Legal
Privacy policy
Information about contact, hosting, consent and optional Google measurement. Updated: 22 September 2026.
Controller
Jawad Gebäudeservice GmbH, represented by managing director Ahmed Jawad Jahnstraße 18, 59439 Holzwickede, Germany Telephone: 02301/9771241 Email: info@jawad-gebaeudeservice.de
Principles and legal bases
We process personal data to provide this website, answer enquiries and perform our services. Depending on the purpose, we rely on Article 6(1)(b) GDPR (a contract or steps taken at your request before entering one), (c) (legal obligations), (f) (legitimate interests), or your consent under (a). The specific purposes and interests are explained below.
Hosting and website delivery
This website is delivered through Vercel (Vercel Inc., USA). In particular, IP addresses, timestamps, requested URLs, referrers, browser/device information and technical logs are processed to deliver pages, investigate errors and prevent attacks. The legal basis is our legitimate interest in a secure, reliable website under Article 6(1)(f) GDPR. Hosting and technical providers receive data as needed for these tasks. Processing outside the EU, particularly in the USA, is possible. Provider information and transfer mechanisms: https://vercel.com/legal/privacy-notice and https://vercel.com/legal/dpa. Logs are deleted when no longer needed for operations or security, unless legal duties or investigation of specific incidents require further retention.
Enquiries and email
When you contact us by form, email or telephone, we process your contact details, messages and information about the property and requested work. This serves to answer you and, where applicable, prepare or perform a contract (Article 6(1)(b) GDPR). For other enquiries, the basis is our legitimate interest in handling your message (Article 6(1)(f)). Authorised staff and hosting and email providers receive the data needed to handle it. You are not legally required to contact us; without the details needed to respond or prepare a quote, we may be unable to process the enquiry.
Contact form and abuse prevention
The form processes your name, email address and/or phone number, service or subject, message and confirmation that you have read the privacy information. The request is validated on the server and sent over an encrypted SMTP connection to the company mailboxes configured to handle enquiries. Its timestamp and originating page are included; from that address we keep only the path and any advertising click identifier, no other parameters. Before delivery the server creates a random enquiry identifier; it appears in the internal notification and, together with the timestamp, the originating path, any advertising click identifier and the delivery result, in the hosting system logs, which do not record names, contact details or message content. The form confirmation is not consent to advertising. A hidden check field and server-side rate limiting help prevent automated or excessive requests. Hashed values derived from the IP address, browser identifier and, where applicable, email address, together with counters, are processed in memory (Article 6(1)(f) GDPR, prevention of spam and abuse). The counting window is ten minutes; this is not a guaranteed memory-deletion period. Form contents are not made public.
WhatsApp contact
The WhatsApp button is an external link; merely visiting this website does not load a WhatsApp chat script. Only opening the link takes you to WhatsApp. The provider for the European Economic Area is WhatsApp Ireland Limited, Ireland. Phone numbers, profile, communication and usage data may be processed there and transferred outside the EU. We process your message to respond or prepare a contract under Article 6(1)(b) or (f) GDPR. WhatsApp's processing is governed by https://www.whatsapp.com/legal/privacy-policy-eea. Alternatively, you can contact us by form, email or telephone.
Retention
Contact and contract data are kept as long as needed to handle enquiries, perform contracts or establish and defend claims. Commercial and tax retention duties may require certain records to be kept longer (Article 6(1)(c) GDPR); they are deleted afterwards. The period depends on the record type and the legally applicable starting date. Separate information about consent records and optional browser identifiers is provided below.
Optional analytics and advertising measurement
With the appropriate consent, we use Google Analytics 4 (measurement ID G-G5V88MGBW3) to analyse website usage and Google Ads (AW-750748931) to measure advertising performance and enable remarketing, where the respective features are enabled. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data include online identifiers, IP addresses, browser/device information, page views, campaign identifiers and usage events. These include scroll depth, form starts, form errors, successfully submitted enquiries and telephone, email and WhatsApp clicks. A contact click does not mean a conversation or order took place. Our measurement integration does not send names, message contents or contact details from the form to Google, neither in plain text nor as hashes. Enhanced conversions are disabled, as explained below.
Conversions and qualifying website calls
An enquiry successfully sent by the form may be recorded as a conversion (an advertising goal reached), with a random enquiry identifier to prevent duplicate counting. Contact clicks may also be measured as conversions when configured. Only with consent to advertising, remarketing and call measurement, and enabled call tracking, may Google replace both the displayed phone number and telephone link with a forwarding number. Calls are forwarded to us. Google may process the time, duration, connection status and caller information, including the phone number or area code, to attribute the call to an advertisement. Our setting counts qualifying website calls lasting at least 60 seconds. The Ads call measurement used does not record conversations. Cookies may attribute advertisements and cache the forwarding number. Without consent or after withdrawal, the regular number is used.
Advertising click identifier from the ad link
If you reach our website through a Google ad, the address contains a click identifier (gclid, gbraid or wbraid). We first keep that identifier in your browser's memory for the current visit only. Only with your marketing consent do we additionally store it for up to 90 days in our own cookie jawad_click_id and under jawad_click_id_v1 in LocalStorage; on withdrawal we remove both copies. When you submit the contact form, the identifier is sent to our server with your enquiry and logged there together with the enquiry identifier, the timestamp and the originating path in order to attribute the enquiry to an advertisement. The identifier contains no names and no contact details, is not used for profiling or advertising outreach and is not passed on to Google by us. Storing it on your device relies on Article 6(1)(a) GDPR and section 25(1) TDDDG; attributing your enquiry relies on our legitimate interest in measuring advertising performance under Article 6(1)(f) GDPR. You can delete the identifier at any time in your browser settings.
