Introduction

With this privacy policy, we would like to inform you about the types of your personal data (also referred to simply as “data” below) that we process, the purposes for which we process it, and the extent of such processing. This privacy policy applies to all processing of personal data carried out by us, both in the course of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (collectively referred to below as the “online offering”).

The terms used are not gender-specific.

Last updated: October 2026

1. Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

asphalt-labor Arno J. Hinrichsen GmbH & Co. KG
Address: Dr.-Hermann-Lindrath-Str. 1-3
Phone: +49 4554 99200
Email: datenschutz@asphalt-labor.de
Website: https://preview-mm82design.de/

The controller determines the purposes and means of processing personal data in connection with the operation of this website.

2. General Information on Data Processing

We take the protection of your personal data seriously. Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, contact details, IP address, and information you submit to us via forms on our website.

We process personal data exclusively in accordance with the applicable data protection laws, in particular the GDPR, the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG), and the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG).

This privacy policy explains what data is collected when you visit our website, the purposes for which we use it, the legal basis for processing, and the rights to which you are entitled.

3. Legal Bases for Processing

Personal data is processed on the basis of the applicable legal provisions. In particular, the following legal bases may apply:

Article 6(1)(a) GDPR: The data subject has given consent.

Article 6(1)(b) GDPR: Processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract.

Article 6(1)(c) GDPR: Processing is necessary for compliance with a legal obligation.

Article 6(1)(f) GDPR: Processing is necessary for the purposes of the legitimate interests pursued by us, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Section 26 BDSG: Processing of personal data in the employment context, in particular for the purpose of deciding whether to establish an employment relationship, where the statutory requirements are met.

Section 25 TDDDG: Storing information on, or accessing information already stored in, terminal equipment, where the statutory requirements are met.

The legal basis applicable in each individual case is explained in the sections below.

4. Website Availability and Hosting by STRATO

Our website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

When you access our website, the web server processes technically necessary information. This may include, in particular:

– IP address of the requesting device;
– date and time of access;
– page or file requested;
– amount of data transferred;
– notification of successful retrieval or an error;
– referrer URL, if transmitted by the browser;
– browser used and browser version;
– operating system used;
– other technical connection information, where applicable.

This data is required to make the website technically available, ensure the stability and security of its operation, identify errors, and prevent unauthorised access.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to ensure the secure, stable, and functional operation of our website.

STRATO may process personal data as a processor in connection with its hosting services. The website operator must check whether the required data processing agreement has been concluded and, where necessary, conclude or confirm such an agreement.

Further information is available at:
https://www.strato.de/datenschutz/

5. Cookies and Consent Management

Our website uses cookies and, where applicable, similar technologies. Cookies are small files that may be stored on your device. Similar technologies may store or access information on your device.

We distinguish between technically necessary technologies and those used, for example, for analytics, personalisation, or the integration of external content.

5.1 Use of Real Cookie Banner

We use the WordPress plugin Real Cookie Banner on our website to manage consent for cookies and other technologies that require consent in accordance with data protection requirements.

The plugin is provided by devowl.io GmbH, Tannet 12, 94539 Grafling, Germany.

Real Cookie Banner enables us to inform you about the cookies and external services used on our website, obtain any required consent, and document your choices. The plugin also helps ensure that services requiring consent are enabled only after you have given your consent, provided that it has been configured accordingly.

In particular, the following data may be processed:
– your consent decision and the consent categories selected;
– the time and status of your consent or refusal;
– information about the consent version used;
– a technical identifier used to associate the consent with you or your device;
– technical information required to document and manage your choices, where applicable.

Where processing is necessary to comply with legal obligations, it is based on Article 6(1)(c) GDPR in conjunction with the applicable data protection provisions. Where managing your choices involves storing information on your device, Section 25 TDDDG must also be observed.

Your consent decision is stored so that your choice can be taken into account on subsequent visits. The specific retention period depends on the plugin configuration and the applicable legal requirements.

You can change or withdraw your consent at any time with effect for the future. To do so, reopen the cookie settings using the link or button provided on our website.

Further information about the plugin and the provider’s data processing is available at:
https://devowl.io/de/datenschutz/

5.2 Technically Necessary Cookies

Technically necessary cookies or similar technologies may be required to ensure that the website functions properly, maintain security, or provide functions you have expressly requested.

