Privacy policy

1. General information

1.1 Scope

Protecting your personal data is a matter we take very seriously. This Privacy Policy explains how we process personal data in connection with your use of our websites.

This Privacy Policy applies to the following websites:

The controller within the meaning of the General Data Protection Regulation (GDPR) is: pro aqua Diamantelektroden Produktion GmbH, Parkring 1, 8712 Niklasdorf, Austria, E-Mail: info@proaqua.at, +43 (0) 3842 81516-0.

This Privacy Policy is intended for visitors to our websites, prospective and existing customers, business partners and any other persons who contact us through our websites.

We protect your personal data by implementing appropriate organisational and technical measures, in particular to prevent unauthorised, unlawful or accidental access, loss or manipulation. Please be aware, however, that transmitting data over the internet always involves inherent security risks. Complete protection against access by third parties cannot be guaranteed.

Our websites may also contain links to external websites or service providers. The respective operators are solely responsible for the content of and data processing carried out on those external websites. This Privacy Policy does not apply to linked external websites.

1.2 Legal bases for processing

We process your personal data exclusively in accordance with the applicable statutory provisions, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (Datenschutzgesetz – DSG) and the Austrian Telecommunications Act 2021 (Telekommunikationsgesetz 2021 – TKG 2021). Depending on the purpose of the processing, we process personal data on the following legal bases:

your consent pursuant to Article 6(1)(a) GDPR;
the performance of a contract or steps taken at your request prior to entering into a contract pursuant to Article 6(1)(b) GDPR;
compliance with a legal obligation pursuant to Article 6(1)(c) GDPR;
our legitimate interests pursuant to Article 6(1)(f) GDPR.

Our legitimate interests include, in particular, providing secure and fully functional websites, processing and documenting enquiries, maintaining structured communication with existing and prospective customers and organising our sales and customer management processes.

The provision of personal data is generally voluntary. However, if you contact us, create a customer account or place an order, we require certain information in order to process your enquiry, fulfil your order or comply with our legal obligations. Without this information, we may be unable to provide the relevant service or may only be able to provide it to a limited extent.

1.3 Retention periods and statutory retention obligations

The specific retention periods applicable to individual processing activities, such as contact enquiries or website analytics, are set out in the relevant sections of this Privacy Policy.

Irrespective of these specific periods, we are subject to statutory retention obligations. In accordance with Austrian commercial and tax law requirements, in particular the Austrian Commercial Code (Unternehmensgesetzbuch – UGB) and the Austrian Federal Fiscal Code (Bundesabgabenordnung – BAO), invoices, accounting records and business documents are generally retained for seven years.

Data that may be required in connection with warranty claims, claims for damages or product liability claims is retained for the duration of the respective applicable statutory limitation periods. Where legal proceedings or administrative proceedings are pending, we retain the data required for those proceedings until they have been finally concluded.

2. Processing activities

2.1 Visiting our websites and server logs

When you visit our websites, the web servers temporarily record each access in a log file. The following data may be processed in particular:

IP address of the requesting device;
date and time of access;
name and URL of the data or page accessed;
amount of data transferred;
information indicating whether the request was successful;
identification data relating to the browser and operating system used;
the website from which the request originated;
the name of your internet service provider.

The legal basis for this processing is our legitimate interest in providing secure, stable and user-friendly websites pursuant to Article 6(1)(f) GDPR.

Website logs are retained for a maximum of 14 days. The data is processed to ensure the proper operation of our websites, diagnose errors and maintain the security and stability of our systems, in particular to detect and prevent attacks.

2.2 Contacting us and contact forms

If you contact us using a contact form, by email, by telephone or by any other means, we process the personal data you provide. This may include, in particular:

name;
company or organisation;
email address;
telephone number;
the content of your enquiry;
products in which you are interested;
any other information you provide voluntarily.

The data is processed in order to handle and respond to your enquiry, address any follow-up questions and communicate with you.

Where your enquiry relates to a contract or to steps taken at your request prior to entering into a contract, the legal basis is Article 6(1)(b) GDPR. In all other cases, the processing is based on our legitimate interest in processing and documenting enquiries pursuant to Article 6(1)(f) GDPR.

Personal data obtained from general contact enquiries is generally retained for the duration of the processing of the enquiry and for up to six months thereafter in case of any follow-up questions. If the enquiry results in a business relationship or a specific pre-contractual interest, the data is transferred to our CRM system and processed in accordance with the provisions applicable to that system.

2.3 Sales communications and the HubSpot CRM system

For the purpose of processing and documenting enquiries, establishing and maintaining business relationships, organising sales activities, and ensuring structured communication with existing and prospective customers, personal data may be stored and processed in our customer relationship management system, HubSpot. The service provider and contracting party is HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany. In connection with the provision of the services, affiliated companies, in particular HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA, may also process personal data.

