Privacy policy

Version: August 2026

Thank you for visiting our website. The protection of your personal data is a matter of great importance to us. In accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), we inform you below about which personal data we process when you use our website, the purposes for which this is done, and the rights to which you are entitled. The German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG) apply in addition.

1. Controller

The controller within the meaning of Art. 4 No. 7 GDPR is:

TAPROGGE Gesellschaft mbH
Schliemannstraße 2–14
58300 Wetter (Ruhr)
Germany

Phone: +49 2335 762-0
Fax: +49 2335 762-245
E-mail: info@taprogge.de

Represented by the management: Detlef Taprogge, Dr. Oliver Fröhling

2. Data Protection Officer

We have appointed an external data protection officer:

Dipl.-Ing. Thorsten Werning
CONCEPTEC GmbH
Bleichstraße 5
45468 Mülheim an der Ruhr, Germany
E-mail: datenschutz@taprogge.de

You may contact our data protection officer or use the contact details stated in Section 1 at any time regarding all matters relating to data protection and the exercise of your rights.

3. General Information on Data Processing; Legal Bases

As a matter of principle, we process our users' personal data only to the extent necessary to provide a functional website and to deliver our content and services, or where you have given your consent.

The relevant legal bases are:

• Art. 6(1)(a) GDPR – consent (e.g. for the use of our Matomo web analytics, when requesting documents via our download form, when joining our talent pool, or when consenting to the sharing of application documents within our corporate group);
• Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures (e.g. processing enquiries about our products and services, conducting application procedures in conjunction with Section 26 BDSG);
• Art. 6(1)(c) GDPR – compliance with legal obligations (e.g. retention obligations under commercial and tax law);
• Art. 6(1)(f) GDPR – protection of legitimate interests (e.g. secure and stable operation of the website, defence against attacks, responding to general enquiries).

In addition, Section 25 TDDDG applies to the storage of information on your terminal device or access to such information (e.g. cookies): storage and access operations that are not technically necessary take place only with your consent (Section 25(1) TDDDG); strictly necessary operations are permitted without consent (Section 25(2) No. 2 TDDDG).

4. Provision of the Website and Server Log Files

4.1 Description and Scope

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing terminal device. The following data are recorded in so-called server log files:

• IP address of the requesting terminal device,
• date and time of access,
• page or file accessed (URL) and volume of data transferred,
• website from which access was made (referrer URL),
• browser used, operating system and, where applicable, language settings,
• HTTP status code.

These data are not merged with other data sources. The data are not evaluated for marketing or profiling purposes.

4.2 Purpose and Legal Basis

The temporary storage of the IP address is technically necessary in order to deliver the website to your terminal device. Storage in log files serves to ensure the functionality, stability and security of the website (including the detection and defence against attacks, and error analysis). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the aforementioned purposes.

4.3 Storage Period

Log files are deleted as soon as they are no longer required to achieve the purpose, generally no later than after 30 days. Any storage beyond this period takes place only in anonymised form or to the extent necessary to investigate specific security incidents.

4.4 Hosting and Technical Support

Our website is hosted by an external service provider: ALL-INKL.COM – Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The hosting provider processes the aforementioned data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. The servers are located in Germany.

In addition, the web agency commissioned by us, BECKDESIGN GmbH, Auf der Heide 3, 44803 Bochum, Germany, is entrusted with the maintenance and further development of the website. Insofar as the agency has access to personal data in the course of maintenance and support, this takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

5. Cookies and Comparable Technologies

5.1 Technically Necessary Cookies and Storage Operations

Our website uses, on the one hand, technically necessary cookies and comparable storage technologies and, on the other hand – exclusively with your consent – cookies of our web analytics service Matomo (Section 5.3). The technically necessary storage operations in detail:

Name	Purpose	Storage period
Session cookie of the content management system (TYPO3, e.g. fe_typo_user)	Maintaining the session; technical provision of the website	End of the browser session
cookieconsent_status	Records that you have taken note of the cookie notice and which consents you have given	12 months
sessionStorage entries	Temporary storage of display and filter settings during the session (e.g. career filters)	End of the browser session

The legal basis for storing and reading this information on your terminal device is Section 25(2) No. 2 TDDDG, as these operations are strictly necessary to provide the service expressly requested by you (display of the website). Insofar as personal data are processed in this context, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in the technically error-free provision of the website).

