Privacy Policy

Last updated: August 2026

1. Controller

The controller responsible for the processing of your personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Seisenbacher GmbH
Schwarzenberg 82, 3341 Ybbsitz, Austria
Company register number: FN 85162 p (Commercial Court of St. Pölten) · VAT ID: ATU 17323108
Email: office@seisenbacher.com · Phone: +43 50 119 – 100

We have not appointed a data protection officer, as the legal requirements for doing so (Art. 37 GDPR) do not apply to us.

2. General information on data processing

We process personal data only where a legal basis exists: for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), to comply with a legal obligation (point (c)), on the basis of your consent (point (a)), or on the basis of our legitimate interest (point (f)). The applicable legal basis for each processing activity is stated in the relevant section of this policy.

When you visit our website, data is generated even if you do not actively provide any information — for example through server log files and the consent cookie. Details can be found in the following sections.

3. Hosting, delivery of the website and server log files

Our website is hosted by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA, and delivered via its content delivery network (including Amazon CloudFront). A data processing agreement pursuant to Art. 28 GDPR is in place with Webflow; Webflow is certified under the EU-US Data Privacy Framework. Details: webflow.com/legal/privacy

When you access the website, the server automatically processes so-called server log files containing the following data: IP address · date and time of access · page or file accessed · data volume transferred and status code · referrer URL · browser type and version · operating system.

Purpose: technically sound and secure operation of the website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Retention period: as a rule no longer than 30 days.

For individual functions we also load script libraries from content delivery networks: jsDelivr (privacy policy), cdnjs / Cloudflare and unpkg / Cloudflare (privacy policy), and Amazon CloudFront (privacy policy). Your IP address is transmitted to the respective provider, as this is technically necessary to deliver the files. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fast and secure delivery).

4. Web fonts

This website uses licensed fonts (purchased via MyFonts, among others) for a consistent appearance. They are served exclusively locally through our hosting. Loading the fonts does not establish any connection to external font providers such as Google Fonts, and no data is transferred to such providers.

5. Cookies and consent management

We only use cookies and similar technologies if they are strictly necessary for the operation of the website or if you have given your prior consent (Section 165(3) of the Austrian Telecommunications Act 2021 (TKG) in conjunction with Art. 6(1)(a) GDPR). On your first visit, a consent banner appears in which you can make your selection.

Your decision is stored in a cookie:
Name: fs-cc (and fs-cc-updated) · Purpose: stores your consent or refusal · Retention period: up to 180 days · Legal basis: Section 165(3) TKG 2021 and Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.

• Essential: strictly necessary functions, including storing your cookie settings. Always active.
• Marketing: externally embedded content such as Google Maps and YouTube videos (see Section 9).
• Functional: services providing extended functionality. No services in this category are currently in use.
• Statistics: analytics and statistics services. No services in this category are currently in use; in particular, Google Analytics is not used.

You can withdraw or adjust your consent at any time with effect for the future — via the “Cookie settings” link or button on the website, or directly in the placeholders of the affected content. The lawfulness of processing carried out before the withdrawal remains unaffected. Independently of this, you can also delete or block cookies in your browser.

6. Contact by email, phone or post

If you contact us by email, phone or post, we process the information you provide (name, contact details, content of the enquiry) in order to handle your enquiry.

Purpose: handling your enquiry and any follow-up questions.
Legal basis: Art. 6(1)(b) GDPR (contractual or pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding).
Retention period: until the enquiry has been fully dealt with; beyond that only where statutory retention obligations (e.g. Section 132 of the Austrian Federal Fiscal Code (BAO): seven years for business-related records) or limitation periods so require.

7. Contact form

For the contact form on our website we use the service Formspark (submit-form.com). The data you enter (first name, last name, email address, message) is transmitted to us via Formspark and delivered to us by email. Details: formspark.io/legal/privacy-policy

Purpose: receiving and processing your enquiry.
Legal basis: Art. 6(1)(b) GDPR (contractual or pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest).
Retention period: until the enquiry has been fully dealt with; longer only where statutory retention obligations apply.

