Privacy policy

Introduction and overview

We have written this data protection declaration (version 09.02.2026-113102893) in order to provide you with General Data Protection Regulation (EU) 2016/679 and applicable national laws, explain what personal data (short data) we process as controllers – and the processors we engage (e.g. providers) – will process in the future and what lawful possibilities you have. The terms used are gender-neutral.
In short: We will provide you with comprehensive information about the data we process about you.

Data protection declarations usually sound very technical and use legal technical terms. This privacy policy, on the other hand, is intended to describe the most important things to you as simply and transparently as possible. To the extent that it is conducive to transparency, technical Terms explained in a reader-friendly manner, links to further information are provided and graphics deployed. In this way, we inform you in clear and simple language that we only process personal data in the course of our business activities if there is a corresponding legal basis. This is certainly not possible if you provide as concise, unclear and legal-technical explanations as possible, as they are often standard on the Internet when it comes to data protection. I hope you find the following explanations interesting and informative and maybe there is one or the other information that you did not know yet.
If you still have questions, we would like to ask you to contact the responsible body named below or in the imprint, to follow the existing links and to view further information on third-party pages. Our contact details can of course also be found in the imprint.

scope

This data protection declaration applies to all personal data processed by us in the company and to all personal data processed by companies commissioned by us (processors). By personal data, we mean information within the meaning of Art. 4 No. 1 GDPR such as the name, e-mail address and postal address of a person. The processing of personal data ensures that we can offer and bill our services and products, whether online or offline. The scope of this privacy policy includes:

• all online presences (websites, online shops) that we operate
• Social media appearances and e-mail communication
• mobile apps for smartphones and other devices

In short: The data protection declaration applies to all areas in which personal data is processed in a structured manner in the company via the aforementioned channels. If we enter into legal relations with you outside these channels, we will inform you separately if necessary.

Legal bases

In the following data protection declaration, we provide you with transparent information on the legal principles and regulations, i.e. the legal bases of the General Data Protection Regulation, which enable us to process personal data.
As regards EU law, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. This EU General Data Protection Regulation can of course be accessed online on EUR-Lex, the access to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679 Read it.

We will only process your data if at least one of the following conditions applies:

1. consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of your entered data in a contact form.
2. contract (Article 6(1)(b) GDPR): In order to fulfil a contract or pre-contractual obligations with you, we process your data. For example, if we conclude a purchase contract with you, we need personal information in advance.
3. Legal obligation (Article 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally obliged to cancel invoices for accounting purposes. These usually contain personal data.
4. Legitimate interests (Article 6 (1) (f) GDPR): In the event of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data in order to operate our website securely and economically efficiently. This processing is therefore a legitimate interest.

Other conditions such as the perception of recordings in the public interest and the exercise of official authority as well as the protection of vital interests usually do not occur with us. Insofar as such a legal basis should nevertheless be relevant, it shall be indicated in the appropriate place.

In addition to the EU regulation, national laws also apply:

• In Austria is the Federal Act on the Protection of Individuals with regard to the Processing of Personal Data (Data Protection Act), short VDU.
• In Germany This shall apply: Federal Data Protection Act (Bundesdatenschutzgesetz), short BDSG.

If other regional or national laws apply, we will inform you in the following sections.

Contact details of the person responsible

If you have any questions about data protection or the processing of personal data, you will find the contact details of the controller in accordance with Article 4(7) of the EU General Data Protection Regulation (GDPR) below:
Sulzer Wellnesstechnik
Johann Sulzer
Meiselstraße 6, 1150 Vienna, Austria
E-mail: office@sulzer-pool.at
Telephone: +43 1 983 14 24
Imprint: https://www.sulzer-pool.at/impressum/

Storage period

The fact that we only store personal data for as long as is strictly necessary for the provision of our services and products is a general criterion for us. This means that we delete personal data as soon as the reason for the data processing no longer exists. In some cases, we are legally obliged to store certain data even after the original purpose has ceased to exist, for example for accounting purposes.

