A timber yard that deals in tons should be able to explain what it does with an email address in a few paragraphs. This policy describes exactly which personal data reaches us, why, how long we keep it, and what you can do about it. It is written to be read — not to hide behind clauses.
1 Who We Are (Data Controller)
The controller responsible for the processing of personal data on this website and in our business correspondence is:
BVG Firewood KG (Limited partnership)
Business Address: Stötten 8, 4941 Mehrnbach, Austria
Company Registration: FN 607526x
Commercial Court: Regional Court Ried im Innkreis
EUID: ATBRA.607526-000
Business Purpose: Production of fuel elements from wood and bark, offering of firewood for sale
Inquiries, Orders & Data Protection Requests: [email protected]
2 Data We Collect — and Where It Comes From
- Enquiries you send us: When you submit a quotation or contact form on this website, or write to us by email or telephone, we receive the details you provide — typically your name or company name, email address, telephone number, delivery destination (postal code and address), and the product, quantity, and packaging you are asking about.
- Order & contract data: To perform delivered contracts we process delivery addresses, freight and unloading instructions, invoice and payment records, and the transport documentation (e.g. CMR) belonging to your consignment.
- Technical access data: Our hosting provider processes server access data that every web server records (IP address, date and time, requested page, referrer, user agent). This is processed to operate the site securely and does not create marketing profiles.
We do not operate customer login accounts, we run no advertising or analytics tracking tools on this site, and we do not buy contact lists. There is no automated decision-making or profiling about you.
3 Purposes & Legal Bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Answering enquiries and preparing freight quotations | Responding to your request, typically within one working day | Art. 6(1)(b) GDPR — pre-contractual steps / contract performance |
| Order fulfilment, freight coordination, invoicing | Producing, loading, hauling, billing, and documenting deliveries | Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR (tax & commercial retention duties) |
| Server access data | Stable and secure website operation | Art. 6(1)(f) GDPR — legitimate interest |
| Anonymous usage statistics (Google Analytics 4) | Understanding which pages and products are useful — switched off until you accept | Art. 6(1)(a) GDPR — consent, withdrawable at any time |
| Responding to legal or authority requests | Compliance with valid legal obligations | Art. 6(1)(c) GDPR |
4 Third-Party Services on This Website
We deliberately keep the site lean, but a few functions load content from outside providers. Your browser contacts these providers directly when pages are displayed:
- Google Fonts (fonts.googleapis.com / fonts.gstatic.com): To display our two typefaces, your browser loads font data from Google Ireland Ltd. In doing so, your IP address is transmitted to Google. If you prefer to avoid this, you can use a browser that blocks third-party font requests, or contact us for offline documents.
- GTranslate language widget (cdn.gtranslate.net): The floating "EN" language selector is provided by GTranslate. When you open it or change language, requests go to GTranslate's service; the chosen language may be stored on your device so it persists between visits. Translated page content is machine-generated — for legally relevant wording (these terms, quotes, contracts) the English or German original applies.
- Google preferred sources (news.google.com, loaded only on request): Product pages and the footer offer an "Add as preferred source" button. Nothing is loaded from Google while you browse; only when you activate that button do we fetch Google's publisher script and open Google's own selection dialog, at which point your IP address is transmitted to Google. Cancelling the dialog leaves you on our page; Google's own privacy terms apply to the dialog.
- Google Analytics 4 (googletagmanager.com): The Analytics script is part of the page so that Google can verify this domain belongs to us. Until you accept, it runs in consent-denied mode: it sets no cookies, records no page view and builds no profile. Like any loaded script, fetching it necessarily transmits your IP address and the page address to Google; that request leaves no identifier on your device and is not used to build a profile. If you choose "Accept all", it is switched on and sets the first-party cookies
_gaand_ga_JE3GH6D4Y7so we can count visits and see which pages are useful. It runs in its default configuration: IP addresses are not stored, advertising features and Google Signals stay off, and no data is shared for advertising. You can change your decision at any time under "Cookies" in the footer; withdrawing consent switches measurement off again and deletes those cookies. - Google Tag Manager (googletagmanager.com, container
GTM-N5XQLT69): Like Analytics, the container is part of the page for domain verification and starts with every consent signal denied. It lets us activate further measurement tags without another code change; those tags are only permitted to measure once you have accepted. - Hosting provider: This website is delivered by a hosting provider acting as processor under a data processing agreement.
We run no advertising, remarketing, or social-media tracking tags, and our enquiry forms transmit no data to advertising platforms.
5 Recipients & Transfers
Within our company, only staff who need the data to answer you or fulfil a contract can access it. Beyond us, data is shared only where the job requires it:
- Freight carriers and forwarding agents receive the name, delivery address, and contact details of the consignee for the haul — nothing more.
- Banks and payment service providers process payment transactions for invoiced orders.
- Service providers such as hosting and email operations act under data processing agreements.
We do not sell, rent, or lease personal data to anyone, and we do not use it for third-party marketing.
6 How Long We Keep Data
- Quotation enquiries without a resulting order: kept for up to 6 months, then deleted — unless you wish otherwise.
- Contract, delivery, and invoice records: retained for as long as Austrian commercial and tax law requires (typically 7 years for invoices and accounting records).
- Server access data: deleted by the hosting provider within days according to its standard log rotation.
- Consignment documentation (CMR, certificates): kept for the retention period applicable to the respective contract file, also as evidence of quality and certification claims.
- Google Analytics event data: retained for 14 months — the longest period Google Analytics 4 allows — after which it is deleted automatically from our property. Cookies on your device expire earlier, typically within 13 months, and you can remove them at any time via "Cookies" in the footer.
7 Your Rights
You have the right to request information free of charge at any time about your stored personal data, its origin and recipients, and the purpose of processing (Art. 15 GDPR), as well as the rights to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw that consent at any time with effect for the future.
Send any request to [email protected] — we answer data protection requests with the same priority as order enquiries. You also have the right to lodge a complaint with a supervisory authority, in particular the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, if you believe processing infringes data protection law.
8 Data Security
The website is delivered over encrypted TLS connections. Business correspondence with orders, invoices, and transport documents is stored on access-controlled systems. We apply technical and organisational measures appropriate to what a firewood wholesaler can reasonably be expected to protect — and no more data than the business needs.
9 Changes to This Policy
If we add new services, carriers, or tools that touch personal data, this policy is updated and the version date above changes. The version current at the time of your enquiry is the one that governs it.