Privacy Policy

1. Scope

This Privacy Policy informs you about the processing of personal data when you visit and use the German country section of heras.com.

The website is operated as a central, modular platform of the Heras Group. It contains central group content as well as country-specific content and contact options.

This Privacy Policy applies to the German country section unless separate privacy information is provided for individual offers, forms, application procedures or external services.

The website is intended in particular to provide information about the Heras Group, its German companies, products, services, locations and career opportunities.

2. Controller for the German country section

Unless a different controller is specified below, the controller responsible for the content, contact options and processing activities on the German country section is:

Heras Group Germany GmbH
Herzogstrasse 8
40764 Langenfeld
Germany

Managing Directors: Sebastiaan Krol, Simon Schumacher
Email: info.de@heras.com

3. Data Protection Officer

The external Data Protection Officer of Heras Group Germany GmbH is:

IT-Security Coach GmbH
Olper Huette 5b
57462 Olpe
Germany

Telephone: +49 2761 83363 100
Email: dataprotection@itsecuritycoach.com
Website: Website of the Data Protection Officer

Please mark confidential correspondence addressed to the Data Protection Officer accordingly or contact the Data Protection Officer directly.

4. Central technical platform

The technical website platform is provided and administered centrally within the Heras Group.

The controller responsible for central processing activities directly connected with the operation, security and group-wide administration of the website platform is:

Heras Group Norway AS
Apotekergata 10B
0180 Oslo
Norway

Heras Group Norway AS is the contracting party of the service providers commissioned with the design, implementation, operation and further development of the central website platform.

Where Heras Group Germany GmbH determines the purposes and essential means of a processing activity on the German country section, it acts as an independent controller for that processing.

The respective responsibility under data protection law depends on the specific processing activity. Enquiries concerning the German country section may be sent to the contact details stated above, irrespective of the internal allocation of responsibilities. If another group company is responsible for the processing concerned, the enquiry will be forwarded to that company.

5. German Heras companies

The German country section presents products, services, locations and business areas of several legally independent Heras companies.

Depending on the subject matter of an enquiry, personal data may in particular be forwarded to one of the following companies:

• Heras Germany Perimeter Protection GmbH;
• Heras Germany Technical Security West GmbH;
• Heras Germany Technical Security South GmbH;
• Heras Germany Consulting & Planning GmbH;
• Heras Germany Technical Security Central GmbH;
• Heras Germany Smart Security Solutions GmbH;
• Heras Germany Security Services GmbH.

6. General legal bases

We process personal data in particular on the following legal bases:

• Article 6(1)(a) GDPR, where you have consented to the processing;
• Article 6(1)(b) GDPR, where the processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract;
• Article 6(1)(c) GDPR, where the processing is necessary for compliance with a legal obligation;
• Article 6(1)(f) GDPR, where the processing is necessary for the purposes of our legitimate interests or those of a third party and your interests, fundamental rights and freedoms do not override those interests.

Our legitimate interests may include in particular:

• the secure, stable and efficient operation of the website;
• the detection and prevention of attacks and misuse;
• the processing and appropriate allocation of enquiries;
• the presentation of the Heras Group and its services;
• the improvement of our website and business processes;
• the documentation of business communications;
• the establishment, exercise or defence of legal claims.

7. Provision of the website and server logs

When you access the website, technically necessary information is processed in order to provide the website and ensure its security, availability and stability.

The following data may be processed in particular:

• IP address;
• date and time of access;
• page or file accessed;
• amount of data transferred;
• access status or HTTP status code;
• previously visited page;
• browser type and browser version;
• operating system;
• device information;
• security and diagnostic information.

The processing is based on Article 6(1)(f) GDPR. Our legitimate interests are the secure, stable and efficient operation of the website and the detection and prevention of attacks and misuse.

Log data is deleted as soon as it is no longer required for these purposes. It may be stored for longer where this is necessary to investigate a security incident, establish or defend legal claims, or comply with legal obligations.

8. Webflow as website and hosting platform

We use Webflow to create, manage, technically provide and host the website.

Provider: Webflow, Inc.
398 11th Street, 2nd Floor
San Francisco, California 94103
USA

When the website is accessed, Webflow may process in particular IP addresses, technical requests, browser and device information, content accessed, access times, and diagnostic and security information.

Static website content and the front end are delivered via a global content delivery network.

Technically necessary processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and efficient provision of the website.

Further information: Webflow Privacy Policy and Webflow Data Processing Agreement.

