Privacy Policy

For Heller Metall GmbH ("Heller"), protecting your privacy when processing personal data is a matter of great importance. With the following privacy policy, we provide you with comprehensive information about how we handle your personal data and about data protection at Heller.

This privacy policy applies to the handling of your personal data when you visit the Heller website. This privacy policy also applies when you contact us via our contact form, by email, by phone, or by mail.

The controller responsible for the data processing described in this privacy policy is:

Heller Metall GmbH
Rätikonweg 6
6781 Bartholomäberg / Gantschier
AUSTRIA

Phone: +43 5556 72176 0
Email: info@heller-snowstop.at
Website: www.heller-snowstop.at

Data Protection Officer

If you have any questions regarding data protection, you can also contact our data protection officer:

Mr. Thomas Wanjura
Projekt 29 GmbH & Co. KG
Ostengasse 14, 93047 Regensburg
Tel.: +49 941 2986930
Fax: +49 941 29869316
Email: anfragen@projekt29.de
Website: www.projekt29.de

If our data protection officer is unable to resolve your concerns to your satisfaction, you always have the right to lodge a complaint with the supervisory authority responsible for your federal state.

Depending on the specific processing situation, Heller collects and processes various types of your personal data.

We process your personal data exclusively in accordance with the requirements of the General Data Protection Regulation ("GDPR") and the Austrian Data Protection Act ("DSG").

Below, you will find a list of the personal data we process depending on the specific situation, the purposes for which this data is processed, and the legal basis for such processing.

In this section, we describe how your personal data is processed in connection with your visit to our website.

Categories of personal data

Personal data is any information relating to an identified or identifiable natural person (e.g., name, address, email). Generally, you do not need to disclose your identity to visit our website. When you access our website, we process the following personal data in particular:

• Log data, i.e., data related to the use of the provided website (e.g., web browser and operating system used, referrer URL, date and time of access, volume of data transferred),
• IP address of the requesting computer, and
• other technical data comparable to the above.

In individual cases, we may also require further information, for example, to provide requested services, respond to inquiries, or send information material. In such cases, we will provide separate notification.

Purposes: The processing of this data enables you to visit our website and ensures that our website is displayed correctly. Furthermore, the processing serves statistical purposes and helps us improve the quality of our website, particularly regarding connection stability and security. No personalized analysis takes place.

Legal basis: The legal basis is Art. 6(1)(f) GDPR, with our legitimate interest derived from the aforementioned purposes.

Storage duration: The data is stored only temporarily for the duration of the session in so-called log files and is deleted after you leave the website, unless a longer statutory retention period applies.

Recipients: Our website is hosted by … (please provide address details), who may need to access the data listed above as part of a (sub-)processing agreement to provide hosting and support services.

Data processing agreement: We have entered into a data processing agreement (DPA) with the provider mentioned above. This is a contract required by data protection law that ensures the provider processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

When you contact us (e.g., via contact form, email, or telephone), we process the information provided by the inquiring person to the extent necessary to respond to the inquiry and, if applicable, to carry out pre-contractual or contractual measures.

Categories of personal data: When you contact us, we process the following personal data in particular:

• First and last name,
• Email address,
• Time of the inquiry,
• Telephone number, if applicable (when contacting us by phone)
• Information you provide when contacting us.

Data subjects: Communication partners.

Purposes: The data is processed exclusively for the purpose of handling your inquiry.

Legal basis: Art. 6(1)(b) GDPR (contract/pre-contractual measures).

Retention period: The data will be deleted after your inquiry has been satisfactorily answered, provided that no longer statutory retention periods apply.

Recipients: In connection with inquiries via the contact form, our technical developer "..." (please add address details) may have access to your data. ... has been contractually bound by us and is obligated to maintain confidentiality.

General:

This website uses Fathom Analytics, a web analytics service provided by Conva Ventures Inc., 53 Forest Road, Victoria, British Columbia, Canada ("Fathom Analytics"). The service is used to collect and evaluate statistical information about the use of this website (e.g., page views, visitor numbers, duration of stay, visitor origin, and the browsers and device types used).

