1. Verantwortlicher (Impressum / Verantwortlicher)

Verantwortlicher für die Verarbeitung personenbezogener Daten auf dieser Website ist: Winkler Gut GmbH Iglbach 14, 4171 Auberg, Austria Telephone: +43 7282 21105 Email: info@winklergut.at Website: www.winklergut.at VAT ID (UID): ATU79352736 Managing Director: Sophie Haas Commercial Register Number (Firmenbuchnummer): FN 600360 h Commercial Register Court (Firmenbuchgericht): Landesgericht Linz GISA Number: 37254643

2. Legal Framework

This Privacy Policy is issued in accordance with:

• Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR)
• Datenschutzgesetz (DSG) – Austrian Federal Act on the Protection of Natural Persons with Regard to the Processing of Personal Data (as amended July 2024)
• Telekommunikationsgesetz 2021 (TKG 2021) – Austrian Telecommunications Act 2021, in particular Section 165(3) regarding cookies

3. What Personal Data We Collect

We may collect the following categories of personal data: Automatically collected data (server logs):

• IP address
• Date and time of access
• Pages visited and files downloaded
• Browser type and version
• Operating system
• Referring URL

This data is stored in server log files for a maximum of 30 days for the sole purpose of ensuring system security and diagnosing technical problems. It is not used to create user profiles. Data you provide voluntarily:

• Name
• Email address
• Message content (via contact forms)
• Phone number
• Billing or shipping address

4. Legal Basis for Processing (Art. 6 GDPR)

We process your personal data on the following legal bases:

Processing Activity	Legal Basis
Server logs / security	Art. 6(1)(f) GDPR – Legitimate interests
Contact form responses	Art. 6(1)(b) GDPR – Pre-contractual measures, or Art. 6(1)(a) – Consent
Newsletter / marketing	Art. 6(1)(a) GDPR – Consent
Order fulfilment	Art. 6(1)(b) GDPR – Performance of a contract
Legal obligations (tax, accounting)	Art. 6(1)(c) GDPR – Legal obligation

5. Cookies and Tracking Technologies

This website uses cookies in accordance with Section 165(3) of the Austrian TKG 2021 and Art. 6 GDPR. Strictly necessary cookies (no consent required): These are essential for the website to function and are processed on the basis of legitimate interests (Art. 6(1)(f) GDPR). Optional cookies (consent required): Analytics, marketing, and preference cookies are only placed after you have given your explicit consent via our cookie banner. You may withdraw consent at any time. We use the following cookies:

Cookie Name	Type	Zweck	Speicherdauer
session_id	Necessary	Session management	Sitzung
_ga / _gid	Analytics	Usage statistics (Google Analytics)	14 months

Note on Google Analytics / Google Fonts: The Austrian Data Protection Authority (DSB) has found that certain uses of Google Analytics and dynamically embedded Google Fonts may violate the GDPR due to IP address transfers to the USA. We utilize self-hosted fonts locally on our servers and only activate web analytics services subject to your prior explicit consent via our cookie consent manager.

6. Data Retention

We retain personal data only for as long as necessary for the stated purpose or as required by Austrian or EU law:

• Server logs: 30 days
• Contact form inquiries: 6 months or until the matter is fully resolved
• Contractual data: 7 years (per Austrian commercial and tax law — §§ 132 BAO, 212 UGB)
• Newsletter subscribers: Until consent is withdrawn

7. Data Transfers to Third Countries

We may transfer personal data to third countries outside the European Economic Area (EEA) only where:

• An adequacy decision exists (Art. 45 GDPR), such as the EU-U.S. Data Privacy Framework, or
• Appropriate safeguards are in place, such as Standard Contractual Clauses (Art. 46 GDPR).

For services provided by vendors based in the USA, data transfers are executed under the EU-U.S. Data Privacy Framework or verified Standard Contractual Clauses with supplementary technical controls.

8. Your Rights as a Data Subject (Arts. 12–22 GDPR; §§ 42–45 DSG)

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) – You may request confirmation of whether we process your data and obtain a copy.
• Right to rectification (Art. 16 GDPR) – You may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17 GDPR / “Right to be forgotten”) – You may request deletion when data is no longer necessary, consent is withdrawn, or processing was unlawful. Note: under § 4(4) DSG, immediate deletion may not always be possible for technical or economic reasons; deletion may occur in scheduled batches within a reasonable timeframe.
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR) – You may object to processing based on legitimate interests at any time.
• Right to withdraw consent (Art. 7(3) GDPR) – Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at: info@winklergut.at We will respond within one month as required by Art. 12(3) GDPR.

9. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes the GDPR or §§ 1, 7–13 DSG, you have the right to lodge a complaint with the competent supervisory authority: Österreichische Datenschutzbehörde (DSB) Barichgasse 40–42 1030 Vienna, Austria Email: dsb@dsb.gv.at Website: www.dsb.gv.at

10. Third-Party Services

• Website Analytics: We use Google Analytics to analyze website traffic. Data is processed based on your consent (Art. 6(1)(a) GDPR) under a Data Processing Agreement.
• Email Services: Contact form messages and email communications are processed using secure hosted mail servers located within the EU.

11. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or destruction, in accordance with Art. 32 GDPR. Data is stored on servers located in Austria and the European Union.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available on this page. This Privacy Policy was last reviewed on July 22, 2026.