Privacy Policy

This is a translation for convenience; the German version is authoritative.

1. Controller

The controller for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Corvex Bau UG (haftungsbeschränkt)
Managing director: Amir Alvandi
Kolonnenstr. 8
10827 Berlin
Germany

Phone: +49 177 7457492
Email: corvexbau@gmail.com
Website: https://corvexbau.de
Register court: Amtsgericht Berlin (Charlottenburg)
Commercial register number: [to be added before publication]
VAT identification number: [to be added before publication]

2. General information on data processing

Protecting your personal data matters to us. We process your personal data exclusively within the framework of the applicable data protection law, in particular the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data is any information relating to an identified or identifiable person. This includes, for example, name, address, email address, telephone number, IP address or details of a construction project.

We process personal data only where this is legally permitted and necessary for the respective purposes.

3. Visiting our website and server log files

When you visit our website, the web server automatically processes technical information. This may include your IP address, the date and time of access, the page or file requested, the referrer URL, the browser and operating system used, technical information about your device, the volume of data transferred and the HTTP status code.

This processing is necessary to provide our website technically, to ensure its stability and security and to detect possible attacks or abusive access. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure, stable and functional provision of our website.

Server log files are generally stored for 14 days and then deleted, unless longer storage is required to investigate a security incident, to defend legal claims or because of statutory obligations.

4. Hosting by Vercel

Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel provides the technical infrastructure for operating and delivering our website.

In the course of hosting, your IP address, the date and time of access and technical information about the device and browser used may be processed. The processing serves the secure, stable and efficient provision of the website. The legal basis is Art. 6 (1) (f) GDPR.

Processing of personal data in the USA or other third countries cannot be excluded. For transfers to third countries, the appropriate safeguards provided for by law are used. Where the European Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR are used for a specific transfer, these serve as the appropriate safeguard.

Where the conditions are met, a transfer may take place on the basis of an adequacy decision, in particular the EU-U.S. Data Privacy Framework. Whether and to what extent this applies to the specific processing by Vercel depends on the provider's current status.

Where legally required, a data processing agreement pursuant to Art. 28 GDPR is in place with Vercel. Further information on data processing by Vercel is available at vercel.com/legal/privacy-policy.

5. Contacting us by email, telephone or contact form

If you contact us by email, telephone or via a contact form, we process the personal data you provide — in particular your first and last name, email address, telephone number, address, details of your construction project and any other information contained in your enquiry.

The processing serves to handle your enquiry, to contact you and, where applicable, to prepare or perform a contract. The legal basis is Art. 6 (1) (b) GDPR where the enquiry is directed at concluding a contract or at pre-contractual measures. In other cases the processing is based on Art. 6 (1) (f) GDPR.

Enquiries that do not lead to a contract are generally deleted no later than six months after the correspondence ends, unless longer storage is required by law or to defend legal claims.

6. Enquiries about construction projects

If you send us information about a construction, conversion, renovation or refurbishment project, we may process that information to handle your enquiry and to prepare or perform a contract. This may include details of the site, building and project, construction drawings, technical documents, photographs, the services requested, budget and schedule expectations, and contact details.

The processing serves pre-contractual measures or the performance of a contract. The legal basis is Art. 6 (1) (b) GDPR. Where an enquiry does not lead to a contract, the six-month deletion period set out in section 5 generally applies, unless longer storage is legally required or necessary to defend legal claims.

7. Disclosure of personal data

We do not, as a rule, disclose personal data to third parties without a legal basis. Disclosure may be necessary to handle your enquiry, to perform a contract or to comply with statutory obligations.

Possible recipients include IT and hosting providers, email and communication service providers, tax advisors and auditors, legal advisors, banks and payment service providers, public authorities, insurers, architects and engineers, specialist planners, subcontractors and other project partners.

Any disclosure takes place only where a corresponding legal basis exists. Where we engage service providers as processors, we conclude agreements with them pursuant to Art. 28 GDPR where legally required.

8. Cookies

Our website may use cookies and comparable technologies. We distinguish between technically necessary and non-necessary cookies.

Technically necessary cookies are used where they are required to operate the website or to provide a function you have expressly requested. Non-necessary cookies — in particular for analytics, marketing or tracking purposes — are used only where consent is required and you have given it.

The legal basis for accessing information on your device is § 25 TDDDG, where applicable. The subsequent processing of personal data is governed by the GDPR.

