Privacy Policy

Controller
The controller within the meaning of Art. 4 no. 7 GDPR is:
ELSTA-Mosdorfer Gesellschaft m.b.H.
Bahnstraße 29
8430 Kaindorf an der Sulm
Austria

Telephone: +43 3452 71660 – 0
E-mail: datenschutz@elsta.com

The company has appointed a data protection officer, who can be contacted at bvm@meineberater.at.

Data Processing pursuant to Art. 13 GDPR
We process data provided to us by various persons through their own statements, for example in the course of registering a customer account, subscribing to newsletters, applying for a position, or concluding contracts.

Wir verarbeiten Daten, die uns von verschiedenen Personen durch eigene Angaben übermittelt werden, wie beispielsweise im Zuge der Registrierung eines Kundenkontos, der Anmeldung zu Newslettern, im Rahmen einer Bewerbung sowie bei Abschluss von Verträgen.

Data Processing pursuant to Art. 14 GDPR
In addition, we also process data not directly provided by the data subject. This may be the case, for example, when governing bodies provide us with the names and contact details of their employees in the context of projects or business relationships. Where necessary to provide our services, we also process personal data from lawfully accessible public sources such as debtor registers, land registers, commercial and association registers, media reports, or the internet.

Data Subjects
For prospective customers: company name, contact person’s name, professional contact details and address data.
For business customers: company name, contact persons’ names, professional address and contact details, bank details, and contract data.
For contractual partners: company name, contact persons’ names, address and contact details, contract data, and bank information.
For newsletter recipients: e-mail address and name data.
For authors: we publish names on request. As soon as the use of the works is discontinued, the personal data is automatically deleted.

Legal Bases
The legal bases for data processing are:

• Consent (e.g. processing your e-mail address for marketing purposes) pursuant to Art. 6(1)(a) GDPR
• Contract initiation and fulfilment pursuant to Art. 6(1)(b) GDPR
• Legal obligations (e.g. statutory retention and documentation obligations, publication requirements under copyright law) pursuant to Art. 6(1)(c) GDPR
• Legitimate interests of our company (e.g. use of software) pursuant to Art. 6(1)(f) GDPR

We inform you separately of the legal basis and purpose of processing for each case of data processing described below.

Transfer of Data
Data is transferred exclusively for the purpose of contract performance pursuant to Art. 6(1)(b) GDPR in order to provide our services.

• Within the Knill Group: The personal data collected will, where necessary, be transferred within the group to parent and subsidiary companies. This is required because various group companies provide, among other things, IT services. The transfer is based on internally concluded agreements.
• Processors: We work with processors to whom personal data is transferred in order to provide services efficiently. This includes companies performing tasks such as contract fulfilment, payment processing, account management, newsletter distribution, personnel leasing, and IT services.
• Other transfers: In certain cases, such as legal obligations or within the scope of legal disputes, personal data may be passed on to authorities or lawyers.

Retention / Deletion / Anonymisation of Data
Contractual retention obligations: After the end of a contractual relationship or contractually agreed periods, personal data is deleted or anonymised, provided there are no statutory retention obligations preventing this.

• Withdrawal of consent: If consent to the processing of personal data is withdrawn, the data is deleted or anonymised, unless another legal basis for processing exists.
• Statutory retention obligations: The controller is subject to various statutory retention obligations. After these legally prescribed periods have expired, personal data is deleted. It may occur that personal data must be retained despite the withdrawal of consent or the expiry of contractual periods for legal reasons and may only be deleted at a later date (after expiry of the respective statutory periods). Applicable EU regulations and laws include, without claim to completeness:
• Austrian Commercial Code (UGB)
• Austrian Trade Regulation Act (GewO)
• Austrian Civil Code (ABGB)
• Austrian Value Added Tax Act (UStG)
• Whistleblower Protection Act (HSchG)
• Network and Information Systems Security Act (NISG)
• Data Protection Act (DSG)
• General Data Protection Regulation (GDPR)

When contacting us by e-mail, telephone, contact form, or via social media, the transmitted data will be stored in order to process your inquiries.
Legal basis: Art. 6(1)(f) GDPR (Legitimate Interest).

General:
When you send us your application documents, we process the personal data contained therein for the purpose of personnel selection and recruitment.
Legal basis: Art. 6(1)(b) GDPR (Contract initiation and fulfilment).

Deletion:
In case of rejection, we delete your documents 7 months after sending you the rejection.
Legal basis: Art. 6(1)(f) GDPR (Legitimate Interest).

Retention for future contact:
If we wish to keep you on file for later contact, we will request your consent. If expressly granted, we store your application documents. If no further opportunity for recruitment arises within three years of consent, your documents are deleted.
Legal basis: Art. 6(1)(a) GDPR (Consent).

