Privacy policy

HABAU Hoch- und Tiefbaugesellschaft m.b.H. regards all data as an asset worthy of protection. The protection of your personal data is of great importance to us. In this privacy policy, we inform you about the processing of personal data in connection with our website, our careers portal and our online and social media presence, as well as about the rights to which you are entitled under data protection law.

We process personal data exclusively in accordance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR), the Data Protection Act (DSG) and the Telecommunications Act 2021 (TKG 2021).

 

1. Scope

This privacy policy applies to the website www.habaugroup.com and, where expressly stated in the following provisions, to our careers portal and our online and social media presence. It provides information on the processing of personal data in connection with the use of these services.

 

2. Legal basis for processing

The processing of your data is based on the following legal grounds:

  • the performance of a contract or pre-contractual measures with the respective (potential) business partners and customers, as well as employees and applicants,
  • processing based on a legal obligation,
  • your consent (newsletters, cookies, contact forms),
  • the performance of a task carried out in the public interest,
  • legitimate interests (secure and economically efficient operation of the website)

 

3.         Purposes of processing

3.1       Processing of applicant data

3.1.1  Job applications and the applicant tracking system

We process the personal data you provide as part of a job application in order to carry out the recruitment process on the basis of Article 6(1)(b) of the GDPR.

We use the REXX applicant tracking system for the electronic processing and management of applications. Where REXX processes personal data on our behalf, this is carried out within the framework of data processing on our behalf in accordance with Article 28 of the GDPR.

If your application is successful, your data may be further processed for the purposes of the employment relationship. Otherwise, your applicant data will be deleted no later than seven months after notification of the rejection decision, provided that no other legal basis justifies longer processing.

If you have consented to your application being retained on file or forwarded within the HABAU GROUP, further processing will take place on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect.

3.1.2   Job Alert

You can register for a Job Alert on our careers portal at jobs.habaugroup.com. The data you provide will be used to inform you of suitable job vacancies. Processing is carried out on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect or unsubscribe from the Job Alert.

 

3.2       Processing of data relating to our business partners and customers

In order to fulfil our contractual and pre-contractual obligations, we process a wide variety of personal data relating to our business partners and customers. Your data is used, amongst other things, to ensure smooth correspondence and to optimise ongoing business relationships.

Your data is processed by HABAU Hoch- und Tiefbaugesellschaft m.b.H. on the basis of the performance of the contract or pre-contractual measures in accordance with Article 6(1)(b) of the GDPR, as well as on the basis of legitimate interests in accordance with Article 6(1)(f) of the GDPR, namely the legitimate interests of HABAU Hoch- und Tiefbaugesellschaft m.b.H. in optimising business relationships.

You have the right to object to the processing.

The objection should be sent to ds-hg@habau.at.

 

3.3 Contacting us via email or the form on our websites

The primary purpose of our website is to inform you about our field of activity and to provide you with suitable ways to get in touch.

When you contact us via the contact form or by email, your details are automatically stored and processed solely for the purpose of responding to your enquiry. Unless other statutory retention periods apply to this enquiry, this personal data will be deleted within 90 days.

 

3.4 Server log data

The providers of our websites automatically process information contained in so-called server log files, which your internet browser automatically transmits to us. This includes the browser type and version, the operating system used, the referrer URL, the hostname of the accessing computer, the time of the server request and the IP
address. This data is not combined with other data sources. The processing is carried out to ensure the technical functionality and security of our website, as well as to detect and prevent misuse, on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

 

3.5 Website analytics, tracking and cookies

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device.

Cookies and similar technologies that are technically essential are used to the extent necessary to provide and ensure the functionality of the website features you have requested. Where personal data is processed in this context, this is done in particular on the basis of Article 6(1)(f) of the GDPR.

Cookies and similar technologies that serve, in particular, analytical, marketing or advertising purposes and are not technically essential are used only with your consent (Section 165(3) of the Telecommunications Act 2021; Article 6(1)(a) of the GDPR). You may withdraw or amend your consent at any time via our consent management tool, with effect for the future.

 

3.6 External services, analytics, marketing and social media tools

We use various external services, analytics and marketing technologies on our website. Services for which consent is required are, as a rule, only activated once you have given your consent via our consent management tool. You may withdraw your consent at any time with future effect.

Where data is transferred to providers outside the EEA, in particular to the USA, this is done on the basis of an applicable adequacy decision or appropriate safeguards in accordance with Chapter V of the GDPR.

 

Consent Management

We use Borlabs Cookie to manage and document your consents regarding cookies and similar technologies. The legal basis is Article 6(1)(c) of the GDPR or Article 6(1)(f) of the GDPR.


