Visionary power. Wherever you want.
1. Data Controller
Name of Person in charge:
Global Hydro Energy GmbH
Niederranna 41, 4085 Hofkirchen im Mühlkreis, Austria
FN 221408a
dataprotection(at)global-hydro.eu
+43 7285 514-0
2. General Information on Data Processing
We process personal data exclusively in accordance with the General Data Protection Regulation (EU GDPR), the Austrian Data Protection Act (DSG), and the Austrian Telecommunications Act 2021 (TKG 2021).
We only process personal data that is necessary for the respective purpose.
The legal bases for processing include, in particular:
Where special categories of personal data are processed in individual cases, this will only take place on the basis of an additional applicable legal basis.
3. Visiting Our Website (Server Log Files)
When you access our website, our web server automatically processes technically required connection data, including:
This processing is carried out for the purposes of providing the website, ensuring its stability and security, analysing technical errors, and preventing, detecting, and investigating misuse or cyberattacks.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our website.
Server log files are generally stored for a maximum period of 14 days. A longer retention period only applies where necessary to investigate specific security-related incidents.
4. Contacting Us
If you contact us by e-mail, telephone, or via a contact form, we process the personal data you provide, including in particular:
Your data is processed for the purpose of handling your enquiry, communicating with you, preparing quotations, and initiating or performing a contractual relationship.
The legal bases are Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. Our legitimate interest lies in maintaining efficient communication with prospective customers, customers, suppliers, and other business contacts.
Providing this information is voluntary. However, if the information required to process your enquiry is not provided, we may be unable to respond to or fully process your request.
5. Visitors to Our Premises / Reception
When you visit the premises of Global Hydro Energy GmbH, personal data may be processed as part of our visitor management procedures. This may include, in particular, your name, company, job title, contact details, the date and time of your visit, the person you are visiting, the purpose of your visit, and any additional information required for access control and security management.
The processing is carried out for the purposes of visitor registration, access management, internal tracking of visits, site security, the organisation of meetings, compliance with internal security requirements and, where necessary, the establishment, exercise or defence of legal claims.
The legal basis for processing is Article 6(1)(f) GDPR and, where the visit serves the initiation or performance of a contract, Article 6(1)(b) GDPR. Our legitimate interests include the orderly administration of visitors, the protection of individuals, business premises and company information, traceability of access, and the organisation of secure and efficient business operations.
Providing the information required for visitor registration is necessary to organise your visit and grant access to our premises. Without this information, access may not be possible or may be restricted.
Visitor data is retained only for as long as necessary for the purposes described above. A longer retention period will only apply where required by statutory retention obligations or where necessary for the establishment, exercise or defence of legal claims.
6. Customer and Prospective Customer Data
As part of establishing, managing and fulfilling business relationships, we process personal data relating to customers, prospective customers, clients and their respective contact persons. This includes, in particular, master and contact data, company and job-related information, communication data, quotation, contract and project data, order and service data, invoicing and payment data, creditworthiness and compliance-related information, as well as other business-related correspondence.
The processing is carried out for the purposes of handling enquiries, preparing quotations, implementing pre-contractual measures, performing contracts and projects, customer relationship management, accounting, documentation, internal administration and the establishment, exercise or defence of legal claims.
The legal basis for processing is Article 6(1)(b) GDPR where processing is necessary for pre-contractual measures or the performance of a contract, Article 6(1)(c) GDPR where processing is required by law, and Article 6(1)(f) GDPR. Our legitimate interests include the proper management and documentation of our business relationships, internal administration, credit assessments, risk management and the assertion and defence of legal claims.
7. Supplier and Business Partner Data
We process personal data relating to suppliers, service providers, consultants, other business partners and their respective contact persons. This includes, in particular, names, contact details, job functions, company information, contract data, purchasing and delivery data, invoicing and payment data, VAT identification numbers, bank account details, project-related information and business correspondence.
The processing is carried out for the selection, administration and management of suppliers and business partners, the implementation of pre-contractual measures, contract and project management, procurement, logistics, invoice verification, payment processing, documentation, compliance with legal obligations and the establishment, exercise or defence of legal claims.
The legal basis for processing is Article 6(1)(b), (c) and (f) GDPR. Our legitimate interests include the efficient and legally compliant organisation of our procurement, supplier and project processes, as well as ensuring proper business operations.
8. Data Relating to Subcontractors and Temporary Agency Workers
Where necessary for project execution or cooperation with subcontractors or temporary employment agencies, we process personal data relating to sole traders, contact persons and, where required by law or contract, deployed personnel.
This may include, in particular, master and contact data, job function information, qualifications and training records, project-related deployment data, proof of identity, employment or professional activity, social security, employment and payroll-related information, documentation required under the Austrian Anti-Wage and Social Dumping Act (LSD-BG), the Temporary Employment Act (AÜG), or other statutory verification and compliance obligations, as well as project-related correspondence.
The processing is carried out for the implementation of pre-contractual measures, contract and project management, coordination of deployed personnel, compliance with statutory inspection, documentation and verification obligations, fulfilment of customer requirements and the establishment, exercise or defence of legal claims.