The following data may be processed in HubSpot in particular:

name;
company or organisation;
professional contact details;
content of enquiries;
product interests;
communication history;
quotation and sales information;
customer data where a business relationship is established.

Where processing is necessary in order to take steps prior to entering into a contract or to perform a contract, the legal basis is Article 6(1)(b) GDPR. In addition, processing is based on our legitimate interest in structured B2B communication, sales organisation, customer support and the provision of relevant information concerning our products and services pursuant to Article 6(1)(f) GDPR. You have the right to object to the processing of your personal data based on legitimate interests in accordance with the applicable statutory requirements. We have entered into a data processing agreement with HubSpot pursuant to Article 28 GDPR.

Personal data may be processed in the United States or in other third countries. Where personal data is transferred to a third country, the transfer is based on appropriate safeguards pursuant to Article 46 GDPR, in particular the European Commission’s Standard Contractual Clauses, or, where applicable, on an adequacy decision pursuant to Article 45 GDPR, including the EU-U.S. Data Privacy Framework.

Personal customer data is retained only for as long as necessary for the relevant processing purpose and is subsequently erased:

Active customers and contact persons: for the duration of the business relationship.
Quotations, orders, invoices and business-related correspondence: for seven years from the end of the relevant calendar year.
Data relating to former customers that is required for the establishment, exercise or defence of potential legal claims: generally for three years, unless a longer statutory retention period applies.
Prospective customers and leads where no business relationship is established: for 24 months after the last relevant contact.

2.4 Orders, online shop, customer accounts and payment processing

Orders may be placed through www.aquariumfresher.com. You may place an order as a guest or create a password-protected customer account.

Customer accounts provide an overview of the customer data stored, orders already placed and active ordering processes. You may manage your customer account and amend your data yourself. Your account can be accessed through www.aquariumfresher.com.

When you place an order, we process the personal data you provide to the extent necessary to process and fulfil that order. This includes, in particular:

company or organisation;
first name and surname;
delivery and billing address;
email address;
telephone number, where provided;
VAT identification number or Austrian ATU number, where required;
products ordered;
order and payment information.

The data is processed for the purposes of processing and fulfilling your order, delivering the products, processing payments, issuing invoices, communicating with you and complying with statutory obligations.

The legal bases are Article 6(1)(b) GDPR for the performance of the contract and steps taken prior to entering into a contract, and Article 6(1)(c) GDPR for compliance with statutory accounting and retention obligations.

Data required to process an order is disclosed to commissioned third parties, in particular shipping and logistics providers such as Österreichische Post, DHL, GLS or freight forwarding companies, as well as payment and financial service providers, depending on the payment method selected.

Depending on the payment method selected, payment data may be transmitted to the relevant payment service providers, banks or other parties involved in processing the payment. This data may include, in particular:

name;
billing and delivery address;
order details;
payment amount;
currency;
transaction data;
technical information required to process the payment.

The following payment methods or service providers may be integrated into our online shop:

credit card payments through Wix Payments, provided by Wix.com Luxembourg S.a.r.l., 5 rue Guillaume Kroll, L-1882 Luxembourg;
Apple Pay, provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland;
Google Pay, provided by Google Payment Ireland Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland;
PayPal, provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.

Payment data is processed for the purposes of carrying out the payment, performing the contract, preventing fraud, responding to enquiries, processing refunds and chargebacks, addressing payment disruptions and complying with statutory documentation and retention obligations.

The legal basis is Article 6(1)(b) GDPR to the extent that the processing is necessary for payment processing and the performance of the contract.

Where we are legally required to retain certain payment and accounting information, the processing is based on Article 6(1)(c) GDPR. Processing may also be based on our legitimate interest in secure, transparent and verifiable payment processing pursuant to Article 6(1)(f) GDPR.

The payment service providers involved in processing the payment may also process personal data as independent controllers. In this respect, the privacy information provided by the payment service provider selected by you also applies.

2.5 Cookies and consent management

Our websites use cookies and similar technologies. Cookies are small text files stored on your terminal equipment through your browser. Similar technologies may also store or access information on your terminal equipment. We use both strictly necessary cookies and non-essential cookies.

Strictly necessary cookies are required for the operation and functionality of our websites. These may be used, for example, for:

navigation;
correct display of website content;
login functions;
shopping basket functions;
session management;
security functions;
storing your cookie preferences.

The legal basis is our legitimate interest in providing technically functional, secure and user-friendly websites pursuant to Article 6(1)(f) GDPR, in conjunction with the exemption for strictly necessary storage or access under Section 165(3) of the Austrian Telecommunications Act 2021.

Non-essential cookies and similar technologies, in particular those used for analytics, statistics or embedded external content, are used only with your consent pursuant to Article 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021.

