PlanRadar securely and sensitively handles your personal data in accordance with all applicable data protection provisions, in particular the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). Personal data is all information that pertains to identified or identifiable natural persons, for example name, address, email addresses or IP addresses.
As a provider of cloud-based Software as a Service (SaaS) products, in particular the PlanRadar solution for construction documentation, task and defect management, PlanRadar primarily acts as a processor for users of its products within the meaning of Article 4 (8) GDPR. Independently of this, PlanRadar also processes personal data under its own responsibility and thus acts as a Controller within the meaning of Article 4 (7) GDPR.
This privacy policy concerns the processing in which PlanRadar GmbH (Kärntner Ring 5-7, Top 201, 1010 Vienna, Austria, registered under company number (FN) 400573d at the Vienna Commercial Court) is the Controller within the meaning of Article 4 (7) GDPR (hereafter called the “Controller” or “we”).
The Controller’s Data Protection Officer can be reached at the above-mentioned address and via email at [email protected].
As Controller, PlanRadar processes personal data in various ways and for various purposes:
By only visiting our website or using our products (e.g. installing our apps), without registering or providing other information, we process only the personal data that your device transfers to our servers. This includes IP addresses, technical information on the browser and operating system, the approximate place of residence and possible error messages (e.g. crash notifications).
The legal basis for this processing is for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically the analysis and guaranteed operation of our websites and our products.
This data is not transferred to third parties.
Providing the listed information is not a statutory requirement but is required for the operation of our website or use of our products.
We use our own cookies and the cookies of selected partners during website visits. In addition, we also use various tools for analysis and optimisation (e.g. web and app tracking, performance tracking) when our websites are visited and our products are used. Cookies and these optimisation/analysis tools are used only if and to the extent that your consent has been obtained, unless they are required for the functionality or guaranteed safe operation of our websites or our products. You can find more information on the cookies and analysis tools used here.
If you have granted us your consent to do so, we also use these tools to process your IP address and technical information about your browser and operating system, the approximate place of your residence, demographic information, the source of our website visitors and activity data such as clicks and page views to improve the user experience and our range of information, and to analyse and optimise the operation of our websites and our products, including the optimisation of our marketing activities.
The legal basis for this processing is your explicit consent (Article 6 (1) (a) GDPR) and for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically the analysis and guaranteed operation of our websites and our products. You can partially withdraw (limit) or fully withdraw your consent to the use of cookies and the mentioned analysis tools at any time via this link.
We may disclose your data to the recipients listed under Point 14 to achieve the purposes listed above.
Providing the listed data is not a statutory requirement but is, in some cases, required to provide particular functionalities of our websites or products. If this data is not provided or is partially provided, you may be unable to use or have restricted use of certain functions of our websites or our products. There are no negative consequences to refraining from providing data for optimisation and analysis purposes.
If you do not only use our websites for information purposes but make use of additional functions and services that our websites and products offer (e.g. the contact form, chat, webinar) or would like to participate in information campaigns, as a rule you must provide us with additional personal data for us to process your enquiries and make the provided functions available. This typically includes information that we require to contact you, for example first name, surname, email address, telephone number and company master data. We process this data together with the data collected in connection with visiting our website and using our products (see Point 2 ), in particular the IP addresses collected and the activity data associated therewith (e.g. clicks, page call-ups, etc.). Furthermore, we process the data made available to us by transferring it to our CRM system (see Point 9 ).
The legal basis for this processing is your express consent (Article 6 (1) (a) GDPR), to take steps prior to entering into a contract or to fulfil our contractual obligations (Article 6 (1) (b) GDPR) and for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically the analysis and guaranteed operation of our websites and products, continuous improvement of our products and optimisation of our marketing activities. In some instances, we complete data sets processed by us with the use of data enrichment solutions to obtain a full data set about you (Data Enrichment, see Point 7).
We may disclose your data to the recipients listed under Point 14 to achieve the purposes listed above.
Providing the listed data is not a statutory requirement but is required to contact you and to use the provided functions of our websites and products. If this data is not provided or is partially provided, you may be unable to use certain functions of our websites and products or have limited use of these, or we may not be able to contact you. There are no negative consequences to refraining from providing data for optimisation and analysis purposes.
If you contact us at trade fairs or exhibitions, for example, and provide your data to us, by handing us business cards or completing a form for example, we process the data made available to us by transferring it to our CRM system (see Point 9). This typically includes information that we require to contact you, for example first name, surname, email address, telephone number and company master data.
