Controller and contact
The controller is Josip Karlovic, Akustikbau Karlovic, Nickelstraße 44, 52249 Eschweiler, Germany. Questions about privacy and requests to exercise your rights can be sent to info@karlovic-bau.de or to our business address.
Karlovic Bau
Privacy notice
As of 15 September 2026. This notice explains which personal data is processed when you visit our website, contact us, apply for work or use the protected portal. Processing is limited to the respective purposes. Google Maps, Google Analytics, other external analytics services and external fonts are not integrated.
Website, hosting and email
We use ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, for hosting and email. Technical connection data, particularly IP address, time, requested page, response status and browser information, is processed for provision, troubleshooting and security. The basis is Article 6(1)(f) GDPR; our legitimate interest is reliable and secure operation. Technical logs are separate from form messages. Their retention depends on what is necessary for operation, troubleshooting, and preventing or investigating specific security incidents. Hosting and email constitute processing on our behalf under Article 28 GDPR and require contractual arrangements. Further provider information is available at all-inkl.com/datenschutzinformationen.
Contact and project enquiries
The contact form requires your first name, last name, email address, telephone number and message. Street and house number, postal code and town can be added voluntarily. You may also attach a PDF, JPG or PNG file up to 15 MiB (15 × 1,024 × 1,024 bytes). Enquiries are sent to info@karlovic-bau.de and handled by responsible business personnel. Contract-related enquiries rely on Article 6(1)(b) GDPR; other relevant enquiries rely on (f), with our interest in business communication. Acknowledging this notice in the form is not additional consent. There is no public database of your messages. Messages and attachments remain in the business mailbox until manually deleted; the website does not automatically delete anything there. Further retention depends on handling the enquiry, any subsequent contractual relationship, applicable statutory duties or the need to bring or defend specific claims.
Applications and documents
The application form requires your first name, last name and email address, plus a PDF file with your application documents up to 15 MiB (15 × 1,024 × 1,024 bytes). A telephone number and additional message are voluntary. Applications are sent to bewerbung@karlovic-bau.de. Processing serves hiring decisions under section 26(1) BDSG and must be necessary for that purpose. Other working arrangements are assessed under their respective legal bases. Access is limited to responsible personnel involved in recruitment. After the process ends, documents may be retained only as necessary to fulfil statutory duties or bring or defend specific claims. When employment begins, necessary documents are further processed for the employment relationship. The form creates no applicant pool. Mailbox copies require deletion by the business; the website does not automatically clear the mailbox. Please provide only documents needed for your application.
Attachments and local security checks
Contact and application attachments are temporarily stored in a private directory outside the publicly accessible website directory. Permitted file types and size are checked, and local malware scanning takes place before email delivery. Attachments are not accepted without an operational scanner. Files are not uploaded to an external scanning service. After checking or delivery, the application attempts to delete the temporary file immediately. If a technical deletion error occurs, it remains privately protected and requires cleanup by the business. This does not remove any already delivered mailbox copies. Security scanning protects our IT and recipients under Article 6(1)(f) GDPR.
Encrypted transmission
The website uses HTTPS to protect transmission between your browser and the server. Sending forms through SMTP requires a verified TLS connection to the mail server. This does not make email end-to-end encrypted; mail providers involved in further delivery can process messages. Send particularly confidential data only after arranging a suitable transmission method with us.
Necessary cookies and preferences
The session cookie __Host-kb_public protects cookie settings, contact and application forms against forged requests. It contains a random session identifier and expires with the browser session. __Host-kb_consent stores your cookie preferences for 180 days so they can be applied without repeatedly asking on every visit. These own cookies serve security and requested settings, not advertising. Strictly necessary storage falls under section 25(2) no. 2 TDDDG and needs no consent. Personal security and preference data relies on Article 6(1)(f) GDPR. Where consent evidence is required, Article 6(1)(c) together with Article 7(1) applies. Cookies are confined to their respective host.
Optional services and withdrawal
No advertising trackers, external analytics, external fonts or Google Maps contents are currently loaded. Google Maps is disabled and technically blocked; a stored choice currently activates no Google service. An optional map may start only after separate setup, information about its provider, data and transfers, and your explicit prior consent under section 25(1) TDDDG and Article 6(1)(a) GDPR. Optional choices default to off. You can change preferences and withdraw any future consent just as easily through Cookie settings. Necessary functions remain usable without optional consent.
Abuse prevention and security logs
Repeated requests and login attempts are time-limited. IP or account identities are converted into pseudonymous verification values using a secret key; this rate-limit storage contains no cleartext IP or email addresses. Expired entries are regularly cleared with a technical retention margin. These data are not automatically anonymous. Security events contain fixed event names and pseudonymous person references; configured retention is 180 days and requires regular deletion. The basis is Article 6(1)(f) GDPR for identifying and preventing abuse. Hosting and email logs are separate.
Protected employee portal
The portal at karlovic-bau.log-portal.de uses its separate session cookie __Host-kb_portal. General sessions end after 30 minutes of inactivity or at most eight hours; administrators have 15 minutes and four hours respectively. Account, personnel, working-time, project and document data is processed for business tasks according to permissions. Employee data particularly relies on section 26 BDSG where necessary for the employment relationship; processing required by law relies on Article 6(1)(c) GDPR. Other contractual data relies on (b). Retention depends on the respective business or employment purpose and statutory duties; additional internal information is provided for the relevant processes. Passwords are stored as protected verification values. Two-factor login can be enabled voluntarily and initially defaults to off. Once enabled, login also requires the time-dependent code, and its secret is stored encrypted. Portal documents are limited to 5 MiB per file and are also scanned locally.
Password links and delivery jobs
A portal password link is single-use and valid for 30 minutes. Its verification value and an encrypted delivery job are held in private server storage. The background sender removes the job after success; expired, damaged or permanently failed jobs are discarded together with their link. A new link replaces its predecessor. Short storage and processing serve secure account access under Article 6(1)(f) GDPR. Unknown account addresses cause no email delivery.
Recipients and international transfers
Access is limited to responsible business personnel, necessary hosting and email providers and any contracted maintenance providers within their tasks. Disclosure occurs only for the respective purpose or where required by law. Article 28 GDPR governs providers processing data on our behalf. Local file checks use no external scanning provider. Google services are not loaded, so they cause no data transfer to Google. Email communication may involve other mail providers, particularly your own provider. Transfers outside the European Economic Area require compliance with Articles 44 onwards GDPR. You can request information about providers involved and any necessary safeguards at info@karlovic-bau.de.
Your rights and complaints
Under Articles 15–20 GDPR you may request access, rectification, erasure, restriction and portability. For processing under Article 6(1)(f), you may object for reasons relating to your particular situation under Article 21. Consent may be withdrawn for the future without affecting earlier lawful processing. Contact: info@karlovic-bau.de. Under Article 77 you may complain to a supervisory authority, particularly LDI Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, poststelle@ldi.nrw.de; its complaint form is at www.ldi.nrw.de.
Required details and retention
Use of our forms is voluntary. Handling a contact form requires the contact and message fields marked as mandatory, including a telephone number; applications additionally require the mandatory application details and PDF documents. Without these details the respective form cannot be submitted. Voluntary details and optional contact attachments are not needed to use the form. Data must be deleted when its purpose ends, unless statutory retention duties or necessary grounds for bringing or defending claims apply. Required statutory retention relies on Article 6(1)(c) GDPR. Backups may contain data until regularly replaced and may be used only for recovery. Mailbox, employment-document and backup retention is managed by the business; the website does not replace these deletion processes. There are no solely automated decisions with legal or similarly significant effects and no advertising profiling.