Privacy Policy

Our company, BWT Holding GmbH (contact details can be found under “Controller and Data Protection Officer”), is delighted that you are visiting our website! The protection of your data and your privacy is of particular importance to us.

In principle, our website can be used without providing any personal data. However, if you wish to use particular services of our company via our website, the processing of personal data may become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain your consent.

Personal data is always processed in accordance with the General Data Protection Regulation (GDPR) and the other national data protection provisions applicable to BWT Holding GmbH. By means of this Privacy Policy, our company would like to inform you of the nature, scope and purpose of the personal data we collect, use and process, and to inform you of the rights to which you are entitled.

To protect your data, BWT Holding GmbH has implemented appropriate technical and organisational measures which protect your data, among other things, against loss, manipulation or unauthorised access. The measures taken are reviewed regularly and continuously adapted to the state of the art.

Scope

This Privacy Policy applies to the website of BWT Holding GmbH and the associated subpages. Where individual sections of this Privacy Policy expressly refer to affiliated companies of BWT Holding GmbH, it also applies to the processing operations carried out by those companies as described therein.

It does not apply to websites controlled and operated by third parties. Please review the privacy notices of such websites separately, as BWT Holding GmbH is not responsible for their content or their data protection measures.

General – Definitions

The Privacy Policy of BWT Holding GmbH is based on the terminology of the GDPR.

“Personal data” means any information relating to an identified or identifiable natural person (hereinafter “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. “Non-personal data” is anonymised information that can under no circumstances be traced back to data subjects. For this reason, non-personal data is not subject to data protection law.

“Data subject” means any identified or identifiable natural person whose personal data is processed by the controller responsible for the processing.

“Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Controller” or “controller responsible for the processing” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

“Third party” means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

“Consent” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Controller and Data Protection Officer

The controller within the meaning of the GDPR, other data protection laws applicable in the Member States of the European Union and other provisions of a data protection nature is:

BWT Holding GmbH
Walter-Simmer-Straße 4
5310 Mondsee, Austria
Telephone: +43 6232 5011-0
Email: office@bwt.at

The Data Protection Officer voluntarily appointed by the controller can be contacted at the following contact details:

BWT Holding GmbH, Data Protection Officer, Walter-Simmer-Straße 4, 5310 Mondsee, Austria, Email: datenschutz@bwt.com

Provision of the Website and Server Log Files

Each time our website is accessed, the browser of your device automatically transmits information to the server of our hosting provider, which is stored temporarily in so-called log files. In particular, the IP address of the requesting device, the date and time of access, the name and URL of the file retrieved, the referrer URL, the browser and operating system used and the name of the access provider are recorded.

The purpose of the processing is to ensure a smooth connection, the convenient use of our website, the evaluation of system security and stability, and the prevention and investigation of attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and trouble-free operation of our website. The log files are deleted after 7 days, unless, by way of exception, they are required to investigate a specific security-related incident.

We use the service providers listed below to operate the website. Where they process personal data on our behalf, we have concluded data processing agreements with them pursuant to Art. 28 GDPR. Where personal data is transferred to a third country, the transfer is based on the safeguards specified in the table for each provider. The service providers process the technical data generated in connection with the operation and security of the website, in particular IP addresses, connection data and log data. In the case of Microsoft Azure and Cloudflare, processing in the United States of America cannot be ruled out. Further details on the safeguards used for transfers to third countries are set out in the table below.

Name	Adress	Service	Basis for data transfer
Microsoft Ireland Operations Limited	One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Irland	Cloud hosting and provision of the website infrastructure	EU-U.S. Data Privacy Framework; supplemented by contractual safeguards
maxcluster GmbH	Lise-Meitner-Straße 1b, 33104 Paderborn, Deutschland	Hosting and operation of the website	Data processing agreement pursuant to Art. 28 GDPR; no transfer to third countries envisaged
Cloudflare, Inc.	101 Townsend Street, San Francisco, CA 94107, USA	Content Delivery Network (CDN) and Web Application Firewall (WAF)	EU-U.S. Data Privacy Framework; supplemented by the Standard Contractual Clauses of the European Commission

Cookies and Consent Management

Our website uses cookies and similar technologies (e.g. pixels, local storage objects). Cookies are small text files that are stored on your device.