Such technologies may be used without consent where the statutory conditions under Section 25(2) TDDDG are met. Any subsequent processing of personal data must also have an appropriate legal basis under the GDPR.

5.3 Technologies Requiring Consent

Before storing information on your device or accessing information already stored there, where no statutory exception applies, we obtain your consent in advance in accordance with Section 25(1) TDDDG.

Where personal data is processed in this context, the processing is based on an appropriate legal basis under the GDPR, in particular Article 6(1)(a) GDPR.

You may withdraw any consent you have given at any time with effect for the future.

5.4 Cookie or Consent Banner

A consent banner is used on our website. Depending on the functions actually integrated, you can use it to accept, reject, or individually select non-essential technologies.

Rejecting non-essential technologies must not be made substantially more difficult than accepting them. Consent must be freely given, informed, and unambiguous.

Your choice is stored so that it can be taken into account on subsequent page visits.

To be checked before publication: the name and version of the consent management plugin, the specific cookies and technologies used, the retention period for consent records, and the technical implementation that blocks external content before consent is given.

5.5 Use of Font Awesome

We use Font Awesome on our website to display icons and symbols consistently. These support the visual design and improve the clarity of our website.

Local integration

If Font Awesome is stored directly on our web server and loaded from there, retrieving the relevant files does not establish a separate connection to an external Font Awesome server. However, when the files are delivered, our hosting provider may process the connection data described in the “Website Availability and Hosting” section.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to provide an attractive, consistent, and user-friendly website design.

Integration via external servers

If Font Awesome is integrated through an external content delivery network (CDN) or another external server, a connection to the relevant provider’s servers may be established when a page is accessed. In particular, your IP address, browser information, and other technically necessary connection data may be transmitted.

In this case, the specific provider, the actual data processing, and any transfer of personal data to a third country must be checked. Where processing requires consent, that consent will be obtained in advance through our consent management system.

Further information about Font Awesome and the provider’s privacy policy is available at https://fontawesome.com/privacy.

5.6 Use of Google Fonts (Local Hosting)

We use fonts from the Google Fonts library on our website to ensure a consistent and user-friendly presentation of our content. The font files are hosted locally on our own web server or made available through our hosting provider, STRATO.

When fonts are hosted locally, the font files are loaded directly from our server. As a result, no connection to Google servers is established solely to retrieve these font files. In this respect, your IP address is not transmitted to Google in connection with loading these fonts.

When you access our website, however, the technically necessary connection data required to deliver the font files is processed. Further information is provided in the “Website Availability and Hosting” section.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to ensure a consistent, attractive, and legible website design.

Further information about Google Fonts is available at https://fonts.google.com/ and in Google’s privacy policy at https://policies.google.com/privacy?hl=en.

5.7 Use of the WordPress Plugin Polylang

We use the WordPress plugin Polylang on our website to provide content in multiple languages and allow visitors to switch between the available language versions.

The plugin supports the management and linking of translated pages and posts. It is used to provide a user-friendly, multilingual website.

Where Polylang operates exclusively on our web server and does not transmit personal data to external providers, processing takes place as part of the operation of the website. Technically necessary connection data, in particular the IP address, may be processed by our hosting provider. Further information is provided in the “Website Availability and Hosting” section.

Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to make our website accessible in different languages and provide user-friendly navigation.

6. Contacting Us and Contact Form

If you contact us using the contact form or by other means, we process the personal data you provide so that we can receive and handle your enquiry and, where necessary, ask follow-up questions.

Depending on the form, this may include:
– first and last name;
– email address;
– telephone number, if provided;
– subject and message;
– other information provided voluntarily;
– technical metadata relating to the submission of the enquiry.

The data is used exclusively to handle your enquiry and communicate with you in connection with it, unless another legal basis permits further processing.

The legal basis is Article 6(1)(b) GDPR if the enquiry relates to entering into a contract or taking pre-contractual steps. In other cases, processing is generally based on Article 6(1)(f) GDPR. Our legitimate interest is to handle incoming enquiries appropriately.

Providing the information marked as mandatory is necessary to submit and process the enquiry through the form. Without this information, it may not be possible to use the form.