Where personal data is transferred to third countries, the transfer will take place only in accordance with the requirements of Articles 44 et seq. GDPR.

Native Webflow forms are not used to submit contact enquiries. Contact forms are provided through Jotform.

9. Cookies and similar technologies

The website uses cookies and similar technologies. These technologies may store information on your terminal device or access information already stored on it.

We distinguish in particular between:

• strictly necessary technologies;
• functional technologies;
• analytics and statistics technologies;
• marketing and conversion technologies;
• external media.

Under section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), storing information on a user’s terminal device and accessing information already stored there generally require prior consent. An exception applies in particular where the technology is strictly necessary to provide a digital service expressly requested by the user or to transmit a message.

Non-essential technologies are activated only after you have consented through our consent management system.

The subsequent processing of personal data by analytics, marketing and external-media services is based on Article 6(1)(a) GDPR.

Current information about the technologies used, providers, purposes and durations is available in the Cookie Settings.

10. Consent management with Usercentrics

We use Usercentrics Business to manage your consent decisions.

Provider: Usercentrics GmbH
Sendlinger Strasse 7
80331 Munich
Germany

Usercentrics is used in particular to:

• provide information about cookies and similar technologies;
• obtain and document consent;
• store selected settings;
• block non-essential services before consent is given;
• transmit consent signals to integrated services;
• enable changes and withdrawals.

The following data may be processed in particular:

• consent status;
• selected categories and services;
• date and time of consent or withdrawal;
• consent ID;
• browser and device information;
• language and regional settings;
• technically necessary evidence data.

Processing required to comply with statutory evidence and accountability obligations is based on Article 6(1)(c) GDPR. The technically necessary management of your consent settings is additionally based on Article 6(1)(f) GDPR. Our legitimate interest is the legally compliant and user-friendly management of the technologies used.

You may change or withdraw your settings at any time through the Cookie Settings.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

11. Webflow Analyze

If you have consented, we use Webflow Analyze to evaluate use of our website and interactions with its content.

The following information may be processed in particular: pages viewed, click events, sessions, information about unique visitors, bounce rates, time spent, traffic sources, regional information, browser and device information, and interaction and conversion events.

Provider: Webflow, Inc.
398 11th Street, 2nd Floor
San Francisco, California 94103
USA

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR. Webflow Analyze is activated only after you have consented to the relevant analytics or statistics processing. You may withdraw your consent at any time through the Cookie Settings.

12. Google Analytics 4

If you have consented, we use Google Analytics 4 to analyse website use and measure the performance of our content and campaigns.

Provider for users in the European Economic Area: Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

The following data may be processed in particular: online and cookie identifiers; IP address and approximate location information; browser, device and operating-system information; language and screen settings; pages viewed; date and time of access; traffic sources and campaign information; interactions and events; session duration; conversion information; and consent signals.

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR. Google Analytics 4 is activated only after you have consented to the “Analytics” or “Statistics” category. Further information is available in Google’s Privacy Policy. You may withdraw your consent at any time through the Cookie Settings.

13. Microsoft Clarity

If you have consented, we use Microsoft Clarity to analyse usability and interactions on our website.

Provider: Microsoft Corporation
One Microsoft Way
Redmond, Washington 98052-6399
USA

The following information may be processed in particular: click and scroll behaviour; navigation paths; session and interaction information; browser and device information; operating-system information; page and referrer information; approximate location information; technical identifiers; and consent signals.

Clarity may create heat maps and session recordings. Input fields in contact forms are not captured in session recordings.

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR. Microsoft Clarity is activated only after you have consented to the corresponding analytics category. Further information is available in the Microsoft Clarity Privacy Information.

14. Google Tag Manager and server-side tagging

We use Google Tag Manager for the technical management and control of services and tags used on the website.

The Tag Manager serves as a technical management layer. It does not replace the consent required for analytics or marketing services.

Services controlled through the container are assigned to their respective consent categories and are activated only when the required consent has been given.

Where the container is loaded before consent, this occurs only to the technically necessary extent required to manage consent-dependent services.

Technically necessary management is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure, controlled and transparent management of the services used.

Analytics and marketing processing controlled by the Tag Manager is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR.

15. Server-side tagging with Stape.io

We use Stape.io for server-side tag management and the controlled transmission of analytics and marketing events.

Depending on your consent and the service activated, the following information may be processed in particular: technical identifiers; page and event information; browser and device information; campaign and referrer information; consent signals; analytics events; and conversion events.

