Privacy Policy

2. General

Protecting your personal data is important to us.

With this privacy policy we inform you which personal data we process in connection with our website www.gf-bau.ch, our services, our communication channels and our online marketing activities, and for which purposes.

We process personal data in particular in accordance with the Swiss Federal Act on Data Protection (FADP) and the associated Data Protection Ordinance (DPO). Where the EU General Data Protection Regulation (GDPR) is applicable in an individual case, we additionally take its requirements into account.

3. Definitions

“Personal data” means any information relating to an identified or identifiable natural person.

“Processing” means any handling of personal data, in particular its collection, recording, storage, use, modification, disclosure, transmission, archiving or deletion.

4. What personal data we process

Depending on how you use our website or our services, we may process in particular the following categories of personal data:

• Contact details such as first name, last name, company, address, phone number and email address
• Project and order data such as project address, project type, requested services, technical details and messages
• Documents and files you send us, for example plans, tender documents, PDFs, DWG files, ZIP files, photos or other project documents
• Communication data from emails, phone calls, form enquiries or other correspondence
• Contract, quotation and billing data
• Technical data such as IP address, browser type, operating system, device information, date and time of access, pages accessed, referrer URL, and server and log data
• Usage and analytics data regarding the use of our website
• Marketing and tracking data, in particular in connection with Google, Meta/Facebook, Instagram and TikTok
• Where applicable, application data if you apply for a position with us

5. Purposes of processing

We process personal data in particular for the following purposes:

• Providing and securely operating our website
• Handling contact, project and quotation enquiries
• Preparing, concluding and carrying out contractual relationships
• Project planning and project execution
• Communication with customers, prospects, suppliers and business partners
• Managing customer and business relationships
• Preparing and processing offers and tenders
• Processing job applications
• Improving our website and our services
• Measuring reach and analysing website usage
• Conducting, optimising and measuring the success of online advertising
• Creating target audiences for advertising campaigns and – where permitted and consented to – for personalised advertising or remarketing
• Ensuring IT and information security
• Preventing and investigating misuse
• Complying with legal and regulatory obligations
• Asserting or defending legal claims

6. Legal bases

Under Swiss data protection law, we process personal data within the framework of the statutory processing principles.

Where consent is required for a particular processing activity, that processing is based on your consent.

Where the GDPR exceptionally applies, processing is based in particular on the performance of a contract or the taking of pre-contractual measures, compliance with legal obligations, legitimate interests, or your consent.

Consent can generally be withdrawn at any time with effect for the future.

7. Contact and project enquiries

If you contact us via the contact form, by email, by phone or in another way, we process the personal data you provide in order to handle your enquiry.

This may include in particular your name, company, phone number, email address, project location, requested service, message content, and any plans, tender documents or other files you submit.

The data may subsequently also be used to prepare a quotation, plan the project, or conclude and carry out a contract.

Please only submit information via forms and file uploads that is necessary for the respective enquiry.

8. Server log files and hosting

When you access our website, our hosting provider may automatically collect technical information. This may include in particular the IP address, date and time of access, the page or file accessed, browser and browser version, operating system, referrer URL, status codes and the amount of data transferred.

This information is needed in particular to technically provide the website, ensure stability and security, and detect errors and abusive access.

Personal data may be processed by our hosting or IT service provider on our behalf in this context.

9. Cookies and similar technologies

Our website may use cookies and comparable technologies such as pixels, tags, local storage or similar identifiers.

We distinguish in particular between technically necessary technologies, functional technologies, analytics and statistics technologies, and marketing and advertising technologies.

Where consent is required, the relevant technologies are only activated after you have given your consent. You can change or withdraw your choices at any time via the cookie or privacy settings provided on our website.

10. Consent management

We may use a consent management solution on our website to inform website visitors about the use of cookies and tracking technologies and to let them set their preferences.

This may store in particular the time of consent, the categories granted or refused, technical information about the device or browser, and, where applicable, a consent ID.

Storing this information serves in particular to document and manage the data protection decisions made.

11. Google services

We may use services provided by the Google group, in particular for advertising, conversion measurement, reach analysis and remarketing. Depending on the specific implementation, these may include in particular Google Ads, Google Tag Manager and, where applicable, Google Analytics.

When using such services, technical information and data about the use of our website may be transmitted to Google. This may include in particular the IP address, browser and device information, pages accessed, time and duration of visits, interactions with our website, information about ads, conversion events, and cookie or similar identifiers.

Google Ads and conversion tracking: We use Google Ads to promote our services. We may use conversion tracking to determine whether a user takes certain actions on our website after contact with one of our ads, for example submitting an enquiry or visiting a particular page.

Google Remarketing: Where activated and permitted, we may use Google services to later show visitors of our website interest-based advertising. Such use only takes place in compliance with the applicable data protection and consent requirements.

Google Consent Mode: We may use Google Consent Mode. The settings a visitor has made via our consent system are transmitted to Google tags, which adjust their behaviour accordingly.

