Jointly responsible as controllers for data processing on these websites and during the execution of the Quarry Life Award are:
HeidelbergCement AG (in the following “HCAG”)
Dr. Dominik von Achten, Chairman
Dr. Nicola Kimm
Berliner Straße 6
Phone: +49 6221-481-0
Fax: +49 6221-481-13217
Data Protection Officer:
+49 6221 481 34567
HeidelbergCement Norway AS (in the following “HeidelbergCement Norway”)
HeidelbergCement Norway AS
Postboks 143 Lilleaker
Chief Privacy Officer:
+46 729 784 038
The controllers are collectively referred to in the following as "we".
1. Collection and processing of data; Joint Controllership
We collect and process personal data insofar you provide us with it via an entry form on our website or by any other way, for example e-mail. Moreover, we collect and process data that arises during your use of our website. The processing of your data is made in accordance with the EU General Data Protection Regulation (GDPR) and applicable local data protection laws. Personal data means any information relating to an identified or identifiable natural person. Below we inform you in detail about which data we process in which way and on which legal basis. Moreover, we inform you about your rights and about the duration of storage of your data.
HCAG and HeidelbergCement Norway work closely together in the Quarry Life Award, i.e. both in the presentation of the award on these websites and in the implementation of the award itself. This also applies to the processing of your personal data. The parties have jointly determined the order of the processing of your personal data in each section of processing. Therefore, they are so-called joint controllers (Article 26 GDPR) for the protection of your personal data within the sections of processing described below.
HCAG is the organizer of the Quarry Life Award and also decides on the winners on an international level (see in detail the Terms & Conditions and How to participate). HCAG also provides the technical infrastructure for the Quarry Life Award website. However, there is a separate competition for each country, in which a local subsidiary of HCAG, in this case HeidelbergCement Norway, independently judges the submissions and selects the winners and manages and controls the press coverage on the Quarry Life Award at national level. The data processing processes as described in sections 2 to 7 are therefore carried out by both controllers. Both controllers are competent for the processing of data as described below unless expressly stated otherwise.
2. Processing of data for registering for and participating in the Quarry Life Award contest
To participate in the Quarry Life Award contest a user account is required. Before submitting a project proposal you have to create an account on our Quarry Life Award website (e.g. https://www.quarrylifeaward.no). For creation of an account you must provide us your e-mail address, first name, last name and postal address. After submitting these personal data in our registration form you receive a confirmation e-mail in which you must click a link to confirm your registration. This confirmation e-mail is necessary for verifying you as the owner of the e-mail address inserted. Without clicking this link, you will not be registered. In this case we delete your personal data after 48 hours as a matter of routine.
We process your personal data submitted when creating a User Account according to Art. 6 (1) sent. 1 point (b) GDPR (contract fulfillment) for the purpose of identification of our contractual partner and providing you the account with Quarry Life Awards’ website and send you messages necessary for your participation in the Quarry Life Award contest or if you wish to receive a new password.
Insofar personal data is included in data uploaded within the User Account during the Contest and/or in the Project Reports, we process this information for the purpose of your participation in the contest and therefore according to Art. 6 (1) sent. 1 point (b) GDPR (contract fulfillment).
Moreover, all data uploaded within the User Account during the Contest and in the Project Reports of the Top Six Submissions will be made publicly available on the Quarry Life Award website. These data and Project Reports do not need to include personal data of Contestants or third parties. However, if personal data is included, we have a legitimate interest to process these personal data because with the Quarry Life Award, we show our sustainability efforts to the public and therefore need to present on the Quarry Life Award Website current and past Contests. For the same reason, we have a legitimate interest to publish names and collect and publish pictures of National and International Winners including submitting these personal data to the national and international press. The legal basis for the processing is Art. 6 (1) sent. 1 point (f) GDPR.
In addition, information you provide to us by participating in a contest, will be processed according to Art. 6 (1) sent. 1 point (b) GDPR (contract fulfillment) by the International and National coordinators as well as National and International Jury Members for the purposes of evaluation and publication of the projects.
3. Processing of Personal Data when contacting us
If you provide us with personal data when contacting us, e.g. by e-mail we collect and process your data according to Art. 6 (1) sent. 1 point (b) GDPR for the performance of a contract with you or in order to take steps at your request prior to entering into a contract or according to Art. 6 (1) sent. 1 point (f) GDPR for the purpose of our legitimate interest to answer your request.