Application portal:
All applications are processed via our application portal jobs.elsta.com/Jobs. You may create a profile on our website. Mandatory registration data: salutation, title, name, gender, date of birth, address, nationality, e-mail address, telephone number, notice period, highest educational qualification, and salary expectations. Further data may be provided by uploading your CV and cover letter, such as education, workplaces, work experience, and hobbies.
Legal basis: Art. 6(1)(b) GDPR (Contract initiation and fulfilment).

Recruitment platforms:
We use various online recruitment platforms. Applicants decide which data to provide. The entered data and uploaded documents are transmitted by the platform operators to us. Both the platform and we act as controllers within the meaning of the GDPR. Please also consult the privacy policies of the respective operators.
Legal basis: Art. 6(1)(b) GDPR (Contract initiation and fulfilment).

We operate a LinkedIn page and a YouTube channel. When visiting our social media presence, personal data, including IP address, is processed by the respective provider and cookies are used for data collection. Please refer to the provider’s privacy policy for details and options to limit data processing.

Note: You use these services and their functions at your own responsibility, in particular the interactive functions (e.g. sharing, commenting, rating).

The providers of these services have provided us with corresponding agreements, mostly joint controller agreements. The use of social media platforms is based on our legitimate business interest.

Where we are obliged to comply with data subject rights (see section 10), you may contact both us and the respective platform provider.
Legal basis: Art. 6(1)(f) GDPR (Legitimate Interest).

We have established a whistleblowing online portal on our website. This system allows reporting compliance and legal violations without fear of reprisals. More information can be found at Whistleblowing System Knill Energy.
Legal basis: Art. 6(1)(f) GDPR (Legitimate Interest)

Informational Use of the Website
When you use our website for informational purposes only, we collect only the personal data that your browser transmits to our server (server log files). If you want to access our website, we collect the data that is technically necessary for us to display our website to you and to ensure stability and security:

• IP address
• Date and time of the request
• Time zone difference to Coordinated Universal Time (UTC)
• Content of the request (specific page)
• Access status/HTTP status code
• Website from which the request originates
• Browser
• Operating system and its interface
• Language and version of the browser software

This data will not be merged with other sources of personal data. We reserve the right to subsequently review this data if we become aware of concrete indications of unlawful use and to pass on the data to law enforcement authorities in the event of a cyberattack. No further disclosure to third parties takes place.
Legal basis: Art. 6 (1) (f) GDPR (Legitimate Interest)

Cookies
When you visit our website, cookies are stored on your device. Cookies are small text files assigned to your browser and stored on your hard drive. They allow us or third parties to collect certain information. Cookies cannot execute programs or transmit viruses to your computer.
The information contained in cookies is used, for example, to determine whether you are logged in, what data you have already entered, or to recognize you as a user when a connection is established between our web server and your browser.
We differentiate between technical cookies, which serve exclusively to ensure the operation of a website, and consent-based cookies, which are set by us or third parties for the purposes of statistical analyses, tracking, or advertising/marketing.
Legal basis: Art. 6 (1) (f) GDPR (Legitimate Interest; for technical cookies), Art. 6 (1) (a) GDPR (Consent; for all other cookies)

Website Registration and Login
You have the option to register for a customer account on our website. For this, we require login data consisting of your email address and a self-chosen password.

The following data must be provided during registration: name, industry, email address, area of interest, and telephone number. Optionally, you may also provide your mobile phone number. You can edit your provided data at any time in the account settings. We generate a customer number, which is also linked to your customer account. You can log in to our website at any time using your login credentials.
Legal basis: Art. 6 (1) (b) GDPR (Contract initiation and performance)

Newsletter Registration
You can subscribe to our newsletter at https://elsta.com/newsletter-anmeldung/ by providing us with your name and email address. You may unsubscribe at any time using the unsubscribe link included in every newsletter or by sending an email to office@elsta.com.

To ensure that the subscription actually originates from you, we use the so-called double opt-in procedure. After your registration, you will receive a confirmation email with a link. Only when you click on this confirmation link will your subscription be activated and your address added to the mailing list. This ensures that no one can use your email address without your consent and that your agreement to receive the newsletter is explicitly confirmed.

After unsubscribing, we will no longer use your data for sending the newsletter. If we are not in any business relationship with you and are not subject to statutory retention obligations, your data will be deleted after unsubscribing.
Legal basis: Art. 6 (1) (a) GDPR (Consent)

We use services of Google Ireland Limited (“Google”), a company incorporated and operated under Irish law with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland.
Further information can be found in Google’s Privacy Policy at https://policies.google.com/privacy?hl=de.
Integrating Google may result in additional Google services being reloaded on our website.

