Controller
The controller for the processing of personal data on this website within the meaning of the GDPR is:
Gottwald GmbH & Co KG
Solarstraße 9, 3390 Melk
Telephone: +43 2752 520 00
Sole proprietorship — no data protection officer has been appointed under Article 37 GDPR, as the legal conditions for doing so are not met. For data protection enquiries please write directly to the email address above.
1. General principles
We process your personal data in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the Austrian Data Protection Act and the Austrian Telecommunications Act 2021.
Processing takes place only where it is legally permitted — on the basis of your consent (Article 6(1)(a) GDPR), to perform a contract or take pre-contractual steps (point (b)), to comply with legal obligations (point (c)) or to pursue legitimate interests (point (f)).
In doing so we follow the principles of data minimisation (Article 5(1)(c) GDPR), purpose limitation (point (b)) and transparency (point (a)) — we collect only the data required for the purpose in question and delete it once that purpose no longer applies or the statutory retention period has expired.
2. Hosting (Hetzner)
Our website is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany.
The servers are located exclusively in a data centre within the European Union (in Germany). We have concluded a data processing agreement with Hetzner under Article 28 GDPR, which ensures processing in line with the GDPR.
Data processed (server log files)
Every time our website is accessed, technical connection data is stored in server log files:
IP address of the requesting device
Date and time of the request
URL requested and HTTP status code
User agent (browser type, operating system)
Referrer URL (the page visited previously)
Volume of data transferred
This data serves solely to keep the site running, to fend off attacks and to analyse faults. It is not combined with other data sources, and no user profiles are created. The log files are deleted automatically after a maximum of 30 days.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in the security and stability of the website).
Further information — Hetzner privacy policy: https://www.hetzner.com/de/rechtliches/datenschutz
3. CDN / reverse proxy (Cloudflare)
To speed up delivery, terminate TLS and fend off attacks (DDoS, bots) we use the services of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.
Every request to our website is routed first through Cloudflare. In doing so, Cloudflare processes the following data:
IP address of the requesting device
HTTP headers (user agent, referrer, cookies)
Connection metadata (TLS version, cipher, routing)
Transfer to a third country
Even though Cloudflare operates global edge nodes in Europe, a technically necessary transfer to the USA cannot be ruled out (routing, configuration, logging).
Since July 2023 Cloudflare has been certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission). In addition, standard contractual clauses under Article 46(2)(c) GDPR have been concluded with Cloudflare.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in security, performance and protection against spam).
Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/
4. Cookies and comparable technologies
We use cookies on our website, along with comparable browser storage technologies (localStorage, sessionStorage). Cookies are small text files that your browser stores locally and sends back to the server on later visits.
Necessary cookies (no consent required)
These cookies are technically necessary for the website to work properly. They are set without consent. Legal basis: Article 6(1)(f) GDPR in conjunction with section 165(3) of the Telecommunications Act 2021.
cookie_consent — stores your cookie settings (lifetime: 12 months)
app-theme — remembers your choice of light or dark mode
Session cookies — keep your session alive and are deleted when you close the browser
Statistics cookies (consent required)
These cookies are set only after you have actively consented through our cookie banner. Legal basis: Article 6(1)(a) GDPR in conjunction with section 165(3) of the Telecommunications Act 2021.
Google Analytics 4 — see section 5
Withdrawing consent
You can change or withdraw your cookie settings at any time — click the link “Cookie settings” in the footer of this website. Withdrawal takes effect for the future; data already lawfully collected is not affected.
5. Google Tag Manager and Google Analytics 4
EU contracting party: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Google Tag Manager (GTM)
GTM is a tag management system that allows analytics and marketing scripts to be managed and delivered centrally. GTM itself stores no personal data, but loads the downstream tags (in our case Google Analytics 4) only after you have consented.
Google Analytics 4
With Google Analytics 4 (measurement ID G-YJ2PEFSBLM) we analyse how our website is used, so that we can keep improving content and performance. Among other things, the following data is processed:
Anonymised IP address (IP anonymisation is active by default in GA4)
URLs visited, time spent, click and scroll behaviour
Device and browser information (user agent, screen resolution, language)
Pseudonymous client ID (stored in a cookie)
Approximate geographic location (country/region — not down to city level)
Retention period
GA4 event data is deleted automatically after 14 months. Aggregated reports may be kept longer, without any conclusions about individual users being possible.
EU data region
Where technically possible, data is transferred via regional collection points in Europe (region1.google-analytics.com) in order to reduce transfers to the USA.
Transfer to a third country
Google is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission). In addition, standard contractual clauses under Article 46(2)(c) GDPR have been concluded.