Retention period: We store the data for as long as necessary to handle the enquiry. It is then deleted unless statutory retention obligations or other legitimate reasons require further storage.

For business-related enquiries, statutory retention periods or the need to establish, exercise, or defend legal claims may justify longer retention.

7. Use of Contact Form 7

We use the WordPress plugin Contact Form 7 to provide our contact and application forms.

Information entered into the forms is processed to transmit and handle the relevant enquiry. Contact Form 7 can technically enable form submissions without permanently storing the content in its own form database. However, actual storage also depends on other plugins, individual settings, email configuration, and the server environment.

In particular, submitted information may be forwarded to the email addresses we use and stored there.

The legal basis depends on the purpose of the relevant form and is explained in the sections on contacting us and job applications.

We recommend checking the actual data flow, including email recipients, any storage or backup plugins used, and whether form submissions are also stored in WordPress or by external services.

8. Job Applications and Application Form

Our website allows you to apply for advertised positions, apprenticeships, or submit unsolicited applications.

8.1 What Data Do We Process?

As part of an application, we may process the following personal data in particular:
– first and last name;
– contact details, especially email address and, where applicable, telephone number;
– desired position or type of work;
– earliest possible starting date;
– information contained in your message;
– CV, cover letter, certificates, and other application documents;
– other information you provide voluntarily;
– technical information relating to the submission of the application.

Please provide only information that is necessary or relevant to your application. You should not provide special categories of personal data, such as health data, unsolicited unless this is exceptionally necessary.

8.2 Purposes and Legal Bases

We process your application data to receive and review your application, assess your suitability for a position or apprenticeship, and decide whether to establish an employment relationship.

Where the relevant conditions are met, processing is based on Section 26(1) BDSG in conjunction with Article 88 GDPR and, where pre-contractual measures are concerned, additionally on Article 6(1)(b) GDPR.

If processing is based on consent in an individual case, the legal basis is Article 6(1)(a) GDPR. Such consent may be withdrawn at any time with effect for the future.

8.3 Recipients of Application Data

Access to your application data is limited to people who need it to process your application, in particular the relevant contact persons and, where applicable, those responsible for recruitment.

Technical service providers may be involved as processors in making the website available and transmitting the data. These may include our hosting provider STRATO and any services used to transmit forms.

We disclose data to other companies or individuals only where there is a legal basis for doing so or you have given your consent.

8.4 Retention Period for Applications

We generally store application data only for as long as necessary to make a decision on the application.

After an unsuccessful application process has concluded, the data is deleted as soon as it is no longer necessary for the purposes stated and there are no legitimate reasons for retaining it. Temporary further storage may be necessary, in particular, to defend against potential legal claims. The specific period must be determined based on the individual procedure and applicable legal requirements.

If you expressly consent to your application being retained for future vacancies, we will store the relevant data for the agreed period or until you withdraw your consent.

If you are hired, necessary application data may be transferred to personnel administration to the extent legally permissible and necessary for the employment relationship.

8.5 Confidential Treatment

We treat your application documents confidentially. Based on the information currently available, no automated decision-making concerning your application within the meaning of Article 22 GDPR is planned. This statement must be reviewed if automated selection or assessment systems are introduced in the future.

9. File Uploads and PDF Files

You may be able to submit files through the application form. Permitted file formats and file sizes depend on the form’s technical settings.

Where specified in the application form, only PDF files with a maximum file size of 5 MB are accepted. This restriction must be technically verified before publication.

Uploaded files are processed so that we can receive, review, and handle your application. For this purpose, they may be forwarded to the relevant email address or stored in a designated technical storage environment.

Please note that files may contain personal information and, in some cases, other sensitive information. You should therefore submit only documents that are necessary for your application.

Storage: Before publication, it must be checked whether uploaded files are forwarded exclusively by email or are also stored in a web server directory, in WordPress, in backups, or with another service provider. The privacy policy must reflect the actual storage arrangements.

PDF Download Area

Our website may provide PDF documents, such as certificates, applications, or forms, for download.

When these files are accessed, the web server processes technically necessary connection data. The documents are provided so that visitors can access the relevant information and materials.

If no additional personal information is required to download a file, no further personal data is collected solely because you download a PDF. However, technical access data may be recorded in server logs.

