Privacy Policy

A. General Information

Thank you for your interest in our company. Data protection is of utmost importance to the management of PORR AG. In general, the use of the PORR AG website is possible without providing any personal data. However, if a data subject wishes to use special services of our company via our website, the processing of personal data may become necessary. If this is required, we will obtain the consent of the data subject.

The processing of personal data is always carried out in compliance with the General Data Protection Regulation (GDPR) and in accordance with national data protection regulations. With this privacy policy, our company aims to inform visitors about the content and purpose of the personal data we collect and process. Additionally, data subjects are informed about their rights through this privacy policy.

As the operator of the website, PORR AG has implemented extensive technical and organizational measures to ensure the reliable protection of the data processed via this website. However, data transmissions between your device and our server may generally have vulnerabilities, especially if you are communicating with our server using a device that is accessible by others. If you have concerns about security, you can obtain information through other means, such as by phone or at one of our branch offices.

B. Definitions

The privacy policy of PORR AG is based on the provisions and definitions of the General Data Protection Regulation (GDPR). Our privacy policy is intended to be easy to read and understand for both visitors and customers and business partners. To ensure this, we would like to explain the terms used in advance:

  1. Personal Data
    Personal data refers to any information relating to an identifiable natural person.

  2. Data Subject
    A data subject is any identifiable natural person whose personal data is processed by a responsible company.

  3. Controller
    The controller is the company that collects the data of data subjects and decides on the purposes and means of processing.

  4. Processor
    The processor is a natural person or a company that is involved in processing by the controller.

  5. Recipient
    The recipient is a natural or legal person or public authority to whom personal data is made accessible.

  6. Third Party
    A third party is a natural or legal person or public authority that processes personal data on behalf of the controller or processor.

  7. Processing
    Processing is any operation performed in connection with personal data, ranging from collection to storage to restriction or deletion of the data.

  8. Restriction of Processing
    Restriction of processing means a reduction in the use of personal data.

  9. Consent
    Consent is any declaration made by a person indicating that they agree to the processing of their personal data.

  10. Withdrawal
    Withdrawal means that a person revokes the controller's right to process data based on previously given consent.

  11. Pseudonymization
    Pseudonymization separates the data from the identifiable person. This connection can only be restored with the help of additional, specially secured information. The process of pseudonymization corresponds to so-called data minimization.

  12. Profiling
    Profiling is any type of automated evaluation of personal data.

C. Controller

Controller in the sense of the GDPR is: PORR AG
Absberggasse 47
1100 Vienna
Austria
Tel.: +43 50 626-0
E-Mail: datenschutz@porr.at
Website: https://karriere.porr.at/

D. Data Collection

This website of PORR AG collects a series of data and information each time the website is accessed, which are stored in the server's log files. The following data is collected in this way:

  1. Browser types and versions,
  2. The operating system of your computer,
  3. The website from which you were referred to us,
  4. The pages accessed on our web server,
  5. The date and time of your visit,
  6. Your IP address,
  7. Your Internet Service Provider.

When using this anonymously collected information, PORR AG does not attempt to draw any conclusions about the data subject. However, this data is necessary to correctly deliver the content of our website and to display it optimally for you, as well as to provide authorities with the necessary information in the event of a hacker attack. Therefore, this data is processed by PORR AG for statistical purposes on the one hand, and as a technical measure on the other hand, to ensure data protection and information security in this processing and of your data.

E. Registration on Our Website

You have the option to register on our website. The data entered by the data subject is processed exclusively for internal use by the controller and for our own purposes.

When you register on our website, the IP address assigned by your Internet Service Provider, the date, and the time of registration are stored. This data is generally not shared with third parties unless there is a legal obligation to do so or if the sharing serves law enforcement purposes.

Registration allows us to offer you content or services that can only be provided to registered users. As a registered user, you have the right to change or completely delete the data you provided at any time.

F. Cookies

The websites of PORR AG use cookies—these are text files that are stored in a computer’s file system via an internet browser.

Cookies contain a cookie ID, which is a unique identifier. They enable PORR AG to distinguish the browser of the data subject from other internet browsers and to display content individually to respond to the preferences and needs of the user.

An example is the cookie of a shopping cart in an online store. The online store remembers the items a customer has placed in the virtual shopping cart through a cookie.

Through our cookie settings, you can conveniently choose which cookies you want to use at any time.

