web offering. This includes a persistent identifier assigned to your browser as well as information continuously associated with this identifier about your usage behaviour, in particular the pages you access and the clicks you perform.

    • Contact profile data: Data submitted through the form (in particular name, email address, telephone number, project-related information and interests) with which usage data is linked.

  3. The legal basis for the processing is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG).

  4. Contact profile data are actively provided by you. HTTP and usage data are automatically transmitted by your browser.

  5. Recipient of data within the framework of a data processing agreement is Microsoft Ireland Operations Ltd. (“MIOL”), One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18, Ireland, as the provider of Microsoft Dynamics 365. MIOL uses Microsoft Corporation in the USA as a service provider. Microsoft is certified under the EU‑U.S. Data Privacy Framework (Art. 45 GDPR). In addition, Microsoft has concluded the EU Standard Contractual Clauses (2021/914; Module 3). You may request a copy of the essential contractual provisions of the Standard Contractual Clauses at any time.

  6. The cookies will be deleted after 365 days.

  7. The provision of data is not required by law or contract. You are not obliged to provide the data. If you do not provide the data, we are unable to analyse your usage behaviour or link it to your contact profile. You may withdraw your consent at any time with effect for the future.

​

​

2) Genereal Communication Requests 

 

The company of the GROPYUS Group to which you specifically address your communication request is responsible for data processing in the context of communication. GROPYUS AG is responsible for processing data in the context of a general contact form without specification of a particular company of the GROPYUS Group. 

​

  1. The purpose of the processing is the preparation and execution of a contractual relationship or other communication. A change of purpose is not planned. 

  2. Processed data are name, contact data, communication details, the time stamp of communication as well as technical metadata of communication. 

  3. The legal basis for processing is Article 6 (1) (b) GDPR (contract or contract initiation) in the case of contracts with natural persons, whereas for contracts with legal persons, Article 6 (1) (f) GDPR (legitimate interest, namely communication with contact persons relevant to the contract) and in all cases Article 6 (1) (c) GDPR (statutory obligations, in particular, tax and commercial law provisions). For simple communication, the legal basis is Article 6 (1) (f) GDPR (legitimate interest, namely documentation of communication processes). 

  4. Contact data is actively provided by the data subject. Communication metadata and communication data are automatically collected. 

  5. Contact and contract data can be transmitted to other service providers, business partners, as well as offices and authorities if necessary for the execution of the contract or order. We also use service providers as processors within the framework of a data processing agreement for the provision of services, especially for the provision, maintenance, and servicing of IT systems. 

  6. Data of contract partners and service providers will be deleted 8 calendar years after termination of the contract or order. Inquiries and communication will be deleted after 8 calendar years.

  7. The processing of contact data of the service providers and business partners is necessary to execute the contract or order. If the data is not provided, the communication may be considerably disturbed. For interested parties, the provision of data is obligatory. Without the provision of data, communication is not possible. 

​​

​

3) Marketing Communication

​

If you have given your consent to receive marketing communication when using our forms for project-related requests, we will send you personalised information about our services and projects by email or telephone. If you have also given your consent to analyse our marketing communication, we will also assess the reach and effectiveness of our marketing communication. This information is linked to your contact profile.

​

  1. The purpose of the processing is to provide you with personalised information about our services and projects, to measure the reach of our marketing communication and to link this information with your contact profile.

  2. The data processed are:

    • Contact profile data (in particular name, email address, telephone number, project-related information and interests)

    • Date and time stamp of the communication

    • For marketing communication by email, we also process:

      • Log data: These are data that are technically required when opening the email or the linked content via the Hypertext Transfer Protocol (Secure) (HTTP(S)). This includes the IP address, type and version of your internet browser, the operating system used, the page accessed, the previously visited page (referrer URL), and the date and time of access.

      • Open rates of the e-mail

      • Clicks within the e-mail

  3. The legal basis for the processing is your consent (Art. 6 (1) (a) GDPR).

  4. Contact profile data is provided by the data subject when using the form. The other data are automatically provided by the browser or device of the data subject.

