Privacy Policy
Version 2.0 (English Version) / Valid from: 2023-09-01
1. Introduction
We at Bauwerk Group (“Bauwerk Group”, “we” or “us”) are committed to protecting and respecting your privacy. This Privacy Policy describes your rights and how we collect and use personal data about our potential, current and former customers, suppliers, business partners, as well as job applicants and visitors of websites, and social networks.
Bauwerk Group owns these well- known brands in the wood flooring industry: Bauwerk, Boen and Somerset. This Privacy Policy applies to our brands globally with respect to the specifics of the activities of relevant companies (local regulation, specific of business operations, etc.).
When processing your personal data, we comply with applicable regulations of the countries in which we operate, the General Data Protection regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP) which applies in Swiss jurisdiction (where our parent company is based). When your personal data is processed by our US companies, the regulation of US also applies to the relevant data processing operations.
This Privacy Policy is primarily intended for our websites and other digital platforms that we use to conduct our business operations and process the relevant categories of personal data. Therefore, the Privacy Policy doesn’t provide the definitive list of data processing operations that we carry out in our activities, since part of data processing operations are exclusively related to our internal environment (for example data processing operations related to our employment relationship; to communication within the Group and to others), where specific data processing rules set out in our internal regulation apply.
It should be emphasized that companies of Bauwerk Group may provide you with additional privacy notices related to the performance of specific operations, in which the content of personal data processing operations may differ from those described in this Privacy Policy. For example, we intend to invite you to participate in our new product launch survey, which cannot be completed without processing your personal data (name, surname, age, etc.). Consequently, for this purpose we’ll provide you with a separate data processing notice (depending on the situation, it could be a consent form, an information notice on data processing regarding this operation, etc.) by explaining the purpose, legal background for data processing, retention period, and other required information.
2. Who is the controller and whom to contact in case of questions?
Bauwerk Group Schweiz AG, Neudorfstrasse 49, 9430 St. Margrethen (Switzerland), is the main data controller that usually determines the purposes and means of processing personal data.
Other companies of Bauwerk Group may also receive and process your personal data, either in the capacity of a controller or processor (depending on the specific of the situation). These are usually cases in which respective data processing operations are exclusively related to the relevant company of Bauwerk Group, i.e., when the respective company independently determines purposes and means for data processing in regard of an operation characteristic to this company. For example, large-scale of video surveillance applies only to our company in Lithuania (UAB Bauwerk Group Lietuva), respectively this company is data controller that determines purposes and means for data processing in respect of this operation. Another example, the relevant company performs its own internal administration procedure (e.g. payroll system) and determines by itself the purposes and means for data processing in relation to this operation.
Please do not hesitate to reach out to us if you have any questions or comments regarding your personal data or this privacy policy.
You can reach us by sending an email to dataprotection@bauwerk-group.com
3. What personal data do we process, how and how long and what are our legal grounds for processing personal data?
We process your personal data for the following purposes and based on the following legal basis.
| Purpose | Personal data processed | Legal bases | Term of processing |
|---|---|---|---|
| Our potential, current and former customers, suppliers, and business partners | |||
| To communicate with you | Name, surname, position, represented legal person, address, email address, phone number, information contained within your communications with us, such as the contents of emails, messages provided via website’s contact form. | Performance of our contract with you or your employer or for our legitimate interest in effective communication. | Up to 10 years from the last contact (further storage can take place in individual cases if this is legally stipulated). |
| To market our products and services | Name, surname, address, email address, phone number will be used to send newsletters, emails with information about our products, services or events. | This processing is based on our legitimate interest in being able to market our products and services to our existing customers or the processing is based on your consent, as you have shown an interest in our products and services. | If you are an existing customer, we will process your personal data until you let us know that you no longer want to get direct mar-keting from us and/or will unsubscribe from this. For those who have issued us a consent for direct marketing – we will process personal data for 3 years (further storage can take place in individual cases if this is legally stipulated) unless you withdraw your consent. At the end of the 3-year period, we’ll remind you about the expiration of your consent. If you no longer want direct marketing from us, please feel free to follow the unsubscribe instructions contained in the email received from us or contact us directly. |