Cookies already stored on your computer can be deleted at any time via the internet browser or directly in the file system. Please note that disabling cookies may result in a limited functionality of the website.

G. Subscription to Our Newsletter

Our website offers users the option to subscribe to our newsletter. We regularly inform our customers and business partners about our offers through newsletters or information subscriptions. After you register, a confirmation email will be sent to the registered email address using the double opt-in procedure. This confirmation email is used to ensure that you, as the owner of the email address, have indeed authorized the receipt of the newsletter and have consented to it in accordance with Article 6(1)(a) GDPR.

When you subscribe to the newsletter on our website, your email address, the IP address assigned by your Internet Service Provider, the date, and the time of the subscription will be stored. This data will not be shared with third parties unless there is a legal obligation to do so or if the sharing serves law enforcement purposes.

The sent messages contain a tracking pixel that helps us to note the successful receipt and opening of the sent messages, enabling us to improve our offerings based on our legitimate interest.

You can avoid the activation of the tracking pixel by not loading the images in the sent email and only viewing the text version.

For technical reasons, the receipt of our messages cannot be separated from the sending of the tracking pixel.

The following data is collected via the tracking pixel:

  • Email address
  • Contact details
  • Device specifications
  • IP address
  • Timestamp of the request

Of course, you can unsubscribe from our newsletter at any time, which will result in the immediate deletion of your data for this processing. You will find the necessary information and an unsubscribe link at the end of each newsletter.

H. Sending of Publications

Our publications (magazine and e-paper) focus on national and international projects as well as the sharing of knowledge and experience across all areas of the construction industry.

The publications offer readers a comprehensive view of the complex challenges and innovative solutions along the value chain of the construction industry. A special feature is that the articles are written by our own experts.

For the purpose of sending the ongoing publication, we need to process the recipient's name, address, and, in the case of electronic delivery, the email address.

The legal basis is either your consent or our legitimate interest in informing recipients about current topics in the construction industry. If you wish to stop receiving our publications in the future, please notify us briefly at datenschutz@porr.at or by mail to the address provided in section (C). In this case, we will delete your contact details from this processing and stop any further mailings.

I. Photo and Video Recordings at Events

During our events, photo and video recordings are made, which may subsequently be published on websites, social media channels, in our publications, and other print media. Our aim is to promote our products and events, as well as the company itself, and to increase awareness in the construction industry.

The legal basis for this is our legitimate interest under Article 6(1)(f) GDPR and Sections 12 and 13 of the Data Protection Act (DSG): Public relations and the representation of the activities of the controller.

If you do not agree with photo or video recordings during our events, please contact a representative of our company during the event.

We have carefully weighed the interests of the data subjects and our company in this processing and are confident that no rights of the data subjects are being violated. Nevertheless, you have the right to object to the processing of the created photo and video recordings. Please send an email with a brief description of your objection to datenschutz@porr.at.

J. Contact Possibility via the Website

Our website contains information required by law that enables quick contact with PORR AG. If you contact us via email, the data you provide will be automatically stored and used exclusively for responding to your inquiry.

If you use a contact form on our websites, we collect the following data from you:

  • Name
  • Email
  • Phone number
  • Company name
  • Your personal message.

By entering your data, you also agree to its use for the purpose of responding to your inquiry in accordance with Article 6(1)(a) GDPR.

Unless other purposes arise from the response, of which we will inform you separately, the data entered will be deleted after your inquiry has been answered or processed.

K. Routine Deletion and Blocking of Personal Data

PORR AG processes and stores personal data of the data subject only for the period necessary to achieve the storage purpose or as required by legal provisions.

If the purpose or legal basis for processing no longer applies, your personal data will be lawfully blocked or deleted based on our processes.

L. Data Subject Rights

Comprehensive rights for data subjects apply in accordance with the GDPR concerning the processing of personal data. Below is a brief list of these rights for your information:

  1. Right of Access
    Every data subject has the right to obtain from the controller, at any time, information about the personal data stored about them, as well as a copy of these data.

  2. Right to Rectification
    Every data subject has the right to demand the immediate rectification or completion of inaccurate personal data concerning them.

