Legal Notice + T&Cs + Cookies etc.
Legal Notice
Regios Energiegenossenschaft SCE mit beschränkter Haftung
Galgenau 28
4240 Freistadt
Österreich
Telefon: +43 (0) 664/460 57 33
E-Mail: office@regios.at
Firmenbuchnummer: FN 633189k
UID: ATU81168727
Europäische Unternehmens-Identifikationsnummer: ATBRA.633189-000
Zuständiges Gericht: Landesgericht Linz
Internetagenturen für Konzeption, Realisierung, Betreuung Betrieb inkl. Hosting: Keferboeck Ltd & Tomorrow Brands
Privacy
This is a translation for convenience. Only the German version is legally binding.
Last updated: 26 October 2026
Download the binding German version as PDF
Controller. Regios Energiegenossenschaft SCE mit beschränkter Haftung, Galgenau 28, 4240 Freistadt, Austria, email: office@regios.at, company register no. FN 633189k. The competent supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna.
1. General
Below we inform you in accordance with Art 13 GDPR about the processing of your personal data when you visit and use our website regios.at and the related forms and sign-up pages (join.regios.at, invest.regios.at, event and appointment pages). For data protection questions please contact office@regios.at.
2. Usage data (server log files)
When you access our website, our web server and our application at our hosting provider (DigitalOcean, LLC, see section 11) automatically collect the following access data: name of the requested file, date and time, amount of data transferred, access status, referrer URL, browser type and IP address. IP addresses are personal data; they are not anonymised.
The web server access logs contain the full IP address and are deleted after 14 days. In our application logs the IP address is only stored in shortened form (IPv4 without the last octet, IPv6 shortened to the first 48 bits); these logs are size-limited and continuously overwritten.
The purpose is secure operation, protection against attacks and misuse, and error analysis. The legal basis is Art 6(1)(f) GDPR (legitimate interest in technically secure and error-free operation).
3. Cookies and consent management
We use strictly necessary cookies and entries in your browser's local storage (for example for session management, form security and storing your consent) on the basis of § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021). We only use analytics and marketing cookies with your consent under Art 6(1)(a) GDPR.
On your first visit our cookie banner lets you choose freely and separately by category (analytics, marketing). No category is preselected, and equivalent buttons let you accept all categories or allow only necessary ones. No analytics or marketing services are loaded before you consent. You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link in the footer or the cookie icon. Strictly necessary cookies can only be managed in your browser settings; some functions may then not be available.
Proof of consent. To be able to demonstrate that and how you consented (Art 7(1) GDPR), we log your choice with a random consent ID, the time, the selected categories, the version of the banner and the version of the privacy policy relevant for it, as well as, to prevent misuse in case the validity of the consent is disputed, temporarily your IP address and browser type. The legal basis is Art 6(1)(c) GDPR in conjunction with Art 7(1) GDPR. IP address and browser type are deleted after 90 days. The remaining proof data is kept for no more than three years, and only as long as necessary to provide proof and to establish or defend legal claims (Art 17(3)(e) GDPR). In the event of withdrawal, retention ends at the latest when the three-year limitation period from the withdrawal expires.
An overview of all cookies we use can be found in our cookie policy.
4. Analytics and marketing services (only with consent)
The following services are used exclusively on the basis of your consent under Art 6(1)(a) GDPR; without consent they are not loaded and no data is transferred to these providers.
(a) Google Analytics 4 and Google BigQuery. Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Purpose: statistical analysis of the use of our website. Google may transfer data to the USA; transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art 45 GDPR), insofar as Google is certified, and additionally on the EU Standard Contractual Clauses (Art 46(2)(c) GDPR). A data processing agreement under Art 28 GDPR is in place. Details: policies.google.com/privacy. Retention of analytics data: 2 months.
(b) Meta Pixel. Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. Purpose: measuring the success of our advertising on Facebook and Instagram. Third-country transfers and safeguards as in (a). Details: facebook.com/privacy/policy. Retention of the _fbp cookie: 90 days.
(c) Contentsquare (formerly Hotjar). Provider: Content Square SAS, 7 rue de Madrid, 75008 Paris, France. Purpose: analysis of click, scroll and usage behaviour on our pages (including session recordings with masked input) to improve our pages and forms. Data is stored in the EU. The IP address is not stored; it is only used to determine the approximate location and to exclude bots, and is deleted after 3 days at the latest. A data processing agreement is in place. Retention: 13 months.
(d) Microsoft Clarity. Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity is loaded solely on the basis of your consent to the “Analytics” category (Art 6(1)(a) GDPR). Without consent, no data is transferred. Purpose: analysis of click, scroll and usage behaviour on our website and in our application forms (including session recordings and heatmaps) to improve our pages and forms. Input in form fields is always masked; in our application forms all text on the page is masked as well. Clarity is not used on pages with signing or download links. Microsoft uses the IP address to determine the approximate location. Microsoft processes the data as an independent controller, also for its own purposes (in particular quality and product improvement). We have configured Clarity so that no data is stored for advertising purposes. Recordings are stored for 30 days. Recordings sampled by Microsoft for its own purposes and recordings marked as favourites, up to 9 months. The data is stored in Microsoft Azure. Transfers to Microsoft Corporation in the USA are based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art 45 GDPR), insofar as Microsoft is certified, and additionally on the standard contractual clauses (Art 46(2)(c) GDPR). Details: microsoft.com/privacy/privacystatement.
(e) Fathom Analytics (without consent, cookieless). Provider: Conva Ventures Inc., Canada. Fathom measures reach, sets no cookies, stores no IP addresses and uses no personal identifiers; visitors from the EU are processed on servers in the EU. The legal basis is Art 6(1)(f) GDPR (legitimate interest in privacy-friendly reach measurement). Canada benefits from an adequacy decision of the European Commission (Art 45 GDPR).
5. Server-side conversion measurement
With your consent under Art 6(1)(a) GDPR we also measure the success of our advertising on Google and Meta server-side. For this we record the advertising platforms' click references (gclid, fbclid, fbp, ttclid) and the Google Analytics client ID and transmit conversion events (for example submitting a form or concluding a contract) via the Google Measurement Protocol or the Meta Conversions API. Contact and contract data are only transmitted pseudonymised as hash values. Transfers to Google only take place with consent to analytics, transfers to Meta only with consent to marketing.
We store the click references as well as IP address and browser type for these events for 90 days, after which they are deleted. You can withdraw your consent at any time via the cookie settings; the consent status is passed to Google via Google Consent Mode v2.
6. Conversion measurement with sales partners
For our electricity offer we work with OurPower Energiegenossenschaft SCE mbH, Lindengasse 65/6, 1070 Vienna; the contract is concluded directly with OurPower. With your consent under Art 6(1)(a) GDPR, we generate a pseudonymous click ID when you switch to the OurPower pages; OurPower stores it and uses it to report the status (registration started, application submitted, contract signed, start of supply, end of contract) back to us in pseudonymous form. Direct identifiers (name, address, email, bank details, metering point number) are not transmitted. We report the matched results server-side to the advertising platforms named in sections 4 and 5. Regios and OurPower act as independent controllers. Retention: 90 days. Without consent no click ID is generated.
7. Contact form, callback and appointment booking
If you request a callback or book an appointment, we process your first name, last name, telephone number, the appointment time and type of conversation as well as the email address you provide voluntarily. The purpose is to handle your request and to prepare and hold the conversation. The legal basis is Art 6(1)(b) GDPR (initiation or performance of the requested conversation); where no contractual relationship is intended, processing is based on Art 6(1)(f) GDPR (legitimate interest in handling contact requests). The data is deleted once the conversation has taken place or if you no longer pursue our offer; statutory retention obligations remain unaffected.
8. Membership, investment and events
If you use our forms to become a member, to invest or to register for an event, we process the data you provide there (for example name, address, date of birth, contact details, bank details, details of the investment) to establish and carry out the membership, the investment or your participation. The legal basis is Art 6(1)(b) GDPR and Art 6(1)(c) GDPR where statutory obligations apply (for example under cooperative law, the Austrian Commercial Code and the Federal Fiscal Code). For electronic signatures we use A-Trust GmbH, Vienna. The data is stored for the duration of the membership or investment and thereafter until the statutory retention periods expire (generally seven years).
9. Newsletter
For our newsletter we use the double opt-in procedure: after signing up you receive an email with a confirmation link, and only after confirming will you receive the newsletter. We log the sign-up and the confirmation (time, shortened IP address) as proof. The legal basis is your consent under Art 6(1)(a) GDPR. You can unsubscribe at any time via the unsubscribe link in every issue or by email to office@regios.at. Your data is stored until you unsubscribe; unconfirmed sign-ups are deleted after 30 days.