If you address a question or a request to one of us, but the controller addressed finds out that only the other controller can answer or fulfill it, then the controller addressed will forward your question or request directly to the other.
4. Processing of Data via Cookies and Logfiles
Necessary cookies do not require the consent of the user under applicable law.
You can configure your web browser in such a way that necessary cookies are also blocked, but you may then not be able to use the website as intended.
If the data processed with the help of necessary cookies can be viewed in individual cases as person related, the legal basis for such processing is Art. 6 (1) point (f) GDPR, as we have a legitimate interest in the operation of the website.
Moreover, in accordance with Art. 6 (1) sent. 1 point (f) GDPR (legitimate interest), every single web page uses log files, i.e. for every page impression, the access data are saved to the server log. The saved data record contains the following details:
Your IP address, the date, the time, the file accessed, the status, the request that your browser sent to the server, the amount of data transmitted and the webpage from which you accessed the requested page (referrer) as well as
The product and version information of the browser used, your operating system and your country of origin.
Log data will be deleted every 14 days as a matter of routine, i.e. any contained data will be deleted irretrievably. This temporary storage is only for protecting our websites against attacks or misuse which represents our legitimate interest in the data processing described above. We do not use the log data beyond this purpose.
The embedding of OpenStreetMap and thus the processing of your data as described above takes place on the legal basis of Art. 6 (1) sent. 1 point (f) GDPR because of our legitimate interest to make it easy to find the locations we have indicated on the website and thus to make our websites more attractive to our website visitors.
Data you insert on our website is transferred in encrypted form (SSL). We take technical and organizational measures to secure our website and other systems against loss, destruction, access, modification or dissemination of your data by unauthorized persons.
7. Categories of recipients of the personal data; data transfer to a third country
Service providers and auxiliary agents used by us in connection with the website, e.g. host provider, agencies, IT service providers may have access to your personal data. However, insofar these service providers and auxiliary agents process data on our behalf they only act according to our instructions and we concluded adequate contracts with them. This applies accordingly to service providers, which have their legal seat in a third country (outside the EU/EEA). We may also disclose your personal data to other entities of the HeidelbergCement Group for related processing purposes as for which you initially submitted your personal information. Some of these entities are located in countries that are not considered to provide the same level of data protection as the countries within the EEA. However, we have bound them by adequate contracts to safeguard your data. Further information can be obtained upon request.
8. Your Rights; Competent Body
We jointly agreed on which obligations each party fulfills under the GDPR. This particularly concerns the exercise of the rights of data subjects and the fulfilment of information obligations under Articles 13 and 14 of the GDPR.
According to Art. 15 GDPR you have the right free of charge of access to your personal data and information about processing. Moreover, according to Art. 16 to 18 GDPR you have the right of rectification of inaccurate personal data as well as of erasure of personal data or restriction of processing.
Under the conditions of Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance.
Moreover, according to Art. 21 (1) GDPR you have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on point (e) or (f) of Art. 6 (1) sent. 1 GDPR including profiling based on those provisions. Where personal data are processed for direct marketing purposes, according to Art. 21 (2) GDPR, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.
If the data processing is based on your consent, you can withdraw it at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
We shall comply with the aforementioned requests if and to the extent such compliance is required by the applicable statutory laws.
In principle, the information to the data subject is provided by the body to which the data subject asserted his or her rights to.
We shall immediately inform each other about the exertion of the rights of a data subject and provide the other party with all necessary information referred to the right of access.
Each data subject has the right to lodge a complaint with a supervisory authority of the alleged infringement.
The supervisory authority for HCAG is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit
Königstrasse 10 a
The supervisory authority for HeidelbergCement Norway is:
Postboks 458 Sentrum
Tel: +47 22 39 69 00
9. Period of Data Storage and routine deletion
Insofar nothing else is explicitly stated above we process and store personal data only for the period, which is required to meet the purpose of processing, or as long and to the extent as statutory laws require us to process and/or store such data.
If the purpose of processing does not apply anymore or the applicable statutory retention requirement expires, we will as a matter of routine erase data or restrict the processing of data in accordance with the applicable statutory laws.