  3. Right to Erasure
    Every data subject has the right to request the deletion of personal data concerning them from the controller if:

    • The purposes for processing no longer apply.
    • The legal basis for processing no longer exists (e.g., the contract has ended, consent has been revoked). You can request the deletion of your data stored with us at any time by contacting an employee—particularly via email at datenschutz@porr.at.

  4. Right to Restriction of Processing
    Every data subject has the right to request the restriction of processing from the controller if:

    • The purposes for processing no longer apply.
    • The legal basis for processing no longer exists (e.g., the contract has ended, consent has been revoked). You can request the restriction of your data stored with us at any time by contacting an employee—particularly via email at datenschutz@porr.at.

  5. Right to Data Portability
    Every data subject has the right to receive the personal data they have provided, in a structured, commonly used, and machine-readable format, or to have it transmitted to another controller without hindrance by the controller, provided the processing is based on consent or a contract and is carried out by automated means. You can request the transfer of your data stored with us at any time by contacting an employee—particularly via email at datenschutz@porr.at.

  6. Right to Object
    Every data subject has the right to object to the processing of personal data concerning them, which is carried out on the basis of legitimate interest. PORR AG will no longer process the personal data in the event of an objection unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject or serve the establishment, exercise, or defense of legal claims. You can exercise the right to object at any time by contacting an employee—particularly via email at datenschutz@porr.at.

  7. Automated Individual Decision-Making, Including Profiling
    As a responsible company, we do not engage in automated decision-making or profiling.

  8. Right to Withdraw Consent
    Every data subject has the right to withdraw consent to the processing of personal data at any time. You can exercise the right to withdraw consent at any time by contacting an employee—particularly via email at datenschutz@porr.at.

  9. Right to Lodge a Complaint with a Supervisory Authority
    You have the right to lodge a complaint with a competent supervisory authority in accordance with Article 77 GDPR if you believe that the processing of your personal data violates the provisions of the GDPR. The Austrian Data Protection Authority can be reached at Barichgasse 40-42, 1030 Vienna

M. Data Protection in Applications and the Application Process

PORR AG collects and processes the personal data of applicants for the purpose of handling the application process. Processing may also be carried out electronically, especially when an applicant submits application documents via electronic means, such as by email or through the career portal porr-group.com/karriere. If PORR AG concludes an employment contract with an applicant, the submitted data will be stored for the implementation of the employment relationship. If PORR AG does not conclude an employment contract with the applicant, the applicant's data will be automatically deleted no later than thirteen months after the application has been received, unless there are other legitimate interests of PORR AG or consent from the applicant for further processing. If an applicant exercises their right to deletion, the data may be deleted after seven months.
If your application is unsolicited (not for a specific position in the career portal), your data may be forwarded to another company within the PORR Group based on mutual legitimate interest according to your qualifications.

What Data is Collected?

For the automated processing of your application, the following data are collected and processed:

  1. First name, last name, email, and possibly address/city, date of birth, title, telephone number, nationality.
  2. Additional questions depending on the specific job posting (e.g., driver's license).
  3. Resume.
  4. Work experience and education.
  5. Skills (e.g., Photoshop, MS Office).
  6. Application photo.
  7. Qualifications, awards, and language skills.
  8. Cover letter.
  9. Files and documents you may upload.

N. Further Processing on the Website

  1. Privacy Policy on the Use of Google Analytics (with Anonymization Function)
    Our website uses “Google Analytics,” a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, USA.
    Google Analytics uses cookies that are stored on your computer and enable an analysis of your use of the website. The information generated by the cookie about your use of this website, such as browser type/version, operating system used, referrer URL (the previously visited page), IP address, time of server request, is usually transmitted to and stored on a Google server in the USA.
    The information is used to analyze internet and website usage, such as anonymized evaluations and graphics of page views and visits. The data are processed exclusively for market research, website optimization, and the provision of other services related to internet usage. This information may also be transferred to third parties if required by law or if third parties process the data on behalf of Google. Your IP address will not be merged with other data from Google under any circumstances. IP addresses are anonymized, making association impossible (IP masking).
    You can prevent the installation of cookies by setting your browser software accordingly. Furthermore, you can prevent the collection of data generated by the cookie related to your use of the website (including your IP address) and the processing of these data by Google by downloading and installing a browser add-on: tools.google.com/dlpage/gaoptout.
    An opt-out cookie will be set that prevents future collection of your data when visiting this website. The opt-out cookie is only valid in this browser and only for our website, and it is stored on your device. If you delete the cookies in this browser, you must reset the opt-out cookie.
    For more information on privacy in connection with Google Analytics, please refer to the Google Analytics Help: support.google.com/analytics/answer/6004245.
    The parent company of Google is a U.S. company whose data protection level has been certified under the EU-U.S. Data Privacy Framework.
    The legal basis for the processing activity is your informed and revocable consent in accordance with Article 6(1)(a) GDPR.

