KILIC Gruppe Privacy Notice

1. Controller and contact details

The controller responsible for operating this website and receiving contact enquiries submitted through it is:

F&K Maschinenbau GmbH & Co. KG
Bunsenstraße 9–11
51145 Cologne
Germany
Phone: +49 2203 93538 40
Email: info@fk-mb.de

The company is represented by its general partner, F&K GmbH, which is in turn represented by its managing directors, Ferhan Kilic and Kemal Kilic.

This notice describes the processing of personal data when using our company website at www.kilic-gruppe.com and through the contact channels explained here.

“KILIC Gruppe” is a group designation and is not, in itself, a separate legal entity acting as controller. F&K Maschinenbau GmbH & Co. KG, at the address given above, is also responsible for the subsequent substantive processing of project enquiries, rental enquiries, job applications and supplier applications. It is the contracting party responsible for projects and purchasing, the landlord, and the employer responsible for job applications.

Membership of the corporate group does not permit unrestricted disclosure of personal data. The recipients and the legal basis for any disclosure depend on the particular matter.

You can send questions about data protection and requests to exercise your rights to info@fk-mb.de.

Data protection officer: Sascha Kertz
Contact the data protection officer: mail@2-xs.com

2. Accessing the website and its technical provision

When you access this website, the data necessary for connection, delivery and security are processed. These include, in particular, your IP address, the requested address or file, the time and technical transmission information. Your browser may also transmit a browser identifier and the address of a previously visited page.

We use the technical hosting service to make the requested content accessible and enable reliable and secure operation. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is in providing a functioning website and preventing disruption and attacks.

Website hosting and technical email delivery through Mittwald

For website hosting and the technical delivery of form messages, we use Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany. Mittwald provides the technical infrastructure and processes the data required for provision, security and transmission. Information from Mittwald: privacy and subprocessors. The technical retention periods are listed in section 9.

On its technology page, Mittwald describes its own data centre in Espelkamp and ISO 27001 certification. The certification concerns the provider’s information security described there; it does not certify our website.

Direct form delivery through Mittwald

We use the Mittwald web server's local mail service (Sendmail/PHP mail) to send form submissions automatically. The data processed includes sender and recipient details, communication timestamps, the subject, message content, attachments and technical delivery data. We use the email address you provide as the reply-to address. Processing serves to transmit and handle your enquiry on the legal bases stated in sections 5 to 7.

The purposes and legal bases for our handling of your data depend on your enquiry and Sections 5 to 7 or 12. Information about recipients, international transfers and retention is provided in Sections 8 and 9.

3. Content and storage on your device

Fonts, images and the files needed to display the website are provided together with this website. Our website application does not embed analytics or advertising services, external maps, social media plugins or external video players. It does not store form content in localStorage or sessionStorage. A technically necessary session using a Secure, HttpOnly and SameSite cookie protects direct form submission.

Entries and selected files are initially held in the browser while you complete the form and are transmitted to our web server when you submit it. Closing a form window does not necessarily delete this data. A form security token is valid for 30 minutes. Expired server-side session files are removed no later than the next daily cleanup run. Any storage by your device or browser depends on its settings.

Browsers, email programs and devices may independently cache or restore content. As a general rule, we have no influence over these functions.

Consent may not be required under Section 25(2) TDDDG for storage or corresponding access that serves solely to transmit a communication or is strictly necessary for a digital service expressly requested by the user. Additional functions requiring consent may only be used after the appropriate information has been provided and valid consent obtained. The data protection basis for any subsequent processing of personal data must be assessed separately.

4. Contact forms and sending documents

Separate forms are available for project enquiries, rental enquiries, job applications and supplier applications. The message is routed to the department responsible: the project team, property letting, HR or purchasing. Recipients are fixed on the server; the form cannot be used to send email to a freely chosen recipient.

