Privacy Policy

1. General Information

The protection of your personal data is important to us. We process your personal data confidentially and in accordance with the applicable data protection laws, in particular the General Data Protection Regulation (GDPR), as well as this Privacy Policy.

This Privacy Policy explains what personal data we collect when you visit our website, the purposes for which your data is processed, the legal basis for such processing, and the rights you have under applicable data protection law.

2. Data Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection legislation is:

M3 Planungsgruppe eGbR
Neustadt 42
37154 Northeim
Germany

Represented by the Partners:

  • Marko Stojkovic
  • Milos Papic
  • Milos Obradovic

E-mail: info@m3-pg.de

Website: www.m3-pg.de

3. Data Protection Officer

At present, our company is not legally required to appoint a Data Protection Officer (DPO), and therefore no Data Protection Officer has been designated.

Should the appointment of a Data Protection Officer become mandatory under applicable law in the future, this Privacy Policy will be updated accordingly.

4. Collection and Processing of Personal Data

4.1 Website Access / Server Log Files

When you access our website, your browser automatically transmits certain information to our web server. This information is temporarily stored in so-called server log files.

The following information may be collected in particular:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the requested file or webpage
  • Referrer URL (the website from which access originated), where transmitted
  • Browser type and browser version
  • Operating system of the requesting device
  • Name of the internet service provider

This information is processed to:

  • ensure the reliable operation of the website;
  • maintain system security and stability;
  • facilitate the technical administration of the website.

The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest lies in providing a secure, stable and technically reliable website.

Server log files are generally retained for 7 to 14 days and are automatically deleted thereafter, unless a longer retention period is required for the investigation or prevention of security-related incidents.

The data contained in server log files is not combined with any other data sources.

4.2 Contact by E-mail or Telephone

If you contact us by e-mail, telephone or by any other means, we process the personal data you provide solely for the purpose of responding to your enquiry and communicating with you.

This may include, in particular:

  • Name
  • E-mail address
  • Telephone number
  • Contents of your enquiry
  • Project-related information
  • Any other information you voluntarily provide

Where your enquiry relates to the initiation or performance of a contract, the legal basis for processing is Article 6(1)(b) GDPR.

In all other cases, processing is based on our legitimate interest in responding to your enquiry pursuant to Article 6(1)(f) GDPR.

Your personal data will be retained only for as long as necessary to process your enquiry, unless you request its deletion or statutory retention obligations require us to retain the data for a longer period.

4.3 Contact Form

Where our website provides a contact form, the personal data you submit will be processed exclusively for the purpose of handling your enquiry and contacting you in response.

This may include, in particular:

  • Name
  • E-mail address
  • Telephone number
  • Message
  • Any additional information you choose to provide voluntarily

Mandatory fields are limited to the information required to process your enquiry effectively.

Your personal data will not be disclosed to third parties unless such disclosure is necessary for processing your enquiry, is carried out through technical service providers acting on our behalf, or is required by applicable law.

Where your enquiry relates to the initiation or performance of a contract, the legal basis for processing is Article 6(1)(b) GDPR. In all other cases, processing is based on our legitimate interest pursuant to Article 6(1)(f) GDPR.

Personal data submitted via the contact form will be deleted once it is no longer required for the purpose for which it was collected, provided that no statutory retention obligations apply.

5. Hosting

Our website is hosted by an external hosting provider who supplies the technical infrastructure required to operate the website.

In providing these services, the hosting provider may process personal data, in particular technical access data, on our behalf to ensure the secure and reliable operation of the website.

Where required by applicable data protection law, we have entered into a Data Processing Agreement (DPA) with our hosting provider in accordance with Article 28 GDPR. The hosting provider processes personal data solely in accordance with our instructions.

The legal basis for the use of our hosting provider is Article 6(1)(f) GDPR. Our legitimate interest lies in ensuring the secure, efficient and reliable provision of our website.

6. Cookies, Analytics and Tracking Technologies

Our website currently does not use cookies, analytics tools such as Google Analytics, marketing technologies, tracking technologies or social media plugins that enable the monitoring of your visit.

To the extent that technical processing is necessary for the operation of the website, such processing is carried out on the basis of Article 6(1)(f) GDPR.

Information is only accessed from or stored on your device where this is permitted by applicable law or where you have given your prior consent.

