Legal

Privacy Policy

WFT GmbH, as of 19.10.2026

1. Controller

The party responsible for processing personal data within the meaning of the General Data Protection Regulation is:

WFT GmbH, Maitisgasse 6, 3400 Klosterneuburg, Austria

Phone: +43 2243 83468

A data protection officer has not been appointed, as the legal requirements for doing so are not met. For all data protection matters, you can reach us at the address given above.

2. Principles

We process personal data only to the extent necessary to provide our website, to respond to your inquiries, to initiate and carry out business relationships, or due to legal obligations. Below we inform you which data we process for which purpose and on which legal basis.

3. Visiting the website and server log files

When you visit our website, our hosting provider World4You (see section 4) automatically processes data transmitted by your browser. This includes in particular the IP address, the date and time of access, the page requested, the status code returned, the amount of data transferred, and information about your browser and operating system.

Purpose: technical provision of the website, ensuring system security and stability, and error analysis. In addition, our hosting provider uses this data to compile aggregated access statistics, see section 10.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the website.

Storage period: The data is automatically deleted by the hosting provider after two weeks.

4. Website hosting

Our website is hosted by World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, 4020 Linz, Austria. On our behalf, World4You provides the servers on which our website, our forms and the data stored via the forms are located, and in doing so processes the data that arises when the website is visited.

We have concluded a data processing agreement with World4You in accordance with Art. 28 GDPR. In it, World4You undertakes to process the data only on our instructions and in compliance with the General Data Protection Regulation. World4You operates its own data centre in Austria. Processing takes place in the European Union or the European Economic Area, and the other processors used by World4You are also based in the European Union.

The fonts and the explainer videos on our website are also loaded from this server. We do not embed content from other providers, such as Google fonts, YouTube videos or embedded maps.

Legal basis: Art. 6(1)(f) GDPR, legitimate interest in reliable and secure operation of the website. For data from our forms, the legal basis stated in sections 6 to 9 applies.

5. Email

When you send us an email or submit one of our forms, the messages are delivered to our email mailboxes, which we operate with Microsoft 365. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data on our behalf on the basis of a data processing agreement in accordance with Art. 28 GDPR.

The data is stored in data centres in the European Union. Access by the parent company Microsoft Corporation in the United States, for example in the context of maintenance and support, cannot be ruled out. Microsoft Corporation is certified under the EU-US Data Privacy Framework. Any such transfer is based on the adequacy decision of the European Commission under Art. 45 GDPR and additionally on standard contractual clauses.

The emails generated by our forms are sent by our web server at World4You.

Legal basis: For the content of your message, the legal basis of the respective purpose applies, for example Art. 6(1)(b) GDPR for quote requests. The use of Microsoft 365 is based on Art. 6(1)(f) GDPR, our legitimate interest in reliable and secure email communication.

6. Contacting us, contact form and cellar planner

If you contact us by email or by phone, we process the information you provide in order to handle your inquiry. On our website you can also send us a message via the contact form or put together a quote request step by step with the cellar planner.

Data processed: your name and email address as mandatory information, and optionally the name of your winery or business, your location, your phone number and your message. In the cellar planner, your answers about your cellar and your project are added, for example on the number of tanks and the functions you want; in the contact form, the number of your fermentation tanks and the topics you selected. In addition, we store the language of the page, the time of the inquiry, the time at which you confirmed the notice on the privacy policy and terms and conditions, and whether you requested the newsletter.

After you submit the form, the following happens:

Your information is sent by email to our mailbox service@vinpilot.com so that our team can take care of your inquiry.
In addition, we store your inquiry on our server at World4You in a protected file that cannot be accessed from the internet. It serves as a backup in case an email does not arrive and as an overview of the inquiries received. Only authorised employees have access, via a password-protected area.
You receive a confirmation by email with your information. This email contains no advertising.
If you have also selected the newsletter, you receive a separate email with a confirmation link (see section 7).

Before submitting, you confirm that you have read this privacy policy and accept our terms and conditions. This confirmation is not consent to data processing. The processing of your inquiry is based on the legal bases set out below.

Purpose: handling your inquiry, follow-up questions about your project and, where applicable, preparing a quote.

Legal basis: Art. 6(1)(b) GDPR, insofar as your inquiry is aimed at concluding or performing a contract (pre-contractual measures at your request). For other inquiries, Art. 6(1)(f) GDPR, our legitimate interest in responding to your request.

Storage period: We delete inquiries that do not lead to an order three years after the end of the calendar year in which they were received. If your inquiry leads to an order, the retention periods set out in section 12 apply.

With our newsletter we inform you about news on VinPilot® and automation in the wine cellar. You can subscribe by ticking the corresponding box in the contact form or in the cellar planner.

Registration takes place using the double opt-in procedure: after registering, you receive an email with a confirmation link. Your registration only becomes effective when you click this link. If you do not confirm the registration, you will not receive the newsletter. After confirmation, we send you a short email with a link to unsubscribe.

We maintain the list of recipients ourselves on our server at World4You. We store your email address, your name if you provided it, the language, the form through which you registered, the status of your registration, the times of registration, confirmation and, where applicable, unsubscription, and a randomly generated key for the confirmation and unsubscribe links. We do not store your IP address in this process.

We currently do not use an external service to send the newsletter. If we use such a service in the future, we will update this policy beforehand.

Legal basis: Art. 6(1)(a) GDPR, your consent. In accordance with Section 174 of the Austrian Telecommunications Act 2021 (TKG 2021), electronic mail for advertising purposes is only sent with your prior consent. Storing the times of registration and confirmation serves as proof of your consent and is based on Art. 6(1)(f) GDPR.