Legal basis and opt-out
Legal basis: your express consent through the cookie banner (Article 6(1)(a) GDPR in conjunction with section 165(3) of the Telecommunications Act 2021).
You can switch off this collection at any time:
through the link “Cookie settings” in the footer, selecting “Necessary only”
by installing the browser add-on https://tools.google.com/dlpage/gaoptout
A Data Processing Amendment (DPA) under Article 28 GDPR has been concluded with Google. Google privacy policy: https://policies.google.com/privacy
6. Newsletter (Brevo)
Provider: Sendinblue GmbH (Brevo), Köpenicker Straße 126, 10179 Berlin, Germany — a subsidiary of Sendinblue SAS, based in Paris, France.
If you subscribe to our newsletter, we process the following data:
your email address
optionally: first and last name
time of sign-up and IP address (as evidence of consent under Article 7(1) GDPR)
time of confirmation in the double opt-in procedure
delivery and open status of individual newsletter mailings
We use the double opt-in procedure: after signing up you receive a confirmation email. Only when you click the confirmation link in that email are you actually added to the list. This protects against sign-ups made improperly using someone else's email address.
You can unsubscribe at any time — either through the unsubscribe link at the end of every newsletter email or by an informal message to office@gottwald.at. Your data is then deleted from the newsletter list.
Legal basis: your consent (Article 6(1)(a) GDPR in conjunction with section 174 of the Telecommunications Act 2021). A data processing agreement under Article 28 GDPR has been concluded with Brevo. The servers are located within the European Union (France/Germany).
Brevo privacy policy: https://www.brevo.com/de/legal/privacypolicy/
7. Contact form
If you use our contact form, we process the data you provide in order to deal with your enquiry.
Data processed
name
email address
telephone number (if given)
the content of your message
time of submission
Legal basis: Article 6(1)(b) GDPR (taking pre-contractual steps) or Article 6(1)(f) GDPR (legitimate interest in answering enquiries efficiently).
Retention period: we keep your enquiry for as long as is necessary to deal with it, and at most for three years after the correspondence ends. The data is then deleted, unless statutory retention obligations (for example section 132 of the Federal Fiscal Code) require otherwise.
Passing on to our enquiry system
Your enquiry is also passed to the system we operate for handling enquiries. The data transferred is name, email address, telephone number and company (if given), subject and the content of your message.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in handling enquiries in a way that can be traced). The system runs on servers within the EU; no transfer to third countries takes place.
8. Spam protection (Cloudflare Turnstile)
To detect and fend off automated requests (bots) we use Cloudflare Turnstile on our forms. Unlike Google reCAPTCHA, Turnstile is more privacy-friendly: no personal tracking cookies are set, and primarily technical browser signals are evaluated (whether JavaScript is available, consistency of the browser fingerprint, and so on).
Data processed: IP address, technical browser characteristics, connection data. This is transferred temporarily to Cloudflare and deleted immediately after evaluation.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in protection against misuse).
Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/
9. Transfers to third countries (USA)
The following services we use may or must transfer data to the USA:
Cloudflare, Inc. — CDN, spam protection, TLS termination
Google LLC — evaluation of Google Analytics 4 (with Google Ireland Ltd. as the EU contracting party)
For every transfer there is either an adequacy decision of the European Commission (EU-US Data Privacy Framework) or standard contractual clauses under Article 46(2)(c) GDPR have been concluded.
Please note: following the Schrems II judgment of the Court of Justice of the EU (C-311/18 of 16 July 2020), even these safeguards cannot fully guarantee a level of data protection equivalent to that in the EU — in particular, US security authorities may access data without EU citizens having effective legal remedies available to them.
We therefore use these services only in so far as this is necessary to fulfil the purposes concerned (security, performance, audience measurement), and we keep reviewing European alternatives.
10. Storage of your cookie consent
Under Article 7(1) GDPR we are obliged to be able to demonstrate your consent. To that end we log the following data on the server in pseudonymised form:
time of consent or of any change to it
content of the consent (which cookie categories were accepted or refused)
hashed fingerprint (an anonymised construct from IP address and user agent — not traceable to a person without further data)
This data is kept for 13 months (12 months of cookie lifetime plus one month as a buffer for any dispute) and then deleted automatically.
Legal basis: Article 6(1)(c) GDPR (fulfilment of the obligation to demonstrate consent) in conjunction with Article 7(1) GDPR.