Should we implement non-essential cookies, analytics tools or comparable technologies in the future, they will only be used with your prior consent.

In such cases, the legal basis for processing will be Article 6(1)(a) GDPR in conjunction with Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), where applicable.

7. External Content and Web Fonts

At present, our website does not incorporate external services such as maps, videos, analytics tools or social media content that transmit personal data to third-party providers.

Where web fonts are used, they are intended to be hosted locally on our server. This ensures that no connection is established to external font provider servers when you access our website.

Should we integrate external services in the future, such as Google Maps, YouTube, Vimeo, Instagram, LinkedIn or externally hosted web fonts, this Privacy Policy will be updated accordingly.

Where required by applicable law, such services will only be activated after obtaining your prior consent.

8. Job Applications

If you apply for a position with our company, we will process your application documents exclusively for the purpose of conducting the recruitment process.

This may include, in particular:

  • Name and contact details
  • Curriculum Vitae (CV)
  • Certificates and qualifications
  • Work samples or portfolio
  • Any other application documents voluntarily submitted

The legal basis for processing your application data is Article 6(1)(b) GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG).

Unless statutory retention obligations apply or you have expressly consented to a longer retention period, your application documents will be deleted no later than six months after completion of the recruitment process.

9. Disclosure of Personal Data

We disclose your personal data to third parties only where this is permitted by applicable law or where you have provided your consent.

Personal data may, in particular, be disclosed to:

  • technical service providers, including hosting and IT service providers;
  • project partners, where necessary for the processing of your enquiry or the performance of a contract;
  • tax advisors, legal advisors and other professional consultants, where required;
  • public authorities, courts or other governmental bodies where we are legally obliged to do so.

Depending on the circumstances, the legal basis for such disclosures may be Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected.

A longer retention period may apply where required by statutory retention obligations or where necessary to establish, exercise or defend legal claims, or where other legitimate interests justify continued storage.

11. Your Rights

Under the applicable data protection legislation, you have the following rights:

  • the right to obtain information about the personal data we process concerning you (Article 15 GDPR);
  • the right to request the rectification of inaccurate or incomplete personal data (Article 16 GDPR);
  • the right to request the erasure of your personal data, subject to the statutory requirements (Article 17 GDPR);
  • the right to request the restriction of processing (Article 18 GDPR);
  • the right to receive your personal data in a structured, commonly used and machine-readable format (Article 20 GDPR);
  • the right to object to certain processing activities (Article 21 GDPR);
  • the right to withdraw your consent at any time with effect for the future, where processing is based on your consent; and
  • the right to lodge a complaint with a competent data protection supervisory authority (Article 77 GDPR).

To exercise any of these rights, please contact the Data Controller using the contact details provided in this Privacy Policy.

12. Right to Object (Article 21 GDPR)

Where we process your personal data on the basis of Article 6(1)(f) GDPR (legitimate interests), you have the right to object to such processing at any time on grounds relating to your particular situation.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.

13. Right to Lodge a Complaint with the Supervisory Authority

If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a data protection supervisory authority.

For companies established in the German federal state of Lower Saxony, the competent supervisory authority is:

The State Commissioner for Data Protection of Lower Saxony (Der Landesbeauftragte für den Datenschutz Niedersachsen)

Prinzenstraße 5
30159 Hannover
Germany

Telephone: +49 511 120-4500

E-mail: poststelle@lfd.niedersachsen.de

14. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Our security measures are regularly reviewed and updated to reflect technological developments and applicable security standards.

15. SSL/TLS Encryption

For security reasons, our website uses SSL/TLS encryption to protect the transmission of confidential information.

An encrypted connection can be recognised by the “https://” prefix in your browser’s address bar and the padlock symbol displayed by your browser.

When SSL/TLS encryption is enabled, any data transmitted between your browser and our website cannot generally be read by unauthorised third parties.

Please note, however, that despite the use of encryption, complete security of data transmission over the Internet cannot be guaranteed.

16. Updates to this Privacy Policy

This Privacy Policy is currently valid.

We reserve the right to amend this Privacy Policy from time to time to reflect changes in legal requirements or the introduction of new services or functionalities on our website.

The latest version of this Privacy Policy will always be published on this page.Last updated: May 2026