The legal basis for processing is Article 6(1)(b), (c) and (f) GDPR. Our legitimate interests include the proper execution of projects, compliance with legal and contractual obligations, the avoidance of liability risks and the documentation and verification required for customers, public authorities and courts.
Where special categories of personal data are processed in individual cases, such processing will only take place where there is an applicable legal basis, a legal obligation, where processing is necessary for the establishment, exercise or defence of legal claims, or where the data subject has given explicit consent.
9. Applications / Careers Page
Information on the processing of personal data in connection with applications, our careers page and the applicant management system used there can be found in the separate Privacy Notice available on the careers page.
This main Privacy Policy does not contain separate detailed provisions in this regard in order to avoid redundancy, inconsistencies and a lack of transparency. Where this website contains a link to a careers page or application portal, the specific privacy information and, where applicable, a separate Cookie Policy available on that page shall apply.
10. Events, Photography and Video Recordings
Photographs and video recordings may be taken during events, training sessions, information events, corporate events, project meetings or other company activities where this is necessary for documenting the event, reporting on it, internal and external corporate communications or public relations.
Such processing may include photographs and video recordings of participants, speakers, employees, customers, business partners and other persons present. Where applicable, such material may be published on our website, in company presentations, internal communication channels, printed publications or social media platforms.
Depending on the nature and circumstances of the recording, the legal basis for processing is Article 6(1)(f) GDPR or, where consent is required in individual cases, Article 6(1)(a) GDPR. Our legitimate interest lies in documenting and reporting on events, projects and business activities as well as in internal and external corporate communications. Processing will only take place where there are no overriding legitimate interests of the data subjects.
If you do not wish to be photographed or filmed, you may inform the event organisers on site or contact us afterwards at dataprotection@global-hydro.eu. Your statutory rights, including your right to object and your right to withdraw consent, remain unaffected.
11. Consent Management and Cookies
Where cookies or similar technologies are used on our website, technically necessary cookies and technically necessary access to information stored on your device are processed, where permitted by law, on the basis of Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). Where personal data is processed in this context, the legal basis is Article 6(1)(f) GDPR or, where the cookie is required to provide a service expressly requested by you, Article 6(1)(b) GDPR.
To obtain, manage and document consent for cookies and similar technologies, we use Cookiebot by Usercentrics, provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark.
The information processed includes your consent preferences, timestamps, browser information, device information and a shortened or pseudonymised IP address where technically required. Processing is carried out for the lawful management and documentation of your consent. The legal basis is Article 6(1)(c) GDPR, Article 6(1)(f) GDPR and Section 165(3) TKG 2021.
Non-essential cookies, in particular analytics cookies, are only used with your prior consent pursuant to Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021. You may withdraw or amend your consent at any time with future effect via the Cookie Settings.
We distinguish between the following categories of cookies and similar technologies:
Detailed information on the cookies and similar technologies used, including the provider, cookie name, purpose, category and storage period, is available at all times in the Cookie Settings or the consent management tool. For this reason, no separate static cookie table is maintained in this Privacy Policy, provided that this information is made available completely and up to date through the consent management platform.
12. Google Analytics 4
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics 4 is used only with your prior consent.
The data processed includes, in particular, information on your use of the website, device and browser information, page views, interactions and, depending on the technical configuration, additional usage-related event data.
The legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.
The retention period for analytics and event data is defined in the service configuration and the Cookie Banner and is limited to a maximum of 14 months.
Personal data may be transferred to Google LLC in the United States. Such transfers take place only on the basis of appropriate safeguards in accordance with Articles 44 et seq. GDPR, in particular the EU–US Data Privacy Framework, where the recipient is certified accordingly, and/or the European Commission's Standard Contractual Clauses.
13. Google reCAPTCHA
Our website uses Google reCAPTCHA to protect our website and online forms against misuse through automated access. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Depending on the technical implementation, processing may include information about your device, browser data, IP address, interaction data and usage data.
Processing is carried out to ensure the security of our website and to prevent automated attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in protecting our website, online forms and IT systems against misuse and cyberattacks.
14. Maps and External Media Services
Our website may integrate mapping or media services such as Snazzy Maps, Google Maps or YouTube. When such content is loaded or played, personal data may be processed by the respective provider. This may include, in particular, your IP address, device and browser information, as well as usage and interaction data.
Where technically possible, non-essential third-party content is only loaded after you have given your consent. In this case, the legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.
Where the integration is technically necessary to provide a function explicitly requested by you, processing may additionally be based on Article 6(1)(f) GDPR.
For YouTube content, the provider is Google Ireland Limited. Personal data may be transferred to Google LLC in the United States only on the basis of appropriate safeguards pursuant to Articles 44 et seq. GDPR.
15. Managing and Withdrawing Cookie Consent
You may withdraw or modify your consent for non-essential cookies at any time with future effect via the Cookie Settings or the consent management tool used on our website.
Alternatively, you may configure your browser to allow cookies only in individual cases, reject cookies generally or automatically delete cookies when the browser is closed.