If you wish to delete your data or revoke your consent to data processing, the data will be deleted as soon as possible and insofar as there is no obligation to store it.

We will inform you below about the specific duration of the respective data processing, if we have further information on this.

Rights under the General Data Protection Regulation

In accordance with Article 13, 14 GDPR, we inform you about the following rights that you have in order to ensure fair and transparent processing of data:

• According to Article 15 GDPR, you have the right to information about whether we process data about you. If this is the case, you have the right to receive a copy of the data and to receive the following information:
  • for what purpose we carry out the processing;
  • the categories, i.e. the types of data processed;
  • who receives this data and, if the data is transferred to third countries, how security can be guaranteed;
  • how long the data is stored;
  • the existence of the right to rectification, erasure or restriction of processing and the right to object to processing;
  • that you can complain to a supervisory authority (links to these authorities can be found below);
  • the origin of the data if we have not collected it from you;
  • whether profiling is carried out, i.e. whether data is automatically evaluated in order to arrive at a personal profile of you.
• According to Article 16 GDPR, you have a right to rectification of the data, which means that we must correct data in case you find errors.
• According to Article 17 GDPR, you have the right to erasure (‘right to be forgotten’), which specifically means that you may request the erasure of your data.
• According to Article 18 GDPR, you have the right to restriction of processing, which means that we may only store the data but no longer use it.
• According to Article 20 GDPR, you have the right to data portability, which means that we will provide you with your data in a common format upon request.
• According to Article 21 GDPR, you have a right of objection, which entails a change in the processing after enforcement.
  • If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you can object to the processing. We will then examine as soon as possible whether we can legally comply with this objection.
  • If data is used for direct marketing purposes, you can object to this type of data processing at any time. We may no longer use your data for direct marketing.
  • If data is used for profiling, you can object to this type of data processing at any time. We may no longer use your data for profiling.
• According to Article 22 GDPR, you may have the right not to be subject to a decision based solely on automated processing (e.g. profiling).
• You have the right to lodge a complaint under Article 77 GDPR. This means that you can complain to the Data Protection Authority at any time if you believe that the processing of personal data violates the GDPR.

In short: You have rights – do not hesitate to contact us at the responsible body listed above!

If you believe that the processing of your data violates data protection law or your data protection claims have otherwise been violated in any way, you can complain to the supervisory authority. For Austria, this is the data protection authority, whose website you can visit at https://www.dsb.gv.at/ find. In Germany, there is a data protection officer for each federal state. For more information, you can contact the Federal Commissioner for Data Protection and Freedom of Information (BfDI) turn around. The following local data protection authority is responsible for our company:

communication

Communication summary 👥 Affected: All those who communicate with us by phone, e-mail or online form 📓 Processed data: e.g. telephone number, name, e-mail address, form data entered. More details can be found at the contact type used 🤝 Purpose: to handle communication with customers, business partners, etc. 📅 storage period: duration of the business case and legal regulations ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (legitimate interests)

If you contact us and communicate by phone, e-mail or online form, personal data may be processed.

The data will be processed for the processing and processing of your question and the related business transaction. The data is stored for as long as required by law.

Affected persons

All those who seek contact with us via the communication channels provided by us are affected by the above-mentioned processes.

telephones

When you call us, the call data is stored pseudonymously on the respective terminal device and with the telecommunications provider used. In addition, data such as name and telephone number can then be sent by e-mail and stored for request response. The data will be deleted as soon as the business case has been terminated and legal requirements allow it.

E-mail

If you communicate with us by e-mail, data may be stored on the respective end device (computer, laptop, smartphone, …) and data may be stored on the e-mail server. The data will be deleted as soon as the business case has been terminated and legal requirements allow it.

Online forms

If you communicate with us using an online form, data will be stored on our web server and, if necessary, forwarded to an e-mail address from us. The data will be deleted as soon as the business case has been terminated and legal requirements allow it.

