Opens in a new tab
Legal

Privacy Policy

This statement informs you about what personal data we process when you visit this website, for what purposes we use it, and what rights you have. The relevant legal basis is the General Data Protection Regulation (GDPR) and the Luxembourg law of August 1st, 2018 on the organization of the National Commission for Data Protection and the general data protection regulation.

1. Responsible party

Hecker Holzbau S.à r.l.
2 Route de Beaufort
L-6360 Grundhof
Luxembourg

Phone: +352 26 78 13
Email: [email protected]

You can also reach us for all questions regarding data protection under these contact details.

2. Website and hosting request

With every call to the website, the web server automatically processes the data that your browser transmits: IP address, date and time, requested page or file, amount of data transferred, status message, previously visited page (referrer), as well as browser type and operating system. We need this data to deliver the website, ensure its stability, and fend off attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The log data is stored only for as long as necessary for these purposes and is then automatically deleted.

The website is operated by FlyingHost, an offering of FlyingWeb LLC, 651 N Broad St, Suite 201, Middletown, Delaware 19709, USA. The servers are located in Germany. FlyingHost delivers the website via the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, and protects it from attacks; your request is routed via the nearest Cloudflare location. Both companies are acting as technical service providers for us. Access from the USA cannot be ruled out. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of July 10, 2023, Art. 45 GDPR).

3. Cookies and consent

This website only uses cookies that are technically necessary. The consent window cookies store your selection so that we do not have to ask you again every time you visit a page. These cookies are set by the website itself; their names begin with „cmplz_“:

  • cmplz_banner-status: remembers that you have closed the consent window. Storage duration: 12 months.
  • cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing: store your selection per category. Storage duration: 12 months.
  • cmplz_consented_services: stores which individual services you have agreed to. Storage duration: 12 months.
  • cmplz_policy_id: stores the version of the consent texts that your selection refers to. Storage duration: 12 months.

To protect the website, Cloudflare (see section 2) also sets two cookies:

  • __cf_bm: helps distinguish automated access from real visits. Storage duration: 30 minutes.
  • cf_clearance: stores that your browser has passed the security check so that it is not repeated with every page load. Storage duration: up to 12 months.

According to Cloudflare, these cookies are not used to track visitors across multiple websites.

The legal basis is Article 4(3)(e) of the amended law of 30 May 2005 on the protection of privacy in electronic communications, in conjunction with Article 6(1)(c) and (f) of the GDPR: The cookies are necessary to implement your decision and to be able to prove it.

We only load external content after you have given your consent (Art. 6(1)(a) GDPR). Currently, this applies to the card on the contact page (see section 8). You can revoke or change your consent at any time with effect for the future: via the „Cookie Settings“ link at the bottom of each page.

4. Contact

If you contact us via the contact form, by email or by phone, we process your information to process your request. The contact form includes your name, email address, your message and, if you provide it, your phone number. In addition, we store the date of the request, the page from which you submitted the form, as well as the browser and device type. We do not store your IP address.

The legal basis is Art. 6(1)(b) GDPR if your request is aimed at a contract or an offer; otherwise, our legitimate interest in answering requests (Art. 6(1)(f) GDPR). We delete the data as soon as your request is finalized and no statutory retention obligations apply. We keep business correspondence for ten years under Luxembourgian commercial law.

5th Project Application

Through the „Request project“ form, we collect information about your construction project (type of project, description, desired timeframe, location), as well as your name, phone number, email address, and any comments. We use this information to assign your request to the appropriate contact person, to contact you, and to prepare a quote. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures regarding your request). For the additional technical information stored and the storage period, see section 4.

6. Applications

If you apply via the application form or by email, we process the data you provide to us: name, place of residence, phone number, email address, information about your professional experience, your message, the desired position and the documents you upload or send. We use this data exclusively for the application process. The legal basis is Art. 6(1)(b) GDPR (starting an employment relationship). Only the persons involved in the selection process have access to this data.

If no employment relationship is established, we will delete your records no later than six months after the completion of the procedure, unless you have agreed to longer retention. Upon hiring, we will enter the necessary data into the personnel file.

7. Range measurement

We measure the use of this website using a statistical software that runs on our own server. It does not set any cookies and does not transmit any data to third parties. The pages accessed and their sequence, time and duration of the visit, the referring page, device type, browser and operating system, the approximate location (country and city from which the IP address is derived), campaign identifiers in links, and clicks on links and submission of forms are recorded, each without any content. Your IP address is not stored. It is only used to create a non-recalculable value together with the browser identifier to count visits.

The legal basis is our legitimate interest in tailoring the website to meet demand and in measuring its reach (Art. 6(1)(f) GDPR). You may object to this processing at any time; a message to the contact details mentioned in section 1 will suffice.

8th map from OpenStreetMap

On the contact page, we display a map from OpenStreetMap. It is only loaded when you have given your consent (Art. 6(1)(a) GDPR). Then your browser calls up the map images directly from the servers of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. Your IP address, information about the browser and device, as well as the address of the page accessed are transmitted in this process. For the United Kingdom, there is an adequacy decision by the European Commission (Art. 45 GDPR). Further information: osmfoundation.org/wiki/Privacy_Policy.

9. Fonts, Videos and external links

We provide fonts and videos from our own server. This does not create a connection to third parties. References to other websites, for example to our profiles on Facebook and Instagram or to route planning, are simple links. Data is only transmitted when you click on such a link; then the privacy policy of the respective provider applies.

10. Recipient

Within our company, only the individuals who need the data for the stated purposes have access to your data. Service providers for hosting, website maintenance, and email processing process data on our behalf and in accordance with our instructions. We only share data with other third parties when we are legally required to do so or you have given your consent.

11. Your rights

You have the right to information about your data (Art. 15 GDPR), rectification (Art. 16), deletion (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can revoke a given consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object: To the extent that we process data based on legitimate interests (Article 6(1)(f) of the GDPR), you may object to this processing at any time for reasons arising from your particular situation (Article 21 of the GDPR).

To exercise your rights, simply send a message to the contact details mentioned in section 1. You also have the right to complain to a supervisory authority. The Commission nationale pour la protection des données (CNPD) is responsible for us, located at 15, Boulevard du Jazz, L-4370 Belvaux, Tel (+352) 26 10 60-1., cnpd.public.lu.

12. Mandatory information and automated decisions

Providing your data is voluntary. However, without the information marked as mandatory fields, we cannot process your request or application. Automated decision-making, including profiling within the meaning of Article 22 GDPR, does not take place.

13. Security

This website transmits all data encrypted (TLS). E-mails can be transmitted on the transmission path in an unencrypted form; therefore, please send us confidential documents via the form or by post.

14th Stand and language versions

We will update this statement as the website or the legal situation changes. The German version is authoritative; translations are provided for information purposes.

Status: October 2026

Timber construction lead enquiry