12. Meta / Facebook / Instagram

We may use technologies and advertising services of the Meta group of companies, in particular in connection with Facebook and Instagram. This may include in particular the Meta Pixel or a comparable conversion or event measurement tool.

This allows us to track in particular whether a website visitor arrived at our website via a Meta advertisement and subsequently took certain actions.

Depending on implementation, this may process for example the IP address, browser and device information, pages accessed, time of visit, interactions and events on our website, advertising and cookie identifiers, and conversion information.

We may use the resulting information in particular to measure the success of our campaigns, optimise our advertising and – where permitted and consented to – for remarketing or building target audiences.

Meta may also process personal data for its own purposes in accordance with its own privacy policy.

13. TikTok

We may use TikTok's advertising and tracking technologies. This may include in particular the TikTok Pixel or a comparable event or conversion measurement tool.

This may measure in particular whether users visit our website after contact with a TikTok advertisement and take certain actions.

Depending on implementation, this may process in particular the IP address, browser and device information, pages accessed, usage and interaction data, advertising identifiers, cookie or device identifiers, and conversion and event data.

The data may be used in particular to measure and optimise advertising campaigns and – where permitted and consented to – to build target audiences and personalised advertising.

TikTok may also process data for its own purposes in accordance with its own privacy policy.

14. Social media

We may maintain a presence on social networks and platforms such as Facebook, Instagram, LinkedIn and TikTok.

If you visit our profiles or communicate with us there, personal data is also processed by the respective platform operators. We have only limited influence on the scope, nature and purpose of this data processing by the platform operators. The platform operators' own privacy policies additionally apply to their data processing.

15. Maps and external content

Our website may embed maps, videos, fonts, media or other content from external providers.

Such embedding may technically transmit in particular your IP address to the respective provider. Where such embeds are not strictly necessary for operation and consent is required, they are only loaded after you have given your consent.

16. Recipients of personal data

We may disclose personal data, to the extent necessary, in particular to the following categories of recipients:

Where external service providers process personal data on our behalf, we take appropriate contractual and organisational measures to protect this data.

• IT and hosting service providers
• Web agencies and technical service providers
• Cloud and software providers
• Advertising, analytics and marketing service providers
• Google
• Companies of the Meta group
• TikTok or affiliated companies
• Business partners and subcontractors, where necessary for a project
• Consultants, fiduciaries, lawyers or insurers
• Authorities and courts, where a legal obligation exists

17. Processing abroad

In connection with the use of international IT, cloud, analytics or advertising service providers, personal data may also be processed outside Switzerland.

This may in particular concern countries within the European Union or the European Economic Area, as well as other countries.

Where personal data is transferred to countries that, from a Swiss perspective, do not guarantee an adequate level of data protection, we take appropriate safeguards where necessary. These may include in particular recognised standard data protection clauses or other guarantees provided by law.

In cases provided for by law, a transfer may also be based on explicit consent or another legal exception.

18. Retention period

We only store personal data for as long as necessary for the respective processing purposes or as required by statutory or contractual retention obligations.

Business correspondence, contract documents, quotations, invoicing documents and comparable documents may in particular be stored for several years within the scope of statutory retention obligations.

Data that is no longer needed is deleted or anonymised, unless there is a retention obligation or an overriding legitimate interest in further storage.

19. Data security

We take appropriate technical and organisational security measures to protect personal data against loss, misuse, unauthorised access, unauthorised modification or disclosure.

These may include in particular encrypted data transmission via TLS/HTTPS, access restrictions, permission concepts, password and access protection, regular updates to systems, backups, logging and security measures, and organisational rules for handling personal data.

However, absolute security in electronic data transmission or storage cannot be guaranteed.

20. Rights of data subjects

Under applicable data protection law, data subjects may in particular have the right to:

The exercise of such rights may be subject to statutory restrictions. To exercise your rights, you can contact us at info@gf-bau.ch. We may require appropriate proof of identity for such requests.

• Obtain information about the data processed about them
• Have inaccurate personal data corrected
• Request the deletion or destruction of certain data
• Request the disclosure or transfer of certain personal data
• Object to a particular processing activity
• Withdraw consent given, for the future

21. Automated individual decisions and profiling

In principle, we do not make decisions based solely on automated processing that have significant legal or similarly significant effects on data subjects.

In connection with online advertising, however, profiles or target audiences may be created based on usage, interest and interaction data. Such processes may in particular be carried out by Google, Meta or TikTok.

Where consent is required for this under applicable law, the corresponding processing only takes place after you have given your consent.

22. Data protection for job applications

If you apply for a position with us, we process the data you submit exclusively for handling your application and carrying out the recruitment process.

This may include in particular contact details, CV, references, qualifications, correspondence and other information you submit.

If no employment relationship is entered into, application documents are deleted after a reasonable period, unless a legal obligation or explicit consent requires longer retention.

23. Changes to this privacy policy

We may amend this privacy policy at any time, in particular in the event of changes to our data processing, the technologies used, or legal requirements.

The version published on our website at the relevant time applies.