Privacy Policy

PRIVACY POLICY / DUTY TO INFORM
Version 1.0, as of 07/2026

Protecting your data is a matter of particular importance to us, which is why, when processing your personal data (e.g. master data), we comply with the applicable data protection provisions, in particular the GDPR and the Austrian Data Protection Act (DSG).
Below you will find further information about the data processing activities we carry out:

1. Controller

CONA Solar GmbH
Voitsdorf 23a
4551 Ried im Traunkreis, Austria

As we are not legally obliged to do so, we have not appointed a data protection officer or notified one to the data protection authority.

2. Rights of data subjects / Right to object and withdraw / Right to lodge a complaint

2.1. Rights of the data subject

You have the following rights towards us regarding personal data concerning you:

• Right of access (Art 15 GDPR),
• Right to rectification (Art 16 GDPR) or erasure (Art 17 GDPR),
• Right to restriction of processing (Art 18 GDPR),
• Right to data portability (Art 20 GDPR),
• Right to object to processing (Art 21 GDPR),

If the processing of your personal data is based on a balancing of interests (Art 6(1)(f) GDPR: legitimate interests), you have the right to object to the processing at any time for reasons arising from your particular situation. When exercising your right to object, we ask you to explain the reasons why we should not process your personal data as we have been doing. We will examine the situation and either discontinue or adjust the data processing, or demonstrate to you our compelling legitimate grounds and continue the data processing. We will also continue the data processing if it serves to assert, exercise or defend legal claims.

You may object to the processing of your data for direct marketing and data analysis purposes at any time. In this case, we will discontinue the data processing.

• Right to withdraw consent (Art 7(3) GDPR).

If you have given us your consent for the processing of your personal data, you may withdraw this consent at any time. Your withdrawal does not affect the lawfulness of the processing carried out until the withdrawal.

To exercise the rights listed above, please contact us in person, by telephone, or in writing:

CONA Solar GmbH
Voitsdorf 23a
4551 Ried im Traunkreis, Austria

Phone: +43 (0) 7588 6446
Email: solar@conasolar.com

Please note that we can only provide you with information if you can identify yourself.

2.2. Right to lodge a complaint with the supervisory authority

If you believe that the processing of data violates applicable data protection law, or that we have violated your data protection rights, you also have the right to lodge a complaint with the supervisory authority in the member state of your habitual residence, your place of work, or the place of the alleged infringement.

If you wish to lodge your complaint with the supervisory authority in Austria, please address it to:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40-42
1030 Vienna, Austria

3. Information about the processing of your personal data

3.1. Website visit

• Purpose: If our website is used purely for informational purposes (no registration and no transmission of other information), personal data is collected that is transmitted from your browser to our server. This is technically necessary to display our website to you and to ensure the stability and security of the website.
• Data subjects: Website visitors
• Legal basis: legitimate interest (Art 6(1)(f) GDPR), § 165(3) Austrian Telecommunications Act 2021 (TKG 2021)
• Legitimate interest: provision of a stable, secure and user-friendly information society service (website, appointment scheduling) to inform about our company, to promote our company and our services and products;
• The following data is processed: IP address, date and time of the request, time zone difference to GMT, content of the request (specific page), access status/HTTP status code, amount of data transferred, requesting website, browser, operating system and interface, language and version of the browser software
• Retention period: For as long as you use our website.
• Recipients/categories of recipients: Processors

3.2. Electronic contact inquiries via the website

• Purpose: Processing of contact inquiries via email or the website contact form.
• Data subjects: Website visitors who use the contact form
• Legal basis: performance of a contract, necessary to carry out pre-contractual measures (Art 6(1)(b) GDPR), legitimate interest (Art 6(1)(f) GDPR), § 165(3) TKG 2021
• Legitimate interest: provision of a stable and user-friendly information society service (website, online shop, appointment scheduling) for receiving and responding to inquiries
• The following data is processed: master data, content data of the inquiry
• Retention period: Until the inquiry has been answered. If statutory retention obligations apply, processing will be restricted until then.
• Recipients/categories of recipients: Processors