You can configure your browser to reject or delete cookies. If technically necessary cookies are deactivated, it may not be possible to use all functions of the website to their full extent.

5.2 Consent Management

For the use of services requiring consent (currently only web analytics with Matomo, Section 5.3), we use the consent management tool Klaro!. The tool is loaded, as an integral part of our website, from the servers on which the website itself is operated (see Section 4.4); no connection to third-party servers is established. When you first visit our website, you will be asked for your decision; services requiring consent are only loaded after you have given your consent.

Your decision is stored in a cookie or storage entry on your terminal device (cookieconsent_status, see Section 5.1) so that you are not asked again on each visit. The legal basis for this is Section 25(2) No. 2 TDDDG as well as Art. 6(1)(f) GDPR (obligation to demonstrate and document consent given, Art. 7(1) GDPR).

You may withdraw or adjust your consents at any time with effect for the future by reopening the cookie settings via the corresponding link in the footer of our website.

5.3 Web Analytics with Matomo (Only with Your Consent)

If you have given your consent via our consent management tool, we use the open-source web analytics service Matomo for the statistical evaluation of the use of our website. Matomo is not operated by a third-party provider but by ourselves on our own Matomo instance operated by TAPROGGE Gesellschaft mbH (reachable at matomo.taproggegroup.com). The technical hosting of the servers is provided by our hosting provider ALL-INKL.COM (Section 4.4) on the basis of a data processing agreement pursuant to Art. 28 GDPR; the servers are located in Germany. The analytics data are not disclosed to any other third parties.

The data processed include in particular: the IP address truncated by the last octet (anonymised), pages visited, duration of the visit, referrer URL, browser and device type used, as well as the date and time of access. For this purpose, Matomo sets the following cookies:

Name	Purpose	Storage period
_pk_id	Recognition of returning visitors (pseudonymous visitor ID)	13 months
_pk_ses	Attribution of page views within a single visit	30 minutes

The purpose of the processing is reach measurement and the needs-based improvement of our online offering. The legal basis for setting and reading the cookies is your consent pursuant to Section 25(1) TDDDG; the legal basis for the processing of personal data is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future via the cookie settings (Section 5.2); the lawfulness of the processing carried out prior to withdrawal remains unaffected. The analytics data are deleted or anonymised after twelve months at the latest.

5.4 No Other Third-Party Services

Beyond the services described above, we do not use any further web analytics services, advertising networks, social media tracking or third-party embeds involving data transfers (e.g. YouTube videos, embedded Google Maps, external fonts) on this website. Fonts (Source Sans 3), images and videos are loaded exclusively from our own servers; no connection to third-party servers is established when the site is accessed.

6. Contact by E-mail and Telephone

E-mail addresses and telephone numbers are provided on our website through which you can contact us. If you contact us by e-mail or telephone, we process the data you provide (e.g. name, contact details, content of the enquiry) exclusively for the purpose of handling your request.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

The data are deleted as soon as the correspondence has been concluded and the matter has been finally resolved, unless statutory retention obligations (in particular Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code (HGB): six or eight/ten years for business correspondence and accounting records) prevent deletion.

Please note: if you address your enquiry to one of our foreign group or sales companies (e.g. in the USA, China, Japan, South Korea, India or the United Kingdom), the respective company is the controller responsible for the processing carried out there. For the intra-group forwarding of enquiries, see Section 10.

7. Contact Form

7.1 Description and Scope

We provide a contact form on our website through which you can send us enquiries. In doing so, we collect the following data:

• name (mandatory field),
• e-mail address (mandatory field),
• company (optional),
• telephone number (optional),
• subject (optional),
• content of your message (optional).

In addition, the time of submission and the technical data referred to in Section 4 are processed. Your form data are transmitted by e-mail to the department within our company responsible for your enquiry.

7.2 Purpose, Legal Basis and Storage Period

The processing takes place exclusively for the purpose of handling and responding to your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the conclusion or performance of a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries addressed to us).

The data are deleted as soon as the correspondence has been concluded and the matter has been finally resolved, unless statutory retention obligations prevent deletion (see Sections 6 and 13).

8. Requesting Documents (Download Form)

8.1 Description and Scope

In the "Downloads" section, you can request documents (e.g. brochures, certificates). For this purpose, we collect the following data via a form:

• first name and surname (mandatory field),
• e-mail address (mandatory field),
• company name (optional).