When you submit a form, your entries and selected attachments are transmitted over HTTPS to our web server at Mittwald, checked there and forwarded through the local mail service to the assigned business mailbox. Uploaded files are held on the web server only temporarily while the request is being processed. The application does not maintain a permanent database containing enquiry content.

The technical delivery function passes the message and checked attachments directly to the local mail service. You do not need to download an email file or send it yourself. Confirmation in the browser means that the mail service has accepted the message for delivery; final delivery may still fail because of subsequent delivery errors. If the delivery status is uncertain, the website displays a reference for investigation and prevents automatic duplicate sending. No automatic confirmation email is sent to you.

Transmission to the website is encrypted. The subsequent email transport and storage in the mailboxes do not provide end-to-end encryption exclusively between you and the person handling your enquiry. For particularly sensitive documents, please first contact us without disclosing confidential details so that an appropriate transmission method can be agreed.

The information marked with an asterisk is needed to identify and process your matter. There is no general statutory obligation to submit an enquiry through this website. If information required for the particular matter is missing, it may not be possible to process it or take steps towards a contract. Further information and documents are voluntary.

Please provide only the information required for your matter. In particular, avoid unnecessary health data, copies of identity documents, bank details and data about other people.

Acknowledging this notice and requesting that your matter be processed do not constitute blanket consent under data protection law. The necessary processing takes place on the legal bases specified below. This does not grant consent to advertising, a candidate pool or other additional purposes.

5. Project and rental enquiries

5.1 Project enquiries

When you send a project enquiry, we process the contact and company information you provide and the description of your project. This may also include technical drawings, specifications, quantities and requested dates.

The processing serves communication, assessment of your project enquiry and, where appropriate, preparation of a quotation or contract.

5.2 Rental enquiries

When you send a rental enquiry, we process the contact and company information you provide and the description of your rental requirements. This may include information about the desired unit, floor area, intended commercial use and preferred start of the tenancy.

The processing serves communication, assessment of your rental enquiry and, where appropriate, preparation of a rental offer or tenancy agreement.

5.3 Common legal bases, recipients and retention

If you are taking steps to enter into a contract with the responsible company yourself, Art. 6(1)(b) GDPR is the legal basis. For company contact persons and other business contacts, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is in properly handling business enquiries and communicating with prospective customers and business partners.

Art. 6(1)(c) GDPR applies to evidence and retention required by law. Processing necessary to assert or defend claims may be based on Art. 6(1)(f) GDPR. Where the purpose changes, the additional requirements applicable to that change must be observed, including Section 24 BDSG where applicable.

The company responsible for your matter is identified in Section 1. Recipients and retention periods are described in Sections 8 and 9.

6. Applications for employment

When you apply for a job, we process your contact details, information about your desired area of work, a possible start date, your message and any application documents you choose to attach. The purpose is to conduct the recruitment process and decide whether to establish an employment relationship with the company identified in Section 1.

The processing necessary to take steps towards a contract is based on Art. 6(1)(b) GDPR and, where applicable, Section 26(1) BDSG.

Information about health, religion, political beliefs or other particularly protected aspects of life is not requested for a general initial application. Where special categories of personal data are required in a particular process to fulfil rights and obligations under employment or social security law, Art. 9(2)(b) GDPR in conjunction with Section 26(3) BDSG may be applicable. The additional requirements and safeguards must be met. Voluntary submission alone does not replace a legal basis.

The website does not automatically add you to a candidate pool. Further storage for other positions requires separate, voluntary and informed consent for a specified period. Refusing or withdrawing this additional consent does not affect the current recruitment process. Where consent covers special categories of personal data, it must expressly refer to them.

If you are hired, only the information required for the employment relationship will continue to be processed. Information on further processing within the employment relationship will be provided separately.

Following an unsuccessful or withdrawn application, limited further retention to establish, exercise or defend claims may be based on Art. 6(1)(f) GDPR. The legitimate interest is in resolving legal issues relating to the selection process. Where the purpose changes, Section 24 BDSG must be observed in particular. For special categories of personal data, a relevant exception must also apply, such as Art. 9(2)(f) GDPR.