10. Use of hCaptcha

We use the hCaptcha security service to protect our forms against automated submissions, spam, and misuse.

According to the service’s information, the provider is Intuition Machines, Inc., a company based in the United States.

hCaptcha may process technical information about your device and your use of the form to assess whether a submission is likely to come from a human or an automated system. This may include, in particular:
– IP address;
– browser and device information;
– information about interactions with the website;
– timestamps and technical details relating to form use;
– other information required to detect misuse.

Processing serves to protect our website and forms against spam, automated attacks, and unauthorised use.

The legal basis may be Article 6(1)(f) GDPR. Our legitimate interest is to protect our forms and the data submitted through them against misuse. If a different legal basis is required in a specific case, this must be assessed in light of the technical integration and actual processing.

The integration may result in information being transmitted to hCaptcha. In particular, it must be checked whether and when a connection to the provider’s servers is established, what data is transmitted, and whether a transfer to a third country takes place.

If data is transferred to a third country, the transfer must comply with Chapter V GDPR, and the relevant legal basis or appropriate safeguards must be documented where necessary.

Further information is available in the provider’s privacy policy:
https://www.hcaptcha.com/privacy

hCaptcha also provides information about integration and privacy at:
https://docs.hcaptcha.com/faq

To be checked before publication: the specific hCaptcha configuration, when it is activated, the provider’s contractual role, any data processing agreements in place, and the legal assessment of the transfer mechanisms used.

11. Google Maps

Google Maps is used on our website to display locations and directions.

The service is provided by Google. Depending on the specific product and integration used, different Google entities and terms of use may apply.

When an interactive map is embedded, a connection to Google servers may be established. In particular, your IP address, technical browser information, information about the map request, and other usage data may be processed. Google may also store or access information on your device where the technologies used allow this.

If you are signed in to Google, Google may be able to associate your use with your account. We have only limited influence over Google’s specific data processing.

Legal Basis and Consent

Where the map function stores information on your device or accesses information already stored there, and no statutory exception applies, the required consent is obtained under Section 25(1) TDDDG. Where personal data is processed on the basis of this consent, the legal basis is Article 6(1)(a) GDPR.

If the specific integration does not involve technologies requiring consent, its lawfulness under data protection law must be assessed separately based on the actual processing.

We recommend configuring Google Maps so that no connection to Google is established before any required consent is given. Alternatively, a static placeholder with a button to activate the map can be displayed first.

Further information about Google’s data processing is available at:
https://policies.google.com/privacy?hl=en

To be checked before publication: whether Google Maps is embedded directly as an iframe, loaded via a plugin, or accessed through an API; which Google services are actually contacted; and whether the consent banner reliably blocks the map until any required consent has been given.

12. No Use of Analytics or Tracking Services

According to the information currently available to us, we do not use analytics or tracking services such as Google Analytics to analyse visitor behaviour.

Nevertheless, technical server log files and the consent management system may process data where this is necessary for their respective purposes.

If analytics, marketing, or tracking services are introduced in the future, this privacy policy will be updated accordingly. Any required consent will be obtained before such services are activated.

Note: This statement applies only if no other analytics or tracking services are active, for example through WordPress plugins, external scripts, or embedded third-party services.

13. Recipients of Personal Data

Personal data is disclosed to third parties only where this is necessary to provide our website, handle an enquiry or application, comply with legal obligations, or where another lawful basis permits the disclosure.

Potential recipients or categories of recipients include, in particular:
– STRATO GmbH as hosting provider;
– the internal contact persons responsible for enquiries and applications;
– technical service providers engaged to process personal data;
– hCaptcha for form protection;
– Google in connection with Google Maps;
– authorities or other recipients where disclosure is legally required.

Data is disclosed only to the extent necessary and in compliance with statutory requirements.

The actual recipients depend on the services enabled and the technical configuration of the website and must be checked before publication.

14. Transfers of Data to Third Countries

Personal data may be transferred to countries outside the European Union or European Economic Area, particularly in connection with external services such as hCaptcha or Google.

Whether such a transfer actually takes place depends on the integration used, the servers involved, the relevant corporate entities, and the applicable contractual terms.