Legal bases

The processing of data is based on the following legal bases:

• Art. 6 (1) (a) GDPR (consent): you give us the consent to store your data and continue to use it for business purposes;
• Article 6(1)(b) GDPR (contract): there is a need for the performance of a contract with you or a processor such as the telephone provider or we need to process the data for pre-contractual activities such as preparing an offer;
• Art. 6 (1) (f) GDPR (legitimate interests): We want to conduct customer inquiries and business communication in a professional setting. For this purpose, certain technical facilities such as e-mail programs, exchange servers and mobile operators are necessary in order to be able to operate the communication efficiently.

Cookies

Cookies summary 👥 Affected: Visitors to the website 🤝 Purpose: depending on the cookie. More details can be found below or at the manufacturer of the software that sets the cookie. 📓 Processed data: Depending on the cookie used. More details can be found below or at the manufacturer of the software that sets the cookie. 📅 storage period: depending on the cookie, may vary from hours to years ⚖️ Legal bases: Art. 6(1)(a) GDPR (consent), Art. 6(1)(f) GDPR (legitimate interests)

What are cookies?

Our website uses HTTP cookies to store user-specific data.
Below we explain what cookies are and why they are used so that you can better understand the following privacy policy.

Whenever you browse the Internet, use a browser. Well-known browsers include Chrome, Safari, Firefox, Internet Explorer and Microsoft Edge. Most websites store small text files in your browser. These files are called cookies.

One thing cannot be denied: Cookies are really useful helpers. Almost all websites use cookies. More specifically, they are HTTP cookies, as there are also other cookies for other areas of application. HTTP cookies are small files that are stored on your computer by our website. These cookie files are automatically stored in the cookie folder, quasi the "brain" of your browser. A cookie consists of a name and a value. When defining a cookie, one or more attributes must also be specified.

Cookies store certain user data about you, such as language or personal page settings. When you visit our site again, your browser transmits the ‘user-related’ information back to our site. Thanks to cookies, our website knows who you are and offers you the settings you are used to. In some browsers, each cookie has its own file, in others, such as Firefox, all cookies are stored in a single file.

The following graphic shows a possible interaction between a web browser such as Chrome and the web server. The web browser requests a website and receives a cookie from the server, which the browser uses again as soon as another page is requested.

There are both first-party cookies and third-party cookies. First-party cookies are created directly from our site, third-party cookies are created by partner websites (e.g. Google Analytics). Each cookie must be evaluated individually, as each cookie stores different data. The expiry time of a cookie also varies from a few minutes to a few years. Cookies are not software programs and do not contain viruses, trojans or other ‘pests’. Cookies also cannot access information from your PC.

For example, this is what cookie data can look like:

Name: _ga
Value: GA1.2.1326744211.152113102893-9
Intended use: Differentiation of website visitors
Expiry date: after 2 years

These minimum sizes should be supported by a browser:

• At least 4096 bytes per cookie
• At least 50 cookies per domain
• At least 3000 cookies in total

What types of cookies are there?

The question of which cookies we use in particular depends on the services used and is clarified in the following sections of the privacy policy. At this point, we would like to briefly discuss the different types of HTTP cookies.

There are four types of cookies:

Essential cookies
These cookies are necessary to ensure basic functions of the website. For example, these cookies are needed when a user places a product in the shopping cart, then surfs on other pages and later goes to the checkout. These cookies do not delete the shopping cart, even if the user closes his browser window.

Appropriate cookies
These cookies collect information about user behavior and whether the user receives any error messages. In addition, these cookies also measure the loading time and behaviour of the website on different browsers.

Targeted cookies
These cookies ensure a better user-friendliness. For example, entered locations, font sizes or form data are stored.

Advertising cookies
These cookies are also called targeting cookies. They serve to provide the user with individually adapted advertising. This can be very practical, but also very annoying.