8. Job applications

Through our online application form we process the data you provide: first and last name, email address, desired position, professional experience, earliest possible starting date, your message, and uploaded documents (CV, cover letter, certificates). Transmission and storage take place via the form function of our hosting provider Webflow (see Section 3); the application is additionally delivered to us by email.

Purpose: carrying out the application procedure.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request).
Retention period: application documents are deleted no later than seven months after the respective application procedure has been completed, unless you are hired. We only keep applications on file for longer with your express consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

9. Externally embedded content (two-click solution)

On some pages we embed content from external providers. This content is not loaded automatically. Until you have given your consent, you will see a placeholder instead, and no connection whatsoever is established to the respective provider. Only when you activate the “Marketing” category via the placeholder or the consent banner is the content loaded. Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with Section 165(3) TKG 2021.

Google Maps

On the “Contact” and “Apply” pages we embed map sections from Google Maps (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When the map is loaded, personal data — in particular your IP address and approximate location data — is transmitted to Google; processing on servers in the USA cannot be ruled out. Google may set cookies in the process. Details: policies.google.com/privacy

Without giving consent, you can open our locations at any time via the direct link to Google Maps offered in the placeholder — or entirely without Google: you will find our address in Section 1 above and on the contact page.

YouTube videos

On the “About us”, “Company philosophy” and “Open positions” pages we embed videos from YouTube (provider: Google Ireland Limited). We use the enhanced privacy mode (youtube-nocookie.com): only when you play the video is data — including your IP address and device information — transmitted to YouTube or Google, and cookies may be set. If you are logged in to YouTube, Google may associate your viewing with your account. Details: policies.google.com/privacy

Alternatively, you can watch any video directly on YouTube via the link in the placeholder, without our website establishing a connection.

10. Protection against spam and misuse

To protect our forms against automated access (bots), we use the following services:

• Botpoison (botpoison.com): checks in the background when the contact form is submitted whether the request originates from a human. Technical connection data (including IP address and browser information) is processed in the course of this.
• Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA): invisible bot detection for forms of our hosting provider Webflow. Technical connection data is processed; details: cloudflare.com/privacypolicy

Purpose: protection against spam and misuse, security of our systems.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest). These services only become active in connection with the use of the forms.

11. Links to social networks

Our website contains links to our profiles on Instagram, Facebook, LinkedIn and YouTube. These are plain links — no social media plugins are embedded, and no data is transferred to these networks when you visit our website. Only when you click a link will you be taken to the respective platform; from that point on, its privacy policy applies.

12. Recipients of your personal data

We only pass on personal data where this is necessary for the purposes described — to the processors named in this policy (hosting and form services, bot protection) and, where applicable, to tax advisors, legal representatives or authorities where we are legally obliged to do so. Data is not passed on for advertising purposes.

13. Data transfers to third countries

Some of the providers named process data (also) in the USA. Where this is the case, we base the transfer on an adequacy decision of the European Commission — in particular the EU-US Data Privacy Framework, where the provider is certified under it — or on the standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Despite these safeguards, it cannot be completely ruled out that US authorities may access transferred data.

14. Retention periods

We store personal data only for as long as is necessary for the respective purposes or as required by statutory obligations. Specific periods are stated for the individual processing activities — in particular: server log files no longer than 30 days, consent cookie up to 180 days, job applications up to seven months after the end of the procedure, business-related records seven years pursuant to Section 132 of the Austrian Federal Fiscal Code (BAO). After that, the data is deleted or anonymised.

15. Your rights as a data subject

Under the GDPR you have the following rights:

• Access to the data processed (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (“right to be forgotten”, Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to office@seisenbacher.com is sufficient.

If you believe that the processing of your data violates data protection law, you also have the right to lodge a complaint with the supervisory authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42, 1030 Vienna, Austria
Phone: +43 1 52 152-0 · Email: dsb@dsb.gv.at · www.dsb.gv.at

16. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

17. Data security

This website is delivered over a TLS-encrypted connection (HTTPS). In addition, together with our service providers we implement technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, misuse and unauthorised access.

18. Changes to this privacy policy

We will update this privacy policy whenever the legal situation, our website or the services used change. The version published on this page, with the date stated above, applies.