Analytics and marketing events are processed and transmitted only if the required consent signal is present.

Processing is based on your consent pursuant to Article 6(1)(a) GDPR. Further information is available in Stape’s Data Processing Agreement.

16. Google Ads and conversion measurement

If you have consented, we use Google Ads to measure the effectiveness of our advertising campaigns.

In particular, it may be evaluated whether users perform certain actions on our website after viewing or clicking an advertisement.

The following may be processed: cookie and online identifiers; browser and device information; advertising and campaign information; website interactions; conversion events; referrer information; approximate location information; and consent signals.

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR. Google Ads and the associated conversion measurement are activated only after you have consented to the “Marketing” category.

17. LinkedIn Insight Tag

If you have consented, we use the LinkedIn Insight Tag to measure the performance of our LinkedIn campaigns and to create campaign and conversion statistics.

Provider for users in the European Economic Area: LinkedIn Ireland Unlimited Company
Wilton Plaza
Wilton Place
Dublin 2
Ireland

The following may be processed in particular: IP address; browser and device information; pages visited; timestamps; traffic sources; campaign interactions; cookie and advertising identifiers; conversion events; and LinkedIn account information if you are logged in.

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR. The service is activated only after you have given marketing consent. You may withdraw your consent at any time through the Cookie Settings.

18. Meta Pixel for Facebook and Instagram

If you have consented, we use the Meta Pixel for advertising and conversion measurement in connection with Facebook and Instagram.

Provider for users in the European Economic Area: Meta Platforms Ireland Limited
Merrion Road
Dublin 4
Ireland

The following data may be processed in particular: IP address; browser and device information; page views; website interactions; campaign and referrer information; cookie and advertising identifiers; conversion events; and information concerning a Facebook or Instagram account if you are logged in.

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR. The Meta Pixel is activated only after you have given marketing consent.

19. TikTok Pixel

If you have consented, we use the TikTok Pixel to measure the effectiveness of TikTok campaigns.

Provider for users in the European Economic Area: TikTok Technology Limited
10 Earlsfort Terrace
Dublin 2
Ireland

The following data may be processed in particular: IP address; browser and device information; page views and interactions; advertising and campaign information; cookie and advertising identifiers; conversion events; referrer information; and TikTok account information if you are logged in.

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR. The service is activated only after you have given marketing consent. Further information is available in TikTok’s Privacy Policy.

20. Embedded videos from YouTube and Vimeo

Videos provided by YouTube or Vimeo may be embedded on the website. External content is loaded only after you have consented to the relevant processing. Before consent, a placeholder or consent request is displayed.

When a video is loaded, the following data may be processed in particular: IP address; page accessed; date and time of access; browser and device information; playback and interaction information; and cookie and online identifiers.

If you are logged in to the respective provider, the provider may associate the interaction with your user account.

YouTube

Provider for users in the European Economic Area: Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Further information is available in Google’s Privacy Policy.

Vimeo

Provider: Vimeo.com, Inc.
330 West 34th Street, 5th Floor
New York, New York 10001
USA

Further information is available in Vimeo’s Privacy Policy.

In each case, processing is based on your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time through the Cookie Settings.

21. Contact forms, forwarding and CRM processing

21.1 Contact forms through Jotform

Our contact forms are provided through Jotform. Native Webflow forms are not used for contact enquiries.

Depending on the form, the following data may be collected in particular:

• name;
• company and position;
• email address;
• telephone number;
• country and location;
• requested product or service;
• business area;
• content of your message;
• attachments submitted voluntarily;
• date and time of submission;
• technical form and transmission data.

Where your enquiry concerns a contract or pre-contractual steps, processing is based on Article 6(1)(b) GDPR. For general enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the receipt, allocation and appropriate response to your enquiry.

21.2 Forwarding to the responsible Heras company

Depending on the selected product or service, requested location, business area, content of the enquiry and regional responsibility, your enquiry is forwarded to the responsible Heras company.

Potential recipients include in particular the German companies listed in section 5.

The receiving company generally processes your data under its own responsibility under data protection law, in particular for:

• processing and responding to your enquiry;
• professional and organisational allocation;
• preparing an offer;
• taking pre-contractual steps;
• initiating and conducting a business relationship;
• documenting communications;
• necessary follow-up of the enquiry;
• complying with legal obligations.

Where possible, the responsible company will be identified in the contact form, in the acknowledgement of receipt or, at the latest, during subsequent communication.

