01 / 12

Data controller and contact details

Controller within the meaning of the General Data Protection Regulation (GDPR):

Institut für Baubiologie Rosenheim GmbH
Münchener Str. 18
83022 Rosenheim
Germany

Phone: +49 (0)8031 3675-0
Email: info@baubiologie-ibr.de

Additional legal details are available in our Legal notice.

Please use the contact details above for questions about data protection.

02 / 12

Principles and legal bases

We process personal data only where there is a lawful basis and the processing is necessary for a specified purpose. Depending on the activity, we rely on:

• Article 6(1)(a) GDPR: your freely given consent.
• Article 6(1)(b) GDPR: performance of a contract or pre-contractual measures.
• Article 6(1)(c) GDPR: compliance with legal obligations.
• Article 6(1)(f) GDPR: legitimate interests, particularly maintaining a secure and functioning website and responding to general enquiries.

Storage of information on your device or access to such information is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Non-essential technologies generally require consent. An exemption may apply to strictly necessary processes under Section 25(2) TDDDG.

03 / 12

Website access and hosting

When you access this website, technically necessary connection data may be processed, including your IP address, access time, requested URL, HTTP status, amount of data transferred, browser and operating system information and referrer URL, insofar as your browser provides these details.

These data are used to deliver the website, diagnose technical errors and prevent attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure and reliable operation.

Our hosting provider is ALRO IT GmbH, Sepp-Heindl-Straße 5, 83026 Rosenheim, Germany. Where ALRO IT processes the data needed to operate the website on our behalf, it acts as a processor under Article 28 GDPR. ALRO IT provider details.

04 / 12

Contact and enquiries

If you contact us by email, telephone or a contact form, we process the information you provide, such as your name, contact details, company and the content of your enquiry. Mandatory form fields are indicated as such.

We process the information to respond to your enquiry and, where relevant, take steps towards or perform a contract under Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR. Information is erased once it is no longer needed, unless legal retention obligations or other lawful grounds justify continued storage.

Our contact forms use Contact Form 7 to process your name, email address, subject and message. An arithmetic question helps prevent spam. Your enquiry is sent to IBR by email. IBR stores received emails locally. Processing within the receiving email system forms part of handling your enquiry.

05 / 12

Product search and website functions

When you use the product search function, we process your search terms and technically necessary request data to display relevant results. The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in providing the search function.

The product search runs within this website. To limit excessive requests, the server generates a pseudonymous key from your IP address and a server-specific secret. A request counter is stored with an expiry period of 60 seconds, which is renewed by further requests. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the search function against misuse.

06 / 12

Cookies, consent management and local storage

This website may use cookies and comparable technologies. Technically necessary storage and access are carried out in accordance with applicable law. For non-essential cookies or similar access, we obtain prior consent where required under Section 25(1) TDDDG. Where personal data are processed, Article 6(1)(a) GDPR may apply in addition.

Complianz is installed to manage consent. You can make choices through the cookie banner or privacy settings and withdraw consent at any time with effect for the future.

Complianz stores the banner status (cmplz_banner-status), the version of the consent policy (cmplz_policy_id) and your choices for functionality, preferences, statistics and marketing (cmplz_functional, cmplz_preferences, cmplz_statistics and cmplz_marketing). The cmplz_consented_services cookie records choices for individual services. Complianz is configured to remember your choices for up to 365 days. You can change them using ‘Cookie settings’ in the footer.

You can reopen your choices using the ‘Manage consent’ button and withdraw consent for the future. Withdrawal does not affect the lawfulness of earlier processing. After withdrawing consent, please reload any contact page that is already open so that a previously activated map is no longer loaded.

07 / 12

Google Maps and external content

You can activate Google Maps on our contact page to view our location. For users in the EEA, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Once activated, Google receives your IP address and browser data. Google may link data to a signed-in Google account and process data in the USA. For Google’s processing, retention and deletion options, see Google’s privacy policy.

The map loads only after consent. The legal bases are Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. Consent is optional. Our address and contact details remain available without activating the map.

Google states that Google LLC relies on its EU-US Data Privacy Framework certification for transfers from the EEA to the USA, using standard contractual clauses where required. See Google’s information about international transfers. Transfers remain subject to Articles 44 onwards GDPR.

08 / 12

Security and processors

The website is accessible over HTTPS. We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss and manipulation. Absolute security during transmission over the internet cannot be guaranteed.

External service providers may access personal data only where necessary and legally permitted. Where they act as processors, the requirements of Article 28 GDPR apply.

09 / 12

Retention periods

We retain personal data only for as long as necessary for the relevant purposes. When the purpose no longer applies, the data are erased unless statutory retention duties or other lawful reasons require continued storage.

Business and tax records are subject to the applicable statutory retention requirements. The deletion policy for straightforward enquiries that are not subject to statutory retention requirements is no later than six months after the enquiry has been fully resolved. This period does not apply where statutory retention duties apply or continued storage is necessary to establish, exercise or defend specific legal claims. The hosting provider’s precise retention period for server logs has not yet been confirmed. Please contact info@baubiologie-ibr.de for definitive information about the periods applicable to your data.

10 / 12

Your rights

Subject to applicable legal conditions, you have the following rights:

• Access to your personal data (Article 15 GDPR)
• Rectification (Article 16 GDPR)
• Erasure (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Objection to certain processing activities (Article 21 GDPR)
• Withdrawal of consent at any time with effect for the future (Article 7(3) GDPR)

In particular, you may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may object to processing for direct marketing at any time.

To exercise your rights, email info@baubiologie-ibr.de. Under Article 77 GDPR, you may lodge a complaint with a supervisory authority. For private-sector organisations in Bavaria, the competent authority is generally the Bavarian Data Protection Authority (BayLDA).

11 / 12

Requirement to provide data and automated decisions

You generally do not need to provide your name simply to browse the website. Certain technical data are necessary to access the website. For enquiries, we need the information necessary to handle your request; without it, we may be unable to respond.

No solely automated decisions producing legal or similarly significant effects within the meaning of Article 22 GDPR are envisaged for the website functions described here.

12 / 12

Changes to this privacy policy

We update this privacy policy whenever our website functions, processing operations or applicable legal requirements change. The current version is available on this page.

Updated on 5 November 2026.