Privacy policy

This policy describes which personal data we process, why we do so and who it is passed on to. Last updated: 1 October 2026.

1. Controller

Westech Solar e.U.
Wienersdorfer Straße 20-24 M37, 2514 Traiskirchen, Austria
E-mail: office@westech-solar.at
Phone: +43 660 120 91 09

We have not appointed a data protection officer, as the legal requirements for this are not met. For all data protection matters, please use the e-mail address mentioned above.

2. Processing when visiting the website

When you visit our pages, our hosting provider processes technically necessary access data (IP address, time, requested resource, browser type, referrer). This processing is necessary for the secure and stable operation of the website.

• Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in operational security)
• Storage period: maximum of 30 days in the server log files

So that we can identify technical faults and hurdles in the request form, the form reports to our server which steps are reached (such as "postcode reached" or "contact step reached"), as well as events like "submit tapped", "input incomplete" or a technical error message from the browser. No inputs are transmitted during this process; for incomplete inputs, only the names of the affected fields are sent. From the browser identification, we only derive the device type (e.g. "Android, Chrome"); the IP address is not stored for this. This is processed by Cloudflare (see point 6), the legal basis is Art. 6 (1) (f) GDPR (legitimate interest in trouble-free operation), and the counts are deleted after 14 days.

3. Request form ("Request quotes")

When you fill in the request assistant, we process the details you provide. These are in detail:

• Property details: current heating system, building type, heated area, year of construction, renovation status, type of heat distribution, hot water generation, desired heat pump type, existing photovoltaics, implementation timeframe, owner or decision-maker status
• Location: postcode and town/city of the property
• Calculator results: if you used one of our calculators before the request for quotes, its result values (e.g. heating load, flow temperature, heating costs per year, distance and noise level to the neighbour).
• Contact details: title, first name and surname, e-mail address, optional phone number and a note
• Technical metadata: time of consent, visited page, referrer, browser identification and a hashed value of your IP address for spam and duplicate detection. We do not store the IP address itself in plain text.
• Google click identifier (gclid): only if you came via a Google ad — to measure advertising effectiveness

• Purpose: processing your request for quotes and passing it on to suitable installers
• Legal basis: Art. 6 (1) (a) GDPR (your consent) and Art. 6 (1) (b) GDPR (pre-contractual measures)
• Storage period: three years from receipt of the request for quotes, then deletion. Longer retention only if legal retention obligations or the defence of legal claims require it.

Your personal link: The confirmation e-mail contains a link that you can use to view your request for quotes without an account and password, change your details or withdraw the request for quotes. The link is personal and valid for 180 days; anyone who has it can see your request for quotes — do not pass it on. Within this period, you can request a new link at /anfrage/zugang; after that, please contact office@westech-solar.at.

Your first assessment: From your property details and, if applicable, your calculator results, we create a non-binding first assessment (such as suitable device size and possible federal state public subsidy). You will see it after submitting, in the confirmation e-mail and via your personal link, where you can also save it as a PDF. We do not store any additional data for this: the first assessment is recalculated each time from the stored details.

When a company accepts: As soon as the first installer has accepted your request for quotes, we will send you another e-mail with the same personal link. It does not contain the name of a company — the company will contact you directly. This e-mail is sent once, not for every further acceptance.

First message from a company: If an installer who has accepted your request for quotes sends you a first message via the portal, we store this so that the company can find it again in its history. Your reply goes directly to the company.

3b. Photos and documents (optional)

Via your personal link, you can upload photos and PDF documents related to your project, for example of the boiler room, the heating system's type plate or the possible installation site outdoors. This is optional; your request for quotes will also be passed on without photos.

• Which data: the uploaded files, plus file name, size, time and the description of what the photo shows; also the time and wording of your consent. Photos are already resized in your browser, which removes embedded additional data such as the location and camera model. We save PDF documents unchanged. Please do not upload any pictures where people can be recognised.
• Purpose: The installers who have accepted your request for quotes should be able to better assess your project — this often saves a follow-up question or an on-site visit.
• Legal basis: Art. 6 Para. 1 lit. a GDPR (your consent, which you give by ticking a box when uploading for the first time).
• Recipients: exclusively the installers who have accepted your request for quotes (see point 4). Companies that have not yet accepted it only see how many photos and documents there are — not the files themselves. The files are stored with Supabase in the EU region, in non-public storage; they can only be accessed via our portal, which checks whether access is permitted for every single request.
• Storage period: We delete the files as soon as they are no longer needed, namely
  • immediately when you delete a file or replace it with a new photo,
  • if you withdraw the request for quotes or your personal link expires,
  • if eight days after passing it on to installers none of them has accepted and no one else can accept,
  • 30 days after every company that accepted has closed the request for quotes (order placed or not realised),
  • at the latest 180 days after uploading.
  If a company has downloaded a file, they are responsible for this copy themselves (see point 4).
• Withdrawal: at any time by deleting the files via your personal link, or by e-mail to office@westech-solar.at.