Categories of personal data:

When a page on this website is loaded, a JavaScript script from Fathom Analytics is executed, which sends a page view request to Fathom's servers. During this process, the IP address and user agent (information about the browser and device type used) are transmitted. Fathom Analytics does not use cookies or similar tracking technologies. Instead, it employs a privacy-friendly hashing method: a SHA-256 hash is generated from the IP address, user agent, website hostname, and a daily, site-specific salt. This allows for the anonymous identification of sessions and page views without permanently storing personal data. No raw personal data (IP address or user agent) is stored in the database. Only anonymized or pseudonymized aggregate data is stored, including:

• page accessed (hostname/pathname), referral source (referrer),
• whether it is a new visit or a new session,
• duration of stay on the page as well as
• statistical metrics on browser types, device types, and countries of origin.

Purposes and legal basis:

The purpose of the processing is to analyze user behavior in order to improve our website and optimize its content and technical infrastructure. Data processing is based on Art. 6(1)(f) GDPR (legitimate interests). Our legitimate interest arises from the aforementioned purposes.

Data processing:

Fathom Analytics processes website visitor data on our behalf. We have entered into a data processing agreement with Fathom Analytics in accordance with Art. 28 GDPR.

Server locations and third-country transfers:

Fathom Analytics is a Canadian company that has implemented "EU Isolation." This feature is enabled by default for all customers. With EU Isolation, traffic from website visitors in the EU is routed exclusively through EU infrastructure. The IP addresses of EU visitors are anonymized within the EU and do not reach third-country servers at any time.

Retention period:

Pseudonymized data (hash values) are retained for approximately 48 hours. After this period, the hash salts are removed from the system, making it practically impossible to trace the data back to individual persons. The hashes used for unique visitor identification are automatically deleted on a daily basis. Aggregated, fully anonymized statistical data (page views, visits, duration of stay, etc.) are stored for the duration of the contract with Fathom Analytics. The data will be deleted upon termination of the contract.

Opt-out options:

Since Fathom Analytics does not set cookies, opting out via browser cookie settings is not technically applicable. Website visitors have the following options to minimize or prevent data collection:

• Do Not Track (DNT): Fathom Analytics respects the browser's Do Not Track header. If DNT is enabled in your browser settings, no tracking will be performed by Fathom Analytics.
• Deactivating JavaScript: Completely deactivating JavaScript in your browser prevents the Fathom script from running, thereby stopping all data collection by the service.

Further information:

Detailed information on data processing by Fathom Analytics is available at: https://usefathom.com/data and https://usefathom.com/legal/compliance.

‍

This website currently does not use any cookies.

‍Neither technically necessary nor optional (functional, statistical, or marketing) cookies are used. A cookie consent banner is therefore not required.

Integration of social media on our website

On our website, we deliberately do not use plugins offered by social media services, but rather simple links to Facebook, Instagram, and LinkedIn. Therefore, no user data is transmitted to the servers of social media providers simply by visiting our website. Only when you click on a social media button is a connection established between your browser and the server of the respective social media service, and you are redirected to the web presence of those services. We do not collect any personal data on our pages via these buttons and therefore do not transmit any data to social media providers.

Social media profiles

We do not maintain any social media profiles ourselves. However, you may find information about us and our services on the profiles of our parent company, Otto Lehmann GmbH. Information on data protection can be found in their privacy policy: https://www.ottolehmann.com/datenschutz.

We only collect personal data if you voluntarily provide it to us when using the snow load calculator. Specifically, the following data is collected:

Planner data

If you request a manufacturer recommendation, the following information is collected:

• Name or company name
• Street and house number
• Postal code and city
• Email address
• Phone number
• Information that you voluntarily provide to us as part of the calculation process.

