Privacy policy

1. Controller

The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) for the processing of personal data on this website is:

Prime Construction Management d.o.o.
Aleja Bosne Srebrene 65
71000 Sarajevo (Novi Grad)
Bosnia and Herzegovina

Represented by

the managing director, Džemil Čalaković

Phone

+49 176 21240171 (Germany)
+387 60 3545008 (Bosnia and Herzegovina)

Email

info@prime-construction-management.com

Representative in the Union (Art. 27 GDPR)

[[PLATZHALTER: name and address of the EU representative, if required under Art. 3(2) and Art. 27 GDPR – the exemption in Art. 27(2)(a) is unlikely to apply where enquiries from the EU are handled regularly; otherwise delete this line]]

2. Overview

In brief:

• This website sets no cookies and stores no data in local storage, session storage or similar browser storage. Your browser merely keeps the files it has retrieved from this website in its cache, as it does for any website.
• There is no tracking. We use no analytics and no advertising services.
• No third-party content is embedded, such as external fonts, maps, videos or social media plugins. Fonts and scripts are loaded exclusively from our own web space.

Personal data are processed only when you visit the website (server log files, section 3) and when you contact us (section 4).

3. Hosting and server log files

This website is hosted by united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany; server location: Germany.

Each time you visit, your browser transmits data to the web server for technical reasons; the server stores them in log files (server log files):

• IP address of the requesting device
• date and time of access
• page or file requested and amount of data transferred
• HTTP status code (e.g. success or error)
• referrer URL (the page previously visited), if your browser transmits it
• browser type and version and operating system (user agent)

This processing serves to deliver the website, to keep it stable and secure, and to detect and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. We do not combine these data with other data sources and do not use them to create usage profiles.

Storage period: [[PLATZHALTER: check scope and retention period of the server log files with the hosting provider; IP address truncation, if any; disable the provider’s server-side visitor statistics (e.g. AWStats, Webalizer)]].

The hosting provider processes these data as a processor on our behalf (Art. 28 GDPR). [[PLATZHALTER: confirm that a data processing agreement with the hosting provider has been concluded]]

4. Contact form, email and telephone

You can reach us via the contact form, by email or by telephone. In doing so, we process the information you provide to us.

Contact form. Mandatory fields are name, email address and message. Optionally, you can state your company, a telephone number and the service you are interested in. The language of the page from which you send the request is also transmitted. By ticking the checkbox you confirm that you have read this privacy policy; this does not constitute consent. The processing is based on the legal bases set out below under “Purpose and legal basis”.

A script on our own web space sends your information by email to our mailbox info@prime-construction-management.com. The script does not store the form data on the web server; they are processed only for sending. Until delivery, the message may be held briefly in the hosting provider’s mail system. The mailbox is operated by [[PLATZHALTER: email mailbox provider and location of its mail servers; confirm a data processing agreement under Art. 28 GDPR]].

Protection against spam and abuse. The form contains a field that is invisible to people and is filled in only by automated programs, and it requires a minimum completion time of a few seconds. To prevent mass submissions, the script stores a hash value of your IP address – a pseudonymised form from which the IP address cannot be read directly – together with the time of the request. Entries older than one hour are no longer taken into account and are deleted automatically, at the latest when the next enquiry is sent via the form.

Email and telephone. If you contact us by email or telephone, we process your contact details and the content of your enquiry for the same purposes.

Purpose and legal basis. We process your information in order to answer your enquiry and, where applicable, to prepare a quotation. If you are enquiring on your own behalf, for example as a sole trader, and your enquiry is aimed at concluding or performing a contract with us, the legal basis is Art. 6(1)(b) GDPR. If you are enquiring on behalf of a company, or for other purposes, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in answering enquiries addressed to us and in initiating business relationships with the company you work for. Spam and abuse protection is based on Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the form against automated and mass submissions.

Providing your data is neither a statutory nor a contractual requirement. Without the mandatory information, however, we cannot process your enquiry via the form.

Recipients. As processors, the hosting provider (section 3) and the provider of our email mailbox have access to the data to the extent technically necessary for operation.

Deletion. We delete your enquiry once it has been fully dealt with, unless statutory retention obligations prevent this. Where such an obligation exists, we restrict processing to storage until it expires.

5. Controller established outside the EU

Our company is established in Bosnia and Herzegovina. Bosnia and Herzegovina is a member of neither the European Union nor the European Economic Area, and there is no adequacy decision of the European Commission for the country under Art. 45 GDPR. Its level of data protection is therefore not recognised as equivalent to that of the EU.

Information you send us via the contact form, by email or by telephone reaches us in Bosnia and Herzegovina and is processed there.

[[PLATZHALTER: legal review of whether forwarding from the hosting or email provider to us in Bosnia and Herzegovina is a transfer under Art. 44 et seq. GDPR (cf. EDPB Guidelines 05/2021; direct input by the data subject is not); if so, name the safeguard under Art. 46 GDPR or the derogation under Art. 49 GDPR here (Art. 13(1)(f) GDPR)]]

[[PLATZHALTER: clarify whether enquiries are also processed at the branch in Serbia (likewise a third country); if so, add this here]]

6. Storage period

We store personal data only for as long as is necessary for the respective purpose or required by statutory retention obligations:

• server log files: [[PLATZHALTER: retention period according to the hosting provider]]
• hash value of the IP address (abuse protection of the contact form): one hour; older entries are deleted automatically, at the latest when the next enquiry is sent via the form
• enquiries via the form, by email or by telephone: until they have been fully dealt with; beyond that only where statutory retention obligations apply

7. Your rights

With regard to the personal data concerning you, you have the following rights against us:

• access (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• information about the recipients to whom a rectification, erasure or restriction has been communicated (Art. 19 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR, see below)

Right to object under Art. 21 GDPR: where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

To exercise your rights, an informal message to info@prime-construction-management.com or to the address given in section 1 is sufficient.

8. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR (Art. 77 GDPR). You may contact any supervisory authority in the EU or EEA, in particular the authority in the member state of your habitual residence, your place of work or the place of the alleged infringement.

9. SSL/TLS encryption

This website is delivered over an encrypted connection (HTTPS with TLS). Data you send via the contact form are therefore transmitted to our web server in encrypted form. [[PLATZHALTER: confirm transport encryption between the web server and the mail server at the hosting provider]]

For emails you send us directly, encryption in transit depends on the mail servers involved.

10. Changes to this privacy policy

We will adapt this privacy policy if the website, the processing of personal data or the legal situation changes. The version published on this page at any given time applies.

This English version is a translation; in case of doubt, the German version is authoritative.