3a. Save progress ("Continue later")

From the eighth question onwards, you can have a link sent to you with which you can continue the assistant later at exactly this point. To do this, enter your e-mail address and click on "Save status". Only then — not just by filling it in — will your previous answers be saved on our server.

• Which data: your e-mail address, the answers given about the property up to that point (see point 3) as well as the answers you give afterwards — in the same session or in one continued via the link; plus the time, the question reached, the origin of the visit (campaign parameters, Google click ID) and the technical metadata mentioned under point 3. Name, phone number and free text are not saved — these only belong to the submitted request for quotes.
• Purpose: Continuing a started request for quotes via the sent link; sending exactly this one e-mail. There are no reminders and no newsletter.
• Legal basis: Art. 6 Para. 1 lit. b GDPR (measure at your request prior to entering into a contract). The e-mail is only sent at your explicit request.
• No disclosure: Saved progress is not a request for quotes. It is not shown to any installer and is not included in any analysis as long as you do not submit the request for quotes.
• Storage period: 30 days from saving. After that, we automatically delete progress that was never submitted. If you submit the request for quotes via the continued progress, we immediately remove the e-mail address and answers from it; a trace without contact and property data remains (time, question reached, campaign parameters, Google click ID), which is linked to your request for quotes and deleted with it. Progress that you do not continue will be deleted after the 30 days — even if you have submitted a new request for quotes in the meantime.
• Delete earlier: Reply to the sent e-mail or write to office@westech-solar.at.
• Recipients: Cloudflare (reception and protection against abuse), Supabase (storage) and Resend (e-mail dispatch), all as data processors, see point 6.

3c. Requests for quotes via forms in our adverts on Facebook and Instagram

If you fill out a request form directly in one of our adverts on Facebook or Instagram, Meta Platforms Ireland Ltd. transmits the details you provide there to us. The privacy policy of Meta additionally applies to the processing within the form itself.

• Which data: name, e-mail address, phone number, postcode, town/city if applicable, your answers about the building, the time and the ID of the form and the campaign.
• Purpose and legal basis: Checking your request for quotes and passing it on to at most three suitable installers (see point 4), based on your consent in the form (Art. 6 Para. 1 lit. a GDPR), which you can withdraw at any time (point 5).
• Complete requests for quotes are processed by us like a request for quotes via our website (point 3).
• Incomplete requests for quotes: If you have only answered some of the questions, we save your e-mail address, postcode, town/city and the given answers as saved progress (as under point 3a, without name and phone number), send you a link to the remaining questions and, if you do not finish, a reminder once after two days. Both are mentioned in the consent text in the form. Only the complete request for quotes goes to installers; we delete uncompleted saved progress after 30 days.
• Recipients: as under points 3a and 4.

3d. Calculator result by e-mail

In our calculators (heating load, heating costs comparison, suitability check, sound calculator) you can have your result sent to you by e-mail.

• Which data: your e-mail address and the calculated result values (e.g. heating load in kW or heating costs per year). No names, no address of the property.
• Purpose and legal basis: Sending exactly this one e-mail at your request (Art. 6 Para. 1 lit. b GDPR). There are no reminders, no newsletter and no disclosure to installers.
• Storage: We do not store your e-mail address and the values in any database. To protect against abuse, we count for 24 hours how often an e-mail was sent to the same address — for this we only save a non-reversible check value (hash) of the address, not the address itself. The dispatch service provider Resend logs the dispatch (recipient, time, delivery status) and deletes this log after its retention periods.
• Recipients: Cloudflare (reception and protection against abuse) and Resend (e-mail dispatch), as data processors, see point 6.

4. Passing on to installers

The core of our service is mediation. With your explicit consent in the form, we pass your request for quotes on to at most three installation companies, which we select according to region and project type and have checked beforehand.

• Which data: all details about the property mentioned above under point 3 and your contact details, plus — if you have uploaded any — your photos and documents (point 3b) as well as your calculator results and the first assessment created from them; a company only sees these two once they have accepted your request for quotes. Technical metadata and the Google click ID are not passed on.
• Legal basis: Art. 6 Para. 1 lit. a GDPR (consent)
• Recipients: Installation companies based in Austria. The companies are independent data controllers within the meaning of the GDPR and may only use your data to create a quote for this specific project. They are contractually prohibited from using it for other advertising.
• No sale: We do not pass your data on to address dealers, data brokers or other third parties.

Before passing on: So that suitable companies can accept a request for quotes at all, checked partner companies from your region that offer your project type first see an anonymised version — federal state, town/city, postcode and the details about the building, but neither name nor address nor contact details and also not your free text or your photos. They only see the number of uploaded photos and documents. Only when a company accepts the request for quotes do they receive your contact details and your photos; as soon as three companies have accepted, the request for quotes is blocked for all others. After seven days, a request for quotes is no longer offered to any other company.

Which companies specifically have received your request for quotes we will let you know at any time upon request — write to office@westech-solar.at.

5. Withdrawal of your consent

You can withdraw your consent at any time and without any formal requirements, for example by sending an e-mail to office@westech-solar.at. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. In this case, we will also inform the installers who have already received your request for quotes and delete your data, provided there is no legal obligation to retain it.

You can also withdraw your consent for photos and documents (point 3b) separately: simply delete the files via your personal link. Your request for quotes remains unaffected by this.

6. Processors and services used

We use the following service providers with whom we have concluded data processing agreements in accordance with Art. 28 GDPR:

Stripe exclusively processes data of the partner installers. Information from the request form is not transmitted to Stripe.

Only the public profile information of a partner installer is transmitted to Google (such as services, location, description) and — if the installer chooses to do so — a reference photo uploaded by them. Information from the request form is not transmitted to Google. We use the paid Gemini API; Google does not use the inputs there to train its models.

7. Cookies and audience measurement

We use cookies and similar technologies provided you have given us your consent to do so. When you first visit the website, a consent banner appears; without your consent, no analytics or advertising services are loaded. You can change or withdraw your selection at any time via the "Cookie settings" link in the footer.

Google Analytics 4, provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the service for audience measurement to understand which content is in demand. The legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR and Sec. 165 para. 3 TKG 2021. This may involve a transfer to the USA; Google relies on the EU-US Data Privacy Framework and additionally on standard contractual clauses. We use IP anonymisation and have not activated Google Signals.

Google Ads, provider also Google Ireland Limited. We use this to measure whether a request for quotes via this portal originates from one of our ads, and we analyse which ads are worthwhile. The click identifier of the ad (gclid) is transmitted along with the information that a request was submitted — not the content of your request. The legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR and Sec. 165 para. 3 TKG 2021. You can consent to audience measurement and ad measurement separately.

Meta Pixel, provider Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. We use this to measure whether a request for quotes originates from an ad on Instagram or Facebook, and to create target groups for further ads. The legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR and Sec. 165 para. 3 TKG 2021. Without your consent, the script is not loaded at all — no connection to Meta is established. We and Meta are jointly responsible for the collection of data on this website (Art. 26 GDPR); Meta is solely responsible for further processing. This may involve a transfer to the USA; Meta relies on the EU-US Data Privacy Framework and additionally on standard contractual clauses. You can consent to audience measurement, Google ad measurement and the Meta Pixel separately and change your decision at any time via "Cookie settings" in the footer.

Microsoft Clarity, provider Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how visitors use the website — mouse movements, clicks, scrolling — and groups this into heatmaps and session recordings. We use this to identify where our request form is unclear or gets stuck. Clarity masks all text inputs: what you type into form fields is not transmitted. We have additionally completely excluded the contact step of the request form, including the summary of your details, from the recording, and Clarity is not loaded at all on your personal request page or in the partner area. The legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR and Sec. 165 para. 3 TKG 2021. Without your consent, the script is not loaded. This may involve a transfer to the USA; Microsoft relies on the EU-US Data Privacy Framework and additionally on standard contractual clauses. The recordings are deleted by Microsoft after a maximum of 30 days, and heatmaps and click data generated from them after a maximum of 9 months.

