Privacy
Privacy
How we process your data and the rights you have.
Controller and contact
Bright Systems FlexCo
Giselakai 51, 5020 Salzburg, Austria
office@brightsystems.at
This notice covers visits to our website and enquiries. Last updated: 23 October 2026.
Website and spam protection
Cloudflare, Inc. (USA) hosts this website and protects our form against spam with Turnstile. It processes IP addresses, requested pages, access times and technical browser, device, connection and interaction data. The basis is our legitimate interest in reliable website operation and preventing abuse (Article 6(1)(f) GDPR). Strictly necessary device access for the requested form falls under section 165(3) TKG 2021. You can also contact us by email.
Cloudflare processes data on our behalf; it also uses Turnstile signals under its own responsibility to improve bot detection. Technical data is retained for as long as needed for service delivery, security investigations or legal obligations. We do not keep separate access logs. Fonts and project images are hosted with the website.
Contact and enquiries
We use your contact details and enquiry to respond and prepare or perform a contract with you (Article 6(1)(b) GDPR). Other communications, including with company representatives, are based on our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR). Providing data is voluntary. The form requires your name, email address and enquiry; without them, submission is not possible. Company, phone number and voice messages are optional.
Submitted form data passes through Cloudflare to our Microsoft 365 mailbox at office@brightsystems.at. Voice messages are sent as email attachments. We use Microsoft Ireland Operations Limited (Ireland), with Microsoft group companies and service providers, for email processing.
Retention
We delete enquiries that do not lead to a contract, including voice messages, within six months after communication ends. Exceptions apply for statutory retention duties and legal claims. Business correspondence and accounting records subject to retention duties are generally kept for seven years from the end of the relevant calendar year (section 212 UGB, section 132 BAO; Article 6(1)(c) GDPR). Data needed for legal claims is retained as long as necessary (Article 6(1)(f) GDPR).
Cookies and choices
Our locally hosted CookieConsent tool stores your selection in the bs_consent cookie for 180 days. It contains your selected categories, timestamps and the policy version, with no unique online identifier. The purpose is to respect and document your choice; the basis is Article 6(1)(f) GDPR and, for strictly necessary storage, section 165(3) TKG 2021. The tool does not send data to an external consent service.
You can change your choice or withdraw consent at any time using “Privacy settings” in the footer. Withdrawal takes effect for the future and does not affect the lawfulness of earlier processing.
Statistics and marketing
No analytics or marketing services are currently active. Selecting these categories does not load tracking services or set optional cookies. Optional analytics and marketing require your prior consent under Article 6(1)(a) GDPR and section 165(3) TKG 2021. You can use the website and submit enquiries without consenting.
Recipients outside the EEA
Cloudflare and Microsoft may process data in the USA and other countries outside the European Economic Area (EEA). Transfers to US recipients covered by the EU-US Data Privacy Framework rely on the European Commission’s adequacy decision (Article 45 GDPR). For other transfers, the providers provide for standard contractual clauses and, where needed, supplementary safeguards (Article 46 GDPR). See their data processing terms for these safeguards, or ask us for a copy.
Cloudflare data processing terms
Microsoft data processing terms
Your rights
Subject to the legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. To exercise your rights, contact office@brightsystems.at.
You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct marketing at any time.
You may lodge a complaint with the Austrian Data Protection Authority or another competent supervisory authority. We do not make automated decisions with legal or similarly significant effects, including profiling of that kind. Austrian Data Protection Authority.