With this privacy policy, we wish to inform the users of our website about the nature, scope, and purposes of the processing of personal data. Personal data in this context includes all information that can personally identify you as a user of our website (theoretically, possibly through indirect means or by linking various data), including your IP address. Information stored in cookies is generally not personal data, or only in exceptional cases; however, these are covered by a special regulation that makes the permissibility of cookie use largely dependent on the active consent of the user, depending on their purpose.

In a general section of this privacy policy, we provide you with information on data protection that applies generally to our processing of data, including data collection on our website. In particular, you will be informed as a data subject about the rights to which you are entitled.

The terms used in our privacy policy and our data protection practices are based on the provisions of the EU General Data Protection Regulation ("GDPR") and other relevant national legal provisions.

Controller

ABF GmbH
FN 517504k
Deggendorfstraße 6
4030 Linz
Austria

E: office@abf.at
T: +43 (0)732 304030 0
F: +43 (0)732 304030 9

Data Collection on Our Website

Personal data is collected from you on the one hand when you expressly provide it to us, and on the other hand, data—particularly technical data—is automatically recorded when you visit our website. Some of this data is collected to ensure the error-free functioning of our website. Other data may be used for analysis purposes. However, you can generally use our website without having to provide any personal information.

General Information on Data Protection

The following provisions apply in principle not only to data collection on our website but also generally to other processing of personal data.

Personal Data

Personal data is information that can be individually assigned to you. Examples include your address, your name, your postal address, email address, or telephone number. Information such as the number of users visiting a website is not personal data because it does not allow for assignment to an individual person.

Legal Basis for the Processing of Personal Data

Unless more specific information is provided in this privacy policy (e.g., regarding the technologies used), we may process personal data from you based on the following legal grounds:

• Consent pursuant to Art. 6(1)(a) GDPR – The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual measures pursuant to Art. 6(1)(b) GDPR – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation pursuant to Art. 6(1)(c) GDPR – Processing is necessary for compliance with a legal obligation.
• Protection of vital interests pursuant to Art. 6(1)(d) GDPR – Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
• Legitimate interests pursuant to Art. 6(1)(f) GDPR – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Please note that in addition to the provisions of the GDPR, national data protection regulations in your or our home country may apply.

Transfer of Personal Data

Your personal data will not be transferred to third parties for purposes other than those listed in this privacy policy.

We only pass on your personal data to third parties if:

• You have given your express consent in accordance with Art. 6(1)(a) GDPR,
• The disclosure is necessary in accordance with Art. 6(1)(f) GDPR to protect legitimate interests and for the establishment, exercise, or defense of legal claims, and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data,
• There is a legal obligation for the disclosure under Art. 6(1)(c) GDPR, and this is legally permissible and/or
• It is necessary in accordance with Art. 6(1)(b) GDPR for the processing of contractual relationships with you.

Cooperation with Processors

We carefully select our service providers who process personal data on our behalf. If we commission third parties to process personal data on the basis of a data processing agreement, this is done in accordance with Art. 28 GDPR.

Transfer to Third Countries

If we process data in a third country or if this occurs in the context of using third-party services or the disclosure or transfer of data to other persons or companies, this only takes place on the basis of the legal grounds set out above for the transfer of data.

Subject to express consent or contractual necessity, we process or have the data processed in accordance with Art. 44-49 GDPR only in third countries with a recognized adequate level of data protection or on the basis of special guarantees, such as a contractual obligation through so-called standard contractual clauses of the EU Commission, the existence of certifications, or binding corporate rules.

General Storage Period

Unless an explicit storage period is specified during the collection of data (e.g., as part of a declaration of consent), we are obliged under Art. 5(1)(e) GDPR to delete personal data as soon as the purpose for its processing no longer exists. In this context, we would like to point out that legal retention obligations to which we are subject constitute a legitimate purpose for the further processing of the personal data covered by them.