Via Consent Mode, no cookies are set, no identifiers are stored and you are not recognised before you give your consent. If you decline, it stays that way; for technical reasons, Google then only receives a cookieless ping without an identifier, from which no connection to your person can be established.

The website's font is delivered from our own server, not from Google Fonts. Therefore, no connection to third-party providers is established when you visit the site.

To temporarily store your answers in the request assistant, we use your browser's session storage (sessionStorage). This ensures your inputs are not lost if you accidentally reload the page. This data does not leave your device and is deleted when you close the browser tab — unless you explicitly request a link to continue later; in that case, point 3a applies. In this case, the session storage additionally holds the key of the saved intermediate status and the e-mail address provided for it. A click parameter originating from a Google ad (gclid) as well as the origin of your first visit (campaign parameters, landing page, referring page) are stored in the local storage for up to 90 days so that a later request for quotes can be assigned to the campaign. If you use one of our calculators, we also store its result values in the session storage (only once you enter something in the calculator). They are only transmitted if you subsequently submit a request for quotes (point 3), and are otherwise deleted with the tab. We also compare three versions of the request assistant, which differ in the order of the questions and the presentation (one of them shows an estimate before the contact step, which is calculated only in your browser). Which version you see is determined randomly and stored in the session storage for the duration of the session so that the order does not change upon reloading; when a request is submitted, we save the version to be able to compare them.

8. Registration of installers

If you register as a partner installer via the form at /fachbetriebe, we process the company name, contact person, contact details, location, VAT number (optional), service areas, the types of heat pumps offered and your details regarding company size and capacity. We use this to create your access to the partner area and send you an e-mail to confirm your address and set a password.

We then check your company using public registers (Firmen A–Z of the Wirtschaftskammer (Chamber of Commerce), Firmenbuch (commercial register), VAT validation of the EU Commission) and your website. Verified companies receive the 'Geprüfter Partnerbetrieb' (Verified Partner) badge; only then can they accept requests for quotes. We record when and by whom the badge was awarded.

The legal basis is Art. 6 (1) (b) GDPR (initiation and performance of a contract). Storage duration: until the end of the partnership; if we reject a registration, we close the access and delete the data after a maximum of twelve months.

9. The partner area

Registered installers receive personal access to a closed area. In doing so, we process:

• Access data — e-mail address and a password chosen by you. The login is in a separate system from our company database; we do not know your password.
• Company data — company name, contact person, contact details, service area, trades, capacity, and the evidence from the admission check.
• Public profile page — the content you enter or upload for your page at meine-waermepumpe.at/fachbetrieb/… (description, services, references, photos, logo, cover photo). The page is only published when you put it online yourself; you can take it offline or delete it completely at any time. If you wish, you can have cover photos suggested and created via Google Gemini (point 6). If the administration has prepared a page for you, it will also only go online with your approval.
• Usage data — which requests for quotes were released to you, which ones you accepted, your processing statuses, and the contact attempts you recorded.
• Billing data — tier, quota, and the payments processed via Stripe. Payment data is stored with Stripe, not with us.

The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). Changes to the tier, price, or quota, as well as access by our support team to your view, are logged — this serves traceability and is our legitimate interest under Art. 6 (1) (f) GDPR.

Companies on the Free tier receive an e-mail once a week with an overview of requests for quotes from their region. This is part of the service (Art. 6 (1) (b) GDPR) and can be unsubscribed from in the partner area.

The company is the independent data controller for the data of prospective customers that it receives after acceptance. It may use them exclusively for providing a quote for the specific project; this is bindingly regulated in the Partnerbedingungen (partner terms and conditions). Storage duration of access and usage data: until the end of the partnership, then within the framework of statutory retention periods.

10. Your rights

You have the following rights against us:

• Right of access (Art. 15 GDPR) — which of your data we process
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of given consent (Art. 7 (3) GDPR)

To exercise these rights, an informal message to office@westech-solar.at is sufficient.

11. Right to lodge a complaint

If you believe that the processing of your data violates the GDPR, you can complain to the supervisory authority:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40-42, 1030 Wien
dsb.gv.at

12. Changes to this policy

We will update this privacy policy if the processing changes. The version published here applies. Last updated: 1 October 2026.