Privacy explanation

The controller responsible for the processing of personal data within the meaning of Art 4 (7) GDPR is:

Company

AGS-Engineering GmbH

Address

Danner 60, A-4971 Aurolzmünster, Austria

Phone

+43 664 80504-200

Availability

Monday to Friday, 8:00 am to 12:00 noon

Email

office@ags.at

Commercial register number

FN 239939b

Data Protection Coordinator

Tobias Kohlbauer

Contact

datenschutz [at] ags.at

AGS-Engineering GmbH is not required to appoint a data protection officer pursuant to Article 37 GDPR. Our internal data protection coordination is available for all questions relating to data protection.

For AGS-Engineering GmbH, data protection and information security form the basis of stable and successful customer relationships and are a high priority within the company. This policy describes how AGS-Engineering GmbH processes personal data.

When handling personal data, AGS-Engineering GmbH complies with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021), as amended.

The hosting resources for this website are provided by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, D-32339 Espelkamp, Germany.

Whenever a page is accessed, access data (server log files) is processed for technical reasons: browser type and version, operating system used, referrer URL, page accessed, date and time of access, and IP address. This processing is necessary to provide the website, maintain its security and analyse errors.

The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website. Server log files are retained for three months; longer retention only occurs where necessary to investigate a specific security incident.

We use the platform provided by Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden, for the development, management, modification and technical support of this website. Where the website application and its server-side functions (e.g. contact form processing) are delivered through Lovable’s infrastructure, Lovable processes access data such as IP addresses on our behalf for technical reasons.

The legal basis is Article 6(1)(f) GDPR (secure and efficient operation of the website). Lovable uses sub-processors for infrastructure services; processing outside the EEA cannot therefore be ruled out. In such cases, processing is based on an adequacy decision (EU–US Data Privacy Framework) or Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR. The provider’s privacy contact is privacy@lovable.dev.

If you contact us via the contact form, by email or by telephone, we process the information you provide (name, company, email address, telephone number, subject and message) to handle and respond to your enquiry.

The legal basis is Article 6(1)(b) GDPR where your enquiry concerns entering into or performing a contract, and otherwise Article 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Form messages are checked on the server and forwarded directly to the relevant AGS mailbox in Microsoft 365; they are not additionally stored in a website database. To protect against abuse, a hash of the IP address generated using a secret key is stored for a maximum of 24 hours to limit the number of enquiries within a given period.

If your enquiry does not lead to a contractual or business relationship, the data processed in connection with it is generally deleted six months after the enquiry has been conclusively handled. Longer retention only occurs where statutory retention or documentation obligations apply, or where the data is required to establish, exercise or defend legal claims. If the enquiry leads to a business relationship, the applicable statutory retention periods apply.

For email communication, we use Microsoft 365 (Exchange Online, Outlook) provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor. Transfers to Microsoft Corporation in the USA cannot be ruled out; they are based on the EU–US Data Privacy Framework or Standard Contractual Clauses.

We process the data provided to us only for purposes covered by the assignment (contract) or another legal basis under the GDPR, in particular:

• Communication and preparation of quotations
• Pre-contractual measures and performance of contracts
• Project delivery and service
• Accounting
• Supplier and business partner management

We process the following personal data relating to contact persons at customers, prospective customers and suppliers:

• Contact information such as first and last names, business address, telephone numbers and email address
• Organisational information, including position and company name
• Payment data for processing payment transactions
• Other information that needs to be processed in connection with a project or contractual relationship, or that is provided voluntarily

The legal bases are Article 6(1)(b) GDPR (contract), Article 6(1)(c) GDPR (legal obligation, e.g. tax-related retention requirements) and Article 6(1)(f) GDPR (legitimate interest in communicating with contact persons at our business partners).

Personal data is only disclosed where necessary for the relevant purpose, required by law or based on your consent. Depending on the processing activity, the following categories of recipients may be involved:

• Banks and payment service providers
• Tax advisers and auditors
• Insurance companies
• Legal advisers and debt collection agencies
• Transport, freight forwarding and logistics companies
• Suppliers, subcontractors, project partners, customers and companies employing assigned personnel
• Public authorities and courts, where required by law or in individual cases
• Credit reference and creditor protection organisations
• IT, hosting, cloud and software service providers

IT, hosting, cloud and software service providers act as processors pursuant to Article 28 GDPR and process data exclusively in accordance with our instructions. Other recipients (e.g. banks, tax advisers, insurance companies and public authorities) process the data as independent controllers.

For online applications, we use CORE Job Applications provided by CORE smartwork GmbH, Zukunftsstraße 2, 4942 Gurten, Austria, which acts as a processor on our behalf. The application form is loaded on our website as an embedded frame (iframe) from att.ags.at only after you click or have allowed external media. When it loads, your IP address and browser data are transmitted to this service for technical reasons; the form sets a technically necessary security cookie and an entry in your browser’s local storage.

We process the data you provide during the recruitment process (in particular your name, contact details, CV and other documents, as well as information from interviews) to conduct the recruitment process. The legal basis is Article 6(1)(b) GDPR (pre-contractual measures).

