Preamble

With the following Privacy Policy, we would like to inform you about which types of your personal data (hereinafter also referred to as “data”) we process, for what purposes, and to what extent. This Privacy Policy applies to all processing of personal data carried out by us, both within the context of providing our services and in particular on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “Online Offering”).

The terms used are not gender-specific.

Status: 2 December 2025

Table of Contents

• Preamble
• Controller
• Overview of Processing
• Relevant Legal Bases
• Security Measures
• General Information on Data Storage and Deletion
• Rights of Data Subjects
• Provision of the Online Offering and Web Hosting
• Use of Cookies
• Analytics-Tool: Matomo
• Contact and Request Management

Controller

BIBM – Federation of the European Precast Concrete Industry
Rue d’Arlon 55 (6th floor)
B-1040 Brussels
Belgium

Email: info@bibm.eu

Overview of Processing

The following overview summarises the types of data processed, the purposes of processing, and the categories of data subjects.

Types of Data Processed

• Inventory data.
• Contact data.
• Content data.
• Usage data.
• Meta, communication and procedural data.
• Log data.

Categories of Data Subjects

• Communication partners.
• Users.

Purposes of Processing

• Communication.
• Security measures.
• Organisational and administrative procedures.
• Firewall.
• Feedback.
• Provision of our online offering and user-friendliness.
• Information technology infrastructure.

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the GDPR legal bases on which we process personal data. Please note that in addition to the GDPR, national data protection regulations may apply in your or our country of residence or establishment. Where more specific legal bases apply in individual cases, we will inform you of these in this Privacy Policy.

• Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR) – Processing is necessary for the performance of a contract to which the data subject is party, or for the implementation of pre-contractual measures taken at the data subject’s request.
• Legitimate interests (Art. 6(1)(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

Security Measures

In accordance with legal requirements and taking into account the state of the art, implementation costs, and the nature, scope, circumstances, and purposes of processing, as well as the varying likelihood and severity of risks to individuals’ rights and freedoms, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to data as well as access, entry, transfer, availability, and separation of data. We have also established procedures to ensure the exercise of data subject rights, the deletion of data, and responses to data threats. Furthermore, we take the protection of personal data into account when developing or selecting hardware, software, and processes in accordance with the principles of data protection by design and by default.

Securing online connections with TLS/SSL encryption technology (HTTPS): To protect user data transmitted via our online services from unauthorised access, we use TLS/SSL encryption. These technologies encrypt information transferred between a website or app and a user’s browser (or between two servers). When a website is secured by SSL/TLS, this is indicated by “HTTPS” in the URL.

General Information on Data Storage and Deletion

We delete personal data we process in accordance with legal requirements as soon as the underlying consents are withdrawn or no other legal basis for processing exists. This applies when the original purpose no longer exists or the data is no longer needed. Exceptions apply where legal obligations or special interests require longer retention.

Data that must be retained for commercial or tax reasons, or that is necessary for the protection of rights or for legal claims, will be archived accordingly.

Our data protection notices may include additional details on retention and deletion applicable to specific processing operations.

Where multiple retention periods apply, the longest period is decisive. Data retained solely due to legal requirements is processed only for the purpose that requires its retention.

Start of retention periods at the end of the year: If a retention period does not explicitly begin on a specific date and lasts at least one year, it automatically begins at the end of the calendar year in which the triggering event occurred.

Rights of Data Subjects

As a data subject, you have various rights under the GDPR, particularly those set out in Articles 15–21 GDPR:

• Right to object: You may object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f) GDPR, including profiling. If your data is processed for direct marketing, you may object at any time to such processing.
• Right to withdraw consent: You may withdraw consent at any time.
• Right of access: You have the right to request confirmation as to whether we process your data and to request access to this data and related information.
• Right to rectification: You may request the completion or correction of inaccurate data.
• Right to erasure or restriction: You may request deletion or restriction of processing, in accordance with legal requirements.
• Right to data portability: You may request receipt or transfer of your data in a structured, commonly used and machine-readable format.
• Right to lodge a complaint: You may lodge a complaint with a supervisory authority.