Requests are handled using a double opt-in procedure: after submitting the form, you will receive an e-mail containing a confirmation link. The requested documents will only be sent to you after you have clicked this link. This ensures that the request actually originates from the holder of the e-mail address provided. The time of the request and of the confirmation are logged.

8.2 Purpose and Legal Basis

The processing takes place exclusively for the purpose of handling your request and sending you the requested documents. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you give via the checkbox in the form. The logging of the double opt-in procedure is based on Art. 6(1)(f) GDPR (demonstrability of consent, Art. 7(1) GDPR).

Your data are not used for advertising purposes (e.g. newsletters).

8.3 Withdrawal and Storage Period

You may withdraw your consent at any time with effect for the future, e.g. by e-mail to info@taprogge.de. The lawfulness of the processing carried out prior to withdrawal remains unaffected. Your data will be deleted as soon as they are no longer required for the purpose of processing your request, at the latest six months after the documents have been sent; proof of consent is retained for the duration of the statutory limitation periods.

9. Applications and Careers Section

9.1 Job Advertisements (HRworks)

The job advertisements displayed in the careers section are loaded via an interface from our human resources management software HRworks (HRworks GmbH, Waldkircher Straße 28, 79106 Freiburg im Breisgau, Germany). The job advertisements are retrieved server-side by our system; when merely visiting the careers section, your browser does not establish a direct connection to HRworks servers.

9.2 Online Application Form

You can apply for advertised positions via the online form provided on the job detail pages. In doing so, we collect the following data:

• title of address, academic title (if any), first name and surname, e-mail address, telephone number, address and country,
• date of birth (optional),
• earliest possible starting date,
• your voluntary details of your most recent and your desired annual salary,
• the application documents uploaded by you (e.g. cover letter, CV, references; up to five files with a total maximum size of 20 MB in PDF, JPEG/JPG or PNG format),
• your voluntary indication of how you became aware of us,
• your voluntary indication of whether you have a recognised severe disability.

Application data are processed exclusively for the purpose of conducting the application procedure. The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26(1) BDSG (decision on the establishment of an employment relationship). The indication of a recognised severe disability is voluntary; it serves to take account of your rights as a severely disabled person or a person of equal status in the selection procedure (in particular under Book IX of the German Social Code, SGB IX). The legal basis for the processing of this special category of personal data is Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG. The same applies to any other special categories of personal data that you voluntarily disclose to us.

For the technical handling of the application procedure, we use the human resources management software HRworks provided by HRworks GmbH as a processor; the application data you submit via the form are processed in our applicant management system via the HRworks interface. A data processing agreement pursuant to Art. 28 GDPR is in place with HRworks GmbH; processing takes place in data centres within the European Union.

9.3 Application by E-mail

Alternatively, you can apply for advertised positions or submit a speculative application by e-mail to bewerbung@taprogge.de. The statements in Section 9.2 apply accordingly to the application data transmitted in this way. Please note that unencrypted e-mails do not constitute a secure transmission channel; on request, we will gladly inform you of alternative transmission methods.

9.4 Talent Pool

In the application form, you may separately consent to us storing your complete application documents in our talent pool beyond the specific application procedure and considering them for further application procedures that may be suitable for you. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR (and, in the case of special categories of personal data, Art. 9(2)(a) GDPR).

This consent is voluntary and has no effect on your current application. You may withdraw it at any time with effect for the future, e.g. by e-mail to bewerbung@taprogge.de. Your data will be stored in the talent pool for a period of twelve months after the conclusion of the application procedure and then deleted, unless you consent again.

9.5 Sharing Within the Corporate Group

If you have given separate consent in the application form, we will share your application documents with other companies of the TAPROGGE group so that they can consider your application for vacancies at those companies. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR (and, in the case of special categories of personal data, Art. 9(2)(a) GDPR). You may withdraw this consent at any time with effect for the future. Insofar as companies outside the European Economic Area are concerned, your application will only be shared in accordance with the rules on third-country transfers set out in Section 10; we will share your application with companies in countries without an adequacy decision only on the basis of your explicit consent (Art. 49(1)(a) GDPR).

9.6 Recipients and Storage Period

Access to application data is restricted to the persons involved in the selection procedure (human resources department, the relevant specialist department, management) and – within the scope of processing on our behalf – our service provider HRworks.