  5. Recipient of data within the framework of a data processing agreement is Microsoft Ireland Operations Ltd. (“MIOL”), One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18, Ireland, as the provider of Microsoft Dynamics 365. Microsoft uses Microsoft Corporation, USA, as a service provider. Microsoft is certified under the EU–US Data Privacy Framework (Art. 45 GDPR). In addition, Microsoft has concluded the EU Standard Contractual Clauses (2021/914; Module 3). You may request a copy of the essential contractual provisions of the Standard Contractual Clauses at any time.

  6. Log data will be deleted after 24 hours. Contact profile data will be deleted or anonymised after consent to receive marketing communications is withdrawn.

  7. The provision of personal data is necessary in order to receive marketing communication. Without providing your data, we are unable to provide marketing communication. You may withdraw your consent at any time. To do so, please use the unsubscribe function included in the marketing communication.

​

​

4) Customers and Contact Persons at Customers 

 

The company of the GROPYUS Group with which you have a contractual relationship is responsible for data processing in the context of communication with customers and contact persons at customers.

​

  1. ​We process your data for the purpose of performing the contractual relationship and processing payments. This also includes consulting, support, and information about new services. A change of purpose is not planned. 

  2. The processed data are name, address data, information on the company, and payment data, as well as contractual relevant communication data. 

  3. The legal basis for processing the data of customers who are natural persons is Article 6 (1) (b) GDPR (contract) and Article 6 (1) (c) GDPR (legal obligations). The legal basis for the processing of contact data for customers who are not natural persons is Article 6 (1) (f) GDPR (legitimate interest, namely communication with the customer). The legal basis for information on services is Article 6 (1) (f) GDPR (legitimate interest, namely advertising. The legal basis for the transfer of payment information to payment providers is Article 6 (1) (f) GDPR (legitimate interest in centrally controlled payment processing by a payment service provider). 

  4. The data is provided either by yourself or your supervisor. 

  5. Recipients of data may be banks and payment providers for the processing of payments and creditworthiness checks. In individual cases, data may be transferred to debt collection service providers, lawyers, and courts. We also use service providers within the framework of a data processing agreement for the provision of services, in particular for the provision, maintenance and servicing of IT systems.

  6. All contractual and booking relevant data are stored for a period of 8 calendar years after termination of the contract in accordance with tax and commercial law retention periods. 

  7. The provision of data is obligatory for customers based on statutory and contractual regulations. The contractual relationship cannot be established and performed without providing data. 

 

​

5) Job Applicants 

​

The company of the GROPYUS Group to which you specifically apply is responsible for data processing in the job application process. GROPYUS AG is responsible for the processing of data in the context of initiative applications or job postings without specification of a particular company of the GROPYUS Group.

​

  1. The purpose of data processing is the selection of job applicants for employment. We also use anonymized data for statistical evaluations. To check the suitability of applicants and to verify information and trustworthiness, in some cases we carry out background research from publicly accessible sources. A change of purpose is not planned. 

  2. The processed data are name, contact data, communication details, login data on the job website (if applicable), interview notes, job application documents including certificates and curriculum vitae, the time stamp of communication, as well as technical metadata of communication, as well as data collected as part of background research from publicly available sources (e.g. public profiles on job portals).

  3. The legal basis is Article 6 (1) (b) (initiation of the employment contract) in conjunction with Article 88 GDPR and the national regulations on employee data protection at the headquarters of the GROPYUS Group company to which you are applying. If we transfer your application documents to other affiliated companies, the legal basis for this is Article 6 (1) (f) GDPR (legitimate interest in group-internal job applicant management). If we are currently unable to offer you a position, but your application is suitable for other positions in the future, and you do not object to further storage, the legal basis for further storage is Article 6 (1) (f) GDPR (legitimate interest in retaining suitable job applications). 

  4. Some of the applicant data mentioned is provided by the applicants. Another part is added by employees during the application process or collected from public sources.