Google Services

We may use the following services provided by Google Ireland Limited, Ireland, or its affiliated companies:

  • Google Maps for displaying locations and directions;
  • YouTube for embedding videos;
  • Google Tag Manager to manage and control website tags;
  • Google Analytics for statistical analysis and optimisation of our website;
  • Google Ads for measuring and optimising advertising campaigns and for remarketing;
  • Google Web Fonts, where fonts are not embedded locally.

Depending on the service, the following data in particular may be processed: IP address, device and browser information, pages visited, interactions, approximate location information, and advertising and conversion data.

Where the relevant service requires consent, processing is carried out on the basis of Article 6(1)(a) of the GDPR.

Further information: https://policies.google.com/privacy?hl=de


Meta Pixel and Meta Ads

With your consent, we may use services provided by Meta Platforms Ireland Limited, in particular Meta Pixel and Meta Ads, to measure and optimise our advertising campaigns, to create target groups and for remarketing.

In particular, IP addresses, device and browser information, pages visited, interactions, and advertising and conversion events may be processed. If you are logged in to Facebook or Instagram, Meta may associate this information with your user account.

The legal basis is Article 6(1)(a) of the GDPR.

Further information:

https://www.facebook.com/privacy/policy/

https://www.facebook.com/privacy/policies/cookies

https://privacycenter.instagram.com/policy


LinkedIn Insight Tag

Where actually used, and subject to your consent, we use the LinkedIn Insight Tag provided by LinkedIn Ireland Unlimited Company to measure the effectiveness of advertising campaigns, carry out statistical analysis and segment target audiences. In particular, IP addresses, URLs, referrers, and device and browser information may be processed in this context.

The legal basis is Article 6(1)(a) of the GDPR.

Further information: https://de.linkedin.com/legal/privacy-policy


Matomo

We use Matomo for statistical analysis and to optimise our website. Where the service is used without cookies or similar technologies and with a configuration that complies with data protection requirements, we base the processing on Article 6(1)(f) of the GDPR. Where non-essential cookies or similar technologies are used, processing takes place only with your consent in accordance with Article 6(1)(a) of the GDPR.


Social media content

Our website may incorporate content or functions from social networks, in particular Facebook, Instagram, LinkedIn or TikTok. Where personal data is transmitted to the relevant provider as soon as the page is loaded, activation will only take place once you have given your consent.

In particular, your IP address, device and browser information, as well as information about the page you have accessed and your interaction with it, may be processed. If you are logged in to the relevant provider’s service, this information may be linked to your user account.

The legal basis is Article 6(1)(a) of the GDPR. In the case of simple links to our social media profiles, simply visiting our website does not result in any data being transferred to the respective platform provider.

 

3.7 Online and social media presences

We maintain corporate profiles on various online and social media platforms, in particular on Google, Facebook, Instagram, LinkedIn and TikTok. If you visit our profiles there or interact with us via these platforms, personal data may be processed both by us and by the respective platform provider.

This applies in particular to details from your user profile, content and messages you have published, and information about your interaction with our company profiles.

Depending on the specific processing operation, we process this data in particular to communicate with prospective clients, customers and job applicants, as well as for public relations and to present our company.

Our processing is carried out on the basis of our legitimate interest in public relations, corporate communications and the management of our online presence in accordance with Article 6(1)(f) of the GDPR. Where your contact with us is aimed at concluding or performing a contract, processing is carried out on the basis of Article 6(1)(b) of the GDPR.

3.7.1   Google Business Profiles

We maintain company profiles on Google, which in particular display information about our locations and enable interactions such as reviews. When these functions are used, Google processes personal data under its own responsibility.

Further information: https://policies.google.com/privacy?hl=de

3.7.2   Social media presence and Swat.io

We use Swat.io to manage and administer our social media accounts. Our processing is carried out on the legal bases set out above. Where Swat.io processes personal data on our behalf, this is done within the framework of data processing on behalf of the controller in accordance with Article 28 of the GDPR.

Further information: https://swat.io/de/legal/

 

4. Data transfer

Within HABAU Hoch- und Tiefbaugesellschaft m.b.H., personal data is exchanged to fulfil legal requirements and to streamline work processes.

In the course of contractual and pre-contractual activities (potential employees / customers / business partners), it may be necessary to transfer personal data to other companies both within and outside the European Economic Area. In some of these countries, the level of data protection may be lower than in the European Union.

When we transfer personal data, appropriate safeguards are put in place to ensure an adequate level of protection. You may request a copy of these safeguards.