The criteria in Section 9 apply to retention. After the selection procedure has ended, further storage is based only on a specific lawful purpose; there is no general legal requirement to retain every application for a blanket six-month period.

7. Supplier applications and information about other people

For a supplier application, we process company and business contact information, the products and services offered, and the information you submit on manufacturing, capacity, quality assurance, certifications, insurance, financial capability and responsible business conduct. Company information may also be personal data, particularly for sole traders. The purpose is to assess suitability, clarify queries and prepare for a possible business relationship. An application does not constitute supplier approval or an order.

We process data about business contact persons on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is in selecting suitable business partners and preparing supply relationships. If you are taking steps towards a contract yourself as a sole trader, Art. 6(1)(b) GDPR applies. The purchasing company responsible is identified in Section 1.

We use information on compliance and supply chain risks to the extent necessary for the specific supplier assessment. The website does not perform automatic credit checks or sanctions list queries. If further assessment involving additional personal data, external sources or particular statutory obligations becomes necessary, we will inform the individuals concerned of that processing as required by law. Please limit information about natural persons and confidential supporting documents to what is necessary.

Bank details or copies of identity documents are not requested for an initial application. Please identify referees or provide other people’s contact details only where this information is necessary and you may lawfully disclose it. Confidential customer documents should not be transmitted without the appropriate authorisation.

If we receive personal data about other people, such as referees, we assess the lawfulness of this processing separately. Unless a statutory exception applies, we inform the data subject about the processing under Art. 14 GDPR, including the categories and source of the data, purposes, legal basis, recipients, retention periods and rights. This is done within a reasonable period, no later than one month after receiving the data. If the first contact occurs earlier, we provide the information at that time; if the first disclosure occurs earlier, no later than that time. Confirmation by the sender does not replace our own information obligation.

8. Recipients and international transfers

Within F&K Maschinenbau GmbH & Co. KG, data are handled by the departments responsible for the respective enquiry: the project team, rental management, recruitment personnel or purchasing; for site visits, also the relevant reception and visit coordinators. Disclosure to other departments must be limited to a necessary and legally permissible task.

The technical recipients are Mittwald as the web host and operator of the local mail service, as well as the mail service providers used to receive and process business emails. Appointed IT service providers may obtain access to the extent required for maintenance, troubleshooting and backups.

International transfers

The form delivery described here uses Mittwald's infrastructure. The roles of any subprocessors engaged and the applicable agreements govern their processing; this does not constitute a blanket assurance that all processing takes place exclusively in Germany. Where a transfer to a third country is necessary, it takes place subject to Articles 44 et seq. GDPR, in particular on the basis of an applicable adequacy decision or appropriate safeguards.

Information about the recipients relevant to your data and, where applicable, a copy of or source for the transfer safeguards is available through info@fk-mb.de or our data protection officer.

Data are disclosed to authorities, courts or professional advisers on an applicable legal basis, for example to comply with a legal obligation or where necessary to assert or defend claims.

The website does not automatically subscribe you to a newsletter and does not transmit enquiries to an advertising service.

9. Retention periods and deletion

The retention period depends on the purpose of the processing, the stage of handling, applicable statutory retention obligations and any specific need to pursue or defend legal claims. A merely possible future use does not justify indefinite retention. We delete data once the lawful retention purpose ceases and no obligation requires continued storage.

If a contractual relationship follows, the data needed for it is processed to perform and administer the contract. Section 257 HGB and Section 147 AO apply in particular to documents subject to statutory retention obligations. Under these provisions, commercial and business correspondence must generally be retained for six years, accounting vouchers for eight years, and the books, inventories and financial statements covered by law for ten years. The classification of the specific document and the applicable statutory provisions are decisive.

