Skip to content

Privacy policy

The authoritative version of our privacy policy is the German Datenschutzerklärung. The following English overview is for convenience only; in case of doubt, the German version prevails.

Controller: AWS-Technik GmbH, Erkrather Str. 401, 40231 Düsseldorf, Germany. Represented by Dipl.-Ing. Wolfgang Buschmeier and M.Sc. Marius Buschmeier. E-mail: info@aws-technik.de.

What we process and why

  • Hosting & server log files (Cloudflare): IP address and technical access data to deliver and secure the website; legal basis Art. 6(1)(f) GDPR.
  • Cloudflare Web Analytics: where enabled, Cloudflare adds a small measurement script to our pages (static.cloudflareinsights.com) to measure delivery quality (load times, error rates, rough page view counts); the measurements are sent back to our own address. It works without cookies and without identifiers that would make you recognisable across page views or websites, so no consent under § 25(1) TDDDG is required and it runs independently of your choice in the consent banner; Art. 6(1)(f) GDPR (legitimate interest in a technically sound and swiftly delivered website). You may object under Art. 21 GDPR.
  • Error monitoring (Sentry, Functional Software, Inc., USA; data stored in the EU data region, Frankfurt am Main): our server sends error reports (type of error, program location, requested address without parameters, time, program version) to detect and fix technical errors; no form contents, cookies or request headers, your IP address is not stored, numbers, email addresses and quoted values in error messages are made unrecognisable before sending, nothing is stored on your device; Art. 6(1)(f) GDPR. Error reports are deleted after 90 days at the latest. You may object under Art. 21 GDPR. Errors in your browser are reported only with your consent to analytics.
  • Spam protection (Cloudflare Turnstile): where enabled, technical form-security data; Art. 6(1)(f) GDPR, § 25(2)(2) TDDDG. To limit mass submissions we also count each day’s requests per IP address (for IPv6 only its first 64 bits) and per e-mail domain; these counters are stored at Cloudflare and expire shortly after the end of the day (UTC); Art. 6(1)(f) GDPR.
  • Business relationships: we also process contact and contract data of customers, prospects, suppliers and their contact persons (including credit checks and existing-customer communication); see the German policy for details, including your right to object to direct marketing (Art. 21(2) GDPR).
  • Contact & inquiry forms / data sheet: the data you enter (required: name, e-mail address, company address and, if different, delivery address, on the inquiry form also your message; optional: company, phone, company website and technical data) is e-mailed to our team through the e-mail sending service of our host Cloudflare to handle your inquiry and prepare an offer. Legal basis: Art. 6(1)(b) GDPR where you inquire on your own behalf (e.g. as a sole trader) with a view to a contract with us; otherwise, in particular where you inquire on behalf of a company, Art. 6(1)(f) GDPR (handling the inquiry and communicating with you as its contact person). These two forms are not permanently stored in a database on the website. Where enabled, you receive a short acknowledgement e-mail that does not repeat your entries. If you select plate heat exchangers on the inquiry form, we also pass your entries (contact details, address, message and technical data) to our internal design and sales system, likewise operated on Cloudflare, where we calculate a design proposal and handle your inquiry up to the offer. The data stays with AWS-Technik GmbH; no further recipient is involved. Legal basis and retention as for the inquiry form.
  • How did you find us?: on the inquiry form, or right after submitting it on the confirmation screen, you can optionally tell us how you came across us (a choice from a fixed list, no free text). We use it only to measure the success of our channels. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the success of our channels). Leaving it empty does not affect how we handle your inquiry. It is included in the e-mail to our team, travels with your other entries to our internal design and sales system for plate heat exchanger inquiries, and is kept as long as the inquiry itself. An answer given after submitting reaches our team as a short additional e-mail with the reference of your inquiry. If you leave the field empty when submitting, we create an entry with the reference of your inquiry in a technical helper table to match a later answer to it. Without an answer we delete the entry after about one hour, otherwise as soon as the answer has been matched, at the latest after about one day; for plate heat exchanger inquiries we also add the answer in our internal design and sales system. The e-mail itself is kept like your inquiry.