Project data

The following project-related data is collected for calculation and documentation purposes:

• Project name
• Project address (street, postal code, city)
• Roof tile manufacturer or type
• Comments (optional)

Calculation data

Technical data is processed as part of the snow load calculation, including:

• Location data (address, coordinates, building elevation)
• Roof geometry (roof pitch, rafter length, eave length, half building width)
• Snow load zone and calculated snow load values
• Selected snow guard systems and products

Purposes and legal basis

Your data is processed for the following purposes:

• Performing snow load calculations and generating manufacturer recommendations
• Creation and provision of a PDF document containing your calculation
• Contacting you regarding your request

The legal basis is Art. 6 (1) (b) GDPR (contract/initiation of contract).

Local storage in the browser

For user convenience, your planner data (name, address, email, phone) is stored in your browser's local storage (localStorage). This means you do not have to re-enter this information when using the tool again. This data remains exclusively on your device and is not automatically transmitted to us. You can delete this data at any time by clearing your browser's local storage.

Data transmission to third parties

When using the snow load calculator, data is transmitted to the following third-party providers:

Google Maps API: We use the Google Maps API (Google Places and Google Elevation Service) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for address searches and altitude determination. The address you enter and the resulting geographic coordinates are transmitted to Google. Google's privacy policy applies.

DLUBAL Snow Load Zone API: To determine the snow load zone according to DIN EN 1991-1-3, the geographic coordinates of the location are transmitted to the service provided by Dlubal Software GmbH, Am Zellweg 2, 93464 Tiefenbach, Germany. No personal data of yours is transmitted, only the coordinates.

Austrian snow load data (HORA): For locations in Austria, geographic coordinates are transmitted to the hora.gv.at service of the Federal Ministry of Agriculture, Forestry, Regions and Water Management to determine the characteristic snow load value. No personal data is transmitted during this process.

Data transmission to the operator

When you request a manufacturer recommendation, all the data mentioned above is transmitted to the Heller Metall GmbH server and stored there. The transmission is encrypted via HTTPS.

Storage period

Your personal data will be stored for as long as is necessary to fulfill the respective processing purpose. Data collected in connection with a manufacturer recommendation will be deleted after the statutory retention periods have expired.

Data stored in your browser's localStorage remains there until you manually delete it.

Personal data is collected directly from you, for example, when you visit our website.

Heller only shares your personal data when permitted under European data protection law, for example, because the data transfer is necessary for the performance of a contract or because you have given us your consent to share the data. We work with several service providers, such as technical service providers (e.g., hosting services, website maintenance).

Disclosure due to legal obligations or to protect legitimate interests

Where we are required to do so by law, court order, or an enforceable official directive, we must transmit your personal data to authorized bodies (e.g., supervisory, law enforcement, or tax authorities). The legal basis for this transfer is Art. 6(1)(c) GDPR.

Data processing and other recipients

We may use commissioned service providers ("data processors") for certain services. These providers act only according to our instructions and have been contractually obligated to comply with data protection regulations in accordance with Art. 28 GDPR. This does not apply if these service providers act as independent controllers (e.g., legal and tax advisors). Data processors are also contractually obligated to, for example, delete or return personal data upon completion of the assignment.

The following categories of recipients, who are generally data processors, may receive access to your personal data:

• IT and web service providers or companies commissioned to support our website or platform and our internal IT infrastructure (software, hardware).

The legal basis for the transfer to entities that are not processors is Art. 6 (1) sentence 1 lit. b or lit. f GDPR. Furthermore, we only pass your personal data on to third parties if you have given your express consent to do so in accordance with Art. 6 (1) sentence 1 lit. a GDPR.

‍

As part of our business relationships, your personal data may be passed on or disclosed to third-party companies. These may also be located outside the European Union ("EU") or the European Economic Area ("EEA"), in so-called third countries. Such processing takes place exclusively for the fulfillment of contractual and business obligations and for the maintenance of your business relationship with us.

For some third countries, the European Commission certifies a level of data protection comparable to the EU standard through so-called adequacy decisions (a list of these countries and a copy of the adequacy decisions can be found here: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.html).