3.3. Cookies/web analytics service: List pursuant to § 165(3) TKG 2021

• Purpose: Improvement of our service offering, web presence and direct marketing
• Data subjects: Website visitors
• Legal basis: consent (Art 6(1)(a) GDPR), performance of a contract, necessary to carry out pre-contractual measures (Art 6(1)(b) GDPR), legitimate interest, in particular to improve our own services for the benefit of users (Art 6(1)(f) GDPR), explicit consent (Art 49(1)(a) GDPR), performance of a contract, necessary to carry out pre-contractual measures (Art 49(1)(b) GDPR), necessary to fulfil an interest of the data subject (Art 49(1)(c) GDPR), assertion, exercise and defence of legal claims (Art 49(1)(e) GDPR)
• Legitimate interests: improvement of our own services, technical stability, plausibility checks of invoices arising from the use of cookies and web analytics services.
• The following data is processed: IP address
• Retention period: See cookie list
• Recipients/categories of recipients: analytics service provider, processors

3.4. Customer management, accounting, logistics and bookkeeping

• Purpose: Processing of personal data in connection with any business relationships with customers and suppliers in the course of business operations, including the systematic recording of all business transactions relating to income and expenses.
• Data subjects: Customers, suppliers, employees
• Legal basis: consent (Art 6(1)(a) GDPR), performance of a contract, necessary to carry out pre-contractual measures (Art 6(1)(b) GDPR), compliance with a legal obligation (Art 6(1)(c) GDPR), legitimate interest (Art 6(1)(f) GDPR), explicit consent (Art 9(2)(a) GDPR).
• Legitimate interests: defence, exercise and assertion of legal claims, verification of the authenticity and accuracy of customer and supplier data, credit checks on customers, statistical analyses of customer and supplier relationships, network and information security measures, particularly in the case of electronic or telephone contact.
• The following data is processed: master data, VAT ID number
• Retention period: Until the end of the business relationship or until the expiry of the warranty, statutory limitation and legal retention periods applicable to the client, generally 7 years (in particular pursuant to § 132 of the Austrian Federal Fiscal Code, BAO); beyond that, until the conclusion of any legal disputes for which the data is required as evidence.
• Recipients/categories of recipients: tax office, courts and authorities, suppliers, debt collection companies, banks involved in payments to the data subject or third parties, legal representatives, tax consultants, payroll accountants.

The provision of your personal data is necessary for the performance of the contract or the implementation of pre-contractual measures. Without this data, we cannot conclude a contract with you.

3.5. Customer support and marketing for our own purposes

• Purpose: Processing of our own or purchased customer and prospect data for business development relating to our own products or services, as well as for carrying out advertising measures and sending newsletters; customer relationship management.
• Data subjects: Suppliers, customers
• Legal basis: consent (Art 6(1)(a) GDPR), performance of a contract, necessary to carry out pre-contractual measures (Art 6(1)(b) GDPR), compliance with a legal obligation (Art 6(1)(c) GDPR), legitimate interest (Art 6(1)(f) GDPR)
• Legitimate interests: defence, exercise and assertion of legal claims; analysis of open rates and statistics on the success of our campaigns; economic interest in customer and supplier retention.
• The following data is processed: master data
• Retention period: The data may be retained until the end of the third year following the last contact with the client, unless longer contractual or statutory retention periods apply.
• Recipients/categories of recipients: analytics service/service provider company

3.6. Applicant management

• Purpose: Use and retention of personal data of applicants where this data was provided by the data subject.
• Data subjects: Applicants, prospective applicants
• Legal basis: consent (Art 6(1)(a) GDPR), explicit consent (Art 9(2)(a) GDPR), as well as assertion, exercise and defence of legal claims (Art 9(2)(f) GDPR) and legitimate interest (Art 6(1)(f) GDPR; Art 10 GDPR in conjunction with § 4(3)(2) DSG)
• Legitimate interests: defence, exercise and assertion of legal claims; documentation of the selection process, including evaluations and interview notes.
• The following data is processed: master data, curriculum vitae, voluntarily submitted data
• Retention period: Applicant data will be deleted immediately after the advertised position has been filled, or after expiry of the claim period under the Austrian Equal Treatment Act (7 months), unless consent has been given for retention. Unsolicited applications are retained for their intended purpose until withdrawn by the data subject.
• Recipients/categories of recipients: Applicant data is not disclosed to third parties.

3.7. Data protection management

• Purpose: Personal data is processed for the systematic and transparent management, documentation and monitoring of all data protection activities within the organisation. The aim is to ensure compliance with data protection regulations (in particular the GDPR, DSG, TKG) as well as the early detection, handling, defence, tracking and documentation of data protection breaches, including the management of data subject requests and cooperation with supervisory authorities.
• Data subjects: Persons affected by a data protection incident; persons asserting a data subject right
• Legal basis: compliance with a legal obligation (Art 6(1)(c) GDPR), assertion, exercise and defence of legal claims (Art 9(2)(f) GDPR) and legitimate interest (Art 6(1)(f) GDPR; Art 10 GDPR in conjunction with § 4(3)(2) DSG)
• Legitimate interests: defence, exercise and assertion of legal claims; tracking the impact of a data protection incident, analysis of data protection failures; analyses regarding the exercise of data subject rights, internal control and audit measures, optimisation of internal processes, fulfilment of internal compliance requirements
• The following data is processed: master data, identification data, communication data, information on breaches, application data of the data subject, documentation data, training and instruction data
• Retention period: 3 years after conclusion of the proceedings or provision of the information.
• Recipients/categories of recipients: courts and authorities, legal representatives, external IT service providers or forensic experts, insurance companies, processors.