Technically necessary cookies are required to provide the website and its basic functions (e.g. session management, shopping cart, storing your cookie selection). The legal basis is Art. 6(1)(f) GDPR; access to your device is permitted without consent pursuant to Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).

All other cookies and similar technologies – in particular for statistics, analysis, marketing and retargeting – are only set or read with your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.

You make your consent decision via our consent management tool Cookiebot. You can withdraw or adjust your consent at any time with effect for the future via the cookie settings. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. In addition, you can delete cookies or restrict their storage at any time via your browser settings.

An overview of the specific cookies used, their providers, purpose and storage period can be found in the cookie settings.

Processing of Personal Data

For the processing operations described below, we provide information on the categories of personal data, the specific purposes of the processing, the respective legal basis, the recipients or categories of recipients, any transfer to a third country including its legal basis, the storage period or the criteria used to determine it, as well as whether the provision of the data is a statutory or contractual requirement or a requirement necessary to enter into a contract, and the possible consequences of failure to provide such data.

Your personal data is processed exclusively for the purposes stated in this Privacy Policy and to the extent necessary to achieve those purposes. This data is not disclosed without your consent, except in the cases described in this Privacy Policy and where required by mandatory national law.

For certain offerings on our website, use – for example of the user account, the newsletter or the contact form – may require prior registration and the associated further processing of personal data. In such cases, we inform you at the relevant point and obtain your consent where required.

Contact Options

Our website features a contact form that enables fast electronic contact with our company as well as direct communication with us. If you contact our company via the contact form, the personal data you transmit will be stored. When you contact us via the contact form, your personal data from the contact fields (title, name, address, telephone number, email address) and the content of your message are processed.

The purpose of the data processing is to handle your enquiry and to keep a traceable record of it. The legal basis for the processing is Art. 6(1)(b) GDPR, where the processing is necessary for the performance of a contract with you or in order to take steps prior to entering into a contract; otherwise, Art. 6(1)(f) GDPR on the basis of our legitimate interest in responding to enquiries.

Your enquiry and the associated data will be deleted as soon as the enquiry has been conclusively dealt with and no statutory retention obligations or other legal grounds preclude erasure.

If you contact us by telephone, you will be expressly asked before any recording begins whether you consent to the recording and automated transcription of the call. No recording takes place without your consent. The processing is based on your consent pursuant to Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future pursuant to Art. 7(3) GDPR. The recording and the transcript will be deleted after completion of the respective request, unless statutory retention obligations or other legal grounds preclude this.

Website-Analyse and Werbetracking

The services described in this section use cookies or similar technologies that are not technically necessary. They are only activated with your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. You can withdraw your consent at any time with effect for the future via our cookie settings.

Google Analytics

On our website we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables us to evaluate the use of our website and to improve our offering. Cookies and similar technologies are used for this purpose.

In particular, information about pages visited, interactions, approximate location, browser, operating system, device, referrer URL and the time and duration of use may be processed. According to Google, for users from the EU or EEA, IP addresses are only used to derive approximate location information and are discarded before storage. The information collected is regularly assigned to a pseudonymous identifier.

The processing is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. You can withdraw your consent at any time with effect for the future via our cookie settings. Google Analytics will not be activated without your consent.

The recipient of the data is Google. Processing may also be carried out by Google LLC in the United States of America or in other third countries. According to Google, such data transfers are based in particular on applicable adequacy decisions, including the EU-U.S. Data Privacy Framework, or on the Standard Contractual Clauses of the European Commission.

A data processing agreement pursuant to Art. 28 GDPR has been concluded with Google.

The storage period for user-level and event-level data depends on the data retention setting selected in Google Analytics and is generally 2 or 14 months; aggregated reports remain unaffected by this. Further information can be found in the Google Analytics privacy settings (https://support.google.com/analytics/answer/9019185), the information on data retention (https://support.google.com/analytics/answer/7667196) and Google’s Privacy Policy (https://policies.google.com/privacy).