21.3 CRM systems

Depending on the responsible company and business area, your enquiry may be processed in HubSpot, Pipedrive, Microsoft Dynamics 365 or a responsible email inbox.

Within a CRM system, the following data may be processed in particular: contact and company data; content and status of the enquiry; correspondence; selected products and services; internal responsibility and allocation; offers and sales opportunities; pre-contractual and contractual information; and required follow-up activities.

Processing is based on Article 6(1)(b) GDPR where it serves to initiate or perform a contract. Otherwise, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the structured processing, documentation and follow-up of business enquiries.

Further information is available in the privacy policies and data processing agreements of HubSpot and Pipedrive, and in Microsoft’s privacy information for Dynamics 365.

21.4 Contact by email and telephone

If you contact us by email or telephone, we process your contact details and the information you provide in order to handle your enquiry. The legal basis is Article 6(1)(b) GDPR where the enquiry serves to initiate or perform a contract. In other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the appropriate handling and documentation of your enquiry.

21.5 Storage period

Contact form data is deleted once the enquiry has been finally dealt with and no contractual or statutory retention duties, or requirements relating to the establishment or defence of legal claims, justify further storage.

If the enquiry results in a business relationship, the further storage period is governed by the statutory and operational retention rules applicable to that business relationship.

22. Newsletter and Mailchimp

If you subscribe to a newsletter or other marketing communications, we process the data provided in the subscription form.

In particular, the following data may be processed:

• Email address;
• Name, if requested;
• Company;
• Country and language;
• Selected areas of interest;
• Date and time of subscription and confirmation;
• Consent information and proof of consent;
• Subscription status.

We use Mailchimp to manage and distribute our newsletters.

Provider:
The Rocket Science Group LLC d/b/a Mailchimp
675 Ponce de Leon Avenue NE
Suite 5000
Atlanta, Georgia 30308
USA

Mailchimp is part of the Intuit group of companies. Under the applicable Terms of Use, the agreement governing the processing of personal data forms part of the contractual arrangements with Mailchimp.

The processing carried out for the purpose of sending newsletters is based on your consent pursuant to Art. 6(1)(a) GDPR.

We generally use a double opt-in procedure to confirm your subscription. As part of this procedure, you will receive a message asking you to confirm your subscription. The subscription and confirmation data are stored so that we can demonstrate that consent has been given.

Where we analyse whether newsletters have been opened and whether links contained in them have been clicked, such processing is also based on your consent pursuant to Art. 6(1)(a) GDPR. This paragraph applies only if personalised open or click tracking is used.

You may withdraw your consent at any time with effect for the future by using the unsubscribe link contained in the relevant message or by contacting the responsible company. The lawfulness of the processing carried out before the withdrawal of consent remains unaffected.

As the provider is established in the USA, personal data may also be processed in the USA. Any transfer takes place only in accordance with the requirements of Art. 44 et seq. GDPR. In particular, the transfer may be based on an applicable adequacy decision, provided that the relevant recipient is validly certified under the EU-U.S. Data Privacy Framework, and, additionally, on the European Commission’s Standard Contractual Clauses included in the Data Processing Addendum. Mailchimp’s Data Processing Addendum contains provisions governing international data transfers and incorporates the Standard Contractual Clauses where applicable.

The data processed for the newsletter are generally stored for as long as the newsletter subscription remains active. Following the withdrawal of consent or unsubscribing, the data will be removed from the active newsletter distribution list, unless statutory retention requirements or requirements relating to proof of consent prevent their deletion. The email address may be stored on a suppression list where this is necessary to ensure that the withdrawal of consent is permanently respected and to prevent newsletters from being sent again.

Further information:

• https://www.intuit.com/privacy/statement/
• Mailchimp Data Processing Addendum (https://mailchimp.com/de/legal/data-processing-addendum/)

23. Careers and Teamtailor

Current vacancies may be displayed on the website. As a rule, only job information intended for publication is provided, in particular the job title, department, country, place of work, job description and application link.

If you select a vacancy or click the application link, you will be redirected to an external Teamtailor application environment.

Provider: Teamtailor AB
Oestgoetgatan 16
116 21 Stockholm
Sweden

The Heras company identified in the respective vacancy is responsible for the application procedure. The privacy information applicable to the application procedure is provided in the Teamtailor application environment. Further information is available in Teamtailor’s Privacy Policy.

24. Whistleblowing system

Our website contains a link to an externally operated whistleblowing system. If you select the link, you leave the German country section. The privacy information provided within the whistleblowing system applies to the processing of personal data in that system.