If personal data is transferred to a third country, the transfer must comply with Articles 44 et seq. GDPR. This may require, for example, an applicable adequacy decision or appropriate safeguards under Article 46 GDPR.

Where required, we will provide information about the relevant safeguards and explain how a copy can be obtained.

To be checked before publication: for each external provider, it must be established whether a transfer to a third country takes place and on what specific legal basis it is permitted. Without a technical review, it would not be appropriate to make a blanket statement that no data is transferred to third countries.

15. Retention and Deletion

We store personal data only for as long as necessary for the relevant processing purpose or as required by statutory retention obligations.

Once the purpose no longer applies, the data is deleted unless statutory obligations or other lawful reasons require it to be retained.

The specific retention period depends, in particular, on:
– the nature and purpose of the enquiry;
– the duration of the application process;
– statutory retention obligations;
– the need to establish, exercise, or defend legal claims;
– technical logging and security requirements;
– the deletion periods established by our service providers.

Where no fixed period can be specified, data is deleted based on the criteria set out above.

16. Data Security

We implement appropriate technical and organisational measures to protect personal data against loss, destruction, manipulation, unauthorised access, and other unlawful processing.

These measures may include encrypted connections, access restrictions, secure credentials, regular updates, and security measures provided by our hosting provider.

The specific measures are designed in accordance with the state of the art, the risks associated with the processing, and the applicable legal requirements.

Despite appropriate security measures, data transmission over the internet cannot be guaranteed to be completely protected against access by third parties in every case.

17. Your Rights as a Data Subject

Subject to the applicable legal requirements, you have the following rights in particular:

Right of Access – Article 15 GDPR

You may request confirmation as to whether we process personal data concerning you and, if so, obtain access to that data.

Right to Rectification – Article 16 GDPR

You may request the rectification of inaccurate personal data and the completion of incomplete data.

Right to Erasure – Article 17 GDPR

You may request the erasure of your personal data where the statutory conditions are met.

Right to Restriction of Processing – Article 18 GDPR

Under certain conditions, you may request that the processing of your data be restricted.

Right to Data Portability – Article 20 GDPR

Where the statutory conditions are met, you may request that personal data concerning you be provided in a structured, commonly used, and machine-readable format or transmitted to another controller.

Right to Object – Article 21 GDPR

If we process personal data on the basis of Article 6(1)(f) GDPR, you may object to that processing on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary to establish, exercise, or defend legal claims.

Withdrawal of Consent – Article 7(3) GDPR

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

Right to Lodge a Complaint – Article 77 GDPR

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

To exercise your rights, you can contact us at datenschutz@asphalt-labor.de.

18. Competent Data Protection Supervisory Authority

You may lodge a complaint with the data protection supervisory authority responsible for us.

Independent State Centre for Data Protection Schleswig-Holstein (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein – ULD)

Address:
Holstenstraße 98
24103 Kiel
Germany

The competent authority depends on the actual registered office of the controller and the applicable rules on jurisdiction.

19. Requirement to Provide Personal Data

When you visit our website for purely informational purposes, you are generally not required to provide personal data, except for technically necessary data processed to deliver the website.

When using contact or application forms, certain information is required so that we can receive and process your enquiry or application. Mandatory fields are identified in the relevant form.

If the required information is not provided, the form may not be submitted or the enquiry may not be processed.

Voluntary information is identified accordingly or may be omitted without generally preventing you from using the rest of the website.

20. Automated Decision-Making and Profiling

Based on the information currently available, no automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place in connection with this website.

The use of hCaptcha to automatically detect potential bot activity does not, by itself, necessarily constitute automated decision-making with legal or similarly significant effects. The actual functionality and effects of the configuration used should be assessed separately where necessary.

21. Data Protection Officer

Our internal Data Protection Officer can be contacted using the following details:

Dipl.-Chemiker Hartmut Schröder
Dr.-Hermann-Lindrath-Str. 1-3
Email: hartmut.schroeder@asphalt-labor.de
Telephone: +49 4554 9920 14

If you have questions about data protection or the processing of your personal data, you can contact our Data Protection Officer directly.

22. Updates to This Privacy Policy

We reserve the right to amend this privacy policy if legal requirements, the technical design of our website, or the services we use change.

The version published on our website at any given time shall apply.