Privacy Policy

1. Data Controller

Controller within the meaning of the GDPR: Ecotech Styria GmbH Judenburgerstraße 176 A-8580 Köflach, Austria Management: Ing. Gernot Pauger Phone: +43 3144 / 70477 Email: office@ecotechstyria.com Company register no.: FN 513783 p VAT no.: ATU 81341004

2. Hosting

This website is hosted by Telematica Internetdienste GmbH (Austria). When our pages are accessed, technically necessary data (e.g. IP address, date, time, browser type, requested URL) are processed which are required for the secure provision of the website. The data are processed exclusively within the EU. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in stable and secure operation of the website).

3. Server Logfiles

On every access to our website, our hosting provider automatically stores the following data: • Anonymised/shortened IP address of the requesting computer • Date and time of access • Name and URL of the requested file • Volume of data transferred • Notification of whether the access was successful • User agent (browser, operating system) • Referrer URL These data are used exclusively to ensure trouble-free operation and to safeguard the security of our IT systems. The data are not merged with other data sources or evaluated for marketing purposes. The data are automatically deleted after no more than 30 days. Legal basis: Art. 6 (1) (f) GDPR.

4. Contact Form and Email

When you contact us via the contact form or by email, the data you provide (name, email address, phone number if provided, message content) are processed to handle your request and communicate with you. Recipient is office@ecotechstyria.com. Legal basis: Art. 6 (1) (b) GDPR (initiation/performance of a contract) or (f) GDPR (legitimate interest in answering your request). Your data will be deleted as soon as they are no longer required for the purpose for which they were collected and there are no statutory retention obligations (e.g. 7 years for business-relevant correspondence under §132 of the Austrian Federal Tax Code).

5. Cookies and Local Storage

Our website only uses technically necessary cookies, which are required without your consent to ensure basic operation: • ECOTECH_LANG — stores your chosen language (German/English). Lifetime: 1 year. Legal basis: Art. 6(1)(f) GDPR. • cms-consent-v2 — stores your cookie decision in your browser's local storage so we do not have to ask again on every visit. Lifetime: until withdrawn. This information never leaves your device. • ecotech_a11y_v2 — stores your accessibility preferences (e.g. larger type, higher contrast) in local storage. Lifetime: until withdrawn. • cms_admin — only set when an administrator uses our internal editing system. Not relevant for ordinary website visitors. Any cookies beyond these (analytics, marketing) are only set once you have explicitly consented via our cookie banner. Technically this is implemented so that the providers' scripts are not loaded until after your consent (Google Consent Mode v2, "basic"). Without consent, no tracking cookies are set and no data is transferred to third parties.

6. Web analytics and advertising (Google Analytics 4, Google Ads)

We use Google Analytics 4 and Google Ads, both provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Neither service is loaded until you have actively given your consent via our cookie banner. As long as no consent has been given, no Google script is loaded, no cookies are set and no connection to Google servers is established — not even in anonymised form. Google Analytics 4 (category "Analytics") Purpose: measuring how our website is used (page views, time on page, visitor sources, devices) in order to improve content and structure. Evaluation is aggregated. We do not combine the data with other sources and do not use it to identify you personally. Cookies: _ga and _ga_<property ID>, each with a lifetime of up to 2 years. IP address: for traffic from the EEA, Switzerland and the United Kingdom, Google uses the IP address solely to derive an approximate location (country, region, city) and discards it immediately afterwards. Individual IP addresses are not stored. Retention: event and user data in Google Analytics is retained for no more than 14 months and is then deleted automatically. Google Ads (category "Marketing") Purpose: measuring the performance of our search ads (conversion tracking) — that is, attributing an enquiry submitted via our contact form to a preceding ad click — as well as remarketing. Cookies: _gcl_au, _gcl_aw and _gac_gb_<ID> (90 days each) and, for remarketing, IDE on the doubleclick.net domain (13 months in the EEA) and test_cookie (15 minutes). We only receive aggregated campaign reports from Google, never personal data on individual visitors. Legal basis Your explicit consent under Art. 6(1)(a) GDPR in conjunction with section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). You may withdraw your consent at any time with effect for the future — via the "Cookie settings" link in the page footer or on our cookie policy page. The lawfulness of processing carried out before withdrawal remains unaffected. Recipients and transfers to third countries For Google Analytics we have entered into Google's data processing terms (processing on our behalf pursuant to Art. 28 GDPR). For Google Ads, the Google Ads Controller-Controller Data Protection Terms apply; there, Google Ireland Limited acts as an independent controller for EEA data. Processing by Google LLC in the USA as a sub-processor cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; by adequacy decision of 10 July 2023 the European Commission determined that certified US companies provide an adequate level of data protection. That decision is in force; an appeal against it is pending before the Court of Justice of the European Union (Case C-703/25 P). Further ways to object • Browser add-on to opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout • Manage personalised advertising at Google: https://myadcenter.google.com • Google's privacy policy: https://policies.google.com/privacy • How Google uses data from its advertising services: https://business.safety.google/privacy/

7. Fonts

This website uses exclusively locally hosted fonts (WOFF2 format, self-hosted on our server). No connection is made to Google Fonts, Adobe Fonts or other external font providers. Your IP address is therefore not transmitted to third parties when fonts are loaded.

8. External Content and Maps

If external content (e.g. embedded Google Maps or YouTube videos) is displayed on individual pages, this only happens after your explicit consent via the cookie banner. Upon activation, your IP address and possibly other data may be transmitted to the respective providers (Google Ireland Ltd. / Meta Platforms Ireland Ltd.), with possible data transfer to the USA. Before your consent is given, only placeholders are displayed without any connection being made to third-party providers.

9. Your Rights as a Data Subject

You have the following rights regarding your personal data: • Right of access (Art. 15 GDPR) • Right to rectification (Art. 16 GDPR) • Right to erasure (Art. 17 GDPR) • Right to restriction of processing (Art. 18 GDPR) • Right to data portability (Art. 20 GDPR) • Right to object to processing (Art. 21 GDPR) • Right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR) Please send requests to office@ecotechstyria.com.

10. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates the GDPR. For Austria, this is the Austrian Data Protection Authority: Österreichische Datenschutzbehörde Barichgasse 40-42, 1030 Vienna, Austria Phone: +43 1 521 52-25 69 Email: dsb@dsb.gv.at Web: www.dsb.gv.at

11. Storage Duration

We store your personal data only for as long as is necessary for the respective purpose or as required by statutory retention periods (in particular §132 of the Austrian Federal Tax Code — 7 years for tax-relevant business documents). After these periods have expired, the corresponding data are routinely deleted.

12. Spam Protection with Google reCAPTCHA

To protect our forms (contact form and brochure request) against automated submissions (spam bots), we use the reCAPTCHA v3 service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; resp. Google LLC, USA). When you visit a page containing a form, the reCAPTCHA script is loaded from Google. Google analyses various technical data of your browser without active interaction (in particular IP address, browser headers, cookies, mouse movements, device sensors) and assigns a risk score (0.0 = bot, 1.0 = human). Only when you submit a form is the score checked against our threshold. Data is transmitted to Google servers in the USA. Google has been self-certified under the EU-US Data Privacy Framework since July 2023; an adequate level of data protection is therefore generally ensured. The legal basis for the use is Art. 6 (1) (f) GDPR (legitimate interest in protecting our forms against abuse and spam). Further information on data processing by Google: • Privacy policy: https://policies.google.com/privacy • Terms of use: https://policies.google.com/terms • Specific information about reCAPTCHA: https://www.google.com/recaptcha/about/