Privacy Policy
Privacy and cookie policy
Privacy Policy
In the following, we provide information about the collection of personal data when using our website. Personal data is all data that can be related to you personally, e.g. name, address, email addresses, user behavior. We have taken extensive technical and operational security measures to protect your data from accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our security procedures are regularly reviewed and adapted to technological progress.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is the
Hydro Building Systems Germany GmbH, Einsteinstraße 61 89077 Ulm (see our imprint)
2. Contact details of the data protection officer
Our data protection officer can be reached at:
Our data protection officer can be reached at: Mr. Maximilian Mertin c/o intersoft consulting services AG Beim Strohhause 17 20097 Hamburg mmertin@intersoft-consulting.de
3. Purpose and legal basis for processing
Personal data is only collected if you provide it to us voluntarily, e.g. when filling out the contact form. We use this data exclusively for the purpose for which you entered your data. For other purposes, it will only be used after express notification or after obtaining your consent, Art. 6 para. 1 lit. a) GDPR. In certain cases, personal data will be processed on the basis of a legitimate interest pursuant to Art. 6 (1) lit. f) GDPR (see section 4).
4. Processing based on a legitimate interest pursuant to Art. 6 (1) lit. f) GDPR
Personal data will be processed on the basis of Art. 6 (1) lit. f) GDPR in the following cases:
Collection of personal data when visiting our website
When you use the website for informational purposes only, we collect only the personal data that your browser transmits to our server. If you wish to view our website, we collect the following data, which is technically necessary for us to display our website to you and to ensure stability and security:
Browser type and browser version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request
IP address
The legitimate interest consists in the proper presentation of our website and in ensuring the stability and security of our website.
Use of cookies
The legal basis for the possible processing of personal data using cookies and their storage duration may vary. If you have given us your consent, the legal basis is Art. 6 (1) lit. a) GDPR. If data processing is based on our overriding legitimate interests, the legal basis is Art. 6 (1) lit. f) GDPR. The stated purpose then corresponds to our legitimate interest.
We use cookies to ensure the proper functioning of the website, to provide basic functionality, to measure reach and, with your consent, to customize our services to your preferred areas of interest. For this purpose, we use both transient cookies and persistent cookies
You can delete cookies already stored on your device at any time. If you wish to prevent cookies from being stored, you can do so via the settings in your internet browser. Please note that individual functions of our website may not work if you have disabled the use of cookies.
Cookiebot
Cookiebot is a consent management platform that enables websites to protect user privacy and comply with the GDPR when it comes to cookies and tracking. “Cookiebot” is a service provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark.
Through the “Cookiebot” function, we inform our website visitors about the use of cookies and other technologies on our website and enable them to make a decision about their use.
If the visitor consents to the use of cookies, the following data is automatically logged:
IP address
Date and time of consent,
user agent of the end user's browser,
URL of the provider,
The user's permitted cookies (cookie status), which are required as proof of consent,
An anonymous, random, and encrypted key.
The encrypted key and the cookie status are stored on the user's device using a cookie in order to establish the corresponding cookie status when the page is accessed in the future. This cookie is automatically deleted after 12 months.
The legal basis for this is Art. 6 (1) lit. f) GDPR. Our legitimate interest lies in the user-friendliness of the website and in complying with the legal requirements of the GDPR and the TDDDG.
The user can prevent or terminate the installation of the cookie and its storage, and thus their consent to cookies, at any time by adjusting their browser settings. You can open the Cookiebot settings via the following link: “Change consent”
Further information on Cookiebot can be found at:
https://www.cookiebot.com/en/privacy-policy/
jsDelivr
In order to distribute traffic on the website across multiple servers and optimize response times, we use jsDelivr, a CDN for open source projects provided by Prospect One sp.z o.o., Królewska 65A/1, 30-081 Kraków, Poland.
The following data is collected
IP address
Browser type
Browser version
Pages visited
Date and time of visit
Time spent on a page
Usage data
Device ID
Diagnostic data
The data is deleted as soon as it is no longer required for processing purposes. The information collected is processed in the European Union.
More information on the handling of user data can be found below:
https://www.jsdelivr.com/terms/privacy-policy
The legal basis for this is Art. 6 (1) lit. f) GDPR and § 25 (2) No. 2 TDDDG. Our legitimate interest consists in the functionality and user-friendliness of the website.
Azure CDN
In order to distribute traffic on the website across multiple servers and optimize response times, we use Azure CDN, a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. The responsible service provider in the EU is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18, Ireland.
IP address
Browser type
Browser version
Pages visited
Date and time of visit
Time spent on a page
Usage data
The information collected by cookies about your use of this website is usually processed within the European Union.
This service may transfer visitor data to the US, which does not offer an adequate level of data protection. There is a risk that your data may be processed by US authorities for control and monitoring purposes, without you having any legal recourse.
The data will be deleted as soon as it is no longer required for processing purposes.
More information on the handling of user data can be found below:
https://azure.microsoft.com/en-us/support/legal/
The legal basis for this is Art. 6 (1) lit. f) GDPR and § 25 (2) No. 2 TDDDG. Our legitimate interest consists in the functionality and user-friendliness of the website.
Contenful
In order to create and manage digital content, we use Contentful, a content management platform provided by Contentful GmbH, Max-Urich-Straße 3, 13355 Berlin, Germany.
The following data may be collected
Usage data (e.g., IP address, browser information)
Content that you create or upload via our system
The recipient of the data is Contentful GmbH as the processor. The data will be deleted as soon as it is no longer required for processing purposes.
Further information about Contentful can be found at: https://www.contentful.com/legal/privacy-at-contentful/privacy-notice/
The processing of your personal data by Contentful is based on our legitimate interest in the efficient creation and management of our digital content and in the provision of our services (Art. 6 para. 1 lit. f GDPR).
5. Website analysis
We use various services described below for the purpose of analyzing and optimizing our websites. This enables us, for example, to analyze how many users visit our site, which information is most popular, or how users find our site. Among other things, we collect data about the website from which a person has come to a website (known as the referrer), which subpages of the website have been accessed, or how often and for how long a subpage has been viewed. This helps us to design our offerings in a user-friendly manner and to improve them. The data collected in this process is not used to identify individual users personally.
Google Tag Manager
For transparency reasons, we would like to point out that we use the Google Tag Manager provided by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. For users in the EU, the EEA and Switzerland the service is provided by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
The Google Tag Manager makes it easier for us to integrate, centrally manage and schedule our tags. Tags are script codes or code sections that can trigger different functionalities, such as measuring the success of our advertisements (Google Ads). The Google Tag Manager itself does not collect any personal data, but may transmit the IP address to Google. You can find more information in our privacy policy.
If Google stores personal data, this data is stored on the Google servers. The storage period for the data processed by the individual tracking tools can be found in our individual data protection notices for the individual tools.
For more information on Google Tag Manager, see: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/.
The legal basis and withdrawal option for this data processing is your consent, Art. 6 para. 1 lit. a) GDPR. You can withdraw any given consent with effect for the future by opening the privacy settings (“Website Cookies”) and making the appropriate changes there.
Siteimprove
If you have given your consent, Hydro uses Siteimprove, a web analytics service provided by Siteimprove A/S, Sankt Annæ Plads 28, 1250 Copenhagen, Denmark.
Siteimprove uses cookies that enable an analysis of your use of our websites.
Content viewed
Anonymized IP address
Use of online services
The information collected by cookies about your use of this website is usually processed within the European Union.
This service may transfer visitor data to the US. There is a risk that your data may be processed by US authorities for control and monitoring purposes, without you having any legal recourse.
The data will be deleted as soon as it is no longer required for processing purposes.
Legal basis and withdrawal option for this data processing is your consent, Art. 6 (1) lit. a) GDPR. You can withdraw your consent at any time with effect for the future by opening the data privacy settings (“Website Cookies”) and making the appropriate changes there.
unpckg
If you have given your consent, Hydro uses unpckg, a network for providing content on npm. It can be used to load any file from any package using a URL and is a service provided by Npm, Inc., 1999 Harrison Street, 1150, CA 94612 Oakland, USA.
The following data is also collected via cookies when using the service
IP address
Referrer URL
Unique identifiers
Information about the operating system
Hardware/software type
Date and time of the request
URL
Language information
Browser information
Metadata
Software data
This service may transfer visitor data to the US, which does not offer an adequate level of data protection. There is a risk that your data may be processed by US authorities for control and monitoring purposes, without you having any legal recourse.
The data will be deleted as soon as it is no longer required for processing purposes.
More information on the handling of user data can be found below: https://docs.npmjs.com/policies/privacy
Legal basis and withdrawal option for this data processing is your consent, Art. 6 (1) lit. a) GDPR. You can withdraw your consent at any time with effect for the future by opening the privacy settings (“Website Cookies”) and making the appropriate changes there.
6. Use of social plugins and embedded functions
Google YouTube
If you have given your consent, Hydro uses services from YouTube, a video content provider owned by Google LLC. The responsible service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
The ability to view videos serves to improve our online offering.
When you visit a website that contains YouTube, your browser establishes a direct connection to Google's servers and processes the following data:
Device information
Videos viewed
IP address
Referrer URL
The information collected about your use of this website is usually processed within the European Union.
This service may transfer visitor data to the US, which does not offer an adequate level of data protection. There is a risk that your data may be processed by US authorities for control and monitoring purposes, without you having any legal recourse.
The data will be deleted as soon as it is no longer required for processing purposes.
More information on the handling of user data can be found below: https://business.safety.google/privacy/?hl=en https://policies.google.com/technologies/cookies?hl=en https://safety.google/privacy/privacy-controls/
Legal basis and withdrawal option The legal basis for this data processing is your consent, Art. 6 (1) lit. a) GDPR. You can withdraw your consent at any time with effect for the future by opening the data protection settings (“Website Cookies”) and making the appropriate changes there.
reCaptcha
If you have given your consent, Hydro uses reCaptcha v2. reCaptcha is a service provided by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. The responsible service provider in the EU is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. reCaptcha is used to prevent abusive automated entries in web forms and thus to protect the technical systems of the host. When you visit one of our web pages that includes reCaptcha, a connection to Google's servers is established. Cookies are also used to collect the following data when you use the service
IP address
Date and time of visit
Operating system
Browser language and plugins
Click path
User input
Time spent on a page
Device information
Mouse movements
Geographical location
You can prevent the storage of cookies and fingerprinting by selecting the appropriate technical settings in your browser software; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. The information collected about your use of this website is generally processed within the European Union. If data is processed outside the EEA, where there is no data protection level equivalent to the European standard, we have concluded EU standard contractual clauses with the service provider to ensure a secure level of data protection. The data will be deleted as soon as it is no longer required for processing purposes; cookies will be stored for a maximum of six months.
Google's privacy policy and terms of use can be found here: https://business.safety.google/privacy/?hl=en https://policies.google.com/technologies/cookies?hl=en
Legal basis and withdrawal option for this data processing is your consent, Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future by opening the data protection settings (“Website Cookies”) and making the appropriate changes there..
7. Applications
Your information will be used to process your application and decide whether to establish an employment relationship. The legal basis for this is Section 26 (1) in conjunction with Section 8 (2) of the German Federal Data Protection Act (FDPA). Furthermore, your personal data may be processed to the extent necessary to defend against legal claims asserted against us arising from the application process. The legal basis for this is Art. 6 para. 1 lit. f) GDPR. The legitimate interest in processing also lies in the purposes stated.
If an employment relationship is established between you and us, we may, in accordance with Section 26 (1) FDPA, further process the personal data already received from you for the purposes of the employment relationship if this is necessary for the performance or termination of the employment relationship or for the exercise or fulfillment of the rights and obligations of the employee representation arising from a law or a collective agreement, a works agreement or service agreement (collective agreement).
Your application data will not be processed beyond the scope described above.
Your personal data will be deleted after completion of the application process, at the latest after 6 months, unless there are other legitimate interests on our part that prevent deletion or you have given us your consent for longer storage. Other legitimate interests in this sense include, for example, a burden of proof in proceedings under the General Equal Treatment Act.