  5. The job application data will be transferred internally to the responsible employees in charge of the decision-making. In this context, the data may also be passed on to other affiliated companies of the GROPYUS Group, provided that you do not object to such transfer. We also use service providers as processors within the framework of a data processing agreement for the provision of services, especially for the provision, maintenance, and servicing of IT systems. We use the service provider Greenhouse Software, Inc. 228 Park Avenue S. PMB 14744, Attn: Privacy, New York, New York 10003-1502 USA for the application portal. There is an adequacy decision for the data transfer to the USA, as the service provider is certified in accordance with the US-EU data protection framework. The service provider that we use to operate the job portal may process personal data as an independent controller (e.g. reach measurement). The service provider itself is responsible for this. See their privacy policy: https://www.greenhouse.com/de/privacy-policy.

  6. Application data is deleted six months after the end of the specific application process. If job applicants are also considered for future positions and do not object to further storage of their data, the data will remain stored for up to 12 months after the end of the job application process. 

  7. The provision of personal data is necessary for the examination of the job application and, if applicable, the subsequent conclusion of an employment contract. A job application cannot be considered without the provision of personal data.

​

​

6) Participants in a Video Conference via Microsoft Teams 

​

​The company within the GROPYUS Group that organizes the video conference is responsible for data processing in the context of the videoconference via Microsoft Teams. 

​

  1. We process the data of participants for the purpose of organizing, conducting, and documenting video conferences via Microsoft Teams. If we separately indicate this in the context of the individual video conference and obtain your consent in this regard, a recording of the video conference is made. There are no plans to change these purposes. 

  2. The data of the participants processed in the context of the video conference are: 

    • Participant data: Name and surname, e-mail address 

    • Conference data and meeting metadata: Topic, IP address, device/hardware information, telephone data: For dial-in with telephone, information on incoming and outgoing telephone number, country name, start and end time, additional connection data if necessary.

    • Communication data within the online event, your communication data in the form of questions, requests to speak or vote, as well as chat content will be processed. You always decide whether and in what form you want to participate. 

    • Image, sound, and video data (and, in case of consent, the corresponding recordings): Within the video conference, image, sound, and video data of the participants will be processed. However, each person is always free to decide whether they want to switch on their camera and microphone or whether they just want to communicate via the chat window. If we have obtained your consent in this regard, the online event will be recorded, including the image, sound, and video data of the participants.

  3. The legal basis for the processing of data of participants for the purpose of conducting the video conference is your consent pursuant to Art. 6 (1) (a) GDPR. The legal basis for making recordings is also your consent pursuant to Art. 6 (1) (a) GDPR. 

  4. ​The participant data is actively provided by the participants. The conference data is actively provided by the data subject or automatically by the browser or device of the data subject. The image, sound, or video data and communication data are collected automatically, and the recordings of the image, sound, or video data are made by the responsible GROPYUS Group company. 

  5.  ​The recipients of the name, communication data, and image, sound, and video data are always the other participants of the video conference. We also use service providers as processors within the framework of a data processing agreement for the provision of services, especially for the provision, maintenance, and servicing of IT systems, in particular the service provider Microsoft Ireland Operations Ltd. In this context, personal data may also be transferred to third countries, in particular the USA. In the USA, there is currently an adequacy decision by the European Commission for companies that have joined the EU-U.S. Data Privacy Framework. This is the case for Microsoft. If data is transferred to subcontractors in other countries, appropriate measures (e.g. standard contractual clauses) are taken insofar as these are necessary to ensure an adequate level of data protection. 

  6. The conference data and communication data will usually be deleted 24 months after the video conference has taken place unless otherwise specified in the context of the individual video conference. However, the excess raw material of the recordings will be deleted 24 months after the online event has taken place. In addition, you can request the deletion of your personal data at any time unless we are legally or contractually obliged or entitled to further process the data. 

  7. ​Without the provision of data, participation in the video conference is not possible. The provision of communication, image, sound, and video data, as well as the production of image, sound, and video recordings, is not obligatory for participation in the video conference. 