You may withdraw your consent at any time with effect for the future through the cookie settings available on the relevant website.

You may also configure your browser so that cookies are not stored or so that you are notified before cookies are stored. Blocking or deleting cookies may restrict the functionality of our websites.

2.5.1 Cookies on www.proaqua.at

The website www.proaqua.at is created and managed using the WordPress content management system. We use the Real Cookie Banner consent tool provided by devowl.io GmbH, Tannet 12, 94539 Grafling, Germany, to manage the cookies and similar technologies used on the website and the related consents.

2.5.2 Cookies on Wix websites

Our product-related websites, www.wcd2.at, www.surfacecleaner.at, www.aquariumfresher.com, www.aquariumfresher.at, www.rainfresher.at are created, managed and hosted using the platform provided by Wix.com Ltd., 40 Namal Tel Aviv Street, Tel Aviv 6350671, Israel.

Wix may process data on servers located within the European Union and in third countries, in particular Israel and the United States.

The European Commission has adopted an adequacy decision pursuant to Article 45 GDPR in respect of Israel and in respect of transfers to certified companies in the United States under the EU-U.S. Data Privacy Framework.

Where applicable, we additionally rely on appropriate safeguards pursuant to Article 46 GDPR for transfers to third countries, in particular the Standard Contractual Clauses approved by the European Commission.

We have also entered into a data processing agreement with Wix pursuant to Article 28 GDPR.

On these websites, we use the Usercentrics consent management system provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, to obtain and manage the required consents and document users’ cookie preferences.

2.6 Google services for analytics and internal reporting

We use Google services on our websites for the statistical analysis of website use and for the internal presentation and evaluation of the resulting statistical data. We use Google Analytics 4 and Google Looker Studio. For users in the European Economic Area, these Google services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have entered into a data processing agreement with the provider pursuant to Article 28 GDPR.

Google services are loaded on our websites only after you have granted your consent through the relevant cookie banner. The processing is based on your consent pursuant to Article 6(1)(a) GDPR. Where information is stored on or accessed from your terminal equipment, this is also based on your consent pursuant to Section 165(3) of the Austrian Telecommunications Act 2021. You may withdraw your consent at any time with effect for the future through the cookie settings.

Google Analytics 4 is used to perform statistical analyses of the use of our websites. The following information may be processed in particular:

pages visited;
date and time of access;
length of visit;
referrer URL;
approximate location information;
technical information concerning the browser and terminal equipment used;
interactions with the website;
pseudonymous online identifiers, such as cookie IDs or client IDs.

The data is analysed for statistical purposes. The analysis is not intended to identify individual website visitors personally.

According to Google, Google Analytics 4 does not store the IP addresses of users located in the European Union, Switzerland or the United Kingdom. Google states that IP addresses are used only to derive approximate location information and are discarded before being stored.

We use Google Looker Studio for the internal evaluation and presentation of data collected through Google Analytics. Looker Studio is used to create internal reports and dashboards. For this purpose, we access statistical data available in Google Analytics. Looker Studio does not place any additional tracking code on our websites.

In accordance with our settings, event data and pseudonymous identifiers in Google Analytics are retained for up to 14 months and are then automatically deleted. Aggregated statistical reports and analyses may remain available after this period.

According to Google, data may also be processed on servers outside the European Economic Area, in particular in the United States.

For transfers of data to the United States, Google states that it relies in particular on Google LLC’s certification under the EU-U.S. Data Privacy Framework, the European Commission’s Standard Contractual Clauses and Google’s applicable data processing terms.

Further information about data processing by Google is available in Google’s Privacy Policy and in Google’s information concerning the use of data from websites and apps that use Google services.

2.7 Embedded Vimeo videos

Videos from the Vimeo platform may be embedded on our websites. The service provider is Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA.

When you access a page containing an embedded Vimeo video, a connection is established with Vimeo’s servers. Personal data, including your IP address, browser information and device information, may be transmitted to Vimeo. If you are logged into your Vimeo account, Vimeo may associate your browsing behaviour with that account. Vimeo videos are loaded on our websites only after you have granted your consent through the relevant cookie banner.

The legal basis for the processing is your consent pursuant to Article 6(1)(a) GDPR and, where information is stored on or accessed from your terminal equipment, Section 165(3) of the Austrian Telecommunications Act 2021. You may withdraw your consent at any time with effect for the future through the cookie settings.

The European Commission has adopted an adequacy decision pursuant to Article 45 GDPR for transfers of data to Vimeo.com, Inc., provided that the relevant requirements of the EU-U.S. Data Privacy Framework are met.

Further information about data processing is available in Vimeo’s Privacy Policy at vimeo.com/privacy.

2.8 Social media presence

We maintain profiles on social networks in order to communicate with users of those networks, prospective and existing customers and to provide information about our products and services.