Application documents are processed exclusively for the relevant recruitment process. They are not retained in an applicant or talent pool beyond that process. Data relating to unsuccessful applicants is retained for up to seven months after the recruitment process has concluded or the application has been rejected, and is then deleted unless another legal basis for further processing exists. If an application is successful, the necessary data is transferred to personnel administration.

For reports under the Austrian Whistleblower Protection Act (HSchG), we provide a whistleblowing system through Microsoft Forms (Microsoft 365). It is accessible via an external link and is not embedded in our website. We process the data provided in a report to assess and handle the information received. The legal basis is Article 6(1)(c) GDPR in conjunction with the HSchG. The data is retained in accordance with the retention and deletion periods stipulated by the HSchG.

As a technically necessary measure, we store your cookie preferences in your browser’s local storage. The legal basis is Section 165(3) TKG 2021. All other technologies (external media and marketing) are loaded only with your consent pursuant to Article 6(1)(a) GDPR and Section 165(3) TKG 2021; optional categories are disabled by default.

You can change your preferences and withdraw consent with effect for the future at any time via “Cookie settings” in the footer or the cookie button at the bottom left. Fonts are loaded from our own server; Google Fonts, Google Analytics, Google Tag Manager, Google Maps and Google reCAPTCHA are not used.

With your consent to the “Marketing” category, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel is used to measure reach and campaign performance (conversion measurement) and, where applicable, to display advertising to visitors to our website on Facebook and Instagram (remarketing). In particular, IP addresses, browser and device information, the page accessed and cookie identifiers are processed. Content from contact, application, privacy or whistleblowing forms is not transmitted to Meta.

We and Meta are joint controllers for the collection and transmission of data to Meta (Article 26 GDPR); subsequent processing is the sole responsibility of Meta. Transfers to Meta Platforms, Inc. in the USA are possible and are based on the EU–US Data Privacy Framework or Standard Contractual Clauses. The legal basis is your consent (Article 6(1)(a) GDPR). The pixel is not loaded before you give consent. Further information: https://www.facebook.com/privacy/policy

With your consent to the “Marketing” category, we use the LinkedIn Insight Tag provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. It is used to measure reach and campaign performance and, where applicable, for retargeting on LinkedIn. In particular, IP addresses, browser and device information, the page accessed, the time of access and cookie identifiers are processed. Form content is not transmitted to LinkedIn.

Transfers to LinkedIn Corporation in the USA are possible and are based on the EU–US Data Privacy Framework or Standard Contractual Clauses. The legal basis is your consent (Article 6(1)(a) GDPR). The Insight Tag is not loaded before you give consent. Further information: https://www.linkedin.com/legal/privacy-policy

Some pages contain embedded YouTube videos. Before playback, only a preview image loaded from our server is displayed; no connection to YouTube is established. Only when you start a video or allow external media is the player loaded via youtube-nocookie.com. Data such as your IP address, browser data and the page accessed is then transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; transfers to Google LLC in the USA are possible (EU–US Data Privacy Framework). If you are logged in to YouTube, the visit may be associated with your account.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR. Other links to our YouTube channel and our Facebook, Instagram and LinkedIn profiles are ordinary links; data is transmitted to the respective provider only when you click them.

Where the services listed above involve processing outside the EEA, we rely on the European Commission’s adequacy decision on the EU–US Data Privacy Framework for certified companies or on Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR.

Personal data is retained only for as long as necessary for the relevant processing purpose or as required by statutory retention and documentation obligations. Once the purpose no longer applies and the relevant periods have expired, the data is deleted.

Server log files

3 months; in the event of security incidents, until the investigation is complete

Contact enquiries without a business relationship

6 months after the enquiry has been conclusively handled

Unsuccessful applications

Up to 7 months after completion of the process or rejection of the application; no talent pool

Accounting / tax-related documents

Generally 7 years; longer in specific cases required by law or during ongoing proceedings

Whistleblowing data

In accordance with the periods stipulated by the Austrian Whistleblower Protection Act

Providing your personal data is voluntary, apart from access data that must be transmitted for technical reasons. However, without the information required for the relevant purpose, we cannot respond to an enquiry, enter into or perform a contract, or process an application.

We do not carry out automated decision-making, including profiling, pursuant to Article 22 GDPR.

You are entitled to the following rights:

• Access pursuant to Article 15 GDPR,
• Rectification pursuant to Article 16 GDPR,
• Erasure according to Art. 17 GDPR,
• Restriction of processing according to Art 18 GDPR,
• Data portability pursuant to Article 20 GDPR, where applicable,
• Objection to processing based on legitimate interests pursuant to Art. 21 GDPR,
• Withdrawal of consent pursuant to Article 7(3) GDPR at any time with effect for the future — for cookies, via the cookie settings.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. To exercise your rights, please contact our data protection coordination: datenschutz [at] ags.at

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with the competent supervisory authority:

Authority

Austrian Data Protection Authority

Address

Barichgasse 40-42, 1030 Vienna

Phone

+43 1 52 152-0

Email

dsb@dsb.gv.at

Web

www.dsb.gv.at

We implement appropriate technical and organisational measures to protect personal data. This website is delivered exclusively via an encrypted connection (HTTPS).

This privacy policy was last updated in October 2026. Further development of our website or changes in legal requirements may make it necessary to amend this policy. The current version is always available on this page.