Please note that disabling technically necessary cookies may limit the functionality of the website.
16. Social Media Presence
We maintain corporate profiles on Facebook, Instagram and LinkedIn. When you visit our profiles on these platforms, both the respective platform operators and we may process personal data, in some cases as independent controllers. For certain processing activities, joint controllership arrangements may also apply.
The processing is carried out for the purposes of presenting our company, communicating with prospective and existing customers, measuring the reach of our content, and analysing user interactions. The legal basis for this processing is Article 6(1)(f) GDPR.
Our legitimate interest lies in the professional and international presentation of our company, providing information about our products, services, projects and activities, communicating with customers, prospective customers, business partners and other stakeholders, and maintaining our corporate and marketing communications. Processing is carried out only where no overriding legitimate interests of the data subjects prevail.
Where the platform operators use cookies or similar technologies, their respective privacy notices and consent mechanisms shall apply in addition.
17. International Corporate Group and Global Project Execution
Global Hydro operates internationally and carries out projects worldwide. In the course of communication, project acquisition, quotation preparation, contract and project execution, service provision, supply chain management, intra-group collaboration and cooperation with customers, suppliers, project partners, consultants and other third parties, it may be necessary to transfer personal data to recipients outside the European Union (EU) or the European Economic Area (EEA).
Such transfers are carried out exclusively in compliance with Articles 44 et seq. GDPR. As a priority, transfers to third countries are based on an adequacy decision of the European Commission or on appropriate safeguards, in particular the Standard Contractual Clauses pursuant to Article 46 GDPR.
Where neither an adequacy decision nor appropriate safeguards pursuant to Articles 46 et seq. GDPR are available, transfers may, in limited individual cases, be based on one of the derogations set out in Article 49 GDPR, particularly where the transfer is necessary for the implementation of pre-contractual measures at the request of the data subject, for the performance of a contract, or for the establishment, exercise or defence of legal claims. Article 49 GDPR is not used as a basis for regular or ongoing transfers.
Any transfer of personal data is limited to the extent necessary for the respective purpose.
18. Recipients of Personal Data
Where necessary for the respective processing purposes, personal data may be disclosed in particular to the following categories of recipients:
Personal data is disclosed only to the extent necessary for the respective purpose. Where recipients process personal data on our behalf, this is carried out on the basis of a Data Processing Agreement pursuant to Article 28 GDPR. Any further disclosure takes place only where required by law, necessary for the performance of a contract, justified by legitimate interests or based on your consent.
19. Transfers of Personal Data to Third Countries
Where personal data is transferred to countries outside the European Union (EU) or the European Economic Area (EEA), such transfers are carried out exclusively in accordance with Articles 44 et seq. GDPR.
Transfers of personal data to third countries may be necessary, in particular:
Where an adequacy decision of the European Commission exists, transfers are based on that decision. Where no adequacy decision exists, transfers are carried out on the basis of appropriate safeguards pursuant to Article 46 GDPR, in particular the Standard Contractual Clauses adopted by the European Commission.
Where neither an adequacy decision nor appropriate safeguards pursuant to Articles 46 et seq. GDPR exist, transfers may, in exceptional individual cases, be based on one of the derogations set out in Article 49 GDPR, particularly where the transfer is necessary for pre-contractual measures requested by the data subject, the performance of a contract or the establishment, exercise or defence of legal claims. Article 49 GDPR is not relied upon for regular or ongoing transfers.
Where US-based service providers are engaged, personal data may be transferred on the basis of the EU–US Data Privacy Framework, provided that the respective recipient is duly certified.
20. Data Retention
We retain personal data only for as long as necessary to fulfil the respective processing purposes, where consent remains valid, or where statutory retention or documentation obligations apply.
Business and tax-related records are generally retained for seven years, or for such longer periods as required by the applicable statutory provisions. Contract, project, service, travel, secondment, visa, financial, legal, IT and correspondence data may be retained beyond this period where necessary for contract performance, project execution, documentation, evidentiary purposes or the establishment, exercise or defence of legal claims. In individual cases, longer retention periods may apply, particularly in connection with warranty, liability, damages or statutory limitation periods.
Personal data processed solely on the basis of consent will generally be retained only until the consent is withdrawn or the relevant processing purpose no longer applies, unless another legal basis permits further storage.
Specific retention periods for server log files, analytics data and consent records maintained through the consent management platform are set out separately in the relevant sections or in the respective tool configuration.
21. Your Rights
Subject to the applicable legal requirements under the GDPR, you have the following rights:
To exercise your rights, please contact us at dataprotection@global-hydro.eu.
22. Right to Lodge a Complaint
If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.
In Austria, the competent supervisory authority is:
Austrian Data Protection Authority (Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna, Austria
E-mail: dsb@dsb.gv.at
Website: www.dsb.gv.at
23. Data Security
We implement appropriate technical and organisational measures in accordance with Article 32 GDPR to protect personal data against loss, destruction, manipulation and unauthorised access. Our security measures are continuously reviewed and updated in line with technological developments.
Data transmitted via our website is protected using TLS/SSL encryption technology.