| To identify you, conclude and perform the contract | If you are a sole trader natural person, we will process your name, surname, position, custom-er/supplier ID, address, email address, phone number, personal identification number or date of birth, bank and bank account details (including credit card details when requires), signature. If you are not a sole trader and represent your em-ployer but contact us in the role of representative of a company, we process your name, surname, email address, phone number, company name, position, workplace and sometimes information regarding your right to represent your company, custom-er/supplier ID signature. | To conclude and perform contract with you or your employer. | 10 years (further storage can take place in individual cases if this is legally stipulated). |
| To fulfil our legal obligations, e.g., related to bookkeeping | If you are a sole trader, natural person, we will process your name, surname, position, customer ID, address, email address, phone number, personal identification number, bank and bank account details, signature. If you are not a sole trader and represent your employer but contact us in the role of representative of a company, we process your name, surname, email address, phone number, company name, position, workplace, address and sometimes information regarding your right to represent your company, customer/supplier ID, signature. | Legal obligations for bookkeeping, archiving of documents. | Up to 10 years (further storage can take place in individual cases if this is legally stipulated). |
| To protect our legal rights and interests | Examples of personal data processed for this purpose is your communication with us, invoices, and agreements (personal data are used in aforementioned sources, i.e. name, surname, email address, phone number, company name, position, workplace, address and other data provided by you). | Legitimate interest to protect and enforce our legal rights and interests, e.g. in connection with legal claims, compliance, regulatory and audit functions. | 10 years (further storage can take place in individual cases if this is legally stipulated). |
| In connection with a merger or acquisition | In connection with, due to strategical or business-oriented reasons, a potential merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company, the personal data we retain about you (name, surname, email address, phone number, company name, position, workplace, address) may be processed, shared, or transferred, to parties involved in the process. | Legitimate interest in being able to develop our business. | Up to 10 years (Further storage can take place in individual cases if this is legally stipulated). |
| In connection with app “My room” | Images of your room you upload to our app from which we may have a theoretical possibility to identify you. | Consent | 30 days After 30 days of non-usage, the images are typically deleted. It is possible that we store individual images for a limited amount of time to train and improve our recognition algorithm. Thus, if you do not agree to this, please delete your uploaded pictures in our application immediately after usage or contact us for assistance. |
| In connection with app “Roomvo” | Their online activity, including the functions, features, and resources that are used, the dates and times of usage, details about how Consumer's access Roomvo such as IP address, operating system, and browser version. Products that you share or identify as favorites, images and names of rooms, email addresses with whom you share your rooms. | Consent | Up to 45 days Any other personal information is kept in anonymized form for statistical purposes and will no longer refer to you. |
| Job applicants | |||
| To recruit our employees | Position for which you are applying, name, telephone number, e-mail address, city where you would like to work, salary expectation, date of interview, other information you will provide with your CV, motivation letter and other information that we may collect from your former workplaces, professional portals. | Legitimate interest and/or your consent. | Based on legitimate interest we process personal data for 4 months or until the end of the relevant recruitment process, depending on what takes longer. Based on your consent, we may process personal data for 5 years. The terms of processing may vary (you’ll be informed about the specific details by additional notice) from those mentioned above depending on which of our companies you apply for the job. |
| To ensure communication via social networks (e.g LinkedIn, Facebook, Twitter, Instagram, etc.) | Name, surname, nickname (if used), photo (if used), phone number, date, time, and content of the communication. | Legitimate interest and/or your consent. | For this purpose, we process your personal data until the moment of withdrawal of your consent (i.e. deletion of the provided data from the account), but no longer until Bauwerk account deletion. We noted that personal data is processed only on the platform of social network therefore the exact processing terms and conditions are determined by the controller of the relevant platform. |
We would like to point out that this is not the exhaustive list of data processing operations that we car-ry out in the course of our business, and you will be informed about the specific operation related to your personal data processing as required by the applicable regulation. Furthermore, as it has been al-ready mentioned, the relevant data processing operations carried out in the companies of Bauwerk Group may differ (depending on the specifics of the company’s activities) in purpose, content, nature, retention period, etc., therefore if you fall within the scope of these operations, you will be notified by additional notice (if required according to the regulation).
4. From where do we receive data?
Most of the personal data we process about you is received from you directly. You may directly or indirectly give us information about yourself in different ways, for example when you visit our showrooms or fill in forms on our websites. You can always choose not to provide us with certain information. However, some personal data is necessary for us to provide you with our products and/or services. Not providing such personal data may prevent us from providing the products and/or performing the services you expect from us.
We may also obtain personal data about you from your employer, the website of your employer or other external public sources.