Usually, when you visit a website for the first time, you are asked which of these types of cookies you want to allow. And of course, this decision is also stored in a cookie.

If you want to know more about cookies and do not shy away from technical documentation, we recommend https://datatracker.ietf.org/doc/html/rfc6265, the Request for Comments of the Internet Engineering Task Force (IETF) called “HTTP State Management Mechanism”.

Purpose of processing via cookies

The purpose ultimately depends on the respective cookie. More details can be found below or at the manufacturer of the software that sets the cookie.

What data is processed?

Cookies are small helpers for many different tasks. Unfortunately, it is not possible to generalize which data is stored in cookies, but we will inform you about the processed or stored data within the framework of the following data protection declaration.

Storage period of cookies

The storage period depends on the respective cookie and is further specified below. Some cookies are deleted after less than an hour, others can be stored on a computer for several years.

They also have an influence on the storage time. You can delete all cookies manually at any time via your browser (see also "Right to object" below). Furthermore, cookies based on consent will be deleted at the latest after revocation of your consent, whereby the legality of the storage remains unaffected until then.

Right to object – how can I delete cookies?

How and whether you want to use cookies is up to you. Regardless of which service or website the cookies originate from, you always have the option of deleting, disabling or only partially allowing cookies. For example, you can block third-party cookies, but allow all other cookies.

If you want to determine which cookies have been stored in your browser, if you want to change or delete cookie settings, you can find this in your browser settings:

Chrome: Delete, enable, and manage cookies in Chrome

Safari: Managing cookies and website data with Safari

Firefox: Delete cookies to remove data that websites have stored on your computer

Internet Explorer: Deleting and Managing Cookies

Microsoft Edge: Deleting and Managing Cookies

If you generally do not want cookies, you can set up your browser so that it always informs you when a cookie is to be set. This allows you to decide for each individual cookie whether you allow the cookie or not. The procedure varies depending on the browser. It is best to search for the instructions in Google with the search term “Delete cookies Chrome” or “Disable cookies Chrome” in the case of a Chrome browser.

legal

The so-called ‘cookie guidelines’ have been in place since 2009. It states that the storage of cookies is a consent (Article 6(1)(a) GDPR) requires you to do so. However, there are still very different reactions to these directives within the EU countries. In Austria, however, that directive was transposed into Paragraph 165(3) of the Telecommunications Act (2021). In Germany, the cookie guidelines have not been transposed as national law. Instead, this directive was largely transposed into Section 15(3) of the Telemedia Act (TMG), which has been replaced by the Digital Services Act (DDG) since May 2024.

For strictly necessary cookies, even if there is no consent, exist legitimate interests (Article 6(1)(f) GDPR), which in most cases are of an economic nature. We want to give visitors to the website a pleasant user experience and for this purpose certain cookies are often absolutely necessary.

Unless strictly necessary cookies are used, this is only done in the case of your consent. The legal basis in this respect is Article 6(1)(a) GDPR.

In the following sections, you will be informed in more detail about the use of cookies if the software used uses cookies.

Explanation of terms used

We always strive to make our privacy policy as clear and comprehensible as possible. However, this is not always easy, especially when it comes to technical and legal issues. It often makes sense to use legal terms (such as personal data) or certain technical terms (such as cookies, IP address). We do not want to use them without explanation. Below you will find an alphabetical list of important terms used, which we may not have sufficiently addressed in the previous data protection declaration. If these terms have been taken from the GDPR and these are definitions, we will also quote the GDPR texts here and, if necessary, add our own explanations.