Anonymous consent statistics
An optional server-side counter is prepared for consent management. When enabled, it stores only daily totals of banner displays and choices (all, necessary only or custom), including the selected categories. It stores no individual profiles, IP addresses, cookie or device identifiers, user agents, page addresses or contact details, and sets no additional cookies or IDs. These counters are independent of analytics or marketing consent. File-based counting is disabled on the current Vercel deployment because durable file storage is unavailable. Technical hosting logs are separate and explained above.
Enhanced conversions (Google Ads)
Enhanced conversions are disabled. Our measurement integration does not send email addresses or phone numbers from the contact form to Google, neither in plain text nor as hashes. Only after the server confirms that an enquiry was successfully sent may the form conversion be measured using the server-generated random enquiry identifier to prevent duplicate counting. Analytics measurement requires your analytics consent; Google Ads measurement requires your marketing consent. In addition to the technical measurement data described above, the form conversion uses only this identifier, not form contents. Neither a new marketing choice nor an older stored consent value activates the transfer of contact details from the form. The information about consent, withdrawal and Google continues to apply.
Google Analytics audiences shared with Google Ads
With analytics and marketing consent, audiences based on website use may be shared from Google Analytics with a linked Google Ads account for remarketing. This allows relevant ads to be shown again based on earlier use. Our website does not permit this measurement and personalisation without the corresponding consent. The legal bases are Article 6(1)(a) GDPR and, for storing or accessing device information, section 25(1) TDDDG.
Google signals and cross-device analysis
When Google signals is enabled and you consent to analytics and marketing, Google may analyse pseudonymous usage across devices. This may particularly concern signed-in Google users who have enabled personalised ads with Google. We receive aggregated reports, not access to your Google account. Our website permits Google signals only with marketing consent. The legal basis is Article 6(1)(a) GDPR; withdrawal and international transfer information also applies.
Consent, Consent Mode and withdrawal
Optional measurement and remarketing rely on Article 6(1)(a) GDPR; storing or accessing information on your device relies on section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Analytics and advertising can be selected separately or rejected altogether. Before the appropriate consent, every optional permission is denied. The integration uses Google Consent Mode in “advanced” mode with storage and advertising permissions initially denied (analytics_storage, ad_storage, ad_user_data, ad_personalization): the Google measurement code is loaded in that denied state, sets no measurement or advertising cookies and reads no identifiers from your browser. Permissions follow your selection. Without consent the measurement code may send cookieless requests to Google; these contain no cookie identifiers, advertising click identifiers are redacted (ads_data_redaction), and Google uses them for aggregated modelling only. Analytics and advertising events including conversions, as well as call measurement, are only triggered after the respective consent. No Analytics data stream is configured without analytics consent. Google Signals and personalised advertising are controlled by the advertising choice. You can change or withdraw consent at any time using “Privacy settings” in the footer. Withdrawal ends further optional measurement and may reload the page. Processing before withdrawal remains lawful. The website and contact form can be used without optional consent.
LocalStorage and necessary storage
Your selection is stored in your browser's LocalStorage under jawad_consent_v2: analytics/advertising choices, version and expiry time. Any additionally stored enhanced-conversion information does not activate contact-data sharing. It is valid for 180 days from saving, after which you are asked again. LocalStorage does not delete entries automatically; we treat an expired entry as invalid and overwrite it when you make a new choice. You can remove it in your browser settings. Storage to implement and respect your choice is based on section 25(2)(2) TDDDG; associated processing relies on our legitimate interest in privacy-compliant controls under Article 6(1)(f) GDPR. If browser storage is unavailable, your choice applies only to the current page load.
Optional cookies and retention at Google
After consent, _ga and _ga_ followed by a measurement identifier may distinguish users and sessions. Google specifies a default lifetime of two years; browsers or different settings may shorten it. Advertising may use _gcl_ identifiers, and call measurement may use gwcc. Names and lifetimes depend on enabled Google features and browser settings. Our 180-day consent selection is not the retention period for all Google data. Deletion of data already sent to Google depends on purpose, account settings and the provider's privacy rules; withdrawal does not automatically delete past data. When consent is refused, the website removes accessible first-party measurement cookies belonging to the declined category. Further information on purposes and lifetimes: https://support.google.com/analytics/answer/11397207?hl=en and https://business.safety.google/adscookies/.
Google and international processing
Google data may be processed in the USA, particularly by Google LLC. Google describes the EU-US Data Privacy Framework as a basis under Article 45 GDPR for covered transfers to certified US recipients, and standard contractual clauses under Article 46 GDPR for other applicable transfers. Details and information about safeguards are available at https://policies.google.com/privacy/frameworks. Government access rights and legal remedies outside the EU may differ. Processing information: https://policies.google.com/privacy and https://business.safety.google/adsprocessorterms/.
Your rights and complaints
Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). You can withdraw consent for the future at any time (Article 7(3)). Use the contact details above; website consent can also be managed through the footer link. Under Article 77 GDPR, you may complain to a data protection authority, particularly where you live, work or suspect an infringement. For North Rhine-Westphalia: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, https://www.ldi.nrw.de/.
Right to object under Article 21 GDPR
You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. We will stop processing unless overriding compelling legitimate grounds apply or the processing is needed to establish, exercise or defend legal claims. You may object at any time, without giving reasons, to processing for direct marketing, including related profiling; that processing will then stop.
Automated decisions and local fonts
This website makes no solely automated decisions about entering into or performing customer contracts that have legal or similarly significant effects within Article 22 GDPR. Optional advertising features may be used to create audiences. Font files are served from this website; no Google Fonts request is needed.