4.1 Recipients

We distinguish between the following categories of recipients of personal data at HABAU Hoch- und Tiefbaugesellschaft m.b.H.:

  • Group companies
  • Subcontractors, suppliers, business partners
  • Data processors, provided they require the data to fulfil their respective services
  • Authorities, public bodies and institutions
  • Notaries, law firms, tax consultancy firms, debt collection agencies and experts for the purpose of asserting, exercising or defending legal claims
  • Audit firms for the fulfilment of accounting obligations
  • Insurance companies
  • Credit and financial institutions or similar organisations
  • Courts for the purpose of asserting, exercising or defending legal claims
  • Adjudication bodies

We only engage third parties who ensure an appropriate level of protection for personal data through suitable technical and organisational measures. Companies that provide maintenance or other services on our behalf and may, in this context, gain access to personal data are contractually obliged to maintain confidentiality. Where data processors are engaged to support or achieve the relevant purposes, personal data is disclosed exclusively to data processors who have been carefully selected in advance and are bound by contract.

4.2 Third parties outside the EU/EEA

In order to fulfil our contractual and legal obligations, it may be necessary to transfer personal data to companies and contractual partners based outside the European Union or the European Economic Area (EU/EEA), in particular for the purposes of providing services, operating and maintaining the website, processing orders, and maintaining our IT systems and software. Such data transfers do not affect our obligation to protect your personal data in accordance with this privacy policy.

Where personal data is transferred to countries outside the EU/EEA, we ensure an adequate level of data protection, either by transferring data to countries for which the European Commission has issued an adequacy decision, or by entering into appropriate contractual arrangements with the relevant data recipients outside the EU/EEA.

 

5. Duration of data retention

We process personal data to the extent necessary for the establishment, performance and fulfilment of the business relationship or for the use of individual services (e.g. newsletters). Processing takes place for the duration of the relevant business relationship or the provision of services and, beyond that, in accordance with the relevant statutory retention and documentation obligations and, where necessary, for the duration of an existing legitimate interest, in particular to assert, exercise or defend potential liability claims. Where processing is based on your consent, the personal data in question will generally be processed until you withdraw your consent or until the relevant purpose of processing ceases to apply, provided that no statutory retention obligations or other legal grounds require longer storage.

 

6. Technical and organisational measures

Ensuring appropriate availability, confidentiality and integrity, as well as safeguarding data protection, are fundamental objectives of HABAU Hoch- und Tiefbaugesellschaft m.b.H.´s information security. This approach to protection applies both to personal data and to all other information processed within our organisation.

Our technical and organisational measures for information security are state-of-the-art and based on internationally recognised standards and norms. These are regularly evaluated and improved as part of a management system.

 

7. Your rights as a data subject:

You are generally entitled at any time to the rights of access, rectification, erasure, restriction, data portability, withdrawal of consent and objection.

As a data subject, you have the following rights with regard to the processing of your data:

7.1 Right of access

You may at any time request information about the nature and content of the processing of your data, as well as about your stored data. Upon request, the data controllers must provide confirmation of the use of your data.

7.2 Right to rectification

You have the right to request the rectification of inaccurate data. Depending on the purpose of the processing, you also have the right to have incomplete data completed by means of a supplementary statement.

7.3 Right to erasure

You may request the erasure of your data at any time. The data controllers are obliged to erase the relevant data without delay, provided there are no legitimate grounds for not doing so.

7.4 Right to restriction of processing

You have the right to request that the processing of your data be restricted, provided there are no legitimate grounds for not doing so.

7.5 Right to data portability

Where the processing is based on your consent or a contract and is carried out by automated means, you have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format and to have it transmitted to another data controller in accordance with the statutory requirements.

7.6 Right to withdraw your consent

You may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent up until the time of withdrawal. To do so, simply send an informal email to ds-hg@habau.at .

7.7 Right to object

Where we process personal data on the basis of Article 6(1)(e) or (f) of the GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation. We will then no longer process the personal data in question, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

 

Please address any enquiries regarding the exercise of your data subject rights or other questions about data protection directly to ds-hg@habau.at . If you believe that HABAU Hoch- und Tiefbaugesellschaft m.b.H. is not implementing your data protection rights in accordance with the law, you are free to lodge a complaint with the competent supervisory authority. In Austria, this is the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, email:
dsb@dsb.gv.at ).

Should there be any changes to your personal data, please notify us immediately.

 

8. Data Protection Contact

As the central point of contact for all data protection enquiries, you can contact us at any time by email at
ds-hg@habau.at . Your enquiry will be forwarded to the relevant staff member for processing.

You are also welcome to write to

HABAU Hoch- und Tiefbaugesellschaft m.b.H., Greiner Straße 63, 4320 Perg

 

Status: 1st October 2026, HG_1-500_AW_02_EN, Revision 2.1