Google Ads

We use Google Ads, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to draw attention to our offerings on external websites and to measure the success of our advertising campaigns.

The use of Google Ads and the setting or reading of cookies or similar technologies that are not technically necessary are carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. You can withdraw your consent at any time with effect for the future via our cookie settings. The corresponding functions will not be activated without your consent.

Processing may also be carried out by Google LLC in the United States of America; the transfer is based on the adequacy decision for the EU-U.S. Data Privacy Framework and, in addition, on the Standard Contractual Clauses of the European Commission. Please refer to our cookie settings for the storage period of the cookies set.

Google Consent Mode

Google Consent Mode adapts the behaviour of integrated Google services to the consent decision you have made. Even if consent has been refused, cookieless signals and modelled analyses may be processed. Whether and to what extent personal data is processed in this context depends on the specific technical configuration. Cookies or similar technologies that are not technically necessary are only activated with your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Further details can be found in the cookie settings.

Google Ads Enhanced Conversions for Web

This website uses Google Ads Enhanced Conversions for Web. In the event of a conversion, personal data provided by you may be transmitted to Google in hashed form and matched there with existing account data in order to attribute conversions to advertising campaigns. Hashing does not necessarily result in anonymisation. The processing is therefore only carried out with your explicit consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. You can withdraw your consent at any time with effect for the future via our cookie settings.

Google Enhanced Conversions for Leads

With Google Enhanced Conversions for Leads, personal data provided by you may be transmitted to Google in hashed form and matched there with existing account data in order to attribute conversions to advertising campaigns. Hashing does not necessarily result in anonymisation. The processing is carried out exclusively with your explicit consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. You can withdraw your consent at any time with effect for the future via our cookie settings.

Microsoft Clarity

We use Microsoft Clarity, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, to analyse and improve the use of our website. For this purpose, session recordings and heatmaps in particular are created.

For this purpose, Clarity processes in particular browser and operating system information, country, referrer URL, links accessed and clicked, as well as clicks, mouse movements and other usage behaviour. The data is collected via a tracking code.

The recipients of the data are Microsoft Ireland Operations Limited and Microsoft Corporation. Data may be processed in the United States of America. Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework; in addition, the transfer is based on the Standard Contractual Clauses of the European Commission.

Further information, including the contact details of the data protection officer, can be found in Microsoft’s Privacy Statement (https://www.microsoft.com/en-us/privacy/privacystatement).

Adform – Conversion-Tracking and Retargeting

On our website we use the service of Adform A/S, Silkegade 8, 1113 Copenhagen, Denmark. Adform uses cookies and similar technologies to collect and analyse information about the usage behaviour of visitors to our website. Among other things, pseudonymised data such as IP addresses, device information, pages visited and interactions with advertising media are processed in order to display targeted advertising, to measure the success of advertising campaigns (conversion tracking) and to create target groups for retargeting.

The data processing is based on your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. You can withdraw your consent at any time with effect for the future via our cookie settings. Alternatively, you can object to data collection by Adform directly via Adform’s opt-out page: https://site.adform.com/privacy-center/platform-privacy/opt-out/.

Where data is processed outside the EU or EEA, this is done on the basis of adequacy decisions of the European Commission or by using the EU Standard Contractual Clauses. Please refer to our cookie settings for the storage period of the cookies set. Further information on data protection at Adform can be found at https://site.adform.com/privacy-center/overview/.

OpenAI – Conversion Tracking and Advertising Services

On our website we use services of OpenAI Ireland Ltd., First Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 Y396, Ireland (for users outside the EEA: OpenAI, L.L.C., 3180 18th St, San Francisco, CA 94110, USA; hereinafter “OpenAI”), to measure the effectiveness of our advertising campaigns (“conversion tracking”) and to optimise and deliver targeted advertisements.