The legal basis for this processing is to take steps prior to entering into a contract (Article 6 (1) (b) GDPR) and for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically establishing a business relationship and maintaining our business contacts (CRM). In some cases, we also supplement the data by collecting data from third parties (Data Enrichment, see Point 7).
Providing the listed data is not legally stipulated but is required to contact you. If this data is not provided or partially provided, we may not be able to contact you and enter into a business relationship with you.
If you subscribe to our newsletter, we process your contact details, in particular your email address, first name, surname, title and IP address to send our marketing newsletter. We also process information on which newsletter we have sent you, whether and when you have opened this, whether it could be delivered, whether you have subscribed or unsubscribed to the newsletter and if you have clicked on links in the newsletters, which and how many. In particular, we process the data made available to us by transferring it to our CRM system (see Point 9).
The legal basis for this processing is your express consent (Article 6 (1) (a) GDPR). You can withdraw your consent to receiving the marketing newsletter at any time. To do this, you can unsubscribe from the marketing newsletter at any time by using the link within the newsletter or by emailing [email protected].
We may disclose your data to the recipients listed under Point 14 to achieve the purposes listed above.
Providing the listed data is not a statutory requirement but is required for our marketing newsletter to be sent. If this data is not provided or is partially provided, we may not be able to send you our marketing newsletter.
In general, we collect personal data directly from you, so that as a rule you can decide on making your personal data available to us. However, in some cases we may obtain personal data from other sources.
These other sources are primarily the internet, from which we obtain publicly available information. In addition, we also obtain information from data enrichment providers. In individual cases, we also obtain information from third parties (e.g. credit agencies).
This personal data is typically limited to contact information (first name, surname, email address, telephone number, postal address) as well as information on your work for a specific company, the company headquarters, the company industry and your role in this company.
If you apply to work with us, we may also process information from publicly available sources on your educational and professional background.
The legal basis for this processing is our legitimate interest (Article 6 (1) (f) GDPR) in a complete data set about you, which is required for professional communication and the establishment of a business relationship or the application process. In general, the recipients and storage duration of this data comply with the respective processing for which the data was collected.
We may disclose your data to the recipients listed under Point 14 to achieve the purposes listed above.
If you create a (test) account to use our products, we process (i) information that we assign to you as a (test) Account Owner and require to contact you. This includes your first name, surname, email address, telephone number (ii), company master data (e.g. company name, postal address, email addresses, telephone numbers, contact person, role), (iii) information on the type and content of our contractual relationship (e.g. number, type and duration of activated licences and information on the requested and created offers), (iv) marketing-relevant information such as industry and target group as well as information on the origin and history of (test) accounts (e.g. responsible sales partners, date of last contact, clicked adverts).
In terms of individual users of our products who are assigned to a specific (test) account, we process information that we require to contact and uniquely assign the user. This includes contact details such as first name, surname, email address, telephone numbers and company details as well as information that we require to manage the user account (e.g. the (test) account that the user is assigned to, licence number, date on which the account was created, account type, whether the account is active/inactive).
In addition, we also process information on the activities of our users in our products, in particular activity data such as the number of projects created, number of tickets created and the device used.
The legal basis for this processing is to take steps prior to entering into a contract or to fulfil our contractual obligations (Article 6 (1) (b) GDPR) and for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically the analysis and guaranteed operation of our websites and products, continuous improvement of our products and optimisation of our marketing activities.
If we have received the respective consent, we also process the contact details of users of our products together with their activity data to (i) interactively support new users with the use of our products and facilitate their use of our products (Onboarding, see Point 10) and (ii) to provide information on (new) product functions or updates/upgrades and, if applicable, the status of the account and to (iii) hold customer surveys on improving service quality. For these purposes, we may also contact you via email, phone, video conference and/or by notifications in our products (e.g. pop-up windows, push-notifications). If you have given us your consent for this, we may also list you as a reference customer on our websites.
The legal basis for this processing is your express consent (Article 6 (1) (a) GDPR). You can withdraw this consent at any time, for example by emailing [email protected] or simply deactivating this in your individual profile settings.
If you activate a paid account with us, we process payment information in addition to the above-mentioned data. Payment information includes invoice recipients, invoice addresses, invoice numbers, invoice period, due date, bank details, payment conditions, contact person for invoices, VAT ID, etc.
The legal basis for this processing is to fulfil our contractual obligations (Article 6 (1) (b) GDPR), to fulfil our legal obligations (Article 6 (1) (c) GDPR) and for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically the optimisation of our accounting processes and for liquidity management purposes.