Google Analytics
We use Google Analytics on our website, a tool that allows us to analyze how our website is used. With Google Analytics, we can see how many people visit our website and how long they stay.

Google uses the collected information to analyze your use of the website, to compile reports on website activity, and to provide other services related to website usage.

Your IP address transmitted by your browser to Google Analytics is not merged with other Google data. However, Google may disclose this information to third parties if required by law or if third parties process the data on behalf of Google.

You can prevent cookies from being stored on your computer by adjusting the corresponding settings in your browser. Please note, however, that you may not be able to use all functions of our website fully in this case.

Further information on terms of use and data protection can be found at https://www.google.com/analytics/terms/de.html and https://support.google.com/analytics/answer/6004245?hl=de.
Legal basis: Art. 6 (1) (a) GDPR (Consent)

Google Tag Manager
We use Google Tag Manager on our website, which enables us to integrate and manage website tags such as tracking codes or conversion pixels. Google Tag Manager stores data (e.g., IP address and device data) as well as the JavaScript “gtm.js” on your device. This receives your Google Tag Manager ID and can thus read out the information stored on your device and transmit it to the US server www.googletagmanager.com.

Further information can be found here: https://www.google.com/intl/de/tagmanager/faq.html.
Legal basis: Art. 6 (1) (a) GDPR (Consent)

YouTube
We operate a YouTube channel. The operating company of YouTube is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC is a subsidiary of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

A connection to YouTube servers is only established when you click the YouTube link in our footer. Only then will your data be transferred to YouTube and processed by the service. YouTube uses cookies to collect data and for statistical evaluation. YouTube is informed which pages you visit. If you are logged in to YouTube, your data is directly assigned to your account. YouTube uses your data for advertising and market research purposes.

By using this service, personal data is transmitted to the USA, or such transmission cannot be excluded. Google is certified under the adequacy decision for the transfer of personal data to the USA. The European Commission has determined that personal data transferred from the EU to a company in the USA certified under the EU-U.S. Data Privacy Framework enjoys an adequate level of protection, making such transfer permissible pursuant to Art. 45 GDPR.

We point out that as the website provider, we have no knowledge of the content of the transmitted data nor of its use by Google.

Further information on data protection at “YouTube” can be found in the provider’s Privacy Policy at: https://www.google.de/intl/de/policies/privacy/
Legal basis: Art. 6 (1) (a) GDPR (Consent)

We have integrated a link to the social media network LinkedIn on our website. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Dublin.

No data is transferred to LinkedIn when accessing our website. Data transfer (IP address) only occurs once you click the LinkedIn link. At that point, a connection to LinkedIn servers is established.

Our LinkedIn profile contains links to our legal notice and privacy policy. Further information on LinkedIn’s data protection regulations can be found in their Privacy Policy at: https://www.linkedin.com/legal/privacy-policy.

We point out that as the provider of the site, we have no knowledge of the content of the data transmitted to LinkedIn or of LinkedIn’s use of such data.
Legal basis: Art. 6 (1) (a) GDPR (Consent)

Adobe Fonts
We use the Adobe Fonts service to design our website. This is a service of Adobe Systems Software Ltd. Ireland, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland, which provides us with access to a library of fonts. To include the fonts we use, your browser must connect to an Adobe server in the USA and download the required font. Adobe thus receives the information that your IP address has accessed our website. Accessing the libraries automatically triggers a connection to the library operator.

Further information on the use of your data by Adobe Fonts can be found at https://fonts.adobe.com/ and in Adobe’s Privacy Policy at https://www.adobe.com/de/privacy/policies/typekit.html.
Legal basis: Art. 6 (1) (a) GDPR (Consent)

Algolia SAS
We use the AI-powered search infrastructure of Algolia SAS, 55 Rue d’Amsterdam, 75008 Paris, France, to optimize the search function and provide our users with a better search experience. When using Algolia Search, certain data is collected, processed, and used to make the search more efficient and deliver relevant results. This includes, in particular, information about search queries, such as search terms, date and time of the request, IP address, and geographical location. Our legitimate interest lies in the optimized display and faster, more secure design of the website.

Further information can be found in Algolia’s Privacy Policy at https://www.algolia.com/de/policies/privacy/.
Legal basis: Art. 6 (1) (f) GDPR (Legitimate Interest)

BootstrapCDN (formerly MaxCDN)
We use the BootstrapCDN (Content Delivery Network) of Volentio JSD Limited (jsDelivr), Suite 2a1, Northside House, Mount Pleasant, Barnet, England, to increase the loading speed of our website.
The CDN service allows website content such as web videos or other large media to be delivered quickly and securely. Proxy servers temporarily store the files locally and thereby improve access speed during download. Using the Bootstrap CDN helps us optimize our website’s loading speed.
The CDN service processes the visitor’s IP address. The IP address is automatically deleted from Bootstrap’s logs.