5. To whom do we disclose data, and do we transfer data outside the EU or EEA?
Your personal information is shared with:
| Our employees and business partners | Your personal data will be shared with some of our employees (including employees across Bauwerk Group where necessary) and business partners. However, we will restrict access to those employees and business partners who need it to perform their jobs. Our employees and business partners are subject to strict confidentiality. |
| Our service providers | We transfer to or share your personal data with our suppliers who help us to provide our products and/or service to you, which require them to process personal data (e.g., IT service providers, cloud service providers, couriers, insurance, credit agencies etc.). |
| Public authorities | Sometimes legal obligations may require us to share information about you, e.g., to respond to lawful requests from law enforcement agencies, regulatory agencies, and other public and government authorities. We may also disclose information if needed in connection with a legal process, e.g., to enforce our agreements or to protect our rights, you or others. |
| Parties involved in mergers and acquisitions | We may share or transfer your personal data in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business, to thecounter party and advisors involved in the process. |
Bauwerk group companies have offices, facilities, and a distribution network all over the world. Transfers to each of these countries will be protected by appropriate safeguards, namely the use of standard data protection clauses adopted or approved by the European Commission and the use of binding corporate rules.
The hosting facilities for our websites are situated in Switzerland, Germany, and Norway. The European Commission has made an "adequacy decision" with respect to the data protection laws of this country.
Here is a list of some of our service providers:
| Purpose | Vendor Name | Despcription | Privacy Policy |
|---|---|---|---|
| Web Hosting | Flownative GmbH | Flownative is our hosting provider. We host our website on Flownative Beach. The Google Cloud Platform (cloud hosting) is the technical basis for Flownative Beach. Flownative has concluded a contract with Google for commissioned data processing. | |
| Content Management System (CMS) | Neos Foundation e.V. | We use the open source content application platform "Neos" as our content management system. In principle, anyone can participate in the further development (open source). Within the project, the Neos team is responsible for further development. The Github service is used for development. We do not transmit any data to Github or the Neos team. | https://www.neos.io/footer-content/privacy-statement.html https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement |
| Web agency | sitegeist NEOS solutions GmbH | "sitegeist" is our web agency and is responsible for the maintenance, support and technical development of our brand website. | https://sitegeist.de/datenschutz.html |
| Google Analytics | Google LLC (Worldwide) Google Dublin (EU) | We have integrated Google Universal Analytics (UA) and Google Analytics 4 (GA4) on our website. | https://policies.google.com/privacy?hl=de |
| Google Ads | Google LLC (Worldwide) Google Dublin (EU) | We place ads in the Google search network. For this purpose, we use the "Google Ads" service and have linked it to our Google Analytics instances (conversion tracking). | https://policies.google.com/privacy?hl=de |
| Google Tag Manager | Google LLC (Worldwide) Google Dublin (EU) | We use Google Tag Manager to embed various code snippets on our website. | https://policies.google.com/privacy?hl=de |
| YouTube | Google LLC (Worldwide) Google Dublin (EU) | We use the video platform "YouTube" to embed videos on our website. | https://policies.google.com/privacy?hl=de |
| Facebook & Facebook Pixel | Meta Platforms Inc. (Worldwide) Meta Platforms Ireland Limited (EU) | We use the "Facebook pixel" on our website. For this purpose, we have implemented a JavaScript code snippet on our website. | https://www.facebook.com/policy.php |
Meta Platforms Inc. (Worldwide) Meta Platforms Ireland Limited (EU) | We use the social network "Instagram" to inform users about our products and activities. | https://help.instagram.com/519522125107875 | |
LinkedIn Corporation (Worldwide) LinkedIn Ireland Unlimited Company (EU/EWR/CH) | We use the social network "LinkedIn" to inform users about our products and activities. | https://www.linkedin.com/legal/privacy-policy | |
Pinterest Inc. (Worldwide) Pinterest Europe Limited (EU) | We use the social network "Pinterest" to inform users about our products and activities. | https://policy.pinterest.com/en/privacy-policy | |
| Mailchimp | The Rocket Science Group, LLC | We use Mailchimp from The Rocket Science Group, LLC to send our newsletter. | https://www.intuit.com/privacy/statement/ |
| Customer Relation Management (CRM) | Salesforce, Inc. (Worldwide) SFDC Ireland Limited (EU) | Cloud-based enterprise platform used as a CRM tool for the Bauwerk Group in the following markets (countries): US, UK, IT, LT, DE, AT, LT, CH, FR. | https://www.salesforce.com/de/company/privacy/ |
| ECHOO by Aioma | Heroku is a Salesforce company, Salesforce, Inc. (Worldwide) Astina AG | Astina is the provider of the software. The software is a customized product developed for the Bauwerk Group and Astina processes the corresponding data on behalf of the Bauwerk Group. ECHOO is hosted by Heroku (https://www.heroku.com/) as a cloud application in the Europe region. Heroku does not specify an exact "location" for this. We continue to seek a data processing agreement with Heroku/Salesforce as they are considered sub-processors. Heroku is a Salesforce company. | https://www.salesforce.com/de/company/privacy/ |
| Mautic | Acquia Inc. (Worldwide) | We use "Mautic", a marketing automation software, on our website. | https://www.mautic.org/privacy-policy |
| Matterport | Matterport, Inc, Sunnyvale, CA 94089, USA | We have a virtual showroom in which Matterport collects user interaction data with the tool. | https://matterport.com/de/privacy-policy |
We maintain online presences on the following social networks: LinkedIn, Xing, Twitter, Instagram, Facebook, YouTube, Pinterest. When you visit these platforms, their privacy policies apply. For information about social networking privacy policies and practices, please visit the following links:
6. How do we use cookies on our website?
This website uses cookies. Insofar as those cookies are not strictly necessary for the provision of our website and services, we will ask you to consent to our use of cookies when you first visit our website.
A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.
Cookies may be either "persistent" cookies or "session" cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.
Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies.
We use cookies for the following purposes:
Mandatory cookies are used to support the navigation. Without these cookies, the website cannot be operated. These cookies do not collect any personal information that can be used for marketing purposes or to track your access to different websites. We use them to:
- increase the page speed of our website
- remember your cookie settings
- save your basket
- process online payments
- protect user accounts, including preventing fraudulent use of login credentials, and to protect our website and services generally
Functional cookies are used to provide website services and to remember your preferences. We use them to:
- remember settings you have applied such as layout, language, or cookie preferences.
- send information to third parties to enable services on our website (such as playing videos, registering, or displaying maps).
The shared information is solely used for providing the requested service and is never used for any other purpose.
Performance cookies (Audience Measurement) are used to collect information about your website usage. All data is stored anonymously. We use them to:
- provide statistics on how our website is used
- see how effective our adverts are
- detect any errors that may occur
- test different designs of our website
Targeting/Marketing/Personalization cookies are linked to services provided by third parties, such as 'Like' buttons and 'Share' buttons. We use them to:
- link to social networks like Facebook, which may subsequently use information about your visit to target advertising to you on other websites.
- provide advertising agencies with information on your visit so that they can present you with adverts that you may be interested in.
- measure the performance of our advertising campaigns.
Our Bauwerk Branded website uses the following cookies:
| Cookie | Domain | Description | Duration | Purpose |
|---|---|---|---|---|
| favourites | www.bauwerk-parkett.com | Used to save favorite products, references and other content (that a user has added to their wish list). | 3 months | Technically neccessary |
| uid | www.bauwerk-parkett.com | Used to track users across different website segments. | 1 year | Marketing |
| _ga | .bauwerk-parkett.com | Used to distinguish individual users. | 1 year | Performance |
| _ga_* | .bauwerk-parkett.com | Used to save the session status. | 1 year | Performance |
| _gid | .bauwerk-parkett.com | Used to distinguish individual users. | 1 day | Performance |
| _gat_UA-* | .bauwerk-parkett.com | Used to throttle the request rate for anonymous users. | 1 minute | Performance |
| 1P_JAR | .google.com | Used for the provision of advertising or retargeting. | 1 month | Marketing |
| SOCS | .google.com | Wird verwendet, um den Status eines Benutzers bezüglich seiner Cookie-Wahl zu speichern. | 13 months | Marketing |
| CONSENT | .google.com | Used to store the status of a user's cookie choice. | 2 years | Marketing |
| AEC | .google.com | Used to ensure that requests within a browser session are made by the user and not by other websites. | 6 months | Marketing |
| NID | .google.com | Is used to display Google advertisements in Google services for users who are not logged in. | 6 months | Marketing |
| OGPC | .google.com | Is used to provide the functionality of Google Maps. | 1 month | Marketing |
| OTZ | .google.com | Used to support Google advertising services. | 17 days | Marketing |
| _GRECAPTCHA | www.google.com | Is used to recognize whether a user is a bot (ensuring security). | 6 months | Performance |
| DV | www.google.com | Used for the provision of advertisements and re-targeting measures. | 24 h | Marketing |
| mautic_device_id | www.bauwerk-parkett.com | Can be used by the monitored website, but is not used by Mautic to actively track the contact. | Session | Performance |
| mtc_id | www.bauwerk-parkett.com | Saves the Mautic ID for the tracked contact. It is not used for tracking. Can be used by the monitored website to use Mautic's REST API in the backend to manipulate the contact. | Session | Performance |
| mtc_sid | www.bauwerk-parkett.com | Obsolete cookie that is the same as mautic_device_id. It is no longer used by Mautic, but is kept for BC reads. | Session | Performance |
| mautic_device_id | form.bauwerk.com | Used by Mautic to track the contact either for the tracking pixel or if the same key is not found in the browser's local storage for the monitored website. | 1 year | Marketing |