We specifically process the listed data by transferring it to our CRM system (see Point 9).
If you activate the functions of PlanRadar Connect, we process the respective package information (e.g. Workato-ID, company name, task quota and term of the package) and the information from technical protocols required for operating PlanRadar Connect (e.g. workflow-logfiles, possible error messages) in addition to the above-mentioned data.
The legal basis for this processing is to fulfil our contractual obligations (Article 6 (1) (b) GDPR), to fulfil our legal obligations (Article 6 (1) (c) GDPR) and for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically the analysis and guaranteed operation of our products.
PlanRadar Connect is hosted and provided by Workato, Inc (“Workato”). Workato is a provider headquartered in the USA. We have concluded a contract with Workato in accordance with standard contract clauses within the meaning of Article 46 (2) GDPR, in which Workato is obliged to process user data only in accordance with our instructions and to comply with EU data protection levels. You can obtain more information on this here: Workato Services Privacy Policy
We may also disclose your data to the recipients listed under Point 14 to achieve the purposes listed above.
Providing the listed data is not a statutory requirement but is required to initiate, maintain and fulfil the business relationship and to meet our legal obligations. If this data is not provided or partially provided, we may not be able to conclude a contract with you or support you when you use our products.
We use the services of Hubspot. Hubspot is a Customer Relationship Management (CRM) subscription and marketing automation system from Hubspot Inc. (25 First Street, 2nd Floor, Cambridge, MA 02141, USA) with subsidiaries in Ireland (Ground Floor, Two Dockland Central, Guild Street, Dublin 1) and Germany (Am Postbahnhof 17, 10243 Berlin).
We use Hubspot for contact management, email marketing (newsletters and automated mailings), providing product information such as new functions or updates/upgrades), reporting (traffic sources, access, etc.), landing pages and contact forms.
If you create a test account to use our products, activate a paid account or are invited to create an account by an account owner, or disclose to us contact information and other demographic information in another way (e.g. in a contact form on our website), we may transfer this information and any content retrieved from our website or in our products, to Hubspot Hubspot’s services help us to subsequently contact website visitors, interested parties and users of our products and, additionally, to answer their enquiries and to determine which of our company services would be of interest to them. What’s more, Hubspot’s services also improve the efficiency when working with our products and help to generally improve user experience and service quality when one uses our products and visits our websites.
If you have granted us consent to this, we also process your contact details such as email address, first name, surname, title and IP address for email marketing and to provide product information such as new functions, unused functions or updates/upgrades and, if applicable, information on account status. You can withdraw your consent at any time, by emailing [email protected] or simply deactivating this in your individual profile settings.
The legal basis for this processing is your express consent (Article 6 (1) (a) GDPR) and for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically improving user experience and service quality when our products are used or our websites are visited (e.g. quick and efficient processing of enquiries).
Hubspot is a provider headquartered in the USA. We have therefore concluded a contract with HubSpot in accordance with standard contract clauses within the meaning of Article 46 (2) GDPR, in which HubSpot is obliged to process user data only in accordance with our instructions and to comply with EU data protection levels. You can obtain more information on this here: https://legal.hubspot.com/de/dpa and here (German): https://legal.hubspot.com/de/privacy-policy
Furthermore, we use the customer relationship management system Zoho CRM from Zoho Corporation, 4141 Hacienda Drive Pleasanton, CA 94588, USA to store and efficiently manage our contact details.
Zoho is a provider headquartered in the USA. We have therefore concluded a contract with Zoho in accordance with standard contract clauses within the meaning of Article 46 (2) GDPR, in which Zoho is obliged to process user data only in accordance with our instructions and to comply with EU data protection levels.
You can view more information on Zoho’s website here: https://www.zoho.com/gdpr.html
The legal basis for this processing is for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically establishing a business relationship and maintaining our business contacts (CRM).
We use various tools to process data stored in our CRM system. This includes the sales platform SalesLoft that we use to improve organisation of our sales processes. To do this, SalesLoft accesses some of the customer details contained in our CRM systems (contact information and company information) and merges this with information on interactions with us (e.g. telephone calls, communication via email and/or social networks). This information helps us to centrally coordinate our sales activities and to always communicate with our customers authentically, with up-to-date information.
SalesLoft is a provider headquartered in the USA. We have therefore concluded a contract with SalesLoft in accordance with standard contract clauses within the meaning of Article 46 (2) GDPR, in which SalesLoft is obliged to process user data only in accordance with our instructions and to comply with EU data protection levels.