In other third countries to which personal data may be transferred, there may be no level of data protection comparable to that of the EU due to a lack of legal provisions. This may mean that your personal data is processed in a legal system that, in certain cases, offers less protection for your personal data than the legal system in which you are normally resident. Where this is the case, we ensure that data protection is adequately guaranteed and that appropriate safeguards are in place. This means, for example, that we enter into the European Commission's standard contractual clauses for the protection of personal data.

Please contact us (see contact details in section 2) if you would like more information on this.

‍

Unless an explicit storage period is stated in section 3, we generally only store your personal data for as long as we need it for the purposes for which it was collected and to fulfill legal requirements and obligations. Your data is generally stored only on our servers, subject to any potential transfer in accordance with the regulations in section 3.

However, storage may continue beyond the specified period in the event of a (threatened) legal dispute with you or other legal proceedings, or if storage is required by legal provisions to which we are subject as the controller. When the storage period prescribed by legal provisions expires, the personal data will be blocked or deleted, unless further storage by us is necessary and there is a legal basis for doing so.

We implement technical and organizational measures to protect your data against loss, destruction, manipulation, and unauthorized access. Our employees and service providers are committed to data protection laws. Wherever we collect and process personal data, the transmission is encrypted (e.g., TLS/HTTPS). Our security measures are continuously improved, and our privacy policy is updated regularly.

If you would like to exercise your rights as a data subject as described below, please contact us informally at info@heller-snowstop.at or use the postal address provided in section 2.

Right of access

Under the conditions of Art. 15 GDPR, you may request information about your personal data processed by us as well as a copy of your data at any time.

Right to rectification

Under the conditions of Art. 16 GDPR, you may request the immediate correction of inaccurate personal data or the completion of incomplete personal data concerning you.

Right to erasure

Furthermore, under the conditions of Art. 17 GDPR, you may request the deletion of your personal data stored by us.

Right to restriction of processing

In accordance with Art. 18 GDPR, you may also request the restriction of the processing of your personal data.

Right to data portability

Under the conditions of Art. 20 GDPR, you have the right to receive your personal data in a structured, commonly used, and machine-readable format or to request the transfer directly to another controller.

Right to withdraw consent

If we process personal data based on your consent, you have the right to withdraw your consent at any time in accordance with Art. 7(3) GDPR. Your withdrawal means that we will no longer continue the data processing based on that consent for the future. The lawfulness of the processing carried out based on your consent prior to the withdrawal remains unaffected.

Right to lodge a complaint

If you believe that our processing of your personal data violates data protection laws, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. In Austria, the competent supervisory authority is the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, Austria, Tel.: +43 1 52 152-0, dsb@dsb.gv.at).

RIGHT TO OBJECT: UNDER THE CONDITIONS OF ART. 21 GDPR, YOU ALSO HAVE THE RIGHT TO OBJECT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA IF THE PROCESSING IS BASED ON A LEGITIMATE INTEREST PURSUANT TO ART. 6(1)(F) GDPR OR ON ART. 6(1)(E) GDPR (THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS). WE WILL CEASE PROCESSING YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR IF THE PROCESSING IS FOR THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

HOW TO OBJECT: THE OBJECTION CAN BE MADE INFORMALLY BY POST OR EMAIL AND SHOULD BE DIRECTED TO THE CONTACT DETAILS PROVIDED IN SECTION 2.

‍

We do not make the conclusion of contracts with us dependent on you providing us with personal data beforehand. As a user, you are generally under no legal or contractual obligation to provide us with your personal data; however, please note that we may only be able to provide certain services to a limited extent, or not at all, if you do not provide the necessary data.

We do not intend to use any personal data collected from you for automated decision-making processes (including profiling).

‍

We reserve the right to update this privacy policy to reflect changes in legal requirements or technical developments. The current version is available on this website. We will provide separate notification of any fundamental changes here.