9. Cookie consent management

We manage your consent with our own solution running on our own server — no external provider is involved. Your choice is stored in the technically necessary first-party cookie corvex_consent (storage period 6 months). The time and content of your consent decision are recorded in order to demonstrate and manage your consent. The legal basis is Art. 6 (1) (c) GDPR and § 25 (2) TDDDG.

All non-necessary services (statistics, external media) are loaded only after your express consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Your consent is voluntary and can be withdrawn at any time with effect for the future via the „Cookie settings“ link in the footer.

10. Reach measurement (Vercel Analytics)

If you have consented to the „Statistics“ category, we use Vercel Analytics for anonymous reach measurement. No cookies are set; aggregated, anonymised usage data is collected which does not allow any conclusions to be drawn about individual persons. The legal basis is your consent (Art. 6 (1) (a) GDPR).

11. Google Maps

On the contact page we embed map material from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map is loaded only after your consentto the „External media“ category. When it loads, data (including your IP address) is transmitted to Google; a transfer to the USA may take place. The legal basis is your consent (Art. 6 (1) (a) GDPR).

12. Fonts

We use locally hosted fonts only. The fonts are served from our own server; there is no connection to third-party servers (e.g. Google Fonts) and no personal data is transferred to third parties in this respect.

13. SSL/TLS encryption

For security reasons our website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser address beginning with „https://“ and by a padlock symbol. The encryption protects the transmission of personal data and other confidential content.

14. External links and social networks

Our website may contain links to external websites or social networks. When you click such a link you leave our website. The respective operator is responsible for data processing on the external site. We have no influence over data processing by external providers.

15. Job applications

If you apply to us for a position, we process the personal data you submit for the purpose of conducting the application procedure and deciding on the establishment of an employment relationship. This may include your name, contact details, CV, references, qualifications, career history and other information from your application documents.

The legal basis is § 26 BDSG, where the statutory conditions are met.

In the event of a rejection, application data is generally retained for six months after the rejection is sent, where this is necessary to assert, exercise or defend possible claims — in particular under the German General Equal Treatment Act (AGG). Where storage is based on Art. 6 (1) (f) GDPR, our legitimate interest lies in the defence of legal claims.

With your express consent, application documents may be stored for up to twelve months for future vacancies. Consent can be withdrawn at any time with effect for the future.

16. Storage periods

We store personal data only for as long as is necessary for the respective processing purpose or as long as statutory retention obligations exist. Unless different statutory obligations or legitimate grounds for longer storage apply, the following periods apply in particular:

• Enquiries not leading to a contract: six months after the correspondence ends.
• Contract documents, invoices and other business records relevant under tax or commercial law: generally up to ten years, where the applicable statutory retention obligations so provide.
• Application documents of rejected candidates: generally six months after rejection, unless longer storage is required because of a legal dispute or a consent given.
• Server log files: generally 14 days, subject to longer storage in individual cases to investigate security incidents, to defend legal claims or because of statutory obligations.
• Records of consent given: generally up to three years after withdrawal or the end of the business relationship, where necessary to meet statutory evidence or limitation requirements.

After the respective period expires, the data is deleted unless a further statutory obligation or a legitimate interest in continued storage exists.

17. Your rights

Under the GDPR you have in particular the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21).

Special note on the right to object: where we process personal data on the basis of our legitimate interest under Art. 6 (1) (f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

You can send your objection informally to the contact address given above.

18. Withdrawal of consent

Where processing is based on your consent, you can withdraw that consent at any time with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected. You can send your withdrawal by email to corvexbau@gmail.com.

19. Right to lodge a complaint with a supervisory authority

Under Art. 77 GDPR you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.

As our company is based in Berlin, the competent authority is in particular the Berlin Commissioner for Data Protection and Freedom of Information, Friedrichstr. 219, 10969 Berlin, Germany.

20. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.

21. Data security

We take appropriate technical and organisational measures to protect your personal data against loss, destruction, manipulation, unauthorised access and other unauthorised processing. Our security measures are continuously adapted in line with technical developments and organisational possibilities.

22. Obligation to provide personal data

You are generally not obliged to provide us with personal data. For certain services and business relationships, however, providing certain data may be necessary. If you do not provide the required data, we may not be able to process an enquiry or to conclude or perform a contract.

23. Changes to this privacy policy

We reserve the right to adapt this privacy policy if legal, technical or organisational changes arise. The version published on our website at the time of your visit applies.

Last updated: August 2026