Processors

Definition according to Article 4 of the GDPR

For the purposes of this Regulation:

‘processor’ means: a natural or legal person, public authority, agency or other body processing personal data on behalf of the controller;

Explanation: As a company and website owner, we are responsible for all data we process about you. In addition to the controllers, there may also be so-called processors. This includes any company or person who processes personal data on our behalf. Therefore, in addition to service providers such as tax consultants, processors can also be hosting or cloud providers, payment or newsletter providers or large companies such as Google or Microsoft.

consent

Definition according to Article 4 of the GDPR

For the purposes of this Regulation:

‘Consent’ to the data subject, any freely given, specific, informed and unambiguous statement of intent, in the form of a statement or other clear affirmative action, by which the data subject indicates that he or she agrees to the processing of personal data concerning him or her;

Explanation: As a rule, such consent is given on websites via a cookie consent tool. I'm sure you know that. Whenever you visit a website for the first time, you are usually asked via a banner whether you agree or consent to the data processing. In most cases, you can also make individual settings and thus decide for yourself which data processing you allow and which you do not. If you do not consent, no personal data may be processed by you. In principle, consent can of course also be given in writing, i.e. not via a tool.

Personal data

Definition according to Article 4 of the GDPR

For the purposes of this Regulation:

‘Personal data’ means: any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more specific characteristics that express the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

Explanation: Personal data is all the data that can identify you as a person. This is usually data such as:

• name
• address
• E-mail address
• Postal address
• telephone
• birthday
• Identification numbers such as social security number, tax identification number, identity card number or matriculation number
• Bank details such as account number, credit information, account balances and much more.

According to the European Court of Justice (ECJ), your IP address for personal data. Based on your IP address, IT experts can at least determine the approximate location of your device and subsequently you as the connection owner. Therefore, the storage of an IP address also requires a legal basis within the meaning of the GDPR. There are also so-called ‘special categories’ personal data, which are also particularly worthy of protection. These include:

• racial and ethnic origin
• political opinions
• Religious or ideological beliefs
• union affiliation
• genetic data, such as data taken from blood or saliva samples;
• biometric data (this is information about mental, physical or behavioral characteristics that can identify a person).
  Health data
• Data on sexual orientation or sex life

profiling

Definition according to Article 4 of the GDPR

For the purposes of this Regulation:

Profiling any type of automated processing of personal data consisting in the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to that natural person’s work performance, economic situation, health, personal preferences, interests, reliability, behaviour, whereabouts or movements;

Explanation: Profiling gathers various pieces of information about a person to learn more about that person. In the web area, profiling is often used for advertising purposes or for credit checks. For example, web or advertising analytics programs collect data about your behavior and interests on a website. This results in a special user profile, with the help of which advertising can be targeted to a target group.

 

responsible

Definition according to Article 4 of the GDPR

For the purposes of this Regulation:

‘responsible person’ means: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for in Union or Member State law;

Explanation: In our case, we are responsible for the processing of your personal data and, consequently, the “controller”. If we pass on collected data to other service providers for processing, they are “processors”. In order to do so, a ‘processing contract’ must be signed.

 

workmanship

Definition according to Article 4 of the GDPR

For the purposes of this Regulation:

‘Processing’ means: any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Note: When we refer to processing in our privacy policy, we mean any type of data processing. This includes, as mentioned above in the original GDPR statement, not only the collection but also the storage and processing of data.

Closing word

Congratulations! If you read these lines, you have really ‘fighted’ through our entire privacy policy or at least scrolled to this point. As you can see from the scope of our privacy policy, we do not take the protection of your personal data lightly.
It is important to us to inform you to the best of our knowledge and belief about the processing of personal data. However, we do not only want to tell you which data is processed, but also to explain the reasons for using various software programs. As a rule, data protection declarations sound very technical and legal. However, since most of you are not web developers or lawyers, we also wanted to go a different way linguistically and explain the facts in simple and clear language. Of course, this is always not possible due to the topic. Therefore, the most important terms are explained in more detail at the end of the data protection declaration.
If you have any questions about data protection on our website, please do not hesitate to contact us or the responsible body. We wish you a nice time and hope to welcome you again on our website soon.

All texts are protected by copyright.

Source: Privacy policy created with the Data Protection Generator for Austria by AdSimple