Provision of the Online Offering and Web Hosting

We process user data in order to provide our online services. For this purpose, we process the user’s IP address, which is necessary to transmit content and functions to the user’s browser or device.

• Types of data processed: Usage data; meta, communication and procedural data; log data; content data.
• Data subjects: Users.
• Purposes of processing: Provision of our online offering and user-friendliness; IT infrastructure; security measures; firewall.
• Retention and deletion: According to the section “General Information on Data Storage and Deletion”.
• Legal basis: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Additional notes on processing operations:

• Provision of online offering on leased servers: We use storage space, computing capacity, and software rented or obtained from a server provider.
  Legal basis: Legitimate interests (Art. 6(1)(1)(f) GDPR).
• Email sending and hosting: Web hosting also includes sending, receiving, and storing emails. Addresses of recipients and senders, transmission data, and email content may be processed.
  Legal basis: Legitimate interests (Art. 6(1)(1)(f) GDPR).
• netcup: Provider of IT infrastructure and related services.
  Provider: netcup GmbH, Daimlerstraße 25, D-76185 Karlsruhe, Germany.
  Legal basis: Legitimate interests (Art. 6(1)(1)(f) GDPR).
  Website: https://www.netcup.de/
  Privacy policy: https://www.netcup.de/kontakt/datenschutzerklaerung.php
  Data processing agreement: https://helpcenter.netcup.com/de/wiki/general/avv/
• Wordfence: Firewall and security functions.
  Provider: Defiant, Inc., 800 5th Ave Ste 4100, Seattle, WA 98104, USA.
  Legal basis: Legitimate interests (Art. 6(1)(1)(f) GDPR).
  Website: https://www.wordfence.com
  Privacy policy: https://www.wordfence.com/privacy-policy/
  Standard Contractual Clauses: https://www.wordfence.com/standard-contractual-clauses/

Use of Cookies

“Cookies” refers to functions that store and read information on users’ devices. They may serve purposes such as functionality, security, convenience, or visitor analytics. We use cookies in accordance with legal requirements and obtain consent where required. Where consent is not required, we rely on legitimate interests. Consent may be withdrawn at any time.

Legal basis information: If personal data is processed via cookies, consent is the legal basis unless legitimate interests apply as described.

Storage duration:

• Temporary (session) cookies: Deleted when the user leaves the online offering and closes the device.
• Permanent cookies: Stored beyond browser closure, e.g. to retain login status or user preferences. Unless otherwise stated, users should assume a storage duration of up to two years.

Withdrawal and objection (opt-out): Users may withdraw consent or object to processing at any time, including via browser settings.

• Types of data processed: Meta, communication and procedural data.
• Data subjects: Users.
• Legal basis: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Additional notes:

• Complianz: Stores and manages consents, logs user decisions, displays cookie notices, enables withdrawal or adjustments.
  Website: https://complianz.io/
  Privacy policy: https://complianz.io/legal/

Analytics-Tool: Matomo

Contact and Request Management

When contacting us (e.g., by mail, contact form, email, phone, or social media) and within ongoing user or business relationships, we process the information provided to respond to inquiries and related measures.

• Types of data processed: Inventory data; contact data; content data; usage data; meta, communication and procedural data.
• Data subjects: Communication partners.
• Purposes of processing: Communication; organisational and administrative procedures; feedback; provision of our online offering and user-friendliness.
• Retention and deletion: According to the section “General Information on Data Storage and Deletion”.
• Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR); performance of a contract and pre-contractual measures (Art. 6(1)(1)(b) GDPR).

Additional notes:

• Contact form: Data submitted via contact form or other channels is processed solely for responding to the inquiry.
  Legal bases: Contract performance and pre-contractual measures (Art. 6(1)(1)(b) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR).