1. Who is responsible
The controller responsible for data processing on our website, in the Gasyco Configurator and in the Gasyco Dashboard is:
Gasyco GmbH
Hauptstraße 122, 1140 Vienna, Austria
Phone: +43 1 595 11 12-0
Email: office@gasyco.com
Company register: FN 402622 t, Commercial Court of Vienna · VAT ID: ATU68142155
Contact for data protection: Maximilian Fischer, office@gasyco.com. Please send all questions about data protection and requests concerning your rights (section 10) to this address.
We have not appointed a data protection officer. We are not required to do so under Art. 37 GDPR, because we neither process special categories of personal data on a large scale nor systematically monitor individuals.
2. What this policy covers
This privacy policy applies to all three online services of Gasyco GmbH. Sections 4 to 6 each concern only one of them; all other sections apply to all of them.
| Service | Address | For whom | Section |
|---|---|---|---|
| Website | www.gasyco.com | all visitors | 4 |
| Gasyco Configurator | configurator.gasyco.com | prospective customers and sales partners who configure devices and create quotes | 5 |
| Gasyco Connect (Cloud Dashboard) | dashboard.gasyco.com | customers with connected Gasyco systems, our service partners and our staff | 6 |
We do not use advertising or tracking cookies, social media plugins or third-party analytics services in any of the three services. Fonts and program components are hosted on our own servers; no content is loaded from external servers when you access them.
Providing personal data is voluntary. Without certain information, however, we cannot set up access for you, prepare a quote or answer your enquiry. We do not make automated decisions within the meaning of Art. 22 GDPR and we do not create profiles.
3. Legal bases
We process personal data in accordance with the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). For each processing operation in sections 4 to 6, we state the specific legal basis:
- Contract and pre-contractual measures (Art. 6(1)(b) GDPR): enquiries, quotes, access for customers and partners, performance of the contract.
- Legal obligation (Art. 6(1)(c) GDPR): for example retention obligations under company and tax law, and the handling of data protection requests.
- Legitimate interest (Art. 6(1)(f) GDPR): secure and stable operation, defence against attacks, traceability of access to customer systems, improvement of our website. Your right to object to this is set out in section 10.
- Consent (Art. 6(1)(a) GDPR): only where we expressly ask you for it. You can withdraw consent at any time with effect for the future.
We store or read information on your device (cookies, the browser’s local storage) only to the extent that this is strictly necessary for the service you have requested (section 165(3) TKG 2021). No consent is required for this, which is why we do not show a cookie banner.
4. Website (www.gasyco.com)
4.1 Hosting and server log files
The website is hosted by world4you Internet Services GmbH, Wolfgang-Pauli-Straße 2, 4020 Linz, Austria. world4you processes the data as our processor (Art. 28 GDPR).
When you access the website, your browser transmits technically necessary data, which the web server stores in log files: IP address, date and time, page or file accessed, previously visited page (referrer), amount of data transferred, browser and operating system. We need this data to deliver the page, to find errors and to defend against attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The log files are deleted after 14 days unless they are needed to investigate a security incident.
4.2 No cookies
The website does not set any cookies for visitors. The language (German/English) is determined by the address (/en/), not by a cookie.
4.3 Audience measurement without cookies
To improve our website, we use our own tool to measure how it is used: which pages and page sections are actively viewed and for how long, how far visitors scroll, which links and controls are clicked, whether a form was submitted (without its content) and what type of source you come from (for example a search engine, LinkedIn or direct access). In addition, we record the device class (derived from the window width), the language of the page and the language of your browser.
The measurement runs exclusively on our own web server; no third-party services are involved. We do not use cookies for this and do not store anything on your device. Each page view counts on its own; you are not recognised across several pages or visits.
We do not store your IP address or your browser identifier (user agent) for the measurement. The IP address is used only at the moment of transmission to determine the country of origin and to exclude access from our office; only the country code is stored. For this we use the “IP to Country Lite” database by DB-IP, which is held on our server; no data is transmitted to DB-IP.
The measurements are aggregated into daily figures after seven days at the latest, and the individual data are deleted. Daily figures do not allow any conclusions to be drawn about individuals; we keep them for 25 months and then aggregate them into monthly figures. The legal basis is our legitimate interest in improving our website (Art. 6(1)(f) GDPR).
Opting out of being counted. You can object to the measurement at any time. The switch below stops this browser from being counted; at your request, we place a note in your browser’s local storage for this purpose. You can remove it with “Count this browser again” or by deleting the website data. You can also write to us informally at office@gasyco.com. If your browser sends the “Global Privacy Control” signal, we do not count it in any case.
This browser is currently being counted.
This browser is not being counted.
Your browser sends the “Global Privacy Control” signal and is therefore not counted.
4.4 Contact form, email and telephone
If you send us an enquiry via the contact form, we process your details (title, first and last name, company, phone number, email address and message) in order to handle your enquiry and reply to you. Required fields are marked. The form does not store your details on the website but sends them as an email to office@gasyco.com; the email is sent via Microsoft 365 (section 7). An invisible additional field keeps out automated spam entries without any external service being involved.
If you write to us or call us directly, we process your details for the same purpose.
The legal basis is the handling of your enquiry or the initiation of a contract (Art. 6(1)(b) GDPR) and, for general enquiries, our legitimate interest in answering them (Art. 6(1)(f) GDPR). We delete enquiries that do not lead to a transaction no later than three years after the last message; for this purpose we clean up our mailbox once a year. If the enquiry turns into a business transaction, the retention periods in section 8 apply.
4.5 Map, LinkedIn and other links
On the contact page, we show directions as an image. No data is transmitted to Google or other map providers when the page loads. Only when you click on the map does Google Maps open in a new window; from then on, the Google privacy policy applies (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
We refer to our company profile on LinkedIn with simple links, not with embedded plugins. Data goes to LinkedIn only when you follow the link; then the LinkedIn privacy policy applies (LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland).
4.6 Fonts
All fonts are hosted on our own server. No connection is made to font providers such as Google Fonts.
5. Gasyco Configurator (configurator.gasyco.com)
Like the website, the configurator runs at world4you in Austria. Section 4.1 applies to access and the server log files.
5.1 Access and login
Guest access. Without an account, you provide your email address and your country. We store both together with the time and your IP address in pseudonymised form (as a hash value), and we receive an email notification at most once per address and day. We use the address only to contact you about your enquiry, not for advertising. Legal basis: Art. 6(1)(b) GDPR.
Partner account. We create accounts for the employees of our sales partners. You log in with your user name or email address and your password. The data stored are user name, name, email address, partner company, role, account status, the time of the last password change and whether you have seen the introductory tour. We store passwords only as a hash value (bcrypt). Legal basis: cooperation with your company (Art. 6(1)(b) GDPR) and our legitimate interest in providing partners with access (point (f)).
Login log and protection against password guessing. We log every login attempt with user name, time, result and pseudonymised IP address. To defend against attacks on passwords, we also count requests per pseudonymised IP address and email address (Art. 6(1)(f) and Art. 32 GDPR).
Forgotten password. We send a link to the address stored in the account. It is valid for 60 minutes and can be used only once; we store it only as a hash value. The response on the page is always the same, so that nobody can find out whether an address is registered with us.
5.2 Quotes and enquiries
Creating a quote. For a quote, we process your email address, your country, your reference (free text field), the selected configuration and the language; for partners, also company and name as the contact person. You download the quote as a PDF, and a copy is sent by email to office@gasyco.com. On the server, we store the PDF, a log entry (time, email, country, reference, language, device, file name, quote number) and the quote number with the same details, so that no number is issued twice. Please enter in the reference field only what is necessary for the quote.
The legal basis is the preparation of quotes and the processing of orders (Art. 6(1)(b) GDPR). Quotes are business letters, which we retain for seven years under section 212 of the Austrian Commercial Code (UGB) and section 132 of the Austrian Federal Fiscal Code, BAO (Art. 6(1)(c) GDPR).
Help and partner enquiries. If you request help or partner access in the configurator, we send your details (email, phone, name, country, reference, message, callback request) by email to our office; they are not stored in the configurator’s database (Art. 6(1)(b) GDPR).
5.3 Sharing a configuration
With “Share”, we save the current configuration and generate a short link. Only the technical selection (device, components, accessories, language and, for partners, the margin) and the time are stored, no contact details. Anyone who knows the link can open the configuration without logging in; only pass it on to people who are meant to see it (Art. 6(1)(f) GDPR).
5.4 Cookie and browser storage
The configurator sets exactly one cookie and stores some values in your browser’s local storage. All of this is necessary for the configurator itself (section 165(3) TKG 2021).
| Name | Type | Purpose | Stored until |
|---|---|---|---|
| gasyco_configurator | Cookie | keeps you logged in, protects forms against requests from other sources | closing the browser |
| gasyco.lang | local storage | selected language | you delete it in the browser |
| gasyco.config | local storage | your configuration is preserved after reloading | you delete it in the browser |
| gasyco.email, gasyco.country, gasyco.phone | local storage | pre-fills forms with the contact details you last entered | you log out |
The cookie is transmitted only in encrypted form and cannot be read by scripts. The values in local storage remain on your device and are not sent to us automatically.
6. Gasyco Connect – Cloud Dashboard (dashboard.gasyco.com)
The dashboard shows customers the measurement data of their Gasyco systems, sends the reports they have ordered and gives service technicians remote access to systems. It runs on servers of A1 Telekom Austria AG in Austria (section 7). Only people with a user account can use it; accounts are created by Gasyco GmbH.
Our role. For the user accounts and the logs, we are ourselves the controller: we need them to perform the contract with your company and to operate the service securely. If your company has concluded a data processing agreement with us (Art. 28 GDPR), we process the data named in it, such as recipient addresses for reports, on behalf of your company; in that case your company is the controller for that part.
Measurement data. Pressures, flow rates, temperatures, gas concentrations, calibrations and alarms of the systems are non-personal device data. Calibration certificates and quality reports do not contain the names of inspectors.
6.1 Which personal data the dashboard processes
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| User account: user name, email address, language, role, assignment to customer or sales partner and region, password (as a hash only), time of the last password change, account status, whether you have seen the introductory tour; optionally the secret of the two-factor authentication (encrypted) | provide access, assign visible devices | Art. 6(1)(b) (contract with your company) |
| Welcome email with user name and initial password, which you must change at your first login | set up access | Art. 6(1)(b) |
| Password link (as a hash value only, valid for 60 minutes and once only), counter against password guessing (IP address pseudonymised only) | reset passwords, prevent misuse | Art. 6(1)(b) and (f) |
| Login log: user name, time, result, IP address only as a pseudonymised hash | detect and investigate misuse | Art. 6(1)(f), Art. 32 |
| Remote access log: user, system, time, type of access; approved service laptops | prove who accessed which system and when (security, customer audits) | Art. 6(1)(f) |
| Report subscriptions: recipient email address, report type and interval, time of dispatch | send the reports ordered | Art. 6(1)(b) |
| Email address of the account for subscription reminders (30, 14, 7 and 1 days before expiry and on the day of expiry) | notify you of the end of the subscription term | Art. 6(1)(b) |
| Alarm SMS and alarm emails from the systems: phone number or email address of the recipient, alarm text, time, result; reply SMS to the system with sender number and text | deliver and acknowledge alarms, prove delivery | Art. 6(1)(f) (operational safety of the systems) |
| Change history: user name for changes to limit values, device assignment and subscriptions; the creator of a limit value set is named in the quality report | traceability of quality-relevant changes | Art. 6(1)(f) |
| Server and program logs: user name, email addresses and phone numbers (shortened), IP addresses for connection errors and login attempts on the server, time, error messages | operation and troubleshooting | Art. 6(1)(f) |
Report recipients who do not have an account themselves. Customers can also have reports sent to colleagues. If you enter someone else’s address, please inform the person concerned about this privacy policy. Every report can be unsubscribed from at any time.
Alarm SMS are sent by the system via the SIM card of its mobile modem on the network of the mobile provider you have chosen. The provider processes the phone number, time and content of the SMS under its own responsibility as a telecommunications service.
The dashboard’s public status page only shows whether the services are running and contains no personal data.
6.2 Cookies and browser storage
The dashboard uses only cookies and browser storage that are strictly necessary for the requested service (section 165(3) TKG 2021). There are no tracking, analytics or advertising cookies and no third-party cookies.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| session | Cookie (Secure, HttpOnly, SameSite=Lax) | keeps you logged in, protects forms against forged requests (CSRF) | becomes invalid on logout or after 30 minutes of inactivity; the browser deletes the cookie after 24 hours at the latest |
| hmi_modem | Cookie (Secure, HttpOnly, SameSite=Lax) | Remote access: remembers which system your browser is connected to | 12 hours |
| ManagerId and similar | Cookie of the system’s operating panel, passed through only during remote access | operating session of the panel | browser session |
| theme, flowUnit, hideCalibration, alarmMarkers | local storage | display settings chosen by you (design, unit, markers in charts) | until you change or delete them |
| Device filter | session storage | retains the device list filter when the page is reloaded | until the tab is closed |
When remote access is opened, the dashboard also instructs your browser to discard cached files from this domain, so that a system is never displayed with files from another system.
7. Recipients, processors and third countries
Within our company, only the employees who handle enquiries and quotes or look after the systems see your data. In the dashboard, customer accounts see only their own devices; administrators of Gasyco GmbH see the account data of all users. We work with the following processors, who are contractually bound by our instructions (Art. 28 GDPR):
| Processor | Task | Place of processing |
|---|---|---|
| world4you Internet Services GmbH, Wolfgang-Pauli-Straße 2, 4020 Linz | Hosting of the website and configurator including database | Austria |
| A1 Telekom Austria AG, Lassallestraße 9, 1020 Vienna | Hosting of the dashboard (server and backup copy) | Austria |
| Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Email mailboxes and email delivery (Microsoft 365): contact form, quotes, reports, alarm and account emails | EU (EU Data Boundary), for exceptions see below |
Beyond this, we pass on data only where we are obliged or entitled to do so: to our tax advisers in connection with retention obligations, to courts and authorities and, in the event of a security incident, to CERT.at or the competent authority. We do not sell data and do not pass it on for advertising.
Third countries. The website, configurator and dashboard are operated in Austria. Under the EU Data Boundary, Microsoft has committed to store and process the contents of our mailboxes in the EU or the EEA (Microsoft Learn: EU Data Boundary). In limited cases, for example for support or security, Microsoft may nevertheless transfer data to the USA. The European Commission’s adequacy decision on the EU-US Data Privacy Framework, under which Microsoft is certified, applies to this, supplemented by the EU standard contractual clauses (Art. 45 and 46 GDPR). No other transfer to countries outside the EU and the EEA takes place.
8. How long we store data
We store data only for as long as we need it for the purpose in question or are legally required to retain it. We retain business records such as quotes, orders and invoices for seven years (section 212 of the Austrian Commercial Code (UGB) and section 132 of the Austrian Federal Fiscal Code, BAO). If proceedings last longer, we restrict the data concerned until they end.
| Data | Service | Deleted after |
|---|---|---|
| Server log files | Website, Configurator | 14 days |
| Individual data from audience measurement | Website | 7 days (afterwards only daily and monthly figures with no personal reference) |
| Contact enquiries not leading to a transaction | Website, Configurator | no later than 3 years after the last message (annual clean-up) |
| Guest access (email, country) | Configurator | 12 months |
| Shared configurations | Configurator | 12 months |
| Quotes, quote log, details of the quote number | Configurator | 7 years from the end of the year in which the quote was created; the number itself remains blocked without any personal reference |
| Partner account | Configurator | end of access |
| Session cookie | Configurator | closing the browser |
| Contact details in browser storage | Configurator | logging out |
| Password links | Configurator, Dashboard | 24 hours or 30 days after expiry (dashboard) |
| Counters against password guessing | Configurator, Dashboard | 24 hours |
| Login log | Configurator / Dashboard | 180 days / 365 days |
| User account | Dashboard | deletion by an administrator; deactivated accounts automatically 12 months after deactivation (end of contract = deactivation) |
| Report subscriptions | Dashboard | unsubscribing |
| Log of subscription reminders | Dashboard | deletion of the device |
| Remote access log | Dashboard | 3 years |
| Alarm SMS, alarm emails, reply SMS | Dashboard | 365 days |
| User name in the change history (limit values, assignment, subscriptions) | Dashboard | with the device; pseudonymised after the account is deleted |
| Server and program logs | Dashboard | 4 weeks |
| Backup copies | Dashboard | 14 days |
| Data protection and security enquiries | all | 3 years after completion |
9. Data security
We protect your data with technical and organisational measures in accordance with Art. 32 GDPR, including:
- Encrypted connections only (HTTPS/TLS; remote access to systems via encrypted WireGuard tunnels)
- Passwords stored only as hash values, password links valid only once and for a short time, credentials and keys stored in encrypted form
- Limiting of login attempts, login logs with pseudonymised IP addresses, two-factor authentication for dashboard administrators
- Separation of roles and tenants: each account sees only what it needs for its task
- Automatic security updates, regular vulnerability checks, daily backup of the dashboard to a second machine in Austria
- A defined procedure for security incidents; we report personal data breaches to the Data Protection Authority within 72 hours and inform data subjects where there is a high risk (Art. 33 and 34 GDPR)
You can report security vulnerabilities to service@gasyco.com (security.txt).
10. Your rights
You can assert the following rights against us at any time. To do so, write to office@gasyco.com. We reply within one month and free of charge; for complex requests, we may extend the deadline by up to two further months, giving reasons. So that we do not disclose data to unauthorised persons, we first check that the request comes from you.
- Access to the data we store about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure, unless a retention obligation or an overriding security purpose prevents it (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability in a commonly used, machine-readable format (Art. 20 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
Right to object (Art. 21 GDPR). Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, or we need the data for the establishment, exercise or defence of legal claims. The easiest way to object to the audience measurement on the website is directly via the link in section 4.3.
Accounts in the dashboard that your employer has created for you. If your access belongs to a customer company, we also inform its contact person when we rectify or delete data, because the access is part of the contract with your employer.
Complaint to the Data Protection Authority
If you believe that we are not processing your data lawfully, you can lodge a complaint with a supervisory authority (Art. 77 GDPR, section 24 of the Austrian Data Protection Act (DSG)). In Austria, this is the:
| Authority | Austrian Data Protection Authority |
| Address | Barichgasse 40–42, 1030 Vienna |
| Phone | +43 1 52 152-0 |
| dsb@dsb.gv.at | |
| Website | www.dsb.gv.at |
However, we would be glad if you would contact us first.
11. Changes to this privacy policy
We will update this policy if our services, our service providers or the legal situation change. The version published on www.gasyco.com at the time applies; the date is shown at the top of the page. We will also notify account holders by email of material changes affecting existing accounts in the configurator or the dashboard.
This policy is also available in English. In the event of any discrepancy, the German version shall prevail.