10. Contact via WhatsApp
If you contact us via WhatsApp, we process your telephone number and the content of your messages in order to handle your request. The legal basis for this processing is Art 6(1)(b) GDPR if your request serves to initiate or perform a contract or another specific service (such as taking up a membership or a consultation), otherwise Art 6(1)(f) GDPR (legitimate interest in handling contact requests). Before WhatsApp is opened we point out that, when you use the service, the provider WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, also processes your telephone number, your message content and further usage data as an independent controller under its own rules; to that extent there is no data processing relationship. WhatsApp may transfer your data to the USA; such transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art 45 GDPR), insofar as the recipients are certified, and additionally on the EU Standard Contractual Clauses (Art 46(2)(c) GDPR). Further information can be found in WhatsApp's privacy policy at whatsapp.com/legal/privacy-policy-eea. We delete the conversation once your request has been dealt with and no statutory retention obligations apply; otherwise WhatsApp's terms of use apply. Please note that we have no influence on the processing by WhatsApp and that we are responsible for our own purposes in using the service, in particular the security and confidentiality of your messages.
11. Processors
We transfer personal data to service providers who support us strictly in accordance with our instructions on the basis of data processing agreements under Art 28 GDPR:
Keferboeck Ltd., 66 Paul Street, London EC2A 4NA, United Kingdom, Company No. 12840144: digitalisation, i.e. development and operation of our website, our customer hub and the related applications (event registration, membership and investment forms, appointment booking), as well as setting up, analysing and optimising our performance marketing on Google, Meta and other channels. The transfer to the United Kingdom is based on the European Commission's adequacy decision under Art 45 GDPR (Implementing Decision (EU) 2021/1772 as amended by Implementing Decision (EU) 2025/2574), valid until 27.12.2031.
DigitalOcean, LLC, New York, USA: hosting in the Frankfurt am Main data centre. A transfer to the USA cannot be ruled out and is based on the EU Standard Contractual Clauses (Art 46(2)(c) GDPR).
Sinch Mailjet SAS, Paris, France: sending emails such as confirmations, login codes and newsletters.
Functional Software, Inc. (Sentry), San Francisco, USA: error analysis of the applications. Transfers based on the EU-US Data Privacy Framework (Art 45 GDPR) or the Standard Contractual Clauses (Art 46(2)(c) GDPR).
Google Ireland Ltd. and Meta Platforms Ireland Ltd.: see sections 4 and 5.
Processors only store data for the duration of the cooperation and then delete or return it; the retention periods stated above also apply to them.
12. Your rights
You have the right of access (Art 15), rectification (Art 16), erasure (Art 17), restriction of processing (Art 18), data portability (Art 20) and to object to processing based on legitimate interests (Art 21) GDPR. You can withdraw any consent at any time with effect for the future via the cookie settings or by email to office@regios.at. No automated decision-making including profiling takes place. You can lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at); you are also entitled to a judicial remedy.
Cookie Policy
What are cookies?
Cookies are small text files stored on your device. We also use your browser's local storage to save settings on your device. For the legal bases see privacy policy section 3.
Necessary (without consent)
_regios_session: session and form security (CSRF protection), until the browser is closed.
_regios_member_session: login to the members' area, until logout or closing the browser.
cookie_consent: stores your choice in the cookie banner and the random consent ID, 12 months.
silktideCookieChoice_necessary, silktideCookieChoice_analytics, silktideCookieChoice_marketing, regios_consent_version (local storage): store your choice in the cookie banner until you delete them.
regios_a11y (local storage): your accessibility settings such as high contrast and font size, until you delete them.
Analytics (only with consent)
_ga, _ga_*: Google Analytics 4, distinguishing users and sessions, up to 2 years.
_gid: Google Analytics 4, distinguishing users, 24 hours.
_cs_id, _cs_c: Contentsquare, recognising the browser and the masking setting for recordings, 13 months.
_cs_s: Contentsquare, linking the page views of a session, 30 minutes.
_clck: Microsoft Clarity, recognising the browser (pseudonymous ID) and settings, 1 year.
_clsk: Microsoft Clarity, linking the page views of a session, 1 day.
CLID, MUID, MR, SM, ANONCHK: cookies Microsoft may set for Clarity on its own domains; for purpose and retention see Microsoft's privacy statement.
regios_session: pseudonymous ID to link page views of a session in our own analysis, 180 days (set with consent to analytics or marketing).
regios_utm: stores the campaign parameters of the visit (utm_source, utm_medium, utm_campaign, utm_term, utm_content) to attribute requests and applications to a campaign, 90 days (set with consent to analytics or marketing).
Marketing (only with consent)
_fbp, _fbc: Meta Pixel, measuring the success of our advertising on Facebook and Instagram, 90 days.
regios_clickids: stores the advertising platforms' click references (gclid, fbclid, ttclid) for server-side conversion measurement, 90 days.
Without cookies
Our reach measurement with Fathom Analytics works without cookies and stores no personal data.
Consent and withdrawal
On your first visit we ask for your consent to non-essential cookies; no category is preselected. You can change or withdraw your decision at any time via the cookie icon on every page or the “Cookie settings” link in the footer. When you withdraw, we delete the analytics and marketing cookies.