Unsubscribing: You can unsubscribe from the newsletter at any time and thereby withdraw your consent with effect for the future. To do so, use the unsubscribe link in every newsletter email or send us a message at the address given above. Unsubscribing via the link takes effect immediately.

Storage period: We store your data until you unsubscribe. We delete unconfirmed registrations after 30 days. After you unsubscribe, we keep only your email address, the times of registration, confirmation and unsubscription, and the form through which you registered, for three years as proof, and then delete them. We no longer use this data for sending.

8. Job applications

On our careers page you can apply to us using a form. In doing so, we process your name and email address as mandatory information, and optionally your phone number, the area you are interested in, your message and, if you upload it, your CV.

Your application is sent as an email with your CV attached to an internal mailbox of our management. The application is not stored on our web server. The uploaded file is only buffered briefly for the duration of the transfer and then deleted automatically. Only the persons involved in the selection have access to your application.

Purpose: carrying out the application process.

Legal basis: Art. 6(1)(b) GDPR, measures to initiate an employment relationship at your request. Retention after a rejection is based on Art. 6(1)(f) GDPR, our legitimate interest in defending against possible legal claims.

Storage period: If no employment relationship is established, we delete your application documents seven months after the rejection. Within this period, claims under the Austrian Equal Treatment Act (Gleichbehandlungsgesetz) can be asserted. Longer retention for future positions only takes place with your consent. If an employment relationship is established, we add the documents to your personnel file.

9. Protecting the forms against misuse

To prevent our forms from being misused on a large scale by automated programs, we use simple technical precautions. We do not use services from other providers, such as captcha services, for this purpose.

A field that is invisible to humans must remain empty, and a form must have been open for a few seconds before it is submitted. No personal data is stored for this.
For the contact form, the cellar planner and the newsletter registration, we limit how often submissions can be made from one internet connection within a short time. To do this, we create a shortened check value from your IP address and a secret additional value, which does not contain the IP address in plain text, and store it on our server together with the time of submission. We do not store the IP address itself. The check values are deleted automatically after one hour at the latest.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website and our mailboxes against misuse and unwanted mass submissions.

10. Cookies and access statistics

The publicly accessible pages of our website do not set cookies. Nor do they store any other information on your device or read any from it. We do not use tools from other providers for audience measurement or analysis, such as Google Analytics or Google Tag Manager. For this reason, we do not display a cookie consent notice.

From the server log files (section 3), our hosting provider World4You automatically compiles simple access statistics. They contain aggregated figures, for example the number of page views per day and month, the most visited pages and the pages through which visitors reach us. They do not show IP addresses. The statistics are accessible only to us, protected by a password. We do not create user profiles from them and do not combine them with other data.

Purpose: We want to know how often our website is visited and which content is in demand, in order to improve it.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical evaluation of the use of our website. The server log files themselves are deleted after two weeks (section 3); the aggregated figures do not relate to individual persons.

Should we use more extensive audience measurement in the future, we will update this privacy policy beforehand.

11. Links to social networks

On our website you will find links to our profiles on Instagram and Facebook. These are simple links. Data is only transmitted to these providers when you click the respective link. The respective provider is then responsible for any further processing.

12. Processing in connection with business relationships

In the context of initiating and carrying out business relationships, we process the contact details of the contact persons of our customers, suppliers, and partners, in particular name, function, business address, telephone number, and email address, as well as the information required for order processing.

Legal basis: Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(c) GDPR for statutory retention obligations, and Art. 6(1)(f) GDPR for ongoing business communication.

Recipients: Within our company, only those persons who need the data to perform their duties are given access. In addition, we pass on data to our tax advisor, banks, transport service providers, and to sales and installation partners, to the extent necessary for processing. For deliveries to third countries, data is transmitted to the partner there, to the extent necessary for contract performance.

Storage period: seven years after the end of the financial year in accordance with statutory retention obligations under commercial and tax law, and beyond that for the duration of any possible warranty claims.

13. Use of the VinPilot software

The control software runs on a server at the customer's premises. The connection to our platform serves exclusively to synchronize external access and is operated on the servers of a service provider in Austria. Technical process data of the systems is processed in this context. Insofar as user accounts are set up for access, the processing of the related data is based on Art. 6(1)(b) GDPR within the scope of the usage relationship.

14. Your rights

You have the right to information about the personal data we process about you, to rectification of inaccurate data, to erasure, to restriction of processing, and to data portability.

You have the right to object at any time, for reasons arising from your particular situation, to processing based on Art. 6(1)(f) GDPR. You may object at any time, without giving reasons, to processing for the purpose of direct marketing.

You may withdraw any consent given at any time with future effect. The lawfulness of processing carried out prior to the withdrawal remains unaffected.

To exercise your rights, a message to the contact details given above is sufficient.

15. Right to lodge a complaint

If you believe that the processing of your data violates data protection law, you may lodge a complaint with a supervisory authority. The authority responsible for us is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40 to 42, 1030 Vienna, dsb@dsb.gv.at.

16. Necessity of providing data

The provision of your data is neither legally nor contractually required. However, without the information required for an inquiry or a contract, we are unable to process your inquiry or to conclude or perform a contract.

17. Automated decision-making

No automated decision-making, including profiling, takes place.

18. Changes to this policy

We update this privacy policy whenever the processing or the legal framework changes. The version published on our website at any given time applies.