Further information can be found in Volentio JSD Limited’s Privacy Policy at https://www.jsdelivr.com/terms/privacy-policy.
Legal basis: Art. 6 (1) (f) GDPR (Legitimate Interest)

Dropbox
We use Dropbox for our website, provided by Dropbox Inc., with its European headquarters at One Park Place, Floor 5, Upper Hatch Street, Dublin 2, Ireland. Dropbox is an online storage service for files, photos, and videos.
Dropbox processes your data, among others, in the USA but is certified under the EU-U.S. Data Privacy Framework, thereby ensuring the correct and secure transfer of personal data of EU citizens to the USA. Dropbox uses the EU Commission’s Standard Contractual Clauses for processors and thus ensures that your data is processed according to European protection standards.
Our legitimate interest lies in providing all necessary information for the purpose of job postings.

Further information can be found in Dropbox Inc.’s Privacy Policy at https://www.dropbox.com/privacy.
Legal basis: Art. 6 (1) (f) GDPR (Legitimate Interest)

hCaptcha
We use the anti-spam tool hCaptcha on our website, operated by the U.S. company Intuition Machines Inc., 1065 SW 8th St #704, Miami, FL 33130, USA.
hCaptcha protects our website from spam and bots by setting cookies in the visitor’s browser, storing user data in order to identify whether the visitor is a human or a bot. Analytical data such as IP addresses, browser type, device type, date, and time of access are stored. Human identifiers such as mouse movements and keystroke events are also stored to determine whether a visitor is human or a potential threat.
hCaptcha deletes personal data once storage is no longer necessary.

Further information can be found in hCaptcha’s Privacy Policy at https://www.hcaptcha.com/privacy?tid=139482946.
Legal basis: Art. 6 (1) (f) GDPR (Legitimate Interest)

Matomo
We use the web analytics service Matomo, provided by InnoCraft Limited, 7 Waterloo Quay, PO625, 6140 Wellington, New Zealand, on our website for statistical analysis of user behavior and for optimization and marketing purposes.
The following data is processed: browser type, browser version, operating system, country of origin, date and time of the server request, number of visits, time spent on the website, and the external links you click. Before the IP address is stored, it is anonymized. Pseudonymized usage profiles can be created and evaluated from this data. The collected data is processed on our servers and not passed on to third parties.
The information generated in the pseudonymous user profile is not used to personally identify website visitors and is not merged with personal data of the pseudonym holder.

Further information can be found in Matomo’s Privacy Policy at https://matomo.org/privacy-policy.
Legal basis: Art. 6 (1) (a) GDPR (Consent) 

Usercentrics (Cookiebot)
To obtain GDPR-compliant consent for the use of cookies and consent-based services on our website, we use the Cookiebot consent banner from Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany.
The consent banner records and stores the selection of cookies and consent-based services of each user of our website. By using the consent banner, it is ensured that statistical, functional, and marketing cookies and consent-based services are only set or loaded once you have given your express consent.
The consent tool records, logs, and stores the visitor’s settings for the duration of the session. To clearly associate the chosen settings with the respective visitor, Cookiebot collects, transmits, and stores certain user information (including the IP address).

Further information can be found in Usercentrics’ Privacy Policy at https://usercentrics.com/de/datenschutzerklaerung/ and in Cookiebot’s Privacy Policy at https://www.cookiebot.com/de/privacy-policy/.
Legal basis: Art. 6 (1) (f) GDPR (Legitimate Interest)

With regard to your personal data, you have the following rights:

• Right of access, rectification, and erasure
• Right to restriction of processing
• Right to object to processing
• Right to data portability

If you believe that we are processing your data in violation of Austrian or European data protection law and thereby infringing your rights, we kindly ask you to contact us so that we can clarify any questions.
Please direct your inquiries and concerns via email to datenschutz@elsta.com or contact us using the contact details provided.

In addition to the aforementioned rights as well as other administrative or judicial remedies, you have the right to lodge a complaint with the Austrian Data Protection Authority:

• Address: Barichgasse 40 – 42, 1030 Vienna
• Telephone: +43 1 52 152-0
• Email: dsb@dsb.gv.at

We reserve the right to make changes to our privacy policy from time to time. All changes to the privacy policy will be published on this page. Please therefore note the current version of our privacy policy.

As of: August 2025