8. Creating a user account (registration)
In order to use all the functions of our website, you are free to create your own user account. During the registration process, we collect and store certain personal data via the form provided. Once you have successfully registered, you can access our WIC product range, download documents and technical data sheets, and use our various tool functions.
The processing takes place on the basis of your consent, Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time and thereby delete your user account. We will then delete all stored data, unless there are legal retention periods that prevent this.
09. Data transfer and recipients or categories of recipients
Your data will not be transferred to third parties unless we are legally obliged to do so, or the transfer of data is necessary for the performance of the contractual relationship, or you have expressly consented to the transfer of your data in advance.
10. Period of storage
Personal data that we collect will be deleted when the purpose of processing ceases to exist or within the statutory retention periods.
11. Information about the data subject's obligations to provide information
When using our website, you are not subject to any legal or contractual obligation to provide information.
12. Existence of automated decision-making, including profiling
Automated decision-making, including profiling in accordance with Art. 22 GDPR, does not take place.
13. Contact
When you contact us by email or via a contact form, the data you provide (your email address and your name) will be stored by us in order to answer your questions. If we request information via our contact form that is not required for establishing contact, we always mark this as optional. This information helps us to specify your request and improve the processing of your enquiry. The provision of this information is expressly voluntary and with your consent, Art. 6 para. 1 lit. a) GDPR. Insofar as this involves information about communication channels (e.g., email address, telephone number), you also consent to us contacting you via this communication channel to respond to your request. You can, of course, withdraw this consent at any time in the future. We will delete the data collected in this context after it is no longer necessary for storage or restrict processing if there are legal retention obligations. If you send us inquiries via the contact form, your details from the inquiry form, including the contact details you provided there, will be stored in Salesforce for the purpose of processing the inquiry and in case of follow-up questions.
Salesforce
Salesforce is software provided by salesforce.com Inc., Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA (“Salesforce”) and is an application for automated lead management, marketing automation, and sales support in the B2B business customer environment. Salesforce stores personal data in the US. Salesforce has issued binding corporate rules (https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/Salesforce-Processor-BCR.pdf) for this purpose, which ensure the secure transfer of data.
14. Data security
We have taken extensive technical and operational security measures to protect your data from accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our security procedures are regularly reviewed and adapted to technological progress.
15. Data transfer and intended data transfer to a third country or an international organization
Your data will not be transferred to third parties unless we are legally obliged to do so, or the transfer of data is necessary for the execution of the contractual relationship, or you have expressly consented to the transfer of your data in advance.
Additional information on data processing when using the WICONA Augmented Reality App
The WICONA Augmented Reality app
requires the following permissions:
Internet access: to ensure the functionality of the application, in particular the downloading of new models for display via FRAME ID links/codes.
Camera access: Augmented Reality core functionality and scanning of FRAME ID QR codes. Permission is requested when the application is launched for the first time.
Photo access: Write access to the photo library is used to store photos made with the application; permission is requested when the first photo is taken. permission is requested when the first photo is taken.
The application does not request access to existing photos on the device. Use of the app does not require access to unique (device) IDs. Any usage data is processed for the purpose of providing the service. This data processing is based on Art. 6 para. 1 lit. f) GDPR. The legitimate interest lies in the fact that these permissions are mandatory for the functionality of this app.
Your rights
You have the following rights with regard to your personal data:
General rights
You have the right to information, correction, deletion, restriction of processing, object to processing, and data portability. If processing is based on your consent, you have the right to withdraw this consent with effect for the future.
Rights in data processing based on legitimate interest
Pursuant to Art. 21 (1) GDPR, you have the right to object, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 para. 1 e GDPR (data processing in the public interest) or on Art. 6 para. 1 f GDPR (data processing to safeguard a legitimate interest). This also applies to profiling based on this provision. In the event of your objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
Rights in direct marketing
If we process your personal data for direct marketing purposes, you have the right, pursuant to Art. 21 (2) GDPR, to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.
Right to lodge a complaint with a supervisory authority
You also have the right to complain to a competent data protection supervisory authority about our processing of your personal data.
We review our privacy policy regularly. It was last updated in June 2025.