2.8.1 Data processing when you contact us:

If you contact us through a social network, for example by sending a direct message or posting a comment on one of our profiles, we process your data in order to respond to your enquiry. Where your enquiry relates to entering into or performing a contract, the legal basis is Article 6(1)(b) GDPR. In all other cases, the processing is based on our legitimate interest in prompt and targeted communication pursuant to Article 6(1)(f) GDPR.

2.8.2 Joint controllership and Page Insights:

When you visit one of our social media profiles, the relevant social network operator generally collects extensive information about your user behaviour, for example by using cookies, and provides us with aggregated statistics known as “Insights”. For this specific processing activity, we and the relevant platform operator act as joint controllers within the meaning of Article 26 GDPR. We have entered into the relevant joint controllership arrangements with the platform operators. Under these arrangements, the platform operators are primarily responsible for complying with the applicable information obligations and handling requests from data subjects.

2.8.3 We maintain profiles on the following platforms:

Meta: Facebook and Instagram

For users in Europe, the service provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Further information and the applicable joint controllership arrangement are available in Meta’s privacy information. Transfers of data to the United States are based on the adequacy decision relating to the EU-U.S. Data Privacy Framework pursuant to Article 45 GDPR, where the relevant requirements are met.

For users in Europe, the service provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. We also use LinkedIn to display advertisements aimed at specific target groups through LinkedIn Ads. Target groups may be selected, for example, according to sector or job title, on the basis of user data collected by LinkedIn. The legal basis for our B2B advertising activities is our legitimate interest in targeted corporate communication pursuant to Article 6(1)(f) GDPR. Further information is available in LinkedIn’s Privacy Policy. Transfers of data to the United States are based on the adequacy decision relating to the EU-U.S. Data Privacy Framework pursuant to Article 45 GDPR, where the relevant requirements are met.

2.9 Use of ALTCHA

We use ALTCHA to protect our contact forms against abusive automated use. ALTCHA is a privacy-friendly anti-spam solution that operates without tracking, without cookies and without transmitting personal data to external servers. Processing takes place exclusively locally in the user’s browser. No personal data is transmitted to third parties in connection with the use of ALTCHA.

The data is processed in order to ensure the functionality of our website and protect it against abusive automated access, spam and automated attacks. The legal basis is our legitimate interest in maintaining the security of our website and protecting it against spam and automated attacks pursuant to Article 6(1)(f) GDPR. Further information is available at altcha.org.

2.10 Service providers and data transfers

We disclose personal data only where this is necessary to fulfil the purposes described in this Privacy Policy, where we are subject to a legal obligation, where you have granted your consent or where another legal basis applies. Recipients of personal data may include, in particular:

IT service providers and hosting providers;
CRM and communication service providers;
shipping and logistics providers;
payment service providers and banks;
tax advisers and accounting service providers;
legal advisers and public authorities, where necessary;
providers of analytics and statistical services, where you have granted your consent;
providers of embedded content, in particular Vimeo, where you have granted your consent.

Where service providers process personal data on our behalf as processors, we enter into data processing agreements with them pursuant to Article 28 GDPR. These service providers may process personal data only in accordance with our documented instructions and solely for the agreed purposes.

Personal data is transferred to countries outside the European Economic Area only where the European Commission has adopted an adequacy decision pursuant to Article 45 GDPR, where appropriate safeguards pursuant to Article 46 GDPR are in place or where another applicable legal basis permits the transfer.

3. Your rights

Subject to the applicable statutory requirements, you have the following rights in particular:

the right to obtain access to the personal data we process concerning you;
the right to rectification of inaccurate or incomplete data;
the right to erasure;
the right to restriction of processing;
the right to data portability;
the right to object to certain processing activities;
the right to withdraw consent you have granted.

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.

Where we process personal data on the basis of legitimate interests, you have the right to object to that processing on grounds relating to your particular situation. You may exercise your rights at any time using the contact details provided in this Privacy Policy. Where necessary to verify your identity, we may request additional information from you. We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.

If you believe that the processing of your personal data infringes applicable data protection law or that your data protection rights have otherwise been violated, you have the right to lodge a complaint with a supervisory authority. In Austria, the supervisory authority is the Austrian Data Protection Authority, Österreichische Datenschutzbehörde, dsb.gv.at.

4. Amendments to this Privacy Policy

We reserve the right to amend this Privacy Policy where necessary in order to ensure that it continues to comply with current legal requirements or to reflect changes to our services, for example where new technical tools or services are introduced. The version of the Privacy Policy in force at the time of your future visit will apply.

5. Contact

You can contact us using the following details:

pro aqua Diamantelektroden Produktion GmbH
Parkring 1
8712 Niklasdorf
Austria
Email: info@proaqua.at
Website: www.proaqua.at

Go to start page