| mtc_id | form.bauwerk.com | Saves the Mautic ID of the tracked contact. It was used for tracking before Mautic 2.13, but is no longer used and is kept for BC readings. | Session | Marketing |
| mtc_sid | form.bauwerk.com | Obsolete cookie that is the same as mautic_device_id. It is no longer actively used by Mautic, but is kept for BC reads. | Session | Marketing |
| mautic_referer_id | form.bauwerk.com | Stores a reference to the last tracked page for the contact and is used by Mautic to determine when a contact has a page they have visited. | Session | Marketing |
| mautic_session_id | form.bauwerk.com | Deprecated in Mautic 2 (no longer supported) and removed in Mautic 3. | Unknown | Marketing |
7. What are your rights as a data subject?
You have the following rights:
| Right to access your data | You have the right to request a transcript of personal data processed by us, and additional information on how the data has been collected, processed, shared, etc. The first transcript may be requested free of charge, however if you make repeated and unreasonable requests, we might charge you an administrative fee. |
| Right to rectification | You have the right to correct inaccurate or incomplete information about yourself. |
| Right to erasure (‘right to be forgotten’) | You have the right to request that we delete personal data about you, e.g., if the data is no longer necessary in relation to the purposes for which it was collected or otherwise processed, or if there is no legal basis for processing the data. |
| Right to object | You have the right to object to processing based on legitimate interest. This means that we may no longer process personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests. You can always contact us for more information on the balance test that has been done. You may also object to your personal data being processed for direct marketing purposes. |
| Right to transfer your data | You are entitled to request that the processing of your personal data should be limited until inaccurate or incomplete information about you has been corrected, or until an objection from you has been handled. |
| Right to restriction | You are entitled to request that the processing of your personal data should be limited until inaccurate or incomplete information about you has been corrected, or until an objection from you has been handled. |
| Right to withdraw your consent | You may at any time withdraw any consent you have given us. However, please note that it will not affect any processing that has already taken place. |
| Right to complain | You have the right to lodge a complaint to the Supervisory Authority in the country you live or work in, if you believe that we have not complied with our obligations regarding your personal data. |
8. How do we protect personal data?
To protect personal data, we apply the following organizational and technical data security measures:
- We apply access control measures.
- We ensure proper management of hardware and software we use.
- We track personal data security breaches and security incidents.
- We train our staff in training on personal data protection and cybersecurity threats.
- We ensure the protection of the workplace.
- We ensure security of network and communication.
- We take care of backups.
- We take care of the protection of mobile devices.
- We maintain the procedure for proper destruction and deletion of data.
- We also take care of physical security.
9. Changes in personal data processing related to the new Swiss Federal Act on data protection (FADP)
Since before the entry into force of FADP (Swiss Federal Act on Data Protection), we processed your personal data in accordance with a provision of GDPR, that are very similar in terms of data subjects’ rights, legal basis for data processing and other requirements related to data processing, therefore the changes in FADP does not change our Privacy policy in essence. If in the course of processing, we face the situation where FADP requires substantially different way of data processing we’ll update our Privacy policy accordingly, for example, we’ll inform you and ask for your consent in case we process sensitive data relating to religious, ideological, political or trade union-related views or activities; health, one's intimate life or racial origin; social security measures; administrative or criminal proceedings and sanctions.
10. Changes in this privacy policy
In the light of continuous development of our business processes (digitalization and other areas) it‘s inevitably that data processing operations will be the subject to change from time to time, accordingly our privacy policy will be changed. Should we make amendments to this privacy policy, we will place the amended policy on our websites, with an indication of the amendment date. If the amendments are significant, we may also inform you about this by other means, for example by sending an email or placing a bulletin on our homepage. We recommend that you review this privacy policy from time to time to ensure you are aware of any amendments made.