When you visit our website and after you have interacted with one of our advertisements on OpenAI platforms, a cookie or a comparable identifier is stored on your device via an embedded script or pixel. In this process, OpenAI processes personal data such as the IP address (usually truncated or pseudonymised), device and browser information (user agent, resolution, operating system), the referrer URL, actions on our website (e.g. pages visited, purchases, form entries, button clicks), the timestamp of access and, where applicable, advertising or campaign IDs.

The purpose of the data collection is to analyse the success of our marketing measures, to attribute conversions and to optimise the placement of advertisements on OpenAI’s services for interested target groups.

The processing of your data and the setting of cookies or pixels are carried out exclusively on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. Consent may be withdrawn at any time via our cookie settings with effect for the future.

In the course of using OpenAI, personal data may be transferred to servers of OpenAI, L.L.C. in the United States of America. OpenAI, L.L.C. is certified under the EU-U.S. Data Privacy Framework, which ensures an adequate level of data protection for data transfers to the USA. In addition, the transfer is based on the Standard Contractual Clauses of the European Commission.

The cookies set by the tracking are automatically deleted after 30 days. You can withdraw your consent at any time by adjusting your preferences in our cookie banner or by deleting cookies in your browser settings.

Storage Period

Where necessary, we store your personal data for the duration of the entire business relationship (from initiation through performance to termination of a contract) and beyond that in accordance with statutory retention and documentation obligations or for the defence of legal claims.

The retention period is therefore determined by the statutory retention periods or limitation periods. These amount, for example, to 7 years under the Austrian Commercial Code (Unternehmensgesetzbuch – UGB) and the Austrian Federal Fiscal Code (Bundesabgabenordnung – BAO), and to six months under the Austrian Equal Treatment Act (Gleichbehandlungsgesetz – GlBG). In certain cases, a longer retention period may also be required for the defence of legal claims or due to limitation periods.

Where specific storage periods are stated in this Privacy Policy for individual processing operations, these shall take precedence.

Automated Decision-Making and Profiling

No automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR takes place, unless expressly stated otherwise for an individual service.

Your Rights as a Data Subject

With regard to the data processing operations described above, you as a data subject have the following rights:

Access (Art. 15 GDPR): the right to obtain confirmation as to whether data concerning you is being processed, access to the data processed, further information about the data processing and a copy of the data.
Rectification (Art. 16 GDPR): the right to have inaccurate data rectified or incomplete data completed.
Erasure (Art. 17 GDPR): the right to have the data concerning you erased without undue delay, provided that none of the exceptions set out in Art. 17(3) GDPR applies.
Restriction of processing (Art. 18 GDPR): the right to request the restriction of processing under the conditions set out therein.
Data portability (Art. 20 GDPR): the right to receive the data concerning you which you have provided in a structured, commonly used and machine-readable format and to have this data transmitted to other controllers.
Objection (Art. 21 GDPR): the right to object to the future processing of personal data concerning you, where the processing is based on Art. 6(1)(f) GDPR. You may object to the processing of personal data for direct marketing purposes at any time and without giving reasons.
Withdrawal of consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw it at any time with effect for the future. This shall not affect the lawfulness of processing carried out before the withdrawal.
Complaint to a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection provisions. The competent supervisory authority in Austria is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria.

In addition, we are obliged to communicate any rectification or erasure of data or restriction of processing carried out in accordance with Art. 16, Art. 17(1) and Art. 18 GDPR to each recipient to whom the data has been disclosed. However, this obligation does not apply where such communication proves impossible or involves disproportionate effort. Notwithstanding this, you have the right to be informed about those recipients.

You may exercise your rights at any time, without any formal requirements, vis-à-vis BWT Holding GmbH, in particular by email to datenschutz@bwt.com or in writing to the address stated above. Please note that we can only provide information about personal data if we are able to verify your identity beyond doubt; we may request additional information for this purpose.

Changes to this Privacy Policy

We amend this Privacy Policy when the services we use, our processing activities or the legal framework change. The current version published on our website applies in each case. Please therefore check the content of this Privacy Policy regularly.

Last updated: 21 September 2026