  2. Privacy Policy on the Use of LinkedIn
    Our website features plugins from the social network LinkedIn, operated by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA (hereinafter referred to as “LinkedIn”). You can recognize LinkedIn plugins by the corresponding logo or the “Recommend” button. Please note that when using the button, a connection is established between your browser and the LinkedIn server. LinkedIn is thus informed that our website has been visited with your IP address. If you click the LinkedIn “Recommend” button while logged into your LinkedIn account, you have the option to link content from our website to your LinkedIn profile page.
    This allows LinkedIn to associate your visit to our website with your user account. Please note that we do not obtain any knowledge of the content of the transmitted data or its use by LinkedIn.

  3. Further details on data collection, your legal options, and settings can be found on LinkedIn. These are provided at https://de.linkedin.com/legal/privacy-policy.

    LinkedIn Insight Tag: The LinkedIn Insight Tag is a JavaScript code embedded on our websites. It is a tracking tool that captures and analyzes LinkedIn members on our site. This provides us with insights into our target audience, the attractiveness of our offers, and the performance of advertising campaigns on LinkedIn.

    The LinkedIn Tag sets a cookie in the visitor’s browser through which the following data is collected:

  4. URL
  5. Referrer URL
  6. Device specification
  7. Browser properties
  8. IP address

  9. LinkedIn associates this information with their LinkedIn account if they are logged in, but anonymizes the data collected via the cookie after 7 days and completely deletes it after 90 days.

    As a result and purpose of this data processing, we do not receive any personal data about our visitors, but rather a report on the demographic distribution of our visitors and the performance of our ads on LinkedIn. LinkedIn is a U.S. company whose data protection level is certified under the EU-U.S. Data Privacy Framework.

    The legal basis for this processing activity is your informed and revocable consent according to Art. 6 (1) (a) GDPR.

    3. Data Protection Provisions on the Use and Deployment of Shariff PORR AG has integrated the Shariff component on this website. The Shariff component provides privacy-compliant social media buttons. Shariff was developed for the German computer magazine c't and is published by GitHub, Inc.

    The developer of the component is GitHub, Inc., 88 Colin P. Kelly Junior Street, San Francisco, CA 94107, USA.

    Typically, social network-provided button solutions already transmit personal data to the respective social network when a user visits a webpage with a social media button integrated. By using the Shariff component, personal data is transmitted to social networks only when the visitor actively clicks one of the social media buttons. Further information about the Shariff component is provided by the computer magazine c't at www.heise.de/newsticker/meldung/Datenschutz-und-Social-Media.

    The use of the Shariff component aims to protect the personal data of our website visitors while allowing us to integrate a button solution for social networks on this website.

    4. Data Protection Provisions on the Use and Deployment of YouTube This website includes at least one YouTube plugin. The operating company of YouTube is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland is a subsidiary of Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, USA.

    When you visit a page of our website equipped with a YouTube plugin, a connection to YouTube’s servers is established. This informs the YouTube server of which specific page of our website you visited. If you are logged into your YouTube account, YouTube can directly assign your browsing behavior to your personal profile. You can prevent this assignment by logging out of your YouTube account before visiting our websites.

    Further information about the collection and use of your data by YouTube can be found in the privacy policy published by Google, available at: www.google.de/intl/de/policies/privacy/.

    Google is a U.S. company whose data protection level is certified under the EU-U.S. Data Privacy Framework.

    The legal basis for this processing activity is your informed and revocable consent according to Art. 6 (1) (a) GDPR.

    5. Data Protection Provisions on the Use and Deployment of kununu PORR AG has integrated components from kununu on this website. kununu is currently the largest employer review platform in Europe with over 2.4 million reviews of more than 650,000 companies. The operating company of kununu is kununu GmbH, a subsidiary of XING SE, Dammtorstraße 30, 20354 Hamburg, Germany. Each time a page of this website operated by PORR AG, which includes a kununu component, is accessed, the web browser on the affected person's IT system is automatically prompted by the kununu component to download a representation of the corresponding kununu component from kununu. As part of this technical procedure, kununu learns which specific subpage of our website is visited by the affected person.