11. Customer account (customer portal)
If you create a customer account in our customer portal, we process the following data:
email address (login identifier)
first and last name
telephone number (if given)
company name and billing address (for business customers)
password — stored only as a hash (Argon2/bcrypt); reconstructing it is technically impossible
audit trail: login attempts, password changes, changes to consent (to protect your account)
Legal basis: Article 6(1)(b) GDPR (performance of a contract).
Retention period: for as long as the account exists. You can delete your account yourself at any time through the account settings — the data is then removed without delay (except for data we are required to keep under statutory retention obligations, in particular section 132 of the Federal Fiscal Code and section 212 of the Business Code for accounting records).
12. Security of processing
We take appropriate technical and organisational measures under Article 32 GDPR to protect your data against loss, manipulation and unauthorised access:
full TLS encryption (HTTPS, HSTS) for all connections
encrypted database backups, tested regularly and kept separately from the production system
role-based access control
password hashing with Argon2/bcrypt (no password stored in plain text)
automated security updates and regular vulnerability scans
audit logging of all administrative actions
rate limiting and IP blocks against brute force attacks
Content Security Policy (CSP), HSTS, X-Frame-Options and other HTTP security headers
13. Your rights as a data subject
You have the following rights:
Right of access (Article 15 GDPR): you can ask us to tell you what personal data we process about you.
Right to rectification (Article 16 GDPR): you can ask for incorrect data to be corrected and incomplete data completed.
Right to erasure (Article 17 GDPR): you can ask for your data to be deleted, provided no statutory retention obligations stand in the way.
Right to restriction (Article 18 GDPR): in certain cases you can ask for processing to be restricted.
Right to data portability (Article 20 GDPR): you can receive your data in a structured, commonly used, machine-readable format.
Right to object (Article 21 GDPR): you can object to the processing of your data where we rely on legitimate interests.
Withdrawal of consent (Article 7(3) GDPR): you can withdraw any consent given at any time, with effect for the future.
To exercise these rights, an informal message to office@gottwald.at is enough. We reply without delay, and at the latest within one month (Article 12(3) GDPR).
Right to lodge a complaint with the supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority — in Austria:
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Telephone: +43 1 52 152-0
https://www.dsb.gv.at
14. Processors at a glance
We have concluded data processing agreements under Article 28 GDPR with the following service providers:
Hetzner Online GmbH — hosting · based in Germany · servers: EU
Cloudflare, Inc. — CDN/spam protection · based in the USA · DPF + SCC
Google Ireland Ltd. / Google LLC — analytics · based in Ireland/USA · DPF + SCC + DPA
Sendinblue GmbH (Brevo) — newsletter · based in Germany/France · EU
- Mistral AI SAS — AI chat assistant and website search · Registered office: France · Servers: EU
We review our processors regularly for compliance with the GDPR and with what has been agreed.
15. Artificial intelligence
Gottwald GmbH & Co KG uses approved AI systems in selected business processes to support its employees. They are used in compliance with applicable legal and contractual requirements as well as data protection and information security requirements. AI serves exclusively as a tool and does not replace professional review or human responsibility. The current information on the use of artificial intelligence (AI) is available at www.gottwald.at/ki and applies in its currently valid version.
16. AI chat assistant on this website
You can voluntarily use a chat assistant on our website. It answers questions about our services, job openings, locations and ways to contact us based solely on the content publicly available on this website. In addition, we use the same provider to match search queries on our website to relevant pages ("semantic search").
Provider
Mistral AI SAS, Paris, France, as a processor pursuant to Art. 28 GDPR. Processing takes place in data centres within the EU.
Data processed
Only your chat entries or search terms are transmitted to the provider. Before that, recognisable personal data such as e-mail addresses, telephone numbers, bank details and postal addresses are automatically removed. Your IP address, browser data and cookies are not transmitted to the provider. Please do not enter any personal or sensitive data in the chat, such as health data.
Legal basis
Our legitimate interest in answering enquiries quickly and easily (Art. 6(1)(f) GDPR). No automated decision-making within the meaning of Art. 22 GDPR takes place.
Retention period
The conversation history is stored only locally in your browser and can be deleted there at any time; we do not store chat content on our server. The provider stores transmitted requests for up to 30 days for abuse monitoring. If misuse is suspected, we store the IP address and a shortened, redacted text excerpt for 90 days.
Right to object
Use is voluntary. You can object to the processing at any time pursuant to Art. 21 GDPR by not using the chat or by deleting your history.
17. Changes to this privacy policy
We reserve the right to amend this privacy policy where changes in our processing make this necessary or where the law changes. The current version published here always applies.
In the event of material changes — for example the addition of new tracking services or recipients — we give active notice through a note on the home page or by newsletter and, where necessary, obtain your consent again.
Last updated: 29 September 2026