In accordance with the relevant provision, statutory periods generally begin at the end of the calendar year of the relevant event, such as the receipt or dispatch of a business letter or the creation of an accounting voucher. Provisions suspending the expiry of periods under tax law and other special statutory rules may require longer retention. Not every enquiry, attachment or application is subject to the same retention obligation.

In specific legal disputes, necessary further storage may be required to resolve them. This processing is restricted to the data needed for that purpose and the permitted purpose. Once the ground for retention ceases to apply, the data is deleted unless another legal basis permits further storage.

These rules also apply to mailboxes, forwarding, working copies and archives. The local mail service may retain messages in its technical delivery queue until delivery or final handling of a delivery failure. Bounce messages and records needed to resolve an issue are retained only for as long as required to handle the specific delivery process or on another legal basis. The provider periods explained below apply to technical logs and backups; they do not replace deletion in active mailboxes.

We have no access to files, clipboard contents or messages that you store independently of our form on your own devices or with your own email provider. Please take account of the settings and deletion options available there.

Technical retention at Mittwald

The following periods concern Mittwald’s technical logs. According to the provider, they cannot be configured individually and do not replace the deletion rules for messages, applications and business documents described above. Source: Mittwald, privacy FAQ, section 5, accessed on 27 October 2026.

Web and database backups are subject to the plan-dependent recovery windows of the relevant hosting contract; according to the provider, log and cache contents are excluded. Technical backup periods and the purpose-related retention of business content must be considered separately.

10. Your rights

Subject to the statutory conditions, you have the right of access to, rectification and erasure of, and restriction of processing of your personal data. You may also have a right to data portability. This concerns, in particular, data you have provided yourself that is processed by automated means on the basis of consent or a contract.

To exercise your rights, you can contact info@fk-mb.de or the responsible company identified in Section 1.

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing before withdrawal remains unaffected.

Your right to object under Art. 21 GDPR

If we process personal data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.

Following such an objection, we stop processing. Processing may continue only if we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims.

You may object to processing for direct marketing at any time without giving a particular reason. The data must then no longer be used for that marketing.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the alleged infringement.

For private-sector bodies in North Rhine-Westphalia, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia is generally a competent point of contact:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestraße 2–4
40213 Düsseldorf
Postal address: Postfach 20 04 44, 40102 Düsseldorf
Email: poststelle@ldi.nrw.de
Website: www.ldi.nrw.de
Complaint information: Your complaint

11. Automated decisions and changes to the website

The website described does not make decisions based solely on automated processing that produce legal or similarly significant effects regarding project enquiries, rental enquiries, job applications or supplier applications. It does not include profiling or automated suitability assessment for these purposes.

A proposed shop is not covered by this notice. Before introducing ordering, payment or customer account functions, an upload portal, analytics tools, external media or automated assessments, the privacy notice must be adapted to the actual processing, and the necessary legal and technical prerequisites must be put in place.

12. Site visits and confidentiality agreements

If you arrange a site visit or enter into a visitor confidentiality agreement, we process your name, where relevant your company and role, business contact details, visit date, location and purpose, the host, and the information and signatures relating to the agreement. Copies of identity documents and dates of birth are not requested for this purpose.

The purposes are to organise and administer the visit, coordinate secure access, protect confidential information, and document and enforce the agreed rights and obligations. Article 6(1)(b) GDPR applies to an agreement with you personally. Where you represent a company or data are needed for organisational safeguards, we base the necessary processing on Article 6(1)(f) GDPR. Our legitimate interests are to protect the business and visitors, maintain accountable visit administration and protect our trade secrets. Specific statutory record-keeping obligations may additionally provide a basis under Article 6(1)(c) GDPR.

Reception, the visit coordinator and the responsible administration receive the necessary information; where required, the persons dealing with legal matters and necessary IT service providers also receive it. Access to protected areas cannot be enabled without the information needed to administer the visit and any confidentiality agreement required in the individual case. Sections 8 to 10 apply to recipients, retention and your rights. A visitor agreement does not constitute consent to advertising.