​​

​

7) Photos and Videos

​

The GROPYUS Group company that organizes the respective project or event is responsible for the processing of photo and video recordings.

​

  1. The purpose of data processing is the use of photo and video material, primarily for internal information purposes, but also for public relations work. Photos and videos may also be uploaded to public platforms in individual cases.

  2. The data processed are still and moving images, possibly combined with an audio track that may contain the voice of the data subjects.

  3. The legal basis for the processing is Art. 6 (1) (f) GDPR, our legitimate interest in internal and public information about the work of GROPYUS and events. If individual persons are the focus of recordings, the consent of the data subject is obtained for further processing. The legal basis is then Art. 6 (1) (a) GDPR.

  4. The aforementioned recordings are collected directly from the data subjects.

  5. Recordings are passed on internally to employees. They may also be passed on to other affiliated companies in the GROPYUS Group. We also use service providers by way of order processing for the provision of services, in particular photographers to create the recordings or service providers for the provision, maintenance and care of IT systems, in particular the service provider Microsoft Ireland Operations Ltd. Such transfers are based on an adequacy decision of the European Union for companies that are certified under the EU/US Data Privacy Framework. This is the case with Microsoft. When transferring data to subcontractors in other countries, appropriate measures (e.g. standard contractual clauses) are taken insofar as these are necessary to ensure an adequate level of data protection. We may also use public platforms on which material can be published.

  6. All recordings are deleted or recognizable persons are anonymized (e.g. by pixelating or cutting out persons) if they are no longer relevant for internal information purposes or publication After 10 years at the latest, the responsible department will carry out a documented assessment of whether the photos have historical value for GROPYUS and whether the information contained in the photos is no longer relevant.

  7. The production and use of recordings is neither contractually nor legally required.

 

​

8) Contact on LinkedIn

​

  1. We process your data to draw your attention to products and services or vacant positions in our staff. For this purpose, we will send you messages, e.g. if you are registered on the LinkedIn platform.

  2. The data processed are: Your full name, job role, affiliation and time of inclusion in the contact list, status of contact activity, notes, the location of your company, time of job changes, time of last LinkedIn post, follower status of the GROPYUS page, profile information, response to contact request (accept/reject), and other information you share during communication with us.

  3. The legal basis for the initial contact with you and its documentation is our legitimate interest (Article 6 (1) (f) GDPR) in contacting people for the purpose of direct marketing and recruiting activities. You can adjust the visibility of your profile and the permission to contact you at any time via your LinkedIn profile settings. If you object to the use of your data, we will add your contact to a blacklist so that we do not contact you again. The legal basis for this is our legal obligation to no longer contact you (Art. 6 (1) (c) GDPR). The further processing of the data collected in the course of communication is based on the consent given to us.

  4. We collect the data via the LinkedIn platform.

  5. Recipients of data may be affiliated companies of GROPYUS and external consultants involved in the project.  We also use LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland and its subcontractors. As part of this processing, your data may be transferred to third countries, in particular the USA. LinkedIn is certified under the EU/US Data Privacy Framework, which is an adequacy decision of the European Commission.

  6. The data collected by LinkedIn for the initial contact will be deleted one year after collection. We retain data about the rejection of a contact request for as long as we use the service so that we do not inadvertently contact the data subjects again.

  7. There is no legal or contractual obligation to provide personal data for us to contact you. However, we are unable to communicate with you without this data.

 

​

9) Click Analysis

​

  1. We collect click statistics for selected links (especially in the form of QR-Codes). The purpose is to measure the popularity of our offerings and, if necessary, adapt the content, products, and services to the expectations of the audience.

  2. The data processed is: IP address, time of access.

  3. The legal basis for the collection is our legitimate interest within the meaning of Art. 6 (1) (f) GDPR in aligning our activities with the interests of the public.

  4. The data is collected automatically when you click on shortened links.

  5. Recipients of anonymized data may be affiliated companies of GROPYUS and external parties. We use the the following service provider for the click tracking activities: URLR, LE LAB'O VILLAGE BY CA, 1 AVENUE DU CHAMP DE MARS, 45100 Orléans France.