    If the affected person is logged in to kununu simultaneously, kununu recognizes with each visit to our website and throughout the duration of the visit, which specific subpage of our website the affected person visits. This information is collected by the kununu component and assigned by kununu to the respective kununu account of the affected person. If the affected person clicks on one of the buttons integrated into our website, such as the “Rate Employer” button, kununu assigns this information to the personal kununu user account of the affected person and stores this personal data.

    kununu receives information through the kununu component that the affected person has visited our website whenever the affected person is logged into kununu at the time of accessing our website, regardless of whether the affected person clicks the kununu component or not. If the affected person does not want such information to be transmitted to kununu, they can prevent this by logging out of their kununu account before accessing our website.

    The published privacy policy applicable to kununu, available at https://privacy.xing.com/de/datenschutzerklaerung, provides information on the collection, processing, and use of personal data by kununu.

    The integration of kununu is based on our legitimate interest in transparently displaying employee satisfaction within the PORR Group (Art. 6 (1) (f) GDPR).

    6. Data Protection Provisions on the Use and Deployment of Facebook & Instagram Instagram is a social media service from Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”) for sharing photos and videos. Users can follow other users, post pictures and videos, and “like” and comment on media from other users. We use Instagram to report on services, events, and offers from the PORR Group, to inform customers, prospects, employees, and applicants with interesting content, and to establish a lasting relationship.

    When using Instagram, the following data is collected:

  10. Email address
  11. Phone number
  12. IP address
  13. Device specification
  14. Operating system
  15. Information from the Instagram user’s address book, if permitted

  16. A social network is an online platform that typically allows users to communicate with each other and interact in the virtual space. A social network can serve as a platform for exchanging opinions and experiences or allow the online community to provide personal or business-related information. Facebook allows users to create private profiles, upload photos, and network through friend requests.

    The European service provider for Facebook services is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Meta Platforms, Inc., Menlo Park, California.

    Meta Platforms is a U.S. company whose data protection level is certified under the EU-U.S. Data Privacy Framework.

    The legal basis for this processing activity is your informed and revocable consent according to Art. 6 (1) (a) GDPR.

    7. Consent Management with CCM19 Our website uses the cookie consent technology of our processor CCM19, Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, to obtain and document your voluntary and informed consent or revocation for the storage of certain cookies in your browser in a GDPR-compliant manner. The time and IP address of your consent are stored by us to manage your consent according to Art. 6 (1) (a) GDPR and to comply with accountability under Art. 5 GDPR. The legal basis for using CCM19 is Art. 6 (1) (c) GDPR.

    P. Data Transfers PORR AG may transfer your contact details to one or more processors, such as an IT service provider, who also use the personal data exclusively for internal purposes attributable to PORR AG as the data controller. We have contracts with all relevant processors to ensure that GDPR regulations are adhered to with these service providers as well.

    Data subject rights received by us are also forwarded to data recipients in accordance with Art. 19 GDPR to ensure that your rights are implemented there as well.

    Q. Legal Basis for Processing The legal basis for processing personal data on our website is either a legitimate interest in providing you with information about our products and services or acquiring you as a future customer, e.g., as a pre-contractual measure or for fulfilling a contract with you as the data subject when an order is placed requiring the delivery of goods. Consequently, legal obligations for retention or presentation to authorities can also become the legal basis.

    For all other processing activities, such as newsletters, we obtain your revocable consent.

    Instagram uses this data for its advertising network, other service providers, and search engines.

    Instagram provides us with “Page Insights” regarding visitors to our company’s Instagram page, thereby establishing joint responsibility under Art. 26 GDPR. “Page Insights” are page statistics on “Likes,” post reach, and other topics which we use primarily on an anonymized basis. Details of this joint responsibility can be found at: https://www.facebook.com/legal/terms/page_controller_addendum

    This agreement states that Facebook has primary responsibility for processing. If you have concerns about security on our Instagram page, you can contact our data protection contact address, and we will forward your request to Facebook.

    Since Facebook is a global social network, we have no influence on the technical and organizational aspects and can only influence the content related to the PORR AG's presence and events.