Privacy policy

This English version is provided for convenience only. In the event of any discrepancy, the German version shall prevail.

1. Controller

The controller within the meaning of Art. 4(7) of the EU General Data Protection Regulation (GDPR) for the processing of personal data is:

Ingenieur-Gesellschaft Romero-Früh mbH (IGRF mbH)
Mühlenfeldstraße 39a
D-28355 Bremen
Phone: +49 (0)421 427 35-0
Email: info@igrf.de

We have not appointed a data protection officer, as there is no legal obligation to do so. If you have any questions regarding data protection, please contact the controller named above.

2. General information on data processing

The protection of your personal data is important to us. Personal data means any information relating to an identified or identifiable natural person (e.g. name, address, email address, IP address). We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) and the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG).

3. Legal bases for processing

Insofar as we obtain consent for processing operations, Art. 6(1)(a) GDPR serves as the legal basis. For processing for the performance of a contract or in order to take steps prior to entering into a contract, Art. 6(1)(b) GDPR serves as the legal basis. For compliance with legal obligations, Art. 6(1)(c) GDPR serves as the legal basis. If processing is necessary to safeguard our legitimate interests and your interests do not override them, Art. 6(1)(f) GDPR is the legal basis. In addition, Section 25 TDDDG applies to the storing of information on, or the reading of information from, your terminal equipment.

4. Your rights as a data subject

You have the following rights vis-à-vis us with regard to your personal data:

• Access (Art. 15 GDPR) – whether and which data we process about you
• Rectification (Art. 16 GDPR) – to have inaccurate data corrected
• Erasure (Art. 17 GDPR) – insofar as no statutory retention obligations preclude this
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR) – see the separate notice below
• Withdrawal of consent (Art. 7(3) GDPR) – at any time with effect for the future
• Complaint to a supervisory authority (Art. 77 GDPR)

To exercise these rights, an informal message to the controller named in section 1 is sufficient.

Right to object (Art. 21 GDPR)

If we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. If we process data for direct marketing purposes, you have the right to object at any time without stating reasons.

Competent supervisory authority

Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen
(State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen)
Georgstraße 122–124
27570 Bremerhaven
Phone: +49 (0)421 361 2010
Email: office@datenschutz.bremen.de

5. Provision of the website and server log files

Each time our website is accessed, our system automatically collects data and information from the accessing device (server log files):

• name and URL of the file retrieved
• date and time of retrieval
• amount of data transferred and notification of successful retrieval
• browser type and version, and operating system
• referrer URL (previously visited page)
• IP address and requesting provider

This data is processed in order to deliver the website, to ensure system security and for error analysis. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. For security reasons, the server log files are stored only for a limited period and are then deleted automatically. The specific storage and deletion is carried out by our hosting provider IONOS.

6. Hosting

We host our website with IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. On our behalf, IONOS processes master, contact, content, usage, meta and communication data of website visitors for the purpose of the secure and efficient operation of the website. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS.

7. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” in your browser’s address bar.

8. No cookies, no tracking

This website does not set any cookies and does not use any analytics, tracking or marketing services that require consent. No third-party content (e.g. map or video services) is embedded automatically. For this reason, no cookie banner is required.

9. Contacting us

If you contact us via the contact form, by email or by telephone, we process the information you provide (e.g. name, company, email address, telephone number, content of the message) in order to handle your enquiry and any follow-up questions. The contact form is transmitted in encrypted form; the data is forwarded to us by email and is not stored on the web server. The legal basis is Art. 6(1)(b) GDPR where the enquiry serves the initiation or performance of a contract; otherwise, it is our legitimate interest in responding to your enquiry (Art. 6(1)(f) GDPR) or your consent (Art. 6(1)(a) GDPR). The data is deleted as soon as it is no longer required to achieve the purpose and no statutory retention obligations apply.

Spam protection for the contact form: To protect against automated mass submissions, we automatically check form entries (including an invisible check field, the time taken to complete the form and typical spam characteristics) and limit the number of submissions per sender. For this purpose, your IP address is not stored in plain text; instead, it is only stored as a non-reversible hash value that changes daily, together with the time of submission, for a maximum of one day in a temporary file on the web server. No cookies are set and no external services (e.g. captchas) are embedded. The legal basis is our legitimate interest in a functioning contact form that is free from misuse (Art. 6(1)(f) GDPR).

10. Applications

If you apply to us – including on an unsolicited basis, e.g. by email to bewerbung@igrf.de – we process your applicant data (cover letter, CV, certificates and references, contact details) exclusively for the purpose of the application process. The legal basis is Art. 6(1)(b) GDPR (taking pre-contractual steps with a view to establishing an employment relationship). Insofar as you voluntarily provide us with special categories of personal data (e.g. information on a severe disability), we process such data on the basis of Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG. If no employment relationship is established, we delete your documents no later than six months after the conclusion of the process; this also serves the defence against possible claims (e.g. under the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz – AGG), Art. 6(1)(f) GDPR). Longer storage – for instance for suitable positions in the future – only takes place with your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

11. Google Search Console

We use Google Search Console (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). This tool enables us to analyse and improve the presentation and findability of our website in Google Search (e.g. search queries, clicks, indexing). Predominantly aggregated data is processed in this context; the tool does not set any tracking cookies for visitors to our website. Our ownership is confirmed by means of a verification code. The legal basis is our legitimate interest in analysing and optimising our website (Art. 6(1)(f) GDPR). In this context, data may be transferred to Google in the USA (see section 13).

12. Locally hosted fonts

Our website loads fonts exclusively locally from our own server; no connection to servers of Google (Google Fonts) or other third-party providers is established in this process. No personal data is transferred to third parties for this purpose.

13. Data transfers to third countries

Insofar as data is transferred to recipients in countries outside the European Economic Area (in particular to the USA), this only takes place if an adequate level of data protection is ensured – for example on the basis of an adequacy decision (EU-U.S. Data Privacy Framework), appropriate safeguards such as standard contractual clauses, or your explicit consent.

14. External links

Our website contains links to external websites (e.g. codeshuttle.de, Google Maps for route planning or profiles on social networks). These are only accessed when you actively click on them; no data is transmitted automatically to the providers without your interaction. The data protection provisions of the respective provider apply to processing on the linked pages.

15. Storage period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods (in particular under tax and commercial law). Once the purpose no longer applies or these periods have expired, the data is deleted.

16. Data security

We take appropriate technical and organisational measures to protect your data against loss, destruction, manipulation and unauthorised access. Our measures are continuously adapted in line with technological developments.

17. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

18. Obligation to provide data

Within the scope of our business relationship, you must provide the data that is required for establishing and conducting the business relationship or that is required by law. Without this data, we will generally be unable to conclude or perform a contract. When merely visiting the website, you are not obliged to actively provide any data.

19. Currency of and changes to this privacy policy

This privacy policy is current as of October 2026. Due to the further development of our website or as a result of changes in legal or regulatory requirements, it may become necessary to amend it. The current version is available on this page at any time.