  6. The data is only personal when it is collected and is immediately anonymized. No personal data is stored permanently or transferred to third parties.

  7. It is not possible to click on shortened links without processing the data.

 

 

10) Building Operating System (BOS)

 

The GROPYUS Technologies GmbH operates the Building Operating System (BOS), a smart home solution for controlling devices in the home, and provides related additional services. Information about data protection in the BOS system can be found here:

BOS privacy information

 

​

11) Surveys and Research Activities

 

11.1) Invitation to Surveys or other Research Activities

 

The GROPYUS Technologies GmbH occasionally invites persons to participate in surveys and studies. Participation is voluntary. The aim of the surveys and studies is to further develop products and services.

​

  1. The purposes of the processing are research and product development for residential buildings and related services, the further development and improvement of products and services, the promotion of interaction with tenants and their active involvement in innovation processes in order to better identify needs.

  2. The processed data is usually: email address, physical address, name.

  3. The legal basis for invitations to surveys and studies is our legitimate interest in conducting surveys and studies (Art. 6 (1) (f) GDPR, Sec. 7 (3) UWG) or your consent in accordance with Art. 6 (1) (a) GDPR.

  4. The data is actively provided by you or automatically through your browser or device.

  5. We use service providers for the provision of services by way of order processing, in particular for the provision, maintenance and care of IT systems.

  6. Unless otherwise stated in the survey or study, we will delete personal data no later than six months after the survey or study has been conducted. The results of the survey will only be stored in anonymized form after evaluation.

  7. There is no legal or contractual obligation to participate in surveys or to provide the data. However, an invitation or participation is not possible without disclosing personal data.

 

11.2) Surveys and other Research Methods

 

GROPYUS processes personal data for research and development purposes, in particular through questionnaires, surveys, and other research methods. Further information about the processing of personal data in this context can be found here:

Surveys and other research methods

​

11.3) GROPYUS Panel of Experts

 

GROPYUS processes personal data in order to invite individuals to join our Panel of Experts and to conduct interviews and studies with them. Detailed information about these processing activities can be found here:

​​Expert panel privacy information

 

​

12) Speak Up Portal (AdvoWhistle)

 

GROPYUS offers a Speak Up Portal (AdvoWhistle, former: iWhistle) to enable anonymous hints, e.g. regarding compliance issues. Detailed information on the processing activities in this context can be found here:

AdvoWhistle privacy information

 

​

13) Data transfers to other countries

 

For the above processing activities, a transfer of personal data to so-called third countries cannot be ruled out. If there is no adequacy decision for the potential recipient, we conclude the EU Standard Contractual Clauses (2021/914; Module 2 or 3). You may request a copy of the essential contractual contents of the Standard Contractual Clauses at any time.

 

​

14) Rights of Data Subjects and Further Information

 

  1. We do not use any methods of automated individual decision-making. 

  2. You have the right to request information at any time about all your personal data, which we are processing.

  3. If your personal data is incorrect or incomplete, you have the right to have it rectified and completed. 

  4. You can request the erasure of your personal data at any time, as long as we are not bound by legal obligations that require or allow us to continue processing your data. 

  5. If the applicable legal requirements are met, you can request a restriction to the processing of your personal data. 

  6. You have the right to object to the processing insofar as the data processing is based on profiling or direct marketing purposes. 

  7. If the processing is carried out on the basis of the balancing of interests, you may object to the processing by stating reasons arising from your particular situation. 

  8. If the data processing takes place on the basis of your consent or a contract, you have the right to a transfer of the data provided by you, insofar as the rights and freedoms of others are thereby not impaired. 

  9. If we process your data on the basis of a declaration of consent, you have the right to revoke this consent at any time with future effect. The processing carried out prior to revocation remains unaffected by the revocation. 

  10. Moreover, you have the right to file a complaint at any time with a data protection supervisory authority if you believe that data processing has been carried out in violation of the applicable law. 

 

 

Version 2 October 2026

bottom of page