Storage period: if no employment relationship is established, we will delete your application documents no later than six months after the conclusion of the application procedure, unless statutory obligations to provide evidence (in particular under the German General Equal Treatment Act, AGG) require longer retention or you have consented to inclusion in our talent pool (Section 9.4). In the event of employment, the data will be transferred to the personnel file.

10. Recipients, Intra-Group Transfers and Transfers to Third Countries

Within our company, access to your data is granted only to those units that require it in order to fulfil the purposes stated. External recipients are in particular:

• our hosting provider and our web agency as processors (Art. 28 GDPR),
• HRworks GmbH as processor for applicant management (Art. 28 GDPR),
• Microsoft as the provider of our e-mail and communication infrastructure (Microsoft 365; Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) as a processor; in this context, personal data may be transferred to Microsoft Corporation in the USA, which is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); EU Standard Contractual Clauses have additionally been agreed,
• where legally required, tax advisers, lawyers and public authorities.

If you address an enquiry to us that falls within the area of responsibility of one of our foreign group or sales companies (with locations including the USA, China, Japan, South Korea, India, the United Kingdom, France, Spain and the Netherlands), we will forward your enquiry, together with the necessary contact details, to the company responsible. The legal basis is Art. 6(1)(b) or (f) GDPR (handling of your enquiry by the competent unit).

The following applies to transfers of personal data to countries outside the European Economic Area:

• We forward enquiries to our companies in the United Kingdom, Japan and South Korea on the basis of the adequacy decisions of the European Commission (Art. 45 GDPR); an adequate level of data protection recognised by the European Commission exists in those countries.
• As a matter of principle, we do not transfer personal data to our companies in other third countries. Data are forwarded to such countries exclusively where this is necessary for the implementation of pre-contractual measures requested by you or for the performance of a contract with you (Art. 49(1)(b) GDPR), or where you have given your prior explicit consent to the transfer after we have informed you of the possible risks involved (Art. 49(1)(a) GDPR). In all other cases, our German company will handle your enquiry itself.

Insofar as we base transfers on appropriate safeguards (e.g. the EU Standard Contractual Clauses agreed with Microsoft), you may request a copy of these safeguards using the contact details stated in Section 1.

11. Links to External Websites

Our website contains links to external third-party websites, in particular:

• LinkedIn (LinkedIn Ireland Unlimited Company): links to our company profile and to the profiles of individual contact persons;
• Google Maps (Google Ireland Limited): "Plan route" links to our locations.

These are pure links; no data are transferred to these providers when our website is accessed. Only when you click on such a link do you leave our website; from that point onwards, the privacy policy of the respective provider applies. We have no influence on the data processing carried out there.

12. Data Security

We take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, misuse and unauthorised access. The website is transmitted in encrypted form via TLS/HTTPS (recognisable by the padlock symbol in your browser). Our security measures are continuously improved in line with technological developments.

13. Storage Period (General)

Unless a more specific storage period is stated in this policy, we process personal data only for as long as is necessary for the respective purposes. Once the purpose no longer applies, the data are deleted unless statutory retention obligations (e.g. six years for commercial and business letters pursuant to Section 257 HGB/Section 147 AO, eight years for accounting records, ten years for commercial books and annual financial statements) prevent this. In such cases, processing is restricted to the fulfilment of these obligations.

14. Your Rights as a Data Subject

Provided that the statutory requirements are met, you have the following rights:

• access to the personal data processed by us (Art. 15 GDPR),
• rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of the processing carried out prior to withdrawal remains unaffected.

Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where data are processed for direct marketing purposes, you may object at any time without stating reasons.

To exercise your rights, an informal notification to the contact details stated in Section 1 (or Section 2) is sufficient.

Right to lodge a complaint: You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
(North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Phone: +49 211 38424-0, e-mail: poststelle@ldi.nrw.de

15. Obligation to Provide Data; Automated Decision-Making

You are under no statutory or contractual obligation to provide us with personal data via this website. However, without the information marked as mandatory, we are unable to process certain requests (e.g. contact enquiries, document requests, applications).

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

16. Amendments to this Privacy Policy

We will amend this privacy policy whenever changes to the data processing carried out by us or to the legal situation so require. The current version published on this website applies in each case.