As a matter of principle, data is stored and kept by us in personal form until the termination of a business relationship or until the expiry of applicable guarantee, warranty, or limitation periods; furthermore, until the conclusion of any legal disputes in which the data is required as evidence, or in any case until the end of the third year after the last contact with a business partner.

Specific Storage Period

Specific information on the storage period of data can be found in the description of individual technologies on our website. In our cookie table, you will be informed about the storage period of individual cookies. Additionally, you always have the option to ask us directly about the specific storage period of data. To do so, please use the contact details provided in this privacy policy.

Rights of Data Subjects

Data subjects have the right:

1. Pursuant to Art. 15 GDPR, to request information about your personal data processed by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
2. Pursuant to Art. 16 GDPR, to demand the immediate rectification of incorrect or completion of your personal data stored by us;
3. Pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us under certain circumstances, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims;
4. Pursuant to Art. 18 GDPR, to request the (temporary) restriction of the processing of your personal data, insofar as the accuracy of the data is contested by you, the processing is unlawful but you oppose its erasure, we no longer need the data but you require it for the establishment, exercise, or defense of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR;
5. Pursuant to Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format or to request its direct transfer to another controller; however, this only covers personal data that we process using automated procedures based on your consent or on a contract;
6. Pursuant to Art. 21 GDPR, if your personal data is processed on the basis of our legitimate interest, to object to the processing of your personal data if there are grounds arising from your particular situation or if the objection is directed against direct marketing. In the latter case, you have a general right of objection, which will be implemented by us without specifying a particular situation;
7. Pursuant to Art. 7(3) GDPR, to withdraw your consent once given to us at any time. As a result, we may no longer continue the data processing based on this consent in the future. Among other things, you have the option to withdraw your consent to the use of cookies on our website with effect for the future by accessing our cookie settings;
8. Pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority regarding the unlawful processing of your data by us. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters for this purpose.

The competent supervisory authority for ABF GmbH is:

Austrian Data Protection Authority
Barichgasse 40-42, 1030 Vienna, Austria
Tel.: +43 1 52 152-0, dsb@dsb.gv.at

Assertion of Data Subject Rights

You decide yourself on the use of your personal data. Therefore, if you wish to exercise one of your above-mentioned rights against us, you are welcome to contact us by email at office@abf.at or by post, as well as by telephone.

Please support us in specifying your request by answering questions from our responsible employees regarding the specific processing of your personal data. In case of justified doubts about your identity, we may request a copy of your ID.

For questions regarding data protection, you can reach us at office@abf.at or via the other contact details provided in this privacy policy.

Linz, October 6, 2026

Technologies on Our Website

Integration of Third-Party Services and Content

On our website, we use content or service offers from third-party providers to analyze and optimize our online presence in order to display their content and services, such as videos or fonts.

This always presupposes that the third-party providers of this content recognize the IP address of the users, which is necessary for the display of this content. We endeavor to only use content whose respective providers use the IP address solely for the delivery of the content. The processing of your data is based on our legitimate interest in optimizing our online offer. Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. Through "pixel tags," information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit, and other information about the use of our online offer, as well as be linked with such information from other sources.

The processing of your data in cookies is based on your consent. You can withdraw this consent at any time with effect for the future.

For further details, we refer to those specific services that are described in more detail in this privacy policy.

Provision of Our Contractual Services

We process personal data of our interested parties, customers, or other persons if we offer them contractual services or within the framework of existing business relationships. Furthermore, we process the data of data subjects on the basis of our legitimate interests, particularly when it involves administrative tasks or public relations.

The data processed in this context and the purpose of its processing are determined by the contract in question. This includes master data of the persons (e.g., name, address, etc.), as well as contact data (e.g., email address, telephone), contractual data, and if we offer services or products subject to payment, billing data (e.g., bank details).

We are obliged to delete personal data as soon as the purpose for the processing has been fulfilled. In this context, we would like to point out that legal retention obligations and periods constitute a legitimate purpose for the processing of personal data.