  • Design configurators (gas/gas plate and shell-and-tube heat exchangers; offered on this website until 1 October 2026, no new inquiries are accepted since): for inquiries received until then, your contact details (e-mail address and company address, a differing delivery address; optionally company, contact person, phone, company website and a description of your application), the process data you entered and the resulting selection remain stored in a database at our host Cloudflare, so that we can review the selection and send you a technical data sheet. Every inquiry was checked automatically for plausibility on receipt (including an MX lookup for the e-mail domain); the decision on your inquiry is always made by a person. The data sheet link is valid for seven days and stops working as soon as we delete your inquiry. We erase stored inquiries six months after declining them; otherwise three years from the end of the year of the last processing (no business relationship; Sections 195, 199 German Civil Code) or six years from the end of the year of receipt (business relationship; your inquiry is then a business letter, Section 257 German Commercial Code, Section 147 German Fiscal Code). Legal basis as for the forms above.
  • Browser storage: without consent we store only entries that are strictly necessary (§ 25(2)(2) TDDDG; Art. 6(1)(f) GDPR): your choice in the consent banner (aws_consent_v2, local storage) and the light or dark display mode if you switch it in the header (aws-theme, local storage). Both remain until you change them or clear the site data in your browser. If you withdraw consent while PostHog is running, PostHog stores a note without any identifier about you (__ph_opt_in_out_…, local storage) so that nothing more is recorded in any open window; it remains until you consent again or clear the site data in your browser. Cloudflare may set technically required security cookies (e.g. __cf_bm).
  • Analytics (PostHog): only after your explicit consent via our consent banner (EU instance, no autocapture, no session recording); Art. 6(1)(a) GDPR, § 25(1) TDDDG. With the same consent we also report technical errors in your browser to Sentry (EU data region; type of error, program location, pages visited before without parameters, browser and program version; no form contents, no click or input logs; the script stores nothing in your browser). You can withdraw consent at any time.
  • Fonts are self-hosted: no connection to Google.
  • LinkedIn pages: our company page (linkedin.com/company/aws-technik) and, as its showcase page, the page of our Shellcore brand (linkedin.com/showcase/shellcore-de), provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. The reference to the company page on our website is a simple link: no data is sent to LinkedIn until you click it. For the page statistics (Page Insights) that LinkedIn compiles from your visits and interactions with our pages, we are joint controllers with LinkedIn (Art. 26 GDPR) under the Page Insights Joint Controller Addendum: LinkedIn has primary responsibility for the Insights data and for fulfilling your rights, we only receive aggregated statistics without reference to individuals, and you can exercise your rights with LinkedIn or with us; legal basis: our legitimate interest in presenting our offering and getting in touch with prospective customers (Art. 6(1)(f) GDPR). What LinkedIn processes beyond that under its own responsibility, including transfers to the USA, is described in its privacy policy. If you message us on LinkedIn or comment on a post, we process your details to reply (Art. 6(1)(f) GDPR); if a message becomes an inquiry, we transfer your name, company, contact details and message into our customer management; legal basis and retention are as for the inquiry form.
  • Retention: server log files are normally deleted or anonymised within 30 days, unless needed longer to investigate a security incident. Analytics data (only with consent) is kept for at most 12 months and then deleted or aggregated. For an answer to “How did you find us?” given after submitting, the reference of your inquiry, a note whether it concerns plate heat exchangers and, where given, your answer are kept in a technical helper table: about one hour without an answer, otherwise until the answer has been matched, at the latest about one day. Inquiries from the contact form, the data sheet and LinkedIn are kept until your request has been dealt with and deleted once no longer needed, unless statutory retention obligations apply (in particular six years for business letters and eight years for accounting records; Section 257 German Commercial Code, Section 147 German Fiscal Code). Your consent choice stored in your browser remains until you delete or withdraw it. Retention of configurator inquiries is described above.

Third-country transfers

Cloudflare, PostHog and Sentry (Functional Software, Inc.) are US companies. Transfers to the USA are based on their certification under the EU-US Data Privacy Framework (Art. 45 GDPR), additionally on Standard Contractual Clauses (Art. 46(2)(c) GDPR). A residual risk of access by US authorities remains.

Your rights

You have the right to access, rectification, erasure, restriction, data portability, withdrawal of consent (Art. 7(3)), and objection (Art. 21 GDPR). You may also lodge a complaint with the competent supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, poststelle@ldi.nrw.de.

There is no solely automated decision-making within the meaning of Art. 22 GDPR.

Status: 30 October 2026. For full details please refer to the German privacy policy.