The legal basis for this processing is for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically the continuous optimisation of our sales processes.
If such consent has been obtained, we process the contact details of our product users together with the activity data in our products to interactively support (new) users when using our products and to facilitate their use of our products (onboarding). For this purpose, we use the services of the following providers:
A) Pendo, 150 Fayetteville Street Suite #1400, Raleigh, NC, 27601 USA.
If Pendo’s service is used, information is collected on which walk-thrus have been completed within our products and which Pendo widgets have been opened within our products. Pendo does not collect any personal data except for IP addresses and the approximate geolocation of the user (country and city in which they are located). Pendo assigns the collected metadata to anonymous random GUIDs.
Pendo is a provider headquartered in the USA. We have concluded a contract with Pendo in accordance with standard contract clauses within the meaning of Article 46 (2) GDPR, in which Pendo is obliged to process user data only in accordance with our instructions and to comply with EU data protection levels. You can find additional information on data privacy at Pendo here: https://www.pendo.io/legal/privacy-policy/.
The legal basis for this processing is your express consent (Article 6 (1) (a) GDPR). You can withdraw your consent at any time, by emailing [email protected] or simply deactivating this in your individual profile settings.
We may disclose your data to the recipients listed under Point 14 to achieve the purposes listed above.
If you are our business partner or supplier or would like to become one, we process (i) information that we require to contact you (e.g. first name, surname, email address, telephone number) (ii) company master data (e.g. company name, company register number, postal addresses, email addresses, telephone numbers, contact people, role) as well as (iii) payment information (e.g. invoice recipients, invoice addresses, invoice numbers, invoice period, bank details, contact person for invoices, VAT ID, etc.) to initiate, maintain and fulfil our goods and services contracts and to conduct the ongoing business of our company.
The legal basis for this processing is to take steps prior to entering into a contract or to fulfil our contractual obligations (Article 6 (1) (b) GDPR), to fulfil our legal obligations (Article 6 (1) (c) GDPR), and for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically the optimisation of our accounting processes and for the purposes of liquidity management.
We may disclose your data to the recipients listed under Point 14 to achieve the purposes listed above.
Providing the listed data is not a statutory requirement but is required to initiate, maintain and fulfil the business relationship and to meet our legal obligations. If this data is not provided or partially provided, we may not be able to conclude a contract with you.
If you submit a job application to us, we process all the data that you provide in your application (CV, cover letter, other documents such as school certificates and recommendation letters). These typically include personal data (name, date and place of birth, nationality), contact details (email and postal address, telephone number, social media profiles), and other information (photo, training/skills/knowledge/official assessments/certificates/experience, professional experience, hobbies and interests, family members). We ask you to refrain from communicating any special categories of personal data in your application. This includes information indicating your racial and ethnic background, political opinions, religious or philosophical beliefs or trade union membership, as well as health data or data on your sexual life or orientation. Such information is automatically saved together with your other data and is not processed separately.
If you give us your consent to this, we also keep you on file as an applicant.
The legal basis for this processing is to take steps prior to entering into a contract (Article 6 (1) (b) GDPR), your consent, if applicable (Article 6 (1) (a) GDPR) and for the purposes of our legitimate interests (Article 6 (1) (f) GDPR), specifically the optimisation of our application processes.
We may disclose your data to the recipients listed under Point 14 to achieve the purposes listed above.
Providing the listed data is not a statutory requirement but is required for the application procedure. If this data is not provided or partially provided, we may not be able to process your application and establish an employment relationship.
If you subscribe to our HR-newsletter, we process your contact details such as your email address, first name, surname and IP address to send our HR-newsletter. We also process information on which HR-newsletter we have sent you, whether and when you have opened this, whether it could be delivered, whether you have subscribed or unsubscribed to the HR-newsletter and if you have clicked on links in the HR-newsletters, which and how many. In particular, we process the data made available to us by transferring it to our CRM system (see Point 9).
The legal basis for this processing is your express consent (Article 6 (1) (a) GDPR). You can withdraw your consent to receiving the HR-newsletter at any time. To do this, you can unsubscribe from the HR-newsletter at any time by using the link within the HR-newsletter or by emailing [email protected].
We may disclose your data to the recipients listed under Point 14 to achieve the purposes listed above.
Providing the listed data is not a statutory requirement but is required for our HR-newsletter to be sent. If this data is not provided or is partially provided, we may not be able to send you our HR-newsletter.