25. Content supported by artificial intelligence

Artificial intelligence may be used to support the creation, editing and generation of content on this website. This concerns the creation and preparation of website content. It does not mean that visitors are subject to automated decision-making processes.

26. Recipients and categories of recipients

Depending on the respective purpose of processing, personal data may be disclosed in particular to the following recipients or categories of recipient:

• the responsible German Heras company;
• Heras Group Norway AS, where necessary for technical platform operation;
• hosting and website platform providers;
• website development and maintenance service providers;
• consent management providers;
• form providers;
• CRM providers;
• newsletter and communications providers;
• analytics and marketing providers, if you have consented;
• external-media providers, if you have consented;
• recruiting and applicant-management providers;
• IT and information-security service providers;
• lawyers, tax advisers, auditors and other advisers;
• courts, authorities and other public bodies where a legal obligation exists.

Processors are contractually required to process personal data only in accordance with the documented instructions of the respective controller and the applicable data protection requirements.

27. Transfers to third countries

Some providers or their subprocessors may process personal data outside the European Union or the European Economic Area.

A transfer will take place only if the requirements of Articles 44 et seq. GDPR are met.

The following may serve in particular as a legal basis or safeguard:

• an adequacy decision of the European Commission;
• the EU-U.S. Data Privacy Framework for validly certified recipients;
• the European Commission’s Standard Contractual Clauses;
• binding corporate rules;
• other legally recognised appropriate safeguards;
• in individual cases provided for by law, a derogation under Article 49 GDPR.

Where required, we assess supplementary contractual, technical or organisational safeguards. Information about the safeguards applicable to a specific service may be obtained through the privacy contacts stated in this Privacy Policy.

28. Storage period and deletion

We store personal data only for as long as necessary for the respective processing purpose or for as long as a statutory obligation or overriding legitimate reason justifies further storage.

The storage period depends in particular on the purpose of processing; the nature and scope of the data; the processing status of an enquiry; the existence of a contractual or business relationship; statutory retention obligations; the need to establish or defend legal claims; the withdrawal of consent; and an objection that has been lodged.

Service-specific storage periods and cookie durations may additionally be viewed through the Cookie Settings.

Once the purpose of processing no longer applies, personal data is deleted or anonymised unless a legal obligation or another permissible basis requires further storage.

29. Obligation to provide data

Where mandatory fields are marked in a form, we require this information to process your enquiry or carry out the pre-contractual step requested by you. Without the required information, your enquiry may not be processed. The provision of any additional information is voluntary.

30. Your data protection rights

Subject to the statutory requirements, you have in particular the following rights:

• right of access under Article 15 GDPR;
• right to rectification under Article 16 GDPR;
• right to erasure under Article 17 GDPR;
• right to restriction of processing under Article 18 GDPR;
• right to data portability under Article 20 GDPR;
• right to object under Article 21 GDPR;
• right to withdraw consent under Article 7(3) GDPR;
• right to lodge a complaint with a data protection supervisory authority under Article 77 GDPR.

Withdrawal of consent

You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. You may change or withdraw consent to cookies and similar technologies through the Cookie Settings.

Right to object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you may object at any time without stating particular grounds. Following such an objection, your data will no longer be processed for direct marketing purposes.

To exercise your rights, you may contact the respective controller or the Data Protection Officer.

31. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

The generally competent data protection supervisory authority for Heras Group Germany GmbH is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestrasse 2-4
40213 Duesseldorf
PO Box 20 04 44
40102 Duesseldorf
Germany

Further information is available on the authority’s website. You may also contact another competent data protection supervisory authority, in particular at your habitual residence, place of work or the place of the alleged infringement.

32. Automated decisions

No decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you are made through the German country section.

33. Data security

We take appropriate technical and organisational measures to protect personal data in particular against:

• accidental or unlawful destruction;
• loss;
• alteration;
• unauthorised disclosure;
• unauthorised access.

Access to systems in which personal data is processed is restricted to authorised persons and to the permissions required for their duties.

Please do not submit special categories of personal data or other particularly sensitive information through general contact forms unless the relevant form expressly requests that information.

34. Amendments to this Privacy Policy

We may amend this Privacy Policy if, in particular, the website or its functions, the services used, responsibilities within the Heras Group, processing activities, statutory requirements, or regulatory or court requirements change.

The current version is available through the German country section. The version date of the Privacy Policy is stated at the beginning of the document.