Privacy
Privacy
How we process your data and the rights you have.
Controller and contact
Bright Systems FlexCo, Giselakai 51, 5020 Salzburg, Austria. office@brightsystems.at
This notice describes the processing of personal data when you visit this website or contact us. Last updated: 23 October 2026.
Hosting and security
We deliver the website using Cloudflare Workers and Static Assets (Cloudflare, Inc., USA). Cloudflare processes IP addresses, requested URLs, timestamps, browser and device information, and technical security data to deliver content and prevent abuse. The legal basis is our legitimate interest in operating a secure, reliable website (Article 6(1)(f) GDPR). We do not keep separate request logs or log the contents of contact enquiries in the Worker. Cloudflare may retain technical security data under its own retention criteria for as long as needed to provide the service, investigate abuse or meet legal obligations.
Your enquiry
The contact form collects your name, email address, your selected services and project answers. Company, phone number and voice messages are optional. Before you submit, entries and recordings remain in the open browser tab. Copying the summary uses your device’s clipboard; saving a summary creates a local text file. Microphone access is requested only when you start recording. Each recording is limited to two minutes. The combined size of all recordings in one enquiry must not exceed 2 MB.
When you click “Send enquiry”, the data and any recordings are transmitted using HTTPS to our Cloudflare Worker and forwarded to office@brightsystems.at through Microsoft 365 (Microsoft Ireland Operations Limited, Ireland, with Microsoft group companies). Your email address is used as the reply-to address. No automated reply or newsletter subscription is triggered. We process enquiries to respond and prepare a possible contract (Article 6(1)(b) GDPR); for other enquiries the basis is our legitimate interest in communication (Article 6(1)(f) GDPR).
Providing your name, a valid email address and information about your project is necessary to submit the form. Alternatively, you can email us directly. We delete enquiries that do not lead to a contract no later than six months after the communication has ended, unless legal claims require longer storage. Contract and accounting records are retained for the applicable statutory period, generally seven years under Austrian tax and company law.
Spam protection
Cloudflare Turnstile loads when you reach the enquiry summary. It checks technical browser and device signals, IP address and interaction information to distinguish legitimate enquiries from automated abuse. We validate the short-lived, single-use result on the server before any email is sent. Pre-clearance cookies are disabled. This security function is based on Article 6(1)(f) GDPR and, where device access is strictly necessary to provide the requested form, the necessary-service exception in section 165(3) Austrian TKG 2021. If verification is not possible, you can email office@brightsystems.at.
Cookies and your choices
Our self-hosted CookieConsent interface stores your choice in the necessary bs_consent cookie for 180 days. It contains the selected categories, a random consent identifier, time and policy revision. Fonts and project images are hosted with the site.
Statistics and marketing are separate choices, disabled by default. Rejecting is as easy as accepting. Optional services require consent under Article 6(1)(a) GDPR and section 165(3) TKG 2021. You may withdraw or change your choice at any time using Privacy settings in the footer. Withdrawal takes effect for the future; it does not affect processing that was lawful before withdrawal. On withdrawal, optional first-party cookies are deleted and the page reloads to stop optional scripts.
No statistics or marketing services are currently active. These categories therefore do not load any external tracking or set optional cookies, even if selected.
Recipients and international transfers
Cloudflare and Microsoft process data within their international infrastructure. Processing in the USA and access from outside the EEA may occur. Transfers to US recipients certified for the relevant processing rely on the European Commission adequacy decision for the EU-US Data Privacy Framework (Article 45 GDPR). Where that framework does not cover a transfer, the providers use standard contractual clauses and supplementary safeguards (Article 46 GDPR). Provider privacy notices explain these safeguards; you may also request information from us.
Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons arising from your particular situation, and to direct marketing at any time. You may withdraw consent at any time. Contact office@brightsystems.at to exercise your rights. We do not make automated decisions with legal or similarly significant effects.
You may lodge a complaint with the Austrian Data Protection Authority or another competent supervisory authority. Austrian Data Protection Authority.
External links
Links to project websites and providers lead to independently operated sites. Those sites process data under their own privacy notices. No external project content is embedded on this website.