3.8. Use of Google services

This website uses various services provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (“Google”). For residents of the European Union, the European Economic Area and Switzerland, processing is carried out by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Below we explain which services this website specifically uses. Further information on Google’s services as well as its privacy policy can be found at: https://policies.google.com/privacy?hl=en.

Transfer to third countries under data protection law:
USA: Companies that have successfully completed the Data Privacy Framework Program are regarded, in accordance with the provisions of the EU-US and Swiss-US Data Privacy Framework, as entities with an adequate level of security. It is permissible under data protection law to transfer information to these companies within the framework of the Data Privacy Framework.

Further information on the EU-US Data Privacy Framework can be found at: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en.

Information on participation can be found by searching for “Google LLC” here: https://www.dataprivacyframework.gov/s/participant-search.

In addition, Google uses Standard Contractual Clauses (SCCs) to ensure that the EU level of data protection is maintained when processing your data. Further information can be found at: https://commission.europa.eu/publications/standard-contractual-clauses-international-transfers_de.

3.8.1. Google Analytics

• Purpose: Improvement of our service offering, web presence and direct marketing. We use the analysis of user behaviour to optimise both our website and our advertising.
• Data subjects: Website visitors
• Legal basis: consent (Art 6(1)(a) GDPR), explicit consent (Art 49(1)(a) GDPR)
• Processing-triggering events: Processing of your data is only initiated if one or more of the following events occur when visiting the website: page views, first visit to the website, session start, your “click path”, interaction with the website, scrolling (whenever a user scrolls to the end of the page (90%)), clicks on external links, internal search queries, interaction with videos, file downloads, ads seen/clicked, language setting.
• The following data is processed: approximate location (region), IP address (in truncated form), technical information about the browser and devices used (e.g. language setting, screen resolution), the visitor’s internet service provider, the referrer URL (which website/advertising medium you came from).
• Retention period: See cookie list.
• Recipients/categories of recipients: service provider’s company, processors
• Transfer to the following third countries under data protection law: USA (DPF-certified)

3.8.2. Google Ads

• Purpose: Addressing website visitors with targeted advertising by displaying personalised, interest-based ads to visitors when they visit other websites within the Google Display Network.
• Data subjects: Website visitors, prospects
• Legal basis: consent (Art 6(1)(a) GDPR), legitimate interest, in particular to improve our own services for the benefit of users (Art 6(1)(f) GDPR), explicit consent (Art 49(1)(a) GDPR), assertion, exercise and defence of legal claims (Art 49(1)(e) GDPR)
• Legitimate interests: improvement of our own services for the benefit of users
• The following data is processed: IP address (truncated), unique user ID, content of the request (e.g. information about the advertisement).
• Retention period: See cookie list.
• Recipients/categories of recipients: processors
• Transfer to the following third countries under data protection law: USA (DPF-certified)

3.8.3. Google Tag Manager

• Purpose: Organisation of tracking tools.
• Data subjects: Website visitors
• Legal basis: consent (Art 6(1)(a) GDPR), legitimate interest, in particular to improve our own services for the benefit of users (Art 6(1)(f) GDPR), explicit consent (Art 49(1)(a) GDPR), assertion, exercise and defence of legal claims (Art 49(1)(e) GDPR)
• Legitimate interests: improvement of our own services for the benefit of users
• The following data is processed: tags of the web analytics tools.
• Retention period: See cookie list.
• Recipients/categories of recipients: processors
• Transfer to the following third countries under data protection law: USA (DPF-certified)

3.8.4. YouTube

Our website links to a YouTube video from our company in order to present our company and our products. The YouTube channel itself is not operated by our company. When a website visitor accesses the link, their IP address is transmitted.

4. Information on data transfers to third countries or international organisations

The data we process is not transferred to recipients in third countries or international organisations.

5. Change management

The currently valid version of this privacy policy is available on our website. If you have any questions about a previous version, please contact the entity named in point 1.