Your data may be transferred by us to the following recipients or categories of recipients in accordance with the processing described above:
| Recipients | Processing concerning data from or in relation to | Headquartered in | Basis for transfer to a third country |
|---|---|---|---|
| App and web tracking providers (currently Google Analytics, Hotjar, Adjust (app only), Firebase) | Website visitors and interested parties (Point2, 3) Users of our websites and products (Point 4) | Germany (Adjust) USA (other providers) | Standard contract clauses Consent |
| Performance tracking providers (currently LinkedIn Insights Tag, Facebook Pixel, Hubspot Pixel, MS App Center) | Website visitors and interested parties (Point2, 3) Users of our websites and products (Point 4) | USA (other providers) | Standard contract clauses Consent |
| CRM service providers (currently Hubspot and Zoho) and tools based on these (currently, Zapier, Zoho One, SalesLoft) | Users of our websites and products (Point 4) Personal contact (Point 5) Subscribing to the marketing newsletter (Point 6) Customers (Point 8) Business partners and suppliers (Point 11) Subscribing to the HR-newsletter (Point 13) | USA | Standard contract clauses Consent |
| Data enrichment providers (currently Lusha) | Users of our websites and products (Point 4) Personal contact (Point 5) | USA (Lusha)Helsinki | Standard contract clauses Consent |
| Digital adoption platform provider (currently Pendo) | Customers (Point 8) | USA | Standard contract clauses Consent |
| Integration Platform Provider (currently Workato) | Customers (Point 8) | USA | Standard contract clauses Consent |
| Business software providers (currently BMD, Zoho One) | Customers (Point 8) Business partners and suppliers (Point 11) | Partly in the USA | Standard contract clauses Consent |
| IT service providers (currently Microsoft, Adobe ID, LogMeIn, Zoho One, Zoom) | Customers (Point 8) Business partners and suppliers (Point 11) Applicants (Point 12) | USA | Standard contract clauses Consent |
| Payment providers (currently Fastspring and Stripe) | Customers (Point 8) Business partners and suppliers (Point 11) | USA | Standard contract clauses Consent |
| Chartered public accountants and tax consultants | Customers (Point 8) | AT | |
| Banks | Customers (Point 8) Business partners and suppliers (Point 11) | AT | |
| Courts and administrative authorities if required | Customers (Point 8) Business partners and suppliers (Point 11) Applicants (Point 12) | AT | |
| Legal representative if required | Customers (Point 8) Business partners and suppliers (Point 11) Applicants (Point 12) | AT | |
| Recruiting service provider (currently Greenhouse) | Applicants (Point 12) | AT | |
| Payroll accountant | Applicants (Point 12) | AT |
In general, your data is only kept for as long as required for the respective purpose:
Data is then deleted unless such deletion, in some individual cases, conflicts with any of our legitimate interests (e.g. continued storage of data as evidence, or to establish or defend legal claims, taking into consideration the relevant applicable limitation periods).
Right of access (Article 15 GDPR): You have the right to obtain confirmation as to whether or not personal data concerning you is processed.
Right to rectification (Article 16 GDPR): If we process your data and this is incorrect or incomplete, you have the right to request its rectification or completion.
Right to erasure (Article 17 GDPR): You have the right to request erasure of your personal data where one of the following grounds applies:
As stated above, there may be reasons that preclude immediate deletion, for example in the case of legally prescribed storage obligations.
Right to restriction of processing (Article 18 GDPR): You have the right to request restriction of processing if:
Right to data portability (Article 20 GDPR): You have the right to receive any personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You have the right to transmit this data to another controller if we process this data on the basis of consent that you gave, or to fulfil a contract between us and this processing is carried out by automated means.
Right to object (Article 21 GDPR): If we process your data to perform a task that is carried out in the public interest, or in the exercise of official authority vested in us or on the basis of a legitimate interest, you have the right to object to this data processing. In this case, we shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or unless this is for the establishment, exercise or defence of legal claims. You can withdraw consent to processing for marketing purposes and the creation of a user profile associated with this, at any time.
Exercise of rights: You can exercise your rights against us at any time. To do this, you can contact us via email at [email protected] or via one of the contact options on our websites.
Withdrawing your consent: Insofar as we process data on the basis of your consent, you have the right to withdraw this at any time by emailing [email protected]. The lawfulness of processing based on the consent until it is withdrawn, remains unaffected by withdrawal.
Right to lodge a complaint: If you think that we have infringed GDPR, you have the right to lodge a complaint with the responsible supervisory authority